Industrial internet of things multi-key fuzzy search method based on walsh matrix

Abstract

The application discloses a kind of industrial internet of things multi-key fuzzy search method based on Walsh matrix, comprising the following steps: S1, system initialization is carried out;S2, based on system initialization result, key distribution is carried out;S3, based on key distribution result, generate ciphertext index;S4, based on key distribution result, generate security query trapdoor;S5, according to ciphertext index and security query trapdoor, carry out ciphertext matching and authorized interception.The application realizes the bottom unification of retrieval and access control, effectively resists structured information disclosure attack, and seamlessly nests the polynomial coefficient of role-based access control into the data structure of encryption matrix.

Description

Technical Field

[0001] This invention belongs to the field of encryption processing technology, specifically relating to an industrial Internet of Things multi-keyword fuzzy search method based on the Walsh matrix. Background Technology

[0002] In modern Industrial Internet of Things (IIoT) architectures, massive amounts of heterogeneous data (such as sensor readings, equipment operation logs, and security monitoring videos) are generated constantly. Limited by the computing and storage bottlenecks of local industrial terminals, enterprises typically tend to outsource this massive amount of data to cloud nodes to reduce the operational costs of the underlying IT infrastructure and achieve elastic resource scaling. However, this "end-to-cloud" collaborative model breaks down the physical isolation of traditional industrial intranets. Cloud service providers (often considered "honest and curious" entities) and data owners do not belong to the same trust domain. If industrial data is stored directly in plaintext on the public cloud, it is highly vulnerable to serious security threats such as unauthorized theft by internal personnel, malicious external attacks, and illegal mining of private data.

[0003] A common and necessary approach to building industrial data security barriers is "encryption before uploading," which involves converting plaintext data into ciphertext before cloud hosting. However, while this encryption mechanism ensures data confidentiality, it also significantly compromises data usability. Traditional database retrieval methods based on exact plaintext matching become completely ineffective in the ciphertext domain. If users had to download the entire massive cloud-based ciphertext database to their local machine, decrypt it, and then search for it each time, it would generate extremely high bandwidth and computational costs, which is unacceptable in practical industrial applications.

[0004] To break this deadlock, searchable encryption technology offers a solution that allows direct retrieval operations in encrypted form. However, in real-world industrial retrieval scenarios, end-user query input is often imperfect. For example, when urgently troubleshooting equipment malfunctions or retrieving historical logs, operators are prone to spelling errors, inconsistent input formats, or providing only truncated or incomplete keywords (such as partial equipment models or ambiguous error codes). Traditional exact-match encrypted search cannot tolerate any character-level deviations, resulting in a rigid retrieval experience and a tendency to miss important information. Therefore, fuzzy searchable encryption has become a key technology to overcome this bottleneck. It aims to bridge the gap between cryptographic rigor and human operational error tolerance, allowing and tolerating a certain degree of input distortion and spelling errors without exposing the original plaintext and search terms throughout the process, thereby significantly improving the flexibility and robustness of encrypted retrieval systems in complex industrial environments.

[0005] Detailed Description of Technical Solution: Existing technology one proposes a two-stage multi-keyword fuzzy search architecture based on Locality-Sensitive Hashing (LSH) and Bloom Filters (BF). Its complete operation steps are as follows:

[0006] Step 1: Plaintext Keyword Feature Decomposition (N-gram Transformation) After the data owner extracts the plaintext keywords from the file, they first split them into multiple character segments of a fixed length (i.e., N-gram transformation, usually using unary or binary grammar). For example, the keywords are broken down into feature sets containing multiple shorter strings, thus transforming the complete word into a feature vector.

[0007] Step Two: Locality Sensitive Hash (LSH) Mapping and Fault-Tolerant Clustering. The feature vector obtained in Step One is input into a predefined Locality Sensitive Hash function. The mathematical property of this algorithm is that two feature vectors with highly similar spellings have a very high probability of being mapped to the same hash bucket or generating identical hash codes after LSH calculation. Existing technology one utilizes this property to allow the system to tolerate minor spelling errors that occur during user input.

[0008] Step 3: Bloom Filter (BF) Index Construction and Multi-Keyword Overlay To achieve joint search of multiple keywords and compress data volume, existing technology uses the hash code output from the LSH stage as a seed, mapping it again to a fixed-length binary bit array (i.e., a Bloom filter), changing the value at specific positions from "0" to "1". When a file contains multiple keywords, the system overlays and sets the bits of all hash codes generated by these keywords within the same Bloom filter (i.e., setting each calculated position to "1"). Finally, this Bloom filter array is uploaded to the cloud server as the encrypted index of the file.

[0009] Step Four: Cloud-based Search and Overlap Matching. When a user initiates a search, the system performs identical splitting, LSH mapping, and Bloom filter bit setting operations on the query keywords, generating a query trapdoor. The cloud server, without decrypting the plaintext, compares the index array and the query array bit-by-bit (calculating the inner product). If the number of overlapping "1" positions in the two arrays exceeds a preset threshold, the cloud server determines that the keywords are similar and returns the corresponding file as the search result.

