A method, device and medium for query based on strong backward security of trusted execution environment

Abstract

The application discloses a kind of strong backward security query method, equipment and medium based on trusted execution environment, the method includes: receiving and deleting instruction corresponding strong backward security condition, constructs the physical deletion logic matched with this condition;Under current time window, collect client query sequence, input to query prediction model to obtain the query probability of each keyword;According to query probability and preset index block threshold, high frequency or low frequency is divided into and is stored in partition;In response to client delete instruction, obtain target deleted document, execute the physical deletion logic to mixed index structure, and the index information corresponding to target deleted document is physically erased, the technical scheme of the embodiment of the application can significantly improve the query efficiency under the premise of ensuring strong backward security, and the index information of deleted document is completely physically erased to prevent data leakage risk.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method, device and medium for strong backward security query based on a trusted execution environment. Background Technology

[0002] With the widespread application of cloud computing and data outsourcing services, searchable encryption technology has become an important means of ensuring the confidentiality of cloud data. How to achieve the retrieval and dynamic updating of encrypted data without leaking its content is a core issue in this field. Especially in highly sensitive scenarios such as medical records and legal files, it is required not only that the search process does not reveal document content, but also that after a document is deleted, any subsequent search operation cannot deduce any trace of the document's existence—that is, strong backward security. However, existing dynamic searchable encryption schemes generally use logical marking or soft deletion methods when handling deletion operations, merely marking index entries as invalid rather than physically erasing them. This allows attackers to infer the information of deleted documents by observing search access patterns, seriously threatening data privacy and security.

[0003] In existing technologies, achieving backward-secure searchable encryption mainly relies on the following methods: First, schemes based on random access machines, which obfuscate each read / write operation to hide the access pattern, but suffer from extremely high communication and computational overhead, making them difficult to deploy in practical systems; second, schemes based on stateful indexes, which control access to deleted documents during the search process by maintaining complex state information, but their state management is complex and their scalability is poor; third, schemes based on partitioned indexes, which divide the index into multiple segments by time or keywords, but lack the ability to detect query hotspots, resulting in low search efficiency for high-frequency keywords. None of the above methods can simultaneously achieve strong backward security and efficient query response, necessitating a technical solution that can achieve high-performance encrypted retrieval while ensuring security. Summary of the Invention

[0004] This invention provides a method, device, and medium for strong backward security query based on a trusted execution environment, in order to solve the problems of low query efficiency and inability to meet strong backward security requirements in the prior art.

[0005] According to one aspect of the present invention, a strongly backward-secure query method based on a trusted execution environment is provided, the method comprising: Receive a strong backward security condition corresponding to the deletion command injected by the user in the trusted execution environment. The strong backward security condition restricts the information of the deleted document from being retrieved through a query request. To address strong backward security conditions, a physical deletion logic matching the deletion command is constructed. This physical deletion logic completely decouples the physical location accessed by the query request from the physical location of the deleted document. Collect client query sequences within the current time window and input them into a query prediction model trained using an incremental learning strategy to obtain the query probability of each keyword output by the query prediction model. Based on the query probability of each keyword and the preset index block threshold, all keywords are divided into high-frequency keywords or low-frequency keywords, and the high-frequency keywords and low-frequency keywords are stored in partitions. In response to a client's delete command, retrieve the target document to be deleted that matches the client's delete command; For the pre-maintained hybrid index structure, the physical deletion logic is executed to physically erase the index information corresponding to the target deleted document from the hybrid index structure.

[0006] According to another aspect of the present invention, a strongly backward-secure query apparatus based on a trusted execution environment is provided, the apparatus comprising: The instruction receiving module is used to receive strong backward security conditions corresponding to deletion instructions injected by users in the trusted execution environment. The strong backward security conditions restrict the information of deleted documents from being retrieved through query requests. The deletion logic building module is used to construct physical deletion logic that matches the deletion command under strong backward security conditions. The physical deletion logic is used to completely decouple the physical location accessed by the query request from the physical location of the deleted document. The query probability prediction module is used to collect client query sequences within the current time window and input the client query sequences into a query prediction model trained by an incremental learning strategy to obtain the query probability of each keyword output by the query prediction model. The index partitioning storage module is used to divide all keywords into high-frequency keywords or low-frequency keywords based on the query probability of each keyword and the preset index partitioning threshold, and then partition and store the high-frequency keywords and low-frequency keywords. The target deletion acquisition module is used to retrieve the target deletion document that matches the client's deletion command in response to the client's deletion command; The physical erasure execution module is used to execute the physical deletion logic for a pre-maintained hybrid index structure to physically erase the index information corresponding to the target deleted document from the hybrid index structure.

[0007] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute a strongly backward-secure query method based on a trusted execution environment as described in any embodiment of the present invention.

[0008] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement a strongly backward-secure query method based on a trusted execution environment as described in any embodiment of the present invention.

[0009] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the method as described in any embodiment of the present invention.

