An adaptive multi-stage inadvertent query method and system for skewed medical internet of things data

Abstract

An adaptive multi-level unintentional query method and system for skewed medical IoT data belongs to the field of information security. First, for the medical IoT dataset, a two-level hash function is used to adaptively trigger local splitting of overload hotspot buckets. A multi-level Bloom filter index is dynamically constructed offline to rigidly limit the number of candidate ciphertext subsets in a single retrieval to within a preset load balancing threshold. During the online query phase, the user end introduces a session blinding factor to obfuscate long-term credentials to ensure unlinkability and constructs a blinded query commitment. This invention employs a non-colluding dual-server architecture. After the query proxy server performs legitimate authentication on the user, it completely strips away the user's identity features and injects a dynamic routing token to forward the request to the storage server. The storage server locates the target bucket and performs matrix-style unintentional encryption. This method is immune to traffic size analysis attacks and possesses extremely high real-time response performance and forward security.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to an adaptive multi-level unintentional query method and system for skewed medical IoT data. Background Technology

[0002] With the widespread application of Internet of Things (IoT) technology in modern medical monitoring, IoT terminals such as wearable biosensors, implantable medical devices, and networked diagnostic instruments generate massive amounts of sensitive patient physiological data (such as heart rate, blood glucose, electroencephalograms, and various clinical diagnostic records) every day. Due to the inherent physical limitations in storage capacity and computing power of medical IoT edge terminals, outsourcing and hosting these massive medical records to cloud servers with powerful computing capabilities for storage and on-demand retrieval has become an inevitable trend in the development of the smart healthcare industry.

[0003] However, medical IoT data is inherently highly sensitive to privacy. How to achieve efficient and privacy-preserving medical IoT data retrieval in an untrusted public cloud environment is a core problem that urgently needs to be solved in the fields of health informatics and distributed secure data mining.

[0004] Currently, cloud-based encrypted retrieval mainly employs the following three technical solutions:

[0005] 1. Searchable Symmetric Encryption (SSE): This technology allows users to perform keyword searches on encrypted data in the cloud without decrypting the data. However, this method inevitably reveals search and access patterns. Attackers can easily deduce the diagnostic privacy content of the user's current query by observing the encrypted sets returned by multiple rounds of queries and combining them with publicly available industry statistical knowledge. In addition, existing single-server SSE solutions typically bind the user's network identity (such as IP address or user ID) directly to the query request, lacking a decoupling mechanism between identity and query content.

[0006] 2. Oblivious Random Access Memory (ORAM) and Private Information Retrieval (PIR): These technologies can completely hide user access patterns. However, their communication and computational overhead is enormous. Classic ORAM solutions typically introduce polynomial or multilogarithmic level communication overhead per query, while PIR solutions may even require the user to download almost the entire database or require the cloud to traverse the entire table. For medical IoT gateways with severely limited bandwidth and high-frequency data acquisition, this cannot meet the needs of real-time response in clinical settings.

[0007] 3. Traditional Bucketing / Partitioning Retrieval Schemes: These schemes attempt to reduce the retrieval scope by uniformly hashing and bucketing keywords. However, these schemes are designed with the assumption that data is uniformly distributed within the distributed system. In real-world medical IoT environments, the retrieval frequency of medical diagnostic keywords exhibits a strong long-tail characteristic, closely matching the power-law distribution characteristics of Zipf's law. For example, high-frequency common disease diagnostic terms such as "hypertension" and "diabetes" account for the vast majority of the system's total traffic, while diagnostic terms for rare diseases have extremely low traffic. This extreme data distribution skewness can lead to severe load imbalance in traditional uniform bucketing schemes.

[0008] When faced with high-frequency diagnostic term searches, certain buckets can become extremely overloaded, leading to severe long-tail communication delays (Spikes) in a single query. Even more critically, because the encrypted data packets returned by the overloaded buckets are significantly larger than those of other buckets, external attackers can easily pinpoint and identify the patient's current search for trending diagnostic terms simply by analyzing network packet size changes through traffic analysis, rendering traditional cryptographic protection methods completely ineffective.

[0009] It can be said that all of the above solutions have significant flaws. Summary of the Invention

[0010] The purpose of this invention is to overcome the shortcomings of existing technologies and provide an adaptive multi-level accidental query method for skewed medical IoT data, along with a system for implementing this method. This invention addresses the technical problems of traditional encrypted retrieval schemes when facing the inherent Zipf skew distribution of medical IoT data, including long-tail communication delays (Spikes) due to uneven load distribution, susceptibility to traffic size analysis attacks, incomplete decoupling of identity and query content, and inability to meet the real-time response requirements of high-frequency IoT.