[0010] While existing technology 1 can achieve a certain degree of multi-keyword fuzzy search, it suffers from the following significant drawbacks in practical industrial applications due to its underlying reliance on Locality Sensitive Hash (LSH) and Bloom Filter (BF):

[0011] 1. Low retrieval accuracy and extremely high false positive rate in multi-keyword scenarios. The LSH algorithm in existing technology 1 is essentially an approximate probability mapping; similar keyword features introduce inherent quantization errors during mapping. More seriously, in the multi-keyword aggregation stage, the hash values ​​of multiple keywords are superimposed in the same Bloom filter; as the number of query keywords increases, the density of feature bits set to "1" in the Bloom filter increases sharply. This inevitably leads to severe hash collisions and cross-interference between different features, causing independent matching errors to accumulate continuously in multi-keyword scenarios. Ultimately, the system is highly prone to incorrectly classifying irrelevant files as matches and returning them. This high false positive rate makes it unsuitable for IIoT scenarios with extremely high data reliability requirements, such as industrial safety monitoring and healthcare.

[0012] 2. High storage overhead, making it difficult to adapt to resource-constrained industrial IoT environments. In order to barely maintain an acceptable false alarm rate when multiple keywords are superimposed, existing Bloom filter-based solutions have to significantly (even exponentially) expand the length of their underlying binary bit array. This approach of trading accuracy for accuracy by drastically expanding the index volume results in extremely high storage overhead for cloud servers, which greatly limits the scalability and practicality of the solution in large-scale, resource-constrained industrial IoT datasets.

[0013] Existing technology two proposes a search architecture that separates access control from keyword query processing. In this type of scheme, the system treats keyword encryption matching and user authorization verification as two completely independent components, and its specific retrieval execution process is typically divided into two sequential stages:

[0014] Phase 1: Independent Identity and Access Verification. When a data user initiates a search request, the cloud server first needs to verify the data user's identity credentials or attribute set individually. In this phase, the cloud server only processes cryptographic operations related to access control to determine whether the user is an authorized visitor.

[0015] Phase Two: Ciphertext Keyword Matching. Only after successfully passing the verification in Phase One and being clearly identified as an authorized user will the cloud server allow the system to enter the keyword matching phase. At this point, the cloud server receives or processes the encrypted query traps submitted by the user and performs similarity calculations and retrieval operations on the outsourced ciphertext index.

[0016] The disadvantages of the existing technology 2 are:

[0017] 1. High system communication and computational overhead, making it difficult to adapt to resource-constrained environments. Because access control and query processing are executed in two separate phases, this not only increases the overall number of communication rounds but also requires calling and maintaining two independent cryptographic algorithm modules. This separate design significantly increases system overhead, leading to increased response latency, making it highly unsuitable for deployment in industrial IoT environments with high real-time requirements or limited computational resources.

[0018] 2. The security risk of structured information leakage exists. Separating access verification from the core search process may inadvertently expose structured information related to the access control mechanism. Malicious attackers (or semi-trusted cloud servers) can exploit this independent design vulnerability by repeatedly sending carefully forged query requests to the system, observing the first-stage interception and the second-stage matching feedback, and thus inferring the user's authorization pattern, or even undermining the security baseline of the entire access control mechanism. This provides a direct motivation for improvement in this invention by "unifying trajectory similarity ranking and access control into the same matrix structure and a single cryptographic operation." Summary of the Invention

[0019] To address the above problems, this invention proposes a multi-keyword fuzzy search method for the Industrial Internet of Things based on the Walsh matrix.

[0020] The technical solution of this invention is: a multi-keyword fuzzy search method for industrial IoT based on the Walsh matrix, comprising the following steps:

[0021] S1. Perform system initialization;

[0022] S2. Based on the system initialization results, perform key distribution;

[0023] S3. Generate a ciphertext index based on the key distribution results;

[0024] S4. Based on the key distribution results, generate a secure query trapdoor;

[0025] S5. Based on the ciphertext index and security query trap, perform ciphertext matching and authorization interception.

[0026] Furthermore, S1 includes the following sub-steps:

[0027] S11. The key management center generates the Walsh-Hadamard matrix;

[0028] S12. Randomly select several non-repeating column vectors from the Walsh-Hadamard matrix to form a set, and establish a bijective mapping from the English alphabet to the set.

[0029] S13. Generate wildcard vectors and randomly select two disjoint vector sets from the unselected Walsh vectors to serve as the fill sets for the data owner and the data user, respectively.

[0030] S14. Generate access control policies and global hidden parameters, and complete system initialization.

[0031] Furthermore, the access control policy includes: determining the set of legitimate user roles and constructing an access control polynomial, the expression of which is:

[0032] ;

[0033] in, This represents the access control polynomial. This represents the total number of legitimate user roles. The independent variable of the polynomial, This represents the identifier of the i-th legitimate user role. Denotes the coefficients of the second-highest degree terms of a polynomial. This represents the (n-1)th power of the independent variable s. Represents the constant term of a polynomial;

[0034] The global hiding parameters include a global binary mask matrix and two invertible hiding transformation matrices, and the global binary mask matrix, the two invertible hiding transformation matrices, and the polynomial coefficients of the access control polynomial are used as the system master key.

[0035] Furthermore, S2 includes the following sub-steps:

[0036] S21. Generate two random invertible matrices for each data owner, and generate a private key and a re-encryption key based on the global binary mask matrix and the two invertible hidden transformation matrices. Send them to the cloud server to complete the DO key distribution.

[0037] S22. Generate a random invertible matrix for each data user, and generate a private key and a re-encryption key based on two invertible hidden transformation matrices, and send them to the cloud server to complete the DU key distribution.