[0010] The technical solution of this invention, by receiving a strong backward security condition corresponding to a deletion instruction, constructs physical deletion logic matching the condition; collects client query sequences within the current time window, inputs these sequences into a query prediction model trained using an incremental learning strategy, and obtains the query probabilities of each keyword output by the query prediction model; based on the query probabilities of each keyword and a preset index segmentation threshold, all keywords are divided into high-frequency keywords or low-frequency keywords, and the high-frequency and low-frequency keywords are stored in partitions; in response to a client deletion instruction, the target deletion document matching the client deletion instruction is obtained; for the pre-maintained hybrid index structure, the physical deletion logic is executed to physically erase the index information corresponding to the target deletion document from the hybrid index structure; this solves the problems of low query efficiency and inability to meet strong backward security in the prior art, achieving the beneficial effect of significantly improving query efficiency while ensuring strong backward security and realizing the complete physical erasure of the index information of deleted documents to prevent data leakage risks.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a strongly backward-secure query method based on a trusted execution environment according to Embodiment 1 of the present invention; Figure 2 This is a flowchart of another strongly backward-secure query method based on a trusted execution environment provided in Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of a strongly backward-secure query device based on a trusted execution environment according to Embodiment 3 of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device that implements a strongly backward-secure query method based on a trusted execution environment according to an embodiment of the present invention. Detailed Implementation

[0014] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0016] Example 1 Figure 1 This is a flowchart of a strong backward security query method based on a trusted execution environment provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where sensitive data stored in the cloud needs to be retrieved securely and meets the requirements of strong backward security. The method can be executed by a strong backward security query device based on a trusted execution environment. This device can be implemented in hardware and / or software and is generally configured in an electronic device.

[0017] The Trusted Execution Environment (TEX) can be understood as a secure area built inside the processor through a hardware-level isolation mechanism. This secure area is isolated from the operating system and upper-level applications, ensuring that the code and data running within it are protected by hardware in terms of confidentiality and integrity, preventing malware or privileged attackers from stealing or tampering with them.

[0018] Correspondingly, such as Figure 1 As shown, the method includes: S110. Receive a strong backward security condition corresponding to the deletion instruction injected by the user in the trusted execution environment, wherein the strong backward security condition restricts the information of the deleted document from being retrieved through a query request.

[0019] Among them, strong backward security conditions can be understood as stipulating that once a document is deleted, any subsequent search operation cannot allow attackers to infer the fact that the document once existed or was deleted by observing information such as search patterns, access frequency, or returned results.

[0020] In this embodiment, the user first injects strong backward security conditions into the Trusted Execution Environment (TEE). The TEE is a secure area protected by hardware isolation, inaccessible to data and code from external operating systems and applications. The user-injected condition is a hard constraint: once a document is deleted, no subsequent search operation should allow an attacker to infer the document's existence or deletion by observing search patterns, access frequency, or returned results.

[0021] S120. For strong backward security conditions, construct physical deletion logic that matches the deletion command. The physical deletion logic is used to completely decouple the physical location accessed by the query request from the physical location of the deleted document.

[0022] In this embodiment, based on the established security constraints, a dedicated deletion logic needs to be designed to meet strong backward security requirements. Traditional deletion methods typically only mark a document as "deleted" in the index, while the actual data still occupies its original storage location. Attackers can determine whether a document has been deleted by comparing the storage areas accessed during searches before and after deletion. The physical deletion logic constructed in this embodiment requires that, when deletion occurs, the index information corresponding to the deleted document be completely erased from the storage medium, leaving no residue. More importantly, it requires that the physical storage areas accessed by subsequent search operations have no connection with the physical storage areas originally occupied by the deleted document. Even if an attacker monitors the storage access path of each search, they cannot infer the occurrence of deletion based on location differences.

[0023] S130. Collect client query sequences within the current time window and input the client query sequences into the query prediction model trained by the incremental learning strategy to obtain the query probability of each keyword output by the query prediction model.

[0024] Incremental learning strategy can be understood as a model training method that allows the query prediction model to incrementally update itself using newly added query data, without having to retrain the entire model from scratch each time.

[0025] In this embodiment, the trusted execution environment continuously collects query requests from clients within a preset time window, forming a query sequence. This sequence reflects the user's recent search hotspots and interest distribution. Subsequently, this query sequence is input into a query prediction model. This model is trained using an incremental learning strategy, meaning it doesn't need to be retrained from scratch each time. Instead, it can progressively update the existing model using new query data, thus adapting to changes in query distribution in a timely manner while avoiding the high computational cost of full retraining. After processing, the model outputs a list of probability values, with each keyword corresponding to a query probability, representing the likelihood of that keyword being searched within a future period. These probability values ​​are used to determine which keywords should be prioritized for faster access.

[0026] Furthermore, based on the above embodiments, a strongly backward-secure query method based on a trusted execution environment may further include: Obtain the internally maintained security query log in the trusted execution environment. The security query log records anonymized historical query sequences and timestamps corresponding to each historical query in the historical query sequence. The security query log is used to obtain truncated query subsequences that match the currently maintained dynamic time window in real time. When the update condition is met at the current time point, the query prediction model is incrementally learned using the truncated query subsequence in the dynamic time window that matches the current time point. After incremental learning is completed, the truncated query subsequence is immediately destroyed in the trusted execution environment memory.