[0011] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0012] This invention provides an adaptive multi-level unintentional query method for skewed medical IoT data. The method is deployed on a server containing a fully trusted offline trusted authority (TA), a data owner (DO), and a non-colluding query proxy server. and storage servers In a distributed architecture, the method includes the following specific steps:

[0013] Step S1: Adaptive two-level index construction steps:

[0014] During the offline initialization phase, the data owner (DO) constructs an adaptive multilevel Bloom filter index (AMBFI) for the collected medical dataset containing Zipf distribution skewness features; the diagnostic keywords corresponding to each medical record in the dataset are then hashed using a first-level hash function. Map to a preset number In the first layer corresponding bucket, and build a corresponding first-level Bloom filter for each bucket;

[0015] Detect the keyword base number within each first-level bucket. If the keyword base number within any first-level bucket exceeds the preset load balancing threshold... Then, the adaptive splitting mechanism will be automatically triggered, utilizing the second-level hash function. The keywords in the first-level bucket will be redistributed to a preset number. In the second layer of sub-buckets, a second-level Bloom filter is constructed for each second layer sub-bucket, and the state of the first layer bucket is marked as split (SPLIT).

[0016] Step S2: Client Session Blinding and Query Encoding Steps

[0017] During the online query phase, the registered user client generates a session pseudonym and Schnorr authentication token unique to the current session;

[0018] Meanwhile, the user end constructs a blind query commitment through target query keywords. The user terminal calculates the routing index tuple corresponding to the current target query keyword based on the AMBFI, and encapsulates the Schnorr authentication token, the pseudonym ciphertext encapsulating the session pseudonym, the routing index tuple, the blinded query commitment, and the current timestamp into a first query request and sends it to the query proxy server. .

[0019] Step S3: Proxy Authentication Separation and Dynamic Routing Steps

[0020] Query proxy server Upon receiving the first query request, the client is authenticated using the session pseudonym and the Schnorr authentication token.

[0021] After certification, by All user identity information is stripped from the first query request. A locally randomly generated dynamic routing token is introduced and injected into the blinded query commitment to generate a second query request without user identity information, which is then sent to the storage server. ;

[0022] Step S4: Server-side unintentional encryption and decryption restoration steps

[0023] storage server Upon receiving the second query request, the target bucket or sub-bucket is located in the AMBFI based on the routing index tuple. All candidate encrypted records within the target bucket or sub-bucket are extracted, and matrix-style unintentional encryption is performed to generate an unintentional ciphertext set, which is then transmitted via... Transmitted back to the user terminal;

[0024] After receiving the unintentional ciphertext set, the client performs unintentional decryption on the ciphertext set to obtain the plaintext medical records that match the target query keywords.

[0025] As a further improvement of the present invention, in step S1, the amount of routing privacy information exposed by the AMBFI in a single routing query is limited to... Within bits, where B1 is the number of buckets in the first layer; B2 is the number of buckets in the second layer; This is a bucket splitting flag; it is used when the first layer of buckets in the target is in a splitted state. The value is assigned as 1 if the value is not specified, and 0 otherwise; the maximum number of candidate records corresponding to the unintentional ciphertext set returned to the user is determined by the load balancing threshold. Rigid control limits the communication bandwidth overhead and long-tail fluctuations of a single query to within a preset safety budget.

[0026] As a further improvement of the present invention, in step S2, the session blinding factor satisfy: .in, These are randomly selected session pseudonyms. To identify the user's real identity. A public key component for long-term user credentials. This is achieved through the session blinding factor. Perform scalar multiplication blinding on long-term vouchers, ensuring that any two query sessions initiated by the same user are hidden on the storage server. From all perspectives, computational indistinguishability is achieved, thus enabling session unlinkability.

[0027] As a further improvement of the present invention, in step S2, the blinded query commitment The construction formula is: .in, A temporary random scalar selected randomly for the user's session. For a group generator over a finite field, Search for keywords to target your search. , The master key is held by a trusted authority (TA); based on the decisional Diffie-Hellman (DDH) assumption, the proxy server is queried. Offline derivation cannot be achieved through exhaustive dictionary attacks. .