[0038] Furthermore, the private key for DO key distribution is ;in, Represents the first random invertible matrix of the data owner. This represents the second random invertible matrix representing the data owner. Represents the global binary mask matrix;

[0039] The re-encryption key for DO key distribution is ; ; ;in, This represents the first layer of encryption matrix assigned to the data owner and distributed to the cloud server. This represents the second layer of encryption matrix assigned to the data owner and distributed to the cloud server. Let the first invertible hidden transformation matrix be represented. Let represent the second invertible hidden transformation matrix;

[0040] The private key for DU key distribution is ;in, Let the first random invertible matrix of the data users be represented. This represents the second random invertible matrix representing the data users. Indicates identity;

[0041] The re-encryption key for DU key distribution is ; ; in, This represents the first layer of encryption matrix sent by the user to the cloud server. This represents the second layer of encryption matrix assigned to the user and distributed to the cloud server. Let the first invertible hidden transformation matrix be represented. Let represent the second invertible hidden transformation matrix.

[0042] Furthermore, S3 includes the following sub-steps:

[0043] S31. Extract several plaintext keywords from the file to be uploaded using the data owner, supplement each plaintext keyword with boundary symbols using the filling vector set, map the letters of each plaintext keyword to Walsh column vectors, and concatenate the boundary symbols to construct several single-word matrices.

[0044] S32. Perform addition operations on the single-character matrix of plaintext keywords to obtain the combined matrix;

[0045] S33. Multiply the polynomial coefficients initialized by the plaintext key and append them as a column vector to the end of the combination matrix to form a complete index matrix to be encrypted.

[0046] S34. Based on the complete index matrix to be encrypted and the key distribution result, perform mask splitting and encryption to generate a ciphertext index.

[0047] Furthermore, the combination matrix for:

[0048] ;

[0049] in, This represents the single-word matrix corresponding to the i-th plaintext keyword. Indicates plaintext keywords;

[0050] In S34, if the corresponding bit of the mask matrix for each column of the fully indexed matrix to be encrypted is 0, then ; Perform left-multiplication encryption using the DO private key allocated by the DO key to generate a ciphertext index; where, This represents the first split vector of the i-th column of the matrix to be encrypted, representing the complete index. This represents the second split vector of the i-th column of the matrix to be encrypted, which is the complete index. This represents the i-th column vector of the complete index of the matrix to be encrypted;

[0051] If the mask matrix corresponding to each column of the fully indexed matrix to be encrypted has a bit of 1, then ; Perform left-multiplication encryption using the DO private key allocated by the DO key to generate a ciphertext index;

[0052] Left-multiplication encryption using the DO private key allocated by the DO key is as follows:

[0053] ;

[0054] ;

[0055] in, This represents the first ciphertext vector generated by encryption. This represents the second ciphertext vector generated by encryption. This represents the first random invertible matrix in the data owner's private key. This represents the second random invertible matrix in the data owner's private key. This represents the matrix transpose operation;

[0056] Ciphertext Index for:

[0057] .

[0058] Furthermore, S4 includes the following sub-steps:

[0059] S41. Using the data user input query term request, after aligning the length using the padding set, the keyword query of the query term request is transformed into a query matrix;

[0060] S42. Based on the role identity of the data user, construct a role vector and append the role vector to the end of the query matrix to form a trapdoor matrix to be encrypted.

[0061] S43. Based on the trapdoor to be encrypted matrix, perform mask splitting and encryption, and use the DU private key allocated by the DU key to perform encryption, generate a secure query trapdoor, and initiate a retrieval.

[0062] Furthermore, character vectors for:

[0063] ;

[0064] in, Indicates the role and identity of the data user. This represents the square of the data user's role identity. The data user role identity raised to the power of d-1. Indicates the transpose operation;

[0065] Encryption is performed using the DU private key allocated by the DU key:

[0066] ;

[0067] ;

[0068] in, This represents the first ciphertext vector generated by the trapdoor encryption. This represents the second ciphertext vector generated by trapdoor encryption. This represents the first split vector of the i-th column of the matrix to be encrypted in the trapdoor. This represents the second split vector of the i-th column of the matrix to be encrypted in the trapdoor. Let the first random invertible matrix of the data users be represented. This represents the second random invertible matrix representing the data users;

[0069] Security query trap for:

[0070] .

[0071] Furthermore, S5 includes the following sub-steps:

[0072] S51. Use the ciphertext index and secure query trapdoor to perform partial decryption, and calculate the transformed trapdoor matrix and the transformed index matrix;

[0073] S52. Calculate the inner product of the transpose of the transformed index matrix and the trapdoor matrix to obtain the matching matrix;

[0074] S53. Calculate the sum of the main diagonal elements of the matching matrix, which will be used as the final judgment criterion:

[0075] S54. Determine whether the final judgment criterion is less than or equal to the security matching threshold. If so, use the cloud server to sort in descending order and return the Top-k search encrypted results to the user. Otherwise, use the cloud server to refuse access.

[0076] Transformed index matrix for:

[0077] ;

[0078] in, This represents the first layer of encryption matrix assigned to the data owner and distributed to the cloud server. This represents the second layer of encryption matrix assigned to the data owner and distributed to the cloud server. This represents the first ciphertext vector generated by encryption. This represents the second ciphertext vector generated by encryption. Indicates the transpose operation;

[0079] Transformed trapdoor matrix for:

[0080] ;

[0081] in, This represents the first layer of encryption matrix sent by the user to the cloud server. This represents the second layer of encryption matrix assigned to the user and distributed to the cloud server. This represents the first ciphertext vector generated by the trapdoor encryption. This represents the second ciphertext vector generated by trapdoor encryption.