[0027] Generally, a secure query log is a dedicated log maintained internally within a trusted execution environment (TEE) to record anonymized historical query sequences. Each historical query record is accompanied by a corresponding timestamp. Anonymization methods include removing client identification information, such as network addresses, device serial numbers, or user identifiers, making it impossible to trace the query records in the log back to the specific query initiator. The log is stored internally within the TEE, protected by hardware isolation, and cannot be directly accessed by external operating systems and applications. The core function of this log is to provide training data for query prediction models, while ensuring client privacy is not compromised through both anonymization and internal storage. The addition of timestamps allows for precise extraction of desired query subsequences based on time ranges, providing a time benchmark for maintaining dynamic time windows.

[0028] Generally, a Trusted Execution Environment (TEE) maintains a dynamic time window, which defines the current time range of interest. Its length can be adaptively adjusted based on query frequency or system load. Query records matching the current dynamic time window are extracted from the security query log in real time, forming a truncated query subsequence. Specifically, the TEE continuously monitors new records in the security query log. Whenever a new query record is written, all historical query records falling within the current dynamic time window's start and end times are extracted from the log, and outdated records outside the window are removed. This process ensures that the acquired query data always reflects recent client query behavior, providing timely input for subsequent model updates while avoiding interference from outdated data on model prediction accuracy.

[0029] Generally, the Trusted Execution Environment (TEE) continuously monitors whether the current time point meets preset update conditions. Update conditions typically include two scenarios: first, the data distribution characteristics of the query sequence within the current dynamic time window have changed significantly compared to the previous window, exceeding a preset threshold; second, although the data distribution change has not exceeded the threshold, there are currently no pending client query requests, and the system is idle. Once either condition is detected, incremental learning of the query prediction model is triggered. The truncated query subsequence corresponding to the current dynamic time window is used as training data to progressively adjust the model parameters. Incremental learning differs from full retraining; it only uses newly added query data to fine-tune the existing model without reprocessing all historical data, thus significantly reducing computational overhead and storage requirements. The training process is entirely completed within the TEE, and external interference or observation of the training data and model update process is impossible.

[0030] Generally, after incremental learning is complete, to prevent training data from leaking client query privacy, the truncated query subsequences used are immediately destroyed in the trusted execution environment's memory. The destruction operation includes freeing up memory space and overwriting the original data, ensuring that any subsequent memory read operations cannot recover any query record from that subsequence. After destruction, only the updated query prediction model parameters are retained in the trusted execution environment; the original query data is no longer present. This ensures that even if the trusted execution environment is subsequently attacked, attackers cannot obtain historical query records, thus protecting client search privacy and also meeting the requirement of unrecoverable processed data in strong backward security.

[0031] Optionally, based on the above embodiments, detecting that the current time point meets the update conditions may include: Calculate the data distribution characteristics of the query sequence within the current dynamic time window and compare them with the data distribution characteristics of the query sequence within the previous dynamic time window to obtain the degree of change in the data distribution. When the degree of change in the data distribution exceeds a preset threshold, it is determined that the update condition is met; When the change in the data distribution does not exceed a preset threshold and there are no pending client query requests, the update condition is deemed met.

[0032] Generally, a trusted execution environment (TEA) first extracts the data distribution features of the query sequence within the current dynamic time window. These features characterize the frequency distribution of queries for each keyword within that time frame. Then, it extracts the data distribution features of the query sequence within the previous dynamic time window and compares the current features with the previous features item by item, calculating the degree of difference between them. This degree of difference represents the change in data distribution. This change reflects the shift in user query interests over time and is the core basis for determining whether the query prediction model needs to be updated.

[0033] Generally, when the calculated change in data distribution exceeds a preset threshold, the trusted execution environment determines that the update condition is met at the current time point. The preset threshold is a pre-determined critical value used to measure the significance of changes in data distribution. Once the degree of change exceeds this threshold, it indicates that the user's query behavior has undergone a substantial change, and the original query prediction model can no longer accurately reflect the current query hotspots. Therefore, it is necessary to trigger a model update to ensure that subsequent query probability predictions remain accurate.

[0034] Generally, when the change in data distribution does not exceed a preset threshold, the trusted execution environment further checks whether there are any pending client query requests. If there are no pending client query requests, meaning the system is idle, then the update conditions are also met at the current time. In this scenario, the update is not driven by an urgent need to address changes in query distribution, but rather by utilizing system idle periods for routine maintenance updates to the model. This gradually absorbs subtle changes in recent query data, preventing the model from deviating from the actual query distribution due to prolonged periods without updates, while ensuring that the update operation does not interfere with normal query services.

[0035] S140. Based on the query probability of each keyword and the preset index segmentation threshold, all keywords are divided into high-frequency keywords or low-frequency keywords, and the high-frequency keywords and low-frequency keywords are stored in separate partitions.

