A response filling-based I / O efficient size mode searchable symmetric encryption method and system
By constructing an I/O-efficient dense inverted index structure on disk media and filling the query results with invalid document identifiers, the problems of size pattern leakage and high I/O overhead in searchable symmetric encryption technology are solved, realizing secure and efficient multi-functional query operations.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- INSTITUTE OF INFORMATION ENGINEERING CHINESE ACADEMY OF SCIENCES
- Filing Date
- 2025-04-28
- Publication Date
- 2026-07-21
Smart Images
Figure CN122437662A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of information security technology, specifically relating to a searchable symmetric encryption method and system for efficient size pattern protection of I / O based on response padding. Background Technology
[0002] In recent years, with the rapid development of new technologies such as cloud computing, big data, the Internet of Things, and artificial intelligence, various industries are accelerating their digital transformation, generating massive amounts of data and creating huge storage demands. Cloud storage, with its advantages of scalable, centralized, and professional services, provides convenient, fast, and economical storage and management solutions, offering users abundant storage and computing resources. Therefore, more and more individuals, businesses, and organizations are choosing to store their data in the cloud.
[0003] While traditional data encryption techniques effectively protect data confidentiality, they struggle to support retrieval operations. A common solution is for users to encrypt plaintext data stored locally before uploading it to a cloud storage server. When a retrieval is needed, the data is downloaded locally, decrypted, and then retrieved directly in plaintext. However, this method wastes significant communication and computing resources. To address this issue, searchable symmetric encryption technology has emerged. This technology allows clients to outsource encrypted data to cloud servers while maintaining data searchability. Searchable symmetric encryption is considered a promising encryption primitive that can enhance privacy protection in cloud storage systems and prevent data leaks.
[0004] However, even if cloud servers process queries honestly and out of curiosity, they can still obtain user data and private query information through schema information leakage. Among these schema information leaks, size schema information leakage, reflected in the length of the returned result, is a common type and is frequently maliciously exploited in related research.
[0005] When executing different query operations, cloud servers may extract two types of maliciously exploitable leaked information from size pattern leaks. In single-keyword queries, cloud servers can infer the document frequency of the query term from the size pattern leak. In dual-keyword concatenation queries, cloud servers can infer co-occurrence patterns, that is, the number of documents containing both query terms simultaneously, from the size pattern leak.
[0006] To address this, researchers are dedicated to developing searchable symmetric encryption methods that can support accurate and efficient multi-functional query operations while minimizing size pattern leakage during the process. However, existing protection schemes face two major challenges: firstly, their protection capabilities are relatively limited, making it difficult to simultaneously support size pattern leakage protection for multiple query operations; secondly, the inverted index structure designed for memory media is characterized by its dispersed and fragmented nature, and the extremely high I / O overhead caused by random addressing makes these mechanisms difficult to port to disk storage media, thus limiting the scalability of protection schemes. Therefore, researching size pattern leakage protection for searchable encryption schemes that support multi-functional queries based on disk media is of great significance. Summary of the Invention
[0007] To address the problems of existing protection methods, the present invention aims to provide a searchable symmetric encryption scheme based on disk media that protects against size pattern leakage and offers high I / O efficiency. This invention utilizes searchable symmetric encryption technology to perform I / O-efficient single-keyword queries, Boolean queries, and other query operations on encrypted data. By populating the query results in a trusted execution environment, size pattern leakage is reduced, ensuring the privacy of both data and queries.
[0008] The technical solution of this invention is as follows:
[0009] A searchable symmetric encryption method for efficient size pattern protection of I / O based on response padding, comprising the following steps:
[0010] 1) Initialization phase: The client generates the keyword blinding key K. W and the tag blinding key K S Local storage of keyword blinding key K W Then, a secure channel is established with the cloud server's filling service component, and the tagging blinding key K is passed to it. S The data is transmitted to the fill service component and stored by the fill service component.
[0011] 2) Index building stage: The client preprocesses the documents to be uploaded, obtaining a set of keyword / document identifier tuples, and uses the keyword blinding key K. W Keywords in the keyword / document identifier tuple set are blinded into tags, resulting in a tag / document identifier tuple set. This tag / document identifier tuple set is then sent to the population service component via a secure channel established during the initialization phase. The population service component then constructs an I / O-efficient dense inverted index and persistently stores it on the disk of the cloud server's storage service component.