[0082] The beneficial effects of this invention are:

[0083] (1) This invention eliminates hash collisions from a mathematical perspective, achieving high-precision fuzzy matching with zero false alarms. It uses Walsh-Hadamard matrix column vectors, which have strict orthogonal properties, to uniquely and deterministically encode characters. This mechanism fundamentally avoids cross-interference caused by different character features during aggregation. Experimental data and theoretical analysis show that this scheme can maintain 100% retrieval accuracy and achieve zero false alarms when handling complex multi-keyword queries, fully meeting the needs of industrial-grade high-reliability scenarios.

[0084] (2) This invention breaks through the bottleneck of index volume expansion with the number of keywords, significantly reduces storage and communication overhead, and innovatively designs a multi-keyword dimensionality reduction and aggregation mechanism based on matrix element-level addition. This mechanism can losslessly compress and merge a set containing any number of keywords into a fixed dimension (e.g., ...). This completely severs the linear or exponential growth relationship between cloud storage overhead and the number of keywords, greatly reducing the storage burden and network communication bandwidth consumption of resource-constrained nodes in the Industrial Internet of Things.

[0085] (3) This invention utilizes underlying matrix algebra operations to significantly improve the retrieval efficiency and response speed of multi-keyword queries. By employing a matrix algebra structure design, the cloud server only needs to perform a single matrix inner product and calculate the trace value during retrieval. This mathematical operation can evaluate the similarity score of the entire multi-keyword query in one go and concurrently, completely avoiding the computational performance penalty caused by multiple rounds of repeated verification for each keyword, and significantly shortening the end-to-end response time of encrypted retrieval.

[0086] (4) This invention achieves a unified underlying system for retrieval and access control, effectively resisting structured information leakage attacks, and seamlessly embedding role-based access control polynomial coefficients into the data structure of the encryption matrix. This unified design allows user permission interception and similarity calculation to be completed synchronously in the same cryptographic operation, completely eliminating the independent authentication stage. This not only reduces the number of communication rounds, but also prevents malicious entities from reverse-engineering the authorization structure by observing and verifying the interception status, fundamentally preventing "identity-keyword linking attacks" and significantly improving the security of industrial data. Attached Figure Description

[0087] Figure 1 This is a flowchart of a multi-keyword fuzzy search method for the Industrial Internet of Things based on the Walsh matrix;

[0088] Figure 2 This is a schematic diagram of the system model;

[0089] Figure 3 This is a diagram illustrating the generation of a ciphertext index. Detailed Implementation

[0090] The embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0091] like Figure 1 As shown, this invention provides a multi-keyword fuzzy search method for industrial IoT based on the Walsh matrix, including the following steps:

[0092] S1. Perform system initialization;

[0093] S2. Based on the system initialization results, perform key distribution;

[0094] S3. Generate a ciphertext index based on the key distribution results;

[0095] S4. Based on the key distribution results, generate a secure query trapdoor;

[0096] S5. Based on the ciphertext index and security query trap, perform ciphertext matching and authorization interception.

[0097] This invention specifically aims to solve the following four technical problems:

[0098] 1. Solving the technical problem of extremely high false alarm rate in multi-keyword retrieval caused by existing hash and Bloom filter mechanisms. In response to the quantization error caused by LSH approximate mapping in existing technology 1, and the serious hash collision and feature cross-interference problem caused by Bloom filter when multiple keywords are superimposed, this invention aims to provide a character encoding and matching mechanism with strict mathematical orthogonality to completely eliminate the error accumulation caused by probability mapping and achieve industrial-grade high-precision zero-false-alarm multi-keyword fuzzy matching.

[0099] 2. Addressing the technical problem of excessive index size and storage and communication overhead caused by maintaining retrieval accuracy: Existing technologies require exponentially expanding the length of the binary bit array to control the false alarm rate, resulting in a massive encrypted index that is difficult to adapt to resource-constrained nodes in the Industrial Internet of Things (IIoT). This invention aims to provide an efficient fixed-length dimensionality reduction and aggregation mechanism. Regardless of the number of keywords in a file, it can losslessly compress and merge them into a fixed-dimensional (e.g., 64×64) matrix structure, thereby completely severing the linear / exponential growth relationship between storage overhead and the number of keywords.

[0100] 3. Solving the technical problems of high computational latency and numerous communication rounds caused by the separate retrieval architecture. In the existing technology 2, the authorization verification and encrypted keyword matching are executed independently in two stages, which causes the system to repeatedly call two sets of cryptographic modules, resulting in cumbersome communication and high computational response latency. This invention aims to provide a solution that completely integrates similarity calculation and authorization verification at the underlying computational logic. By synchronously outputting the matching result and authorization judgment through a single matrix mathematical operation (trace finding), the computational complexity and end-to-end latency of the system are greatly reduced.

[0101] 4. Addressing the Structured Information Leakage and Security Risks Caused by the Separation of Query and Authorization: Addressing the technical problem that the existing serial verification architecture in Technology 2 is easily exploited by malicious attackers who can infer the authorization mode by observing the verification interception status and matching feedback, thus facing the risk of "identity-keyword linking attacks," this invention aims to deeply embed user role access credentials into the matrix structure of encrypted indexes and query trapdoors. This allows the cloud server to perform "blind search and blind verification" without exposing any access control structure information, completely blocking side-channel inference attacks using independent verification stages.