[0036] In this embodiment, after obtaining the query probabilities of each keyword, they need to be compared with a preset index block threshold. If the query probability of a keyword is higher than the threshold, it is classified as a high-frequency keyword, indicating that the keyword is searched frequently and requires a fast response; conversely, it is classified as a low-frequency keyword, indicating that it is searched less frequently. After classification, the index blocks corresponding to high-frequency keywords are migrated to a high-speed cache area with faster access speed so that they can be quickly located in subsequent searches; the index blocks corresponding to low-frequency keywords are stored in a regular encrypted storage area to save valuable cache resources. Through this partitioned storage strategy, the response speed of high-frequency searches can be significantly improved without affecting overall security, while reducing overall storage costs.

[0037] S150. In response to the client's deletion command, obtain the target document to be deleted that matches the client's deletion command.

[0038] In this embodiment, when a client issues a deletion command, the trusted execution environment receives and parses the command to extract the identification information of the target document to be deleted, such as the document's unique number or identifier. This step is the trigger point for the entire deletion process; subsequent physical erasure operations will revolve around this target document. It is important to note that the deletion command itself also requires authorization verification to ensure that only legitimate clients can initiate the deletion operation, preventing malicious deletion that could lead to data loss.

[0039] S160. For the pre-maintained hybrid index structure, execute the physical deletion logic to physically erase the index information corresponding to the target deleted document from the hybrid index structure.

[0040] Physical erasure can be understood as completely erasing the index information corresponding to the deleted document from the storage structure, leaving no residual data, rather than simply marking it as "deleted" or "invalid".

[0041] In this embodiment, the hybrid index structure consists of both an inverted index and a forward index. The inverted index uses a keyword as the key and records all document identifiers containing that keyword for quick location during searching; the forward index uses a document identifier as the key and records all inverted index keys corresponding to that document for quick reverse lookup during deletion. When a target document needs to be deleted, all inverted index keys corresponding to that document are first found through the forward index, and then the corresponding entries in the inverted index are directly located. The records related to that document in these entries are physically erased, that is, completely removed from the storage medium without leaving any residue.

[0042] The technical solution of this invention, by receiving a strong backward security condition corresponding to a deletion instruction, constructs physical deletion logic matching the condition; collects client query sequences within the current time window, inputs these sequences into a query prediction model trained using an incremental learning strategy, and obtains the query probabilities of each keyword output by the query prediction model; based on the query probabilities of each keyword and a preset index segmentation threshold, all keywords are divided into high-frequency keywords or low-frequency keywords, and the high-frequency and low-frequency keywords are stored in partitions; in response to a client deletion instruction, the target deletion document matching the client deletion instruction is obtained; for the pre-maintained hybrid index structure, the physical deletion logic is executed to physically erase the index information corresponding to the target deletion document from the hybrid index structure; this solves the problems of low query efficiency and inability to meet strong backward security in the prior art, achieving the beneficial effect of significantly improving query efficiency while ensuring strong backward security and realizing the complete physical erasure of the index information of deleted documents to prevent data leakage risks.

[0043] Example 2 Figure 2 This is a flowchart of a strongly backward-secure query method based on a trusted execution environment provided in Embodiment 2 of the present invention. This embodiment is based on and optimized from the above embodiments. Specifically, the step of "dividing all keywords into high-frequency keywords or low-frequency keywords according to the query probability of each keyword and the preset index block threshold, and storing the high-frequency keywords and low-frequency keywords in partitions" has been refined.

[0044] Correspondingly, such as Figure 2 As shown, the method includes: S210. Receive a strong backward security condition corresponding to the deletion instruction injected by the user in a trusted execution environment, wherein the strong backward security condition restricts the information of the deleted document from being retrieved through a query request.

[0045] S220. For strong backward security conditions, construct physical deletion logic that matches the deletion command. The physical deletion logic is used to completely decouple the physical location accessed by the query request from the physical location of the deleted document.

[0046] S230. Collect client query sequences within the current time window and input the client query sequences into the query prediction model trained by the incremental learning strategy to obtain the query probability of each keyword output by the query prediction model.

[0047] S240. Obtain the query probability of each keyword output by the query prediction model.

[0048] In this embodiment, after incremental learning training, the query prediction model outputs a set of probability values ​​for the query sequence within the current time window. Each probability value corresponds to a keyword, indicating the likelihood that the keyword will be queried by the client in the future. The trusted execution environment reads these probability values ​​from the model as input for subsequent index partitioning operations. The obtained query probability list completely covers all known keywords, ensuring the completeness of the basic data for subsequent partitioning operations.

[0049] S250. Keywords with a query probability higher than the preset index block threshold are determined as high-frequency keywords, and keywords with a query probability lower than or equal to the preset index block threshold are determined as low-frequency keywords.

[0050] In this embodiment, the trusted execution environment compares the query probabilities of each keyword obtained in the previous step with a preset index block threshold. This threshold is a predetermined value used to define the boundary between high-frequency and low-frequency keywords. If the query probability of a keyword is greater than the threshold, it is classified as a high-frequency keyword, indicating that the keyword is searched frequently and requires a faster access response; if the query probability is less than or equal to the threshold, it is classified as a low-frequency keyword, indicating that its search frequency is low and a relatively slower access speed is acceptable. Through this binary division, the keyword access popularity is differentiated, laying the foundation for subsequent differentiated storage strategies.