[0012] 3) Query phase:
[0013] 3.1) The client uses the keyword to blind the key K WEach query term 'w' is blinded and labeled with a tag 'stag'. w Boolean logic between tags and query terms The secure channel established during the initialization phase is sent to the fill service component.
[0014] 3.2) The filling service component uses the tokenized blinding key K S , will tag stag w The counter 'c' is blinded into a key 'label' and sent to the storage service component, which retrieves the encrypted document identifier value 'value' based on the encrypted inverted index.
[0015] 3.3) Decrypt the encrypted document identifier value (value) in the populate service component and execute Boolean logic. The query results are obtained through calculation. The results are then populated according to the query operation type, and the populated results are returned to the client via a secure channel.
[0016] Furthermore, the keyword blinding method is to tag... Where w is the keyword to be blinded, K W F is the keyword blinding key, and F is the pseudo-random function.
[0017] Furthermore, the method for constructing the I / O-efficient dense-state inverted index is as follows:
[0018] (1) Set the block size base x according to requirements. Here, a block refers to the keyword index cache array element buff[stag]. w The block size is the set of document identifiers cached in the keyword index cache array buff. The block size refers to the maximum size of document identifiers that any element in the keyword index cache array buff is allowed to cache.
[0019] (2) Initialize the block count array cnt of the keyword inverted index and the keyword index cache array buff.
[0020] (3) For each tag / document identifier tuple (stag) w ,id), where id represents the document identifier. First, add id to buff[stag]. w In ], then if buff[stag w The number of document identifiers in Chinese has reached This generates a dense inverted index record (label, value), which is then transferred to the storage service component for storage. Simultaneously, cnt[stag] is... w Add one.
[0021] Furthermore, in a dense inverted index record, the key label = H(stag) w ||cnt[stag w]), where stag w It is a tag generated by the keyword w, cnt[stag] w ] is the current tag stag w The number of index entries generated, where H is the hash function; the value of the encrypted document identifier. It is an encryption algorithm Enc that uses symmetric cryptography, consisting of a symmetric key K. e buff[stag] w The result of encryption.
[0022] Furthermore, the symmetric key K e The generation method is as follows: symmetric key Among them, stag w It is a tag generated by the keyword w, K S F is the marker blind key, and F is the pseudo-random function.
[0023] Furthermore, the method for populating the service component with the generated key label during the query phase to query the storage service component is as follows: the counter c increments from 1, and the label is calculated as H(stag). w ||c), Generate the tag stag w The key label is generated. If the generated key label cannot be found in the storage service component with a corresponding encrypted document identifier value, the generation of the key label is stopped.
[0024] Furthermore, the method for decrypting the encrypted document identifier value during the query phase using the population service component is: encrypted document identifier set. Where Dec is the symmetric cryptography decryption algorithm. It is a symmetric key.
[0025] Furthermore, the method by which the cloud server's populate service component populates the query results during the query phase is as follows:
[0026] (1) If there is only one query term, then invalid document identifiers are entered into the query results, so that the number of returned document identifiers is [number missing]. Where counter c is the stag marked during the query storage service component process. w Find the number of corresponding encrypted document identifier values from the storage service component.
[0027] (2) If there are multiple query terms, fill the query results with Lap(μ, 2·(l-1) / ∈) invalid document identifiers, where Lap represents the Laplace distribution, μ is the expectation of the Laplace distribution, l is the maximum number of different keywords contained in a single document in the document dataset, and ∈ is the privacy budget.
[0028] A response-filled, I / O-efficient, size-pattern-protected searchable symmetric encryption system is disclosed, comprising a client and a cloud server. The client primarily initializes the client system, generates random keys, preprocesses the dataset, and blinds query terms. The cloud server includes a fill service component and a storage service component, providing two types of services: fill service and storage service. The fill service runs in a trusted execution environment and is protected by trusted hardware; the storage service has massive disk resources and continuously provides persistent storage services. The fill service component is mainly used to initialize the trusted execution environment and related data structures. During the index building phase, it is responsible for caching tag / document identifier tuples and generating a dense inverted index. During the query phase, it is responsible for generating keys, interacting with the storage service component, calculating query results, and filling them. The storage service component is responsible for maintaining and managing the dense inverted index storage and retrieving keys sent by the fill service component from the dense inverted index during the query phase.
[0029] Compared with the prior art, the advantages and positive effects of the present invention are mainly reflected in the following aspects:
[0030] (1) This invention proposes a dense inverted index structure with high I / O efficiency in disk media. The number of disk accesses is logarithmically related to the number of document identifiers in the keyword w inverted index, which reduces the seek time overhead caused by moving the transmission arm to find the target sector during random addressing. In addition, accessing this index structure during the query phase will not generate additional size pattern leakage information.