[0102] like Figure 2As shown, for ease of description, the system model is simplified to four entities: Key Management Server (KMS), Data Owner (DO), Data User (DU), and Cloud Server (CS). The Data Owner and Data User submit their relevant identity information or system requests to the KMS for key generation and parameter acquisition. The KMS's tasks are to distribute index building keys to the Data Owner, distribute trapdoor generation keys to the Data User, and provide a re-encryption key to the Cloud Server. The Data Owner sends the encrypted keyword index to the Cloud Server for storage. The Data User submits an encryption trapdoor to the Cloud Server to initiate a search. Subsequently, the Cloud Server uses its re-encryption key to complete similarity matching and access control verification without decrypting the original information. Further details about these entities are described below:

[0103] Key Management Center: Responsible for global system initialization, generating orthogonal coding bases, alphabetic bijective mapping rules, global binary mask matrix, and various encryption and re-encryption keys.

[0104] Data owner: Industrial data source equipment. Responsible for using the Walsh matrix to perform matrix encoding, length padding, multi-keyword dimensionality reduction and aggregation of plaintext keywords in the file, embedding the system's role access control coefficients, and finally performing asymmetric encryption to generate a ciphertext index.

[0105] Data User: The query initiator of the system. Responsible for encoding and aggregating fuzzy query keywords into a query matrix using the same rules, calculating and embedding a multinomial feature vector identifying their own role, and then encrypting it to generate a query trapdoor.

[0106] Cloud server: Responsible for ciphertext storage and blind computation. It uses a re-encryption key to align the index and trapdoor with ciphertext fields, performs matrix inner product and trace calculation, and outputs the matching score and authorized interception result in a single operation.

[0107] The WMFS scheme aims to ensure the privacy of outsourced data search in the Industrial Internet of Things (IIoT) environment, primarily focusing on keyword confidentiality and the ability of encrypted indexes to resist statistical analysis. To this end, this invention defines the following two security models:

[0108] 1) Indistinguishability under plaintext attacks: This aims to guarantee the confidentiality of encrypted indexes and query trapdoors. This model ensures that even if an honest and curious cloud server can select a specific plaintext and obtain its corresponding ciphertext, it cannot distinguish with a non-negligible advantage which of the two challenge keywords corresponds to a given encrypted index or trapdoor.

[0109] 2) Index Unlinkability: This feature aims to prevent cloud servers from inferring the association between encrypted data and underlying keywords through background knowledge or statistical analysis. The model ensures that for the same keyword combination, different encrypted indexes generated by the system appear highly random and independent; even if an adversary intercepts multiple indexes, they cannot determine whether they correspond to the same underlying keyword combination, thus mitigating the risk of identity-keyword linking attacks.

[0110] Both security models described above are formally defined through interactive games between adversaries and challengers. If, within probabilistic multinomial time, the adversary's winning advantage in these games is negligible relative to random guessing, then the WMFS scheme proposed in this invention satisfies IND-CPA security and index unlinkability.

[0111] In this embodiment of the invention, S1 includes the following sub-steps:

[0112] S11. The key management center generates the Walsh-Hadamard matrix;

[0113] S12. Randomly select several non-repeating column vectors from the Walsh-Hadamard matrix to form a set, and establish a bijective mapping from the English alphabet to the set.

[0114] S13. Generate wildcard vectors and randomly select two disjoint vector sets from the unselected Walsh vectors to serve as the fill sets for the data owner and the data user, respectively.

[0115] S14. Generate access control policies and global hidden parameters, and complete system initialization.

[0116] Generate an orthogonal matrix: The Key Management Center (KMS) generates a 64×64 Walsh-Hadamard matrix. Each column vector of this matrix Satisfying strict orthogonality: when The time product is 64, when The time product is 0.

[0117] Establish character encoding mapping: from matrix A set is formed by randomly selecting 26 unique column vectors. Establish the English alphabet to the set bijective mapping For any letter Its vector representation is .

[0118] Defining wildcards and dynamic padding sets: Defining wildcard vectors To support fuzzy queries; simultaneously, to enforce a uniform keyword length and introduce randomness, two disjoint vector sets are randomly selected from the remaining unused Walsh vectors. and These serve as dedicated fill sets for the data owner and the data user, respectively.

[0119] Generate access control policies: The system administrator defines the set of legitimate user roles. And construct the access control polynomial Extracting polynomial coefficients to form a parameter set. .

[0120] (5) Generate global hidden parameters: Randomly generate a global binary mask matrix. And two invertible hidden transformation matrices They are included in the system master key along with the polynomial coefficients. .

[0121] In this embodiment of the invention, the access control policy includes: determining a set of legitimate user roles and constructing an access control polynomial, the expression of which is:

[0122] ;

[0123] in, This represents the access control polynomial. This represents the total number of legitimate user roles. The independent variable of the polynomial, This represents the identifier of the i-th legitimate user role. Denotes the coefficients of the second-highest degree terms of a polynomial. This represents the (n-1)th power of the independent variable s. Represents the constant term of a polynomial;

[0124] The global hiding parameters include a global binary mask matrix and two invertible hiding transformation matrices, and the global binary mask matrix, the two invertible hiding transformation matrices, and the polynomial coefficients of the access control polynomial are used as the system master key.

[0125] In this embodiment of the invention, S2 includes the following sub-steps:

[0126] S21. Generate two random invertible matrices for each data owner, and generate a private key and a re-encryption key based on the global binary mask matrix and the two invertible hidden transformation matrices. Send them to the cloud server to complete the DO key distribution.

[0127] S22. Generate a random invertible matrix for each data user, and generate a private key and a re-encryption key based on two invertible hidden transformation matrices, and send them to the cloud server to complete the DU key distribution.

[0128] DO Key Distribution: Generate two random invertible matrices for each data owner. ,calculate and .Will As its private key, it will be distributed. It is sent to the cloud server as a re-encryption key.

[0129] DU key distribution: for each data user (carrying an identity identifier) Generate random invertible matrices ,calculate and .Will As its private key is issued. It is sent to the cloud server as a re-encryption key.