[0051] S260. Move the index block corresponding to the high-frequency keyword to the high-speed cache area, and move the index block corresponding to the low-frequency keyword to the ordinary encrypted storage area.

[0052] In this embodiment, the trusted execution environment adjusts the index storage layout based on the partitioning results. For all keywords identified as high-frequency keywords, their corresponding index blocks are migrated from their original storage location to the cache area. The cache area is a storage region with low access latency and high throughput, suitable for storing frequently accessed data, thereby shortening the response time of high-frequency searches. For all keywords identified as low-frequency keywords, their corresponding index blocks are migrated to the ordinary encrypted storage area. Although this area has a relatively slower access speed, its storage cost is lower, making it suitable for storing infrequently accessed data. Through this partitioned storage strategy, the system optimizes the allocation of storage resources without sacrificing security, enabling high-frequency searches to achieve faster responses while reducing overall storage overhead.

[0053] Furthermore, based on the above embodiments, a strongly backward-secure query method based on a trusted execution environment may further include: Obtain the index block threshold before the update, and calculate the average prediction probability of all keywords at present; The new index block threshold is obtained by taking a weighted average of the index block threshold before the update and the average prediction probability. The new index segmentation threshold is used to replace the current index segmentation threshold for the next round of high-frequency and low-frequency keyword segmentation.

[0054] Generally, the trusted execution environment first obtains the currently used index block threshold, i.e., the index block threshold before the update. Simultaneously, based on the query probabilities of each keyword output by the query prediction model, it calculates the average predicted probability of all keywords. This average predicted probability reflects the average level of overall query popularity within the current time window and is an important reference for adjusting the index block threshold. The purpose of obtaining these two values ​​is to provide input parameters for subsequent threshold updates, enabling the new threshold to comprehensively reflect changes in historical benchmarks and the current query distribution.

[0055] Generally, the trusted execution environment calculates a new index block threshold by weighting the previous index block threshold with the current average prediction probability of all keywords, assigning different weight coefficients to both. This weighted averaging approach ensures the new threshold retains the historical dividing benchmark of the old threshold while incorporating the latest trends in query distribution. The weight coefficients determine the degree of influence of the old threshold and the average prediction probability on the new threshold. A larger weight for the old threshold allows for smoother threshold changes, avoiding frequent adjustments due to short-term fluctuations; a larger weight for the average prediction probability allows the threshold to respond more quickly to changes in query hotspots.

[0056] Generally, trusted execution environments use a newly calculated index partitioning threshold to replace the old threshold as the criterion for determining high-frequency and low-frequency keywords in the next round. This means that when keyword partitioning is performed again, the updated threshold will be used as the comparison benchmark, classifying keywords with query probabilities higher than the threshold as high-frequency keywords and those lower than or equal to the threshold as low-frequency keywords. Through this periodic or conditionally triggered threshold update mechanism, the index partitioning threshold can adaptively adjust to follow the overall changes in query distribution, ensuring that the division between high-frequency and low-frequency areas always matches the current actual query activity.

[0057] S270. In response to a client deletion command, obtain the target deletion document that matches the client deletion command.

[0058] S280. For the pre-maintained hybrid index structure, execute the physical deletion logic to physically erase the index information corresponding to the target deleted document from the hybrid index structure.

[0059] Optionally, based on the above embodiments, executing the physical deletion logic for the pre-maintained hybrid index structure to physically erase the index information corresponding to the target deleted document from the hybrid index structure may include: Construct an inverted index, whose key is generated from keyword-related information and whose value is a document identifier, used to locate documents containing the target keyword during search operations; A forward index is constructed, with the document identifier as the key and the inverted index key set corresponding to the document as the value. This is used to obtain all index association information of the document to be deleted during the deletion operation. During the deletion process, the forward index is searched based on the identifier of the target document to be deleted, all inverted index keys corresponding to the document are obtained, the corresponding entries in the inverted index are directly located and physical erasure is performed without traversing the search. After physical erasure, the counter or flag bit of the corresponding entry in the inverted index is updated so that subsequent search operations skip physically erased entries when accessing the inverted index via a search token.

[0060] Generally, an inverted index is an index structure that uses keywords as entry points. Its keys are generated from keyword-related information, and its values ​​are document identifiers. During a search operation, when a client initiates a query request, the trusted execution environment accesses the inverted index using the keyword information in the search token. This allows for quick location of all document identifiers containing that keyword, thus efficiently retrieving matching results without traversing all document data.

[0061] Generally, a forward index is an index structure that uses document identifiers as entry points. Its key is the document identifier, and its value is the set of inverted index keys corresponding to that document. During a deletion operation, when a target document needs to be deleted, the trusted execution environment uses the document's identifier to search the forward index. This allows it to retrieve the keyword information associated with that document in all inverted indexes at once, thus accurately locating the inverted index entry to be processed and providing an accurate index path for subsequent physical erasure.