[0031] (2) This invention proposes a response filling method with size pattern hiding. For different query operations, invalid document identifiers of corresponding size are inserted into the returned results to confuse the length of query results of different query terms, reduce the useful information extracted by the cloud server from the query response length, and effectively enhance system security. Attached Figure Description
[0032] Figure 1 This is a flowchart illustrating the method of the present invention. Detailed Implementation
[0033] The present invention will now be described in further detail with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.
[0034] The system architecture constructed in this invention comprises two entities: a client and a cloud server. The client's main functions are initializing the client system, generating random keys, preprocessing the dataset, and blinding query terms. The cloud server provides two functional components: a population service component and a storage service component. The population service component performs all operations within a trusted execution environment, utilizing trusted hardware to protect the security of its execution logic and cached data. Specifically, the population service component's main functions are initializing the trusted execution environment and related data structures; caching tag / document identifier tuples and generating a dense inverted index during the index building phase; generating keys during the query phase; interacting with the storage service component; calculating query results; and populating the index. The storage service component's main functions are maintaining and managing the dense inverted index storage and retrieving keys sent by the population service component from the dense inverted index during the query phase.
[0035] To better illustrate the efficient size pattern protection searchable symmetric encryption method for I / O based on response padding proposed in this invention, the following detailed implementation examples further explain the invention.
[0036] During the initialization phase, the client inputs the security parameter λ, and a pseudo-random number generator is used to generate the keyword blinding key K. W and the tag blinding key K S Then, the client and the padding service component execute a key exchange protocol, and both parties obtain the same symmetric key sk. Finally, the client locally stores the keyword blinding key K. W Use sk to encrypt and mark the blind key K S The key is sent to the padding service component, which decrypts and saves the tag blinding key K. S Simultaneously, the service component sets the block size cardinality x and the expected value μ of the Laplace distribution, and initializes the keyword inverted index block count array cnt and the keyword index cache array buff.
[0037] During the index building phase, the client first uses a tokenizer to segment the uploaded document, extracting a set of unique keywords and converting it into a set of keyword / document identifier tuples {(w, id)}. Then, for each tuple in the set, the client calculates a tag. Replace the keyword 'w' with the tag 'stag'. w This yields a set of tag / document identifier tuples {(stag)} w Finally, the client uses the symmetric key sk to transfer {(stag)}. w After encryption, id)} is sent to the cloud server to populate the service component.
[0038] The fill service component receives the encrypted {(stag) wDecrypt the buff[stag] using the symmetric key sk, and add the id to the buff[stag]. w In the context of buff[stag], if buff[stag] w The number of document identifiers in Chinese has reached Then calculate the symmetric key. Calculate using the symmetric encryption algorithm AES Calculate the key label = H(stag) w ||cnt[stag w This generates a dense inverted index record (label, value), which is then sent to the storage service component for storage and management. Simultaneously, cnt[stag] is... w Add one.
[0039] During the query phase, for each query term w i Client-side calculation of tags The tag is set using the symmetric key sk. Logical relationship between query terms After encryption, it is sent to the cloud server to populate the service components.
[0040] After the padding service component decrypts using the symmetric key sk, for each token... Calculate the symmetric key Initialize counter c to 1, and calculate... Send the data to the storage service component to retrieve the corresponding encrypted document identifier value, and then decrypt it using the AES symmetric encryption algorithm to obtain the document identifier set. Then increment the counter c by 1.
[0041] After retrieving all indexes, populate the service component to calculate the query results. And add an invalid document identifier to the query result ID to obfuscate the size pattern. If the query term count is 1, populate the ID to... Size; if the number of query terms is 1, fill the ID to the size of |ID|+Lap(μ, 2·(l-1) / ∈). Encrypt with the symmetric key sk and return to the client.
[0042] After receiving the query response, the client uses the symmetric key sk to decrypt it, removes invalid document identifiers, and obtains the query results.
[0043] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.