[0130] In this embodiment of the invention, the private key for DO key allocation is: ;in, Represents the first random invertible matrix of the data owner. This represents the second random invertible matrix representing the data owner. Represents the global binary mask matrix;

[0131] The re-encryption key for DO key distribution is ; ; ;in, This represents the first layer of encryption matrix assigned to the data owner and distributed to the cloud server. This represents the second layer of encryption matrix assigned to the data owner and distributed to the cloud server. Let the first invertible hidden transformation matrix be represented. Let represent the second invertible hidden transformation matrix;

[0132] The private key for DU key distribution is ;in, Let the first random invertible matrix of the data users be represented. This represents the second random invertible matrix representing the data users. Indicates identity;

[0133] The re-encryption key for DU key distribution is ; ; in, This represents the first layer of encryption matrix sent by the user to the cloud server. This represents the second layer of encryption matrix assigned to the user and distributed to the cloud server. Let the first invertible hidden transformation matrix be represented. Let represent the second invertible hidden transformation matrix.

[0134] In this embodiment of the invention, S3 includes the following sub-steps:

[0135] S31. Extract several plaintext keywords from the file to be uploaded using the data owner, supplement each plaintext keyword with boundary symbols using the filling vector set, map the letters of each plaintext keyword to Walsh column vectors, and concatenate the boundary symbols to construct several single-word matrices.

[0136] S32. Perform addition operations on the single-character matrix of plaintext keywords to obtain the combined matrix;

[0137] S33. Multiply the polynomial coefficients initialized by the plaintext key and append them as a column vector to the end of the combination matrix to form a complete index matrix to be encrypted.

[0138] S34. Based on the complete index matrix to be encrypted and the key distribution result, perform mask splitting and encryption to generate a ciphertext index.

[0139] like Figure 3 As shown, keyword expansion and length alignment: The data owner extracts the file to be uploaded. Plain text keywords. Set uniform alignment length. Using the filling vector set Add boundary characters to each keyword Map each letter in the keyword to a Walsh column vector and concatenate boundary symbols to construct several single-word matrices, each with a dimension of 64×63. .

[0140] Multi-keyword linear aggregation compression: This method performs element-wise addition on the single-word matrices representing all keywords in the file, aggregating them into a unified combined matrix. .

[0141] Embedded access control vector: This sets the polynomial coefficients used for system initialization. Multiply by the number of keywords Then, it is concatenated as a column vector into the combination matrix. At the end, a complete index matrix of size 64×64 is formed to be encrypted. .

[0142] Mask splitting and encryption: For matrices For each column, if the corresponding bit of the mask matrix Then, its random addition is broken down into ;like ,but Then, left-multiplication encryption is performed using the DO private key: , Generate ciphertext index And upload it to the cloud.

[0143] In this embodiment of the invention, the combination matrix for:

[0144] ;

[0145] in, This represents the single-word matrix corresponding to the i-th plaintext keyword. Indicates plaintext keywords;

[0146] In S34, if the corresponding bit of the mask matrix for each column of the fully indexed matrix to be encrypted is 0, then ; Perform left-multiplication encryption using the DO private key allocated by the DO key to generate a ciphertext index; where, This represents the first split vector of the i-th column of the matrix to be encrypted, representing the complete index. This represents the second split vector of the i-th column of the matrix to be encrypted, which is the complete index. This represents the i-th column vector of the complete index of the matrix to be encrypted;

[0147] If the mask matrix corresponding to each column of the fully indexed matrix to be encrypted has a bit of 1, then ; Perform left-multiplication encryption using the DO private key allocated by the DO key to generate a ciphertext index;

[0148] Left-multiplication encryption using the DO private key allocated by the DO key is as follows:

[0149] ;

[0150] ;

[0151] in, This represents the first ciphertext vector generated by encryption. This represents the second ciphertext vector generated by encryption. This represents the first random invertible matrix in the data owner's private key. This represents the second random invertible matrix in the data owner's private key. This represents the matrix transpose operation;

[0152] Ciphertext Index for:

[0153] .

[0154] In this embodiment of the invention, S4 includes the following sub-steps:

[0155] S41. Using the data user input query term request, after aligning the length using the padding set, the keyword query of the query term request is transformed into a query matrix;

[0156] S42. Based on the role identity of the data user, construct a role vector and append the role vector to the end of the query matrix to form a trapdoor matrix to be encrypted.

[0157] S43. Based on the trapdoor to be encrypted matrix, perform mask splitting and encryption, and use the DU private key allocated by the DU key to perform encryption, generate a secure query trapdoor, and initiate a retrieval.

[0158] Query term encoding and aggregation: Data user input query term request (supports wildcard vectors) (Fuzzy search). Following the same mapping and additive aggregation rules as in step 3, utilize the fill set. Align the length to transform multi-keyword queries into a 64×63 query matrix. .

[0159] Construct and embed role vectors: Users based on their own role identities Construct a role vector for testing the zero-return property of polynomials. .Will spliced ​​into a matrix At the end, a 64×64 trapdoor matrix is ​​formed to be encrypted. .

[0160] Corresponding mask splitting and encryption: Employing mask logic complementary to step 3 (if...) Random addition splits the data; otherwise, the data remains the same. Encryption is performed using the DU private key: , Generate a secure query trap And initiate a search.