[0062] Generally, during deletion, the trusted execution environment looks up the forward index based on the identifier of the target document to obtain all the inverted index keys corresponding to that document. Then, using these inverted index keys, it directly locates the corresponding entries in the inverted index and physically erases the records related to that document, completely removing them from the storage medium. Because precise jumping is achieved through the forward index, the entire process does not require traversing or searching irrelevant entries in the inverted index, thus significantly improving the efficiency of the deletion operation.

[0063] Generally, after performing a physical erase, the trusted execution environment updates the counter or flag of the corresponding entry in the inverted index. The counter records the number of valid documents in that entry, and the flag indicates whether there are any physically erased documents in that entry. When subsequent search operations access the inverted index via search tokens, the trusted execution environment automatically skips physically erased entries based on the status of the counter or flag, ensuring that the search results returned to the client do not contain any information about deleted documents, while maintaining the integrity and consistency of the index structure.

[0064] Furthermore, based on the above embodiments, a strongly backward-secure query method based on a trusted execution environment may further include: Receive query requests sent by clients and verify permissions, record query requests in the security query log, and generate search tokens; The search token is used to access the inverted index to locate the set of document identifiers containing the target keyword. The query probability of each keyword output by the query prediction model is used to sort the set of document identifiers. The sorted set of document identifiers is then encrypted and returned to the client.

[0065] Generally, a trusted execution environment (TEA) first receives a query request from a client and verifies its permissions to confirm that the client initiating the query has legitimate access rights. After successful verification, the TEA records the query request in a secure query log for subsequent auditing or as a data source for updating the query prediction model. Subsequently, the TEA generates a search token based on the keywords contained in the query request. This token encapsulates the key or identifier required for the query and is used for secure access to the index structure, preventing unauthorized index access.

[0066] Generally, a trusted execution environment (TEA) uses a generated search token to access the inverted index, locating all document identifiers containing the target keyword, forming a document identifier set. Then, using the query probabilities of each keyword previously output by the query prediction model, this document identifier set is sorted, prioritizing documents corresponding to keywords with higher query probabilities to improve the relevance of the search results. Finally, the sorted document identifier set is encrypted to protect the confidentiality of the search results during transmission, and the encrypted result is returned to the client for decryption and use.

[0067] The technical solution of this invention, by receiving a strong backward security condition corresponding to a deletion instruction, constructs physical deletion logic matching the condition; collects client query sequences within the current time window and inputs them into a query prediction model trained through an incremental learning strategy to obtain the query probability of each keyword; obtains the query probability, determines keywords with query probabilities higher than a preset index block threshold as high-frequency keywords and migrates them to the cache area, and determines keywords with query probabilities lower than or equal to the preset index block threshold as low-frequency keywords and migrates them to the ordinary encrypted storage area; responds to the client deletion instruction to obtain the target deletion document, and executes physical deletion logic on the pre-maintained hybrid index structure to physically erase the index information corresponding to the target deletion document from the hybrid index structure; solves the problems of low query efficiency and inability to meet strong backward security in the prior art, and achieves the beneficial effect of significantly improving query efficiency through partitioned storage while ensuring strong backward security and realizing the complete physical erasure of the index information of deleted documents to prevent data leakage risks.

[0068] Example 3 Figure 3 This invention provides a strongly backward-secure query device based on a trusted execution environment in Embodiment 3, such as... Figure 3 As shown, the device includes: The instruction receiving module 310 is used to receive a strong backward security condition corresponding to the deletion instruction injected by the user in the trusted execution environment. The strong backward security condition restricts the information of the deleted document from being retrieved through a query request. The deletion logic building module 320 is used to build physical deletion logic that matches the deletion command for strong backward security conditions. The physical deletion logic is used to completely decouple the physical location accessed by the query request from the physical location of the deleted document. The query probability prediction module 330 is used to collect client query sequences in the current time window and input the client query sequences into the query prediction model trained by the incremental learning strategy to obtain the query probability of each keyword output by the query prediction model. The index partition storage module 340 is used to divide all keywords into high-frequency keywords or low-frequency keywords according to the query probability of each keyword and the preset index partition threshold, and to partition and store the high-frequency keywords and low-frequency keywords. The deletion target acquisition module 350 is used to acquire the target deletion document that matches the client's deletion command in response to the client's deletion command; The physical erasure execution module 360 ​​is used to execute the physical deletion logic for a pre-maintained hybrid index structure to physically erase the index information corresponding to the target deleted document from the hybrid index structure.

[0069] The technical solution of this invention, by receiving a strong backward security condition corresponding to a deletion instruction, constructs physical deletion logic matching the condition; collects client query sequences within the current time window, inputs these sequences into a query prediction model trained using an incremental learning strategy, and obtains the query probabilities of each keyword output by the query prediction model; based on the query probabilities of each keyword and a preset index segmentation threshold, all keywords are divided into high-frequency keywords or low-frequency keywords, and the high-frequency and low-frequency keywords are stored in partitions; in response to a client deletion instruction, the target deletion document matching the client deletion instruction is obtained; for the pre-maintained hybrid index structure, the physical deletion logic is executed to physically erase the index information corresponding to the target deletion document from the hybrid index structure; this solves the problems of low query efficiency and inability to meet strong backward security in the prior art, achieving the beneficial effect of significantly improving query efficiency while ensuring strong backward security and realizing the complete physical erasure of the index information of deleted documents to prevent data leakage risks.