[0028] As a further improvement of the present invention, in step S2, the Schnorr authentication token, comprising R, s, and c, is generated in the following manner: the user selects a random number. And calculate Define the current query context ,in These are two-level routing indexes. Use timestamps; calculate challenge values ​​using the Fiat-Shamir transform. And calculate the response value ,in This is the blinded voucher component;

[0029] The query context The AMBFI routing index and blinded query commitment are bound in the middle. This is used to combat cross-context replay attacks.

[0030] As a further improvement of the present invention, in step S3, the query proxy server With storage server The non-collusion assumption is satisfied; By mastering the user's authentication context and private key, both physical and logical decoupling of identity information and query content can be achieved.

[0031] As a further improvement of the present invention, in step S3, the query proxy server When verifying a Schnorr authentication token, the following verification equation is executed: .in, The system public key of the trusted authority (TA) is used; the user terminal authentication is determined to be successful if and only if the verification equation is true.

[0032] As a further improvement of the present invention, in step S4, after a single query session ends, the user terminal and the query proxy server... and storage servers Immediately physically erase all temporary random scalars corresponding to the current session from memory, including user random scalars. Authentication random number Server-side random number generation and dynamic routing tokens This ensures that the encrypted messages of completed sessions remain computationally unrecoverable based on the Diffie-Hellman (CDH) assumption, thus satisfying forward security.

[0033] The technical effects achieved by this invention are:

[0034] With the implementation of the above-mentioned technical means, this invention has achieved the following extremely significant technical progress and beneficial effects compared with the prior art:

[0035] 1. Overcame the problem of uneven load distribution under extreme skew distribution, and completely smoothed out the long tail of communication.

[0036] This invention features a unique AMBFI two-level indexing mechanism that dynamically senses the inherent Zipf skewness of medical data. For high-frequency diagnostic keywords that cause overload in hotspot bucketing, the system automatically triggers a two-level adaptive split and redistribution. Regardless of the extreme skewness of the keyword distribution in the input medical IoT dataset, this invention can rigidly limit the number of candidate ciphertext subsets retrieved in a single search to within a preset load balancing threshold through elastic bucketing. This not only completely eliminates long-tail latency mutations at the network communication layer but also ensures a constant and controllable ciphertext volume returned in a single query, thus providing physical and statistical immunity against traffic size analysis attacks launched by external attackers targeting the ciphertext data packet volume.

[0037] 2. It greatly reduces network bandwidth load and enables low-latency real-time response in environments with massive IoT data.

[0038] Thanks to the AMBFI mechanism's refined secondary shuffling and remapping of overloaded candidate buckets, this invention avoids the drawbacks of traditional solutions that require downloading massive amounts of redundant ciphertext or traversing the entire table due to hot data aggregation. Under massive data volumes, the network communication payload overhead and long-tail fluctuations of a single query in this invention are strictly limited. Compared to traditional forward-secure symmetric searchable encryption schemes and dual-server ORAM schemes, this invention significantly reduces end-to-end query response latency while maintaining extremely low bandwidth consumption, completely overcoming the performance threshold of resource-constrained medical IoT gateways in wireless transmission and real-time health monitoring scenarios.

[0039] 3. It achieves strong decoupling of "identity-query" logic and builds a comprehensive privacy protection mechanism.

[0040] This invention is based on a non-collusive dual-server architecture, in querying the proxy server. With storage server Strict physical and logical isolation was established between them. It is only responsible for user authentication, but due to the cryptographic blind query commitment, it cannot know any substantive content about the query keywords and records; It is responsible for performing unintentional encryption and storing the ciphertext, but the routing requests it receives have been... It completely strips away all traces that could deduce or link to the user's real identity. The two are mutually independent, severing the connection between "identity" and "query content." Furthermore, by introducing a session blinding factor, the historical query trajectories initiated by the same user at different times appear as independent random flows from an external perspective, exhibiting extremely strong session unlinkability.

[0041] 4. It has lightweight engineering feasibility and robust forward security defense capabilities.