[0161] In this embodiment of the invention, the role vector for:

[0162] ;

[0163] in, Indicates the role and identity of the data user. This represents the square of the data user's role identity. The data user role identity raised to the power of d-1. Indicates the transpose operation;

[0164] Encryption is performed using the DU private key allocated by the DU key:

[0165] ;

[0166] ;

[0167] in, This represents the first ciphertext vector generated by the trapdoor encryption. This represents the second ciphertext vector generated by trapdoor encryption. This represents the first split vector of the i-th column of the matrix to be encrypted in the trapdoor. This represents the second split vector of the i-th column of the matrix to be encrypted in the trapdoor. Let the first random invertible matrix of the data users be represented. This represents the second random invertible matrix representing the data users;

[0168] Security query trap for:

[0169] .

[0170] In this embodiment of the invention, S5 includes the following sub-steps:

[0171] S51. Use the ciphertext index and secure query trapdoor to perform partial decryption, and calculate the transformed trapdoor matrix and the transformed index matrix;

[0172] S52. Calculate the inner product of the transpose of the transformed index matrix and the trapdoor matrix to obtain the matching matrix;

[0173] S53. Calculate the sum of the main diagonal elements of the matching matrix, which will be used as the final judgment criterion:

[0174] S54. Determine whether the final judgment criterion is less than or equal to the security matching threshold. If so, use the cloud server to sort in descending order and return the Top-k search encrypted results to the user. Otherwise, use the cloud server to refuse access.

[0175] Transformed index matrix for:

[0176] ;

[0177] in, This represents the first layer of encryption matrix assigned to the data owner and distributed to the cloud server. This represents the second layer of encryption matrix assigned to the data owner and distributed to the cloud server. This represents the first ciphertext vector generated by encryption. This represents the second ciphertext vector generated by encryption. Indicates the transpose operation;

[0178] Transformed trapdoor matrix for:

[0179] ;

[0180] in, This represents the first layer of encryption matrix sent by the user to the cloud server. This represents the second layer of encryption matrix assigned to the user and distributed to the cloud server. This represents the first ciphertext vector generated by the trapdoor encryption. This represents the second ciphertext vector generated by trapdoor encryption.

[0181] Ciphertext field secondary transformation: The cloud server uses the re-encryption key to partially decrypt the received index and trapdoor, and calculates... and This eliminates the dimensional barriers caused by different users' public and private key systems.

[0182] (2) Single matrix inner product calculation: The cloud server directly calculates the inner product of the transpose of the transformed index matrix and the trapdoor matrix. In this operation, a globally hidden transformation matrix is ​​introduced during the encryption phase. and The mathematical cancellation reveals the product relationship of the underlying Walsh vectors.

[0183] Trace extraction and automated verification: Cloud server calculates matching matrix The sum of the elements on the main diagonal (i.e., the trace of the matrix) is used as the final criterion: .

[0184] Permission interception determination: If a user's role is not authorized, its embedded role vector... The inability to bring the result of the access control polynomial to zero will cause the calculated trace value to expand exponentially. Much greater than the preset security matching threshold The cloud server directly returned "Access Denied".

[0185] Similarity return: If authorization is approved ( ), then the The value is directly equivalent to the sum of the number of characters hit in the fuzzy query and wildcards. The cloud server sorts the results in descending order based on this score and returns the Top-K ciphertext search results to the user.

[0186] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A multi-keyword fuzzy search method for industrial IoT based on Walsh matrix, characterized in that, Includes the following steps: S1. Perform system initialization; S2. Based on the system initialization results, perform key distribution; S3. Generate a ciphertext index based on the key distribution results; S4. Based on the key distribution results, generate a secure query trapdoor; S5. Based on the ciphertext index and security query trap, perform ciphertext matching and authorization interception.

2. The industrial IoT multi-keyword fuzzy search method based on Walsh matrix according to claim 1, characterized in that, S1 includes the following sub-steps: S11. The key management center generates the Walsh-Hadamard matrix; S12. Randomly select several non-repeating column vectors from the Walsh-Hadamard matrix to form a set, and establish a bijective mapping from the English alphabet to the set. S13. Generate wildcard vectors and randomly select two disjoint vector sets from the unselected Walsh vectors to serve as the fill sets for the data owner and the data user, respectively. S14. Generate access control policies and global hidden parameters, and complete system initialization.

3. The industrial IoT multi-keyword fuzzy search method based on Walsh matrix according to claim 2, characterized in that, The access control policy includes: determining a set of legitimate user roles and constructing an access control polynomial, the expression of which is: ； in, This represents the access control polynomial. This represents the total number of legitimate user roles. The independent variable of the polynomial, This represents the identifier of the i-th legitimate user role. Denotes the coefficients of the second-highest degree terms of a polynomial. This represents the (n-1)th power of the independent variable s. Represents the constant term of a polynomial; The global hiding parameters include a global binary mask matrix and two invertible hiding transformation matrices, and the global binary mask matrix, the two invertible hiding transformation matrices, and the polynomial coefficients of the access control polynomial are used as the system master key.

4. The industrial IoT multi-keyword fuzzy search method based on Walsh matrix according to claim 1, characterized in that, S2 includes the following sub-steps: S21. Generate two random invertible matrices for each data owner, and generate a private key and a re-encryption key based on the global binary mask matrix and the two invertible hidden transformation matrices. Send them to the cloud server to complete the DO key distribution. S22. Generate a random invertible matrix for each data user, and generate a private key and a re-encryption key based on two invertible hidden transformation matrices, and send them to the cloud server to complete the DU key distribution.