[0070] Furthermore, based on the above embodiments, a strongly backward-secure query device based on a trusted execution environment may further include: The security log acquisition module is used to acquire the internally maintained security query log in the trusted execution environment. The security query log records the anonymized historical query sequence and the timestamp corresponding to each historical query in the historical query sequence. The time window truncation module is used to obtain, in real time, truncated query subsequences that match the currently maintained dynamic time window in the security query log; The incremental learning trigger module is used to perform incremental learning on the query prediction model when the update condition is detected at the current time point, using the truncated query subsequence in the dynamic time window that matches the current time point. The data destruction module is used to immediately destroy the truncated query subsequence in the trusted execution environment memory after incremental learning is completed.

[0071] Based on the above embodiments, the incremental learning triggering module is specifically used for: Calculate the data distribution characteristics of the query sequence within the current dynamic time window and compare them with the data distribution characteristics of the query sequence within the previous dynamic time window to obtain the degree of change in the data distribution. When the degree of change in the data distribution exceeds a preset threshold, it is determined that the update condition is met; When the change in the data distribution does not exceed a preset threshold and there are no pending client query requests, the update condition is deemed met.

[0072] Based on the above embodiments, the index partition storage module 340 is specifically used for: Obtain the query probability of each keyword output by the query prediction model; Keywords with a query probability higher than the preset index block threshold are identified as high-frequency keywords, and keywords with a query probability lower than or equal to the preset index block threshold are identified as low-frequency keywords. The index blocks corresponding to the high-frequency keywords are migrated to the high-speed cache area, and the index blocks corresponding to the low-frequency keywords are migrated to the ordinary encrypted storage area.

[0073] Furthermore, based on the above embodiments, a strongly backward-secure query device based on a trusted execution environment may further include: The threshold acquisition and mean calculation module is used to obtain the index block threshold before the update and calculate the average prediction probability of all keywords at present. The weighted average update module is used to perform a weighted average of the index block threshold before the update and the average prediction probability to obtain a new index block threshold. The threshold replacement application module is used to replace the current index block threshold with the new index block threshold for the next round of high-frequency and low-frequency keyword segmentation.

[0074] Based on the above embodiments, the physical erasure execution module 360 ​​is specifically used for: Construct an inverted index, whose key is generated from keyword-related information and whose value is a document identifier, used to locate documents containing the target keyword during search operations; A forward index is constructed, with the document identifier as the key and the inverted index key set corresponding to the document as the value. This is used to obtain all index association information of the document to be deleted during the deletion operation. During the deletion process, the forward index is searched based on the identifier of the target document to be deleted, all inverted index keys corresponding to the document are obtained, the corresponding entries in the inverted index are directly located and physical erasure is performed without traversing the search. After physical erasure, the counter or flag bit of the corresponding entry in the inverted index is updated so that subsequent search operations skip physically erased entries when accessing the inverted index via a search token.

[0075] Furthermore, based on the above embodiments, a strongly backward-secure query device based on a trusted execution environment may further include: The request verification and token generation module is used to receive query requests sent by the client, verify permissions, record the query requests in the security query log, and generate search tokens. The index positioning, sorting, and encryption return module is used to access the inverted index to locate the set of document identifiers containing the target keywords through the search token, sort the set of document identifiers using the query probability of each keyword output by the query prediction model, and encrypt the sorted set of document identifiers before returning it to the client.

[0076] The strong backward security query device based on a trusted execution environment provided in the embodiments of the present invention can execute the strong backward security query method based on a trusted execution environment provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0077] The collection, storage, use, processing, transmission, provision, and disclosure of client personal information in this technical solution comply with relevant laws and regulations and do not violate public order and good morals.

[0078] Example 4 Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0079] like Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0080] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0081] Processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as performing a strongly backward-secure query method based on a trusted execution environment as described in any embodiment of the present invention, i.e.: Receive a strong backward security condition corresponding to the deletion command injected by the user in the trusted execution environment. The strong backward security condition restricts the information of the deleted document from being retrieved through a query request. To address strong backward security conditions, a physical deletion logic matching the deletion command is constructed. This physical deletion logic completely decouples the physical location accessed by the query request from the physical location of the deleted document. Collect client query sequences within the current time window and input them into a query prediction model trained using an incremental learning strategy to obtain the query probability of each keyword output by the query prediction model. Based on the query probability of each keyword and the preset index block threshold, all keywords are divided into high-frequency keywords or low-frequency keywords, and the high-frequency keywords and low-frequency keywords are stored in partitions. In response to a client's delete command, retrieve the target document to be deleted that matches the client's delete command; For the pre-maintained hybrid index structure, the physical deletion logic is executed to physically erase the index information corresponding to the target deleted document from the hybrid index structure.