Claims
1. A searchable symmetric encryption method for efficient size pattern protection of I / O based on response padding, comprising the following steps: Initialization phase: The client generates the keyword blinding key K. w and the tag blinding key K S Then, a secure channel is established with the cloud server's filling service component, and the tagging blinding key K is passed to it. S The data is transmitted to the fill service component and stored by the fill service component. Index building phase: The client preprocesses the documents to be uploaded, obtaining a set of keyword / document identifier tuples, and uses the keyword blinding key K. W Blind the keyword 'w' in the keyword / document identifier binary set to the tag 'stag'. w The set of tag / document identifier tuples is obtained and sent to the population service component through the secure channel established during the initialization phase. Then, the population service component builds an I / O-efficient dense inverted index and persists it in the hard disk of the cloud server's storage service component. Query phase: The client uses the keyword blinding key K W Each query term 'w' is blinded and labeled with a tag 'stag'. w Boolean logic between tags and query terms The secure channel established during the initialization phase is sent to the filling service component; the filling service component uses the tag-blinding key K. S , will tag stag w The counter 'c' is blinded into a key 'label' and sent to the storage service component. The encrypted document identifier value 'value' is retrieved based on the encrypted inverted index. The service component then decrypts the encrypted document identifier value 'value' and executes Boolean logic. The query results are obtained through calculation. The results are then populated according to the query operation type, and the populated results are returned to the client via a secure channel.
2. The method as described in claim 1, characterized in that, The use of keyword blinding key K W Blinden keywords in the keyword / document identifier tuple set to tags, including: tags Where w is the keyword to be blinded, K W F is the keyword blinding key, and F is the pseudo-random function.
3. The method as described in claim 1, characterized in that, The method for constructing the I / O-efficient dense-state inverted index is as follows: Set the block size base x according to requirements, where a block refers to the keyword index cache array element buff[stag]. w The set of document identifiers cached in the keyword index cache array buff; the block size refers to the maximum size of document identifiers that any element in the keyword index cache array buff is allowed to cache. Initialize the block count array cnt of the keyword inverted index and the keyword index cache array buff; For each tag / document identifier tuple (stag) w First, add the id to the buff[stag]. w In ], then if buff[stag w The number of document identifiers in Chinese has reached This generates a dense inverted index record (label, value), which is then transferred to the storage service component for storage, and simultaneously the cnt[stag] is... w Add one.
4. The method as described in claim 3, characterized in that, The method for generating the dense inverted index record (label, value) is as follows: key label = H(stag) w ||cnt[stag w ]), where stagw is the tag generated by keyword w, cnt[stag w ] is the current tag stag w The number of index entries generated, where H is the hash function; Closed document identifier value It uses the symmetric encryption algorithm Enc with the symmetric key K e buff[stag] w The result of encryption.
5. The method as described in claim 4, characterized in that, The symmetric key K e The generation method is as follows: symmetric key Among them, stag w It is a tag generated by the keyword w, K S F is the marker blind key, and F is the pseudo-random function.
6. The method as described in claim 1, characterized in that, The method for filling in the service component's generated key label to query the service storage component during the query phase is as follows: the counter c increments from 1, and the formula label = H(stag) is calculated. w ||c), Generate the tag stag w The key label is generated; if the generated key label cannot be found in the storage service component with a corresponding encrypted document identifier value, the generation of the key label is stopped.
7. The method as described in claim 1, characterized in that, The method used by the populate service component to decrypt the encrypted document identifier value during the query phase is: document identifier set. Where Dec is the symmetric cryptography decryption algorithm. It is a symmetric key.
8. The method as described in claim 1, characterized in that, The method by which the cloud server populates the query results during the query phase is as follows: If there is only one query term, then invalid document identifiers are entered into the query results, so that the number of returned document identifiers is [number missing]. Where counter c is the stag marked during the query storage service component process. w Find the number of corresponding encrypted document identifier values from the storage service component; If there are multiple query terms, then fill the query results with Lap(μ, 2·(l-1) / ∈), where Lap represents the Laplace distribution, μ is the expectation of the Laplace distribution, l is the maximum number of different keywords contained in a single document in the document dataset, and ∈ is the privacy budget.
9. A searchable symmetric encryption system with efficient I / O size pattern protection based on response padding, characterized in that, It includes a client and a cloud server; the client is mainly used to initialize the client system, generate random keys, preprocess the dataset and blind query terms; the cloud server includes a population service component and a storage service component; the population service component performs all operations in a trusted execution environment, and uses trusted hardware to protect the security of the component execution logic and the cached data in the component. The populate service component is responsible for caching tag / document identifier tuples and generating a dense inverted index during the index building phase, and for generating keys during the query phase. It interacts with the storage service component to calculate the query results and populate them. The storage service component is responsible for maintaining and managing the dense inverted index storage, and retrieving and populating the keys sent by the service component from the dense inverted index during the query phase.