5. The industrial IoT multi-keyword fuzzy search method based on Walsh matrix according to claim 4, characterized in that, The private key for the DO key distribution is ;in, Represents the first random invertible matrix of the data owner. This represents the second random invertible matrix representing the data owner. Represents the global binary mask matrix; The re-encryption key for the DO key allocation is: ; ; ;in, This represents the first layer of encryption matrix assigned to the data owner and distributed to the cloud server. This represents the second layer of encryption matrix assigned to the data owner and distributed to the cloud server. Let the first invertible hidden transformation matrix be represented. Let represent the second invertible hidden transformation matrix; The private key for the DU key distribution is ;in, Let the first random invertible matrix of the data users be represented. This represents the second random invertible matrix representing the data users. Indicates identity; The re-encryption key for the DU key allocation is: ; ; in, This represents the first layer of encryption matrix sent by the user to the cloud server. This represents the second layer of encryption matrix assigned to the user and distributed to the cloud server. Let the first invertible hidden transformation matrix be represented. Let represent the second invertible hidden transformation matrix.

6. The industrial IoT multi-keyword fuzzy search method based on Walsh matrix according to claim 1, characterized in that, S3 includes the following sub-steps: S31. Extract several plaintext keywords from the file to be uploaded using the data owner, supplement each plaintext keyword with boundary symbols using the filling vector set, map the letters of each plaintext keyword to Walsh column vectors, and concatenate the boundary symbols to construct several single-word matrices. S32. Perform addition operations on the single-character matrix of plaintext keywords to obtain the combined matrix; S33. Multiply the polynomial coefficients initialized by the plaintext key and append them as a column vector to the end of the combination matrix to form a complete index matrix to be encrypted. S34. Based on the complete index matrix to be encrypted and the key distribution result, perform mask splitting and encryption to generate a ciphertext index.

7. The industrial IoT multi-keyword fuzzy search method based on Walsh matrix according to claim 6, characterized in that, The combination matrix for: ； in, This represents the single-word matrix corresponding to the i-th plaintext keyword. Indicates plaintext keywords; In step S34, if the corresponding bit of the mask matrix for each column of the fully indexed matrix to be encrypted is 0, then ; Perform left-multiplication encryption using the DO private key allocated by the DO key to generate a ciphertext index; where, This represents the first split vector of the i-th column of the matrix to be encrypted, representing the complete index. This represents the second split vector of the i-th column of the matrix to be encrypted, which is the complete index. This represents the i-th column vector of the complete index of the matrix to be encrypted; If the mask matrix corresponding to each column of the fully indexed matrix to be encrypted has a bit of 1, then ; Perform left-multiplication encryption using the DO private key allocated by the DO key to generate a ciphertext index; The left-multiplication encryption performed using the DO private key allocated by the DO key is as follows: ； ； in, This represents the first ciphertext vector generated by encryption. This represents the second ciphertext vector generated by encryption. This represents the first random invertible matrix in the data owner's private key. This represents the second random invertible matrix in the data owner's private key. Indicates the transpose operation; The ciphertext index for: 。 8. The industrial IoT multi-keyword fuzzy search method based on Walsh matrix according to claim 1, characterized in that, S4 includes the following sub-steps: S41. Using the data user input query term request, after aligning the length using the padding set, the keyword query of the query term request is transformed into a query matrix; S42. Based on the role identity of the data user, construct a role vector and append the role vector to the end of the query matrix to form a trapdoor matrix to be encrypted. S43. Based on the trapdoor to be encrypted matrix, perform mask splitting and encryption, and use the DU private key allocated by the DU key to perform encryption, generate a secure query trapdoor, and initiate a retrieval.

9. The industrial IoT multi-keyword fuzzy search method based on Walsh matrix according to claim 8, characterized in that, The role vector for: ； in, Indicates the role and identity of the data user. This represents the square of the data user's role identity. The data user role identity raised to the power of d-1. Indicates the transpose operation; The encryption performed using the DU private key allocated by the DU key is as follows: ； ； in, This represents the first ciphertext vector generated by the trapdoor encryption. This represents the second ciphertext vector generated by trapdoor encryption. This represents the first split vector of the i-th column of the matrix to be encrypted in the trapdoor. This represents the second split vector of the i-th column of the matrix to be encrypted in the trapdoor. Let the first random invertible matrix of the data users be represented. This represents the second random invertible matrix representing the data users; The security query trap for: 。 10. The industrial IoT multi-keyword fuzzy search method based on Walsh matrix according to claim 1, characterized in that, S5 includes the following sub-steps: S51. Use the ciphertext index and secure query trapdoor to perform partial decryption, and calculate the transformed trapdoor matrix and the transformed index matrix; S52. Calculate the inner product of the transpose of the transformed index matrix and the trapdoor matrix to obtain the matching matrix; S53. Calculate the sum of the main diagonal elements of the matching matrix, which will be used as the final judgment criterion: S54. Determine whether the final judgment criterion is less than or equal to the security matching threshold. If so, use the cloud server to sort in descending order and return the T ciphertext search result to the user. Otherwise, use the cloud server to refuse access. The transformed index matrix for: ； in, This represents the first layer of encryption matrix assigned to the data owner and distributed to the cloud server. This represents the second layer of encryption matrix assigned to the data owner and distributed to the cloud server. This represents the first ciphertext vector generated by encryption. This represents the second ciphertext vector generated by encryption. Indicates the transpose operation; The transformed trapdoor matrix for: ； in, This represents the first layer of encryption matrix sent by the user to the cloud server. This represents the second layer of encryption matrix assigned to the user and distributed to the cloud server. This represents the first ciphertext vector generated by the trapdoor encryption. This represents the second ciphertext vector generated by trapdoor encryption.

Images