[0082] In some embodiments, a strongly backward-secure query method based on a trusted execution environment, as described in any one of the embodiments of the present invention, can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the strongly backward-secure query method based on a trusted execution environment, as described above, can be performed. Alternatively, in other embodiments, processor 11 can be configured by any other suitable means (e.g., by means of firmware) to perform the strongly backward-secure query method based on a trusted execution environment, as described in any one of the embodiments of the present invention.

[0083] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0084] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0085] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0086] To provide interaction with a client, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the client; and a keyboard and pointing device (e.g., a mouse or trackball) through which the client provides input to the electronic device. Other types of devices can also be used to provide interaction with the client; for example, feedback provided to the client can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the client can be received in any form (including sound input, voice input, or tactile input).

[0087] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., client computers with graphical client interfaces or web browsers through which clients can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0088] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0089] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0090] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A strongly backward-secure query method based on a trusted execution environment, characterized in that, Executed by a trusted execution environment, the method includes: Receive a strong backward security condition corresponding to the deletion command injected by the user in the trusted execution environment. The strong backward security condition restricts the information of the deleted document from being retrieved through a query request. To address strong backward security conditions, a physical deletion logic matching the deletion command is constructed. This physical deletion logic completely decouples the physical location accessed by the query request from the physical location of the deleted document. Collect client query sequences within the current time window and input them into a query prediction model trained using an incremental learning strategy to obtain the query probability of each keyword output by the query prediction model. Based on the query probability of each keyword and the preset index block threshold, all keywords are divided into high-frequency keywords or low-frequency keywords, and the high-frequency keywords and low-frequency keywords are stored in partitions. In response to a client's delete command, retrieve the target document to be deleted that matches the client's delete command; For the pre-maintained hybrid index structure, the physical deletion logic is executed to physically erase the index information corresponding to the target deleted document from the hybrid index structure.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the internally maintained security query log in the trusted execution environment. The security query log records anonymized historical query sequences and timestamps corresponding to each historical query in the historical query sequence. The security query log is used to obtain truncated query subsequences that match the currently maintained dynamic time window in real time. When the update condition is met at the current time point, the query prediction model is incrementally learned using the truncated query subsequence in the dynamic time window that matches the current time point. After incremental learning is completed, the truncated query subsequence is immediately destroyed in the trusted execution environment memory.

3. The method according to claim 2, characterized in that, The current time point was found to meet the update conditions, including: Calculate the data distribution characteristics of the query sequence within the current dynamic time window and compare them with the data distribution characteristics of the query sequence within the previous dynamic time window to obtain the degree of change in the data distribution. When the degree of change in the data distribution exceeds a preset threshold, it is determined that the update condition is met; When the change in the data distribution does not exceed a preset threshold and there are no pending client query requests, the update condition is deemed met.

4. The method according to claim 1, characterized in that, Based on the query probability of each keyword and the preset index segmentation threshold, all keywords are divided into high-frequency keywords or low-frequency keywords, and high-frequency keywords and low-frequency keywords are stored in separate partitions, including: Obtain the query probability of each keyword output by the query prediction model; Keywords with a query probability higher than the preset index block threshold are identified as high-frequency keywords, and keywords with a query probability lower than or equal to the preset index block threshold are identified as low-frequency keywords. The index blocks corresponding to the high-frequency keywords are migrated to the high-speed cache area, and the index blocks corresponding to the low-frequency keywords are migrated to the ordinary encrypted storage area.

5. The method according to claim 4, characterized in that, The method further includes: Obtain the index block threshold before the update, and calculate the average prediction probability of all keywords at present; The new index block threshold is obtained by taking a weighted average of the index block threshold before the update and the average prediction probability. The new index segmentation threshold is used to replace the current index segmentation threshold for the next round of high-frequency and low-frequency keyword segmentation.

6. The method according to any one of claims 1-5, characterized in that, For the pre-maintained hybrid index structure, the physical deletion logic is executed to physically erase the index information corresponding to the target deleted document from the hybrid index structure, including: Construct an inverted index, whose key is generated from keyword-related information and whose value is a document identifier, used to locate documents containing the target keyword during search operations; A forward index is constructed, with the document identifier as the key and the inverted index key set corresponding to the document as the value. This is used to obtain all index association information of the document to be deleted during the deletion operation. During the deletion process, the forward index is searched based on the identifier of the target document to be deleted, all inverted index keys corresponding to the document are obtained, the corresponding entries in the inverted index are directly located and physical erasure is performed without traversing the search. After physical erasure, the counter or flag bit of the corresponding entry in the inverted index is updated so that subsequent search operations skip physically erased entries when accessing the inverted index via a search token.

7. The method according to claim 6, characterized in that, The method further includes: Receive query requests sent by clients and verify permissions, record query requests in the security query log, and generate search tokens; The search token is used to access the inverted index to locate the set of document identifiers containing the target keyword. The query probability of each keyword output by the query prediction model is used to sort the set of document identifiers. The sorted set of document identifiers is then encrypted and returned to the client.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the strongly backward-secure query method based on a trusted execution environment as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the strongly backward-secure query method based on a trusted execution environment as described in any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the strongly backward-secure query method based on a trusted execution environment according to any one of claims 1-7.

Images