[0042] This invention abandons computationally expensive fully homomorphic encryption or complex zero-knowledge proofs and other heavyweight cryptographic primitives. It is entirely based on lightweight elliptic curve scalar multiplication and a compact Bloom filter matrix, which are highly compatible with industrial applications and resource-constrained edge devices. The computational and storage overhead of the IoT gateway is negligible. Furthermore, since all temporary random scalars remaining in system memory are immediately physically erased after a single query session, this invention satisfies forward security. Even in extreme cases where system-level credentials or long-term keys are stolen in the future, the historically completed and stored static communication traffic remains computationally unbreakable, possessing extremely high resistance to long-term tracing attacks. Attached Figure Description

[0043] Figure 1 This is a schematic diagram of the overall architecture and topology of the adaptive multi-level unintentional query system for skewed medical IoT data provided in this embodiment of the invention;

[0044] Figure 2 This is a schematic diagram of the dynamic construction and two-level splitting process of the Adaptive Multilevel Bloom Filter Index (AMBFI) provided in an embodiment of the present invention.

[0045] Figure 3 This is a schematic diagram of the timing interaction and processing flow of the unintentional query protocol under the dual-server distributed architecture provided in this embodiment of the invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of protection of this invention.

[0047] This invention provides an adaptive multi-level unintentional query method for skewed medical IoT data. The method is deployed on a server containing a fully trusted offline trusted authority (TA), a data owner (DO), and a non-colluding query proxy server. and storage servers In a distributed architecture, the method includes the following specific steps:

[0048] Step S1: Adaptive two-level index construction steps:

[0049] During the offline initialization phase, the data owner (DO) constructs an adaptive multilevel Bloom filter index (AMBFI) for the collected medical dataset containing Zipf distribution skewness features; the diagnostic keywords corresponding to each medical record in the dataset are then hashed using a first-level hash function. Map to a preset number In the first layer corresponding bucket, and build a corresponding first-level Bloom filter for each bucket;

[0050] Detect the keyword base number within each first-level bucket. If the keyword base number within any first-level bucket exceeds the preset load balancing threshold... Then, the adaptive splitting mechanism will be automatically triggered, utilizing the second-level hash function. The keywords in the overflow bucket will be redistributed to a preset number. In the second layer of sub-buckets, a corresponding second-level Bloom filter is constructed for each second layer sub-bucket, and the state of the first layer bucket is marked as split (SPLIT).

[0051] Step S2: Client Session Blinding and Query Encoding Steps

[0052] During the online query phase, registered users locally restore their long-term credentials and a randomly selected, session-unique session blinding factor is introduced. The long-term credentials are obfuscated to generate a session pseudonym and Schnorr authentication token independent of the current session.

[0053] Meanwhile, the user client combines the target query keywords with a temporarily generated random scalar for encryption and obfuscation, constructing a blind query commitment. The user terminal calculates the routing index tuple corresponding to the current target query keyword based on the AMBFI, and encapsulates the Schnorr authentication token, the pseudonym ciphertext encapsulating the session pseudonym, the routing index tuple, the blinded query commitment, and the current timestamp into a first query request and sends it to the query proxy server. .

[0054] Step S3: Proxy Authentication Separation and Dynamic Routing Steps

[0055] Query proxy server Upon receiving the first query request, the timestamp validity is verified, and after the verification is passed, the pseudonym is decrypted. The session pseudonym and Schnorr authentication token are used to authenticate the user's identity.

[0056] After certification, by All user identity information is stripped from the first query request. A locally randomly generated dynamic routing token is introduced and injected into the blinded query commitment to generate a second query request without user identity information, which is then sent to the storage server. .

[0057] Step S4: Server-side unintentional encryption and decryption restoration steps

[0058] storage server Upon receiving the second query request, the target bucket or sub-bucket is located in AMBFI based on the routing index tuple. All candidate encrypted records within the target bucket or sub-bucket are extracted, and a matrix-style inadvertent encryption process is executed. During encryption, the dynamic routing token and the random number from the storage server itself are incorporated into the encryption key of each candidate encrypted record, generating an inadvertent ciphertext set, which is then transmitted via... Transmitted back to the user terminal;

[0059] After receiving the unintentional ciphertext set, the client first performs a server integrity check. If the check passes, the client uses the corresponding local random scalar to perform unintentional decryption on the ciphertext set. The decryption key matches the encryption key successfully if and only if the keyword corresponding to the candidate encrypted record matches the target query keyword, thus obtaining the correct plaintext medical record.

[0060] The overall system architecture and topology of the method described above in this invention are as follows:

[0061] Please see Figure 1 The present invention provides an adaptive multi-level accidental query system for skewed medical IoT data, which adopts a distributed multi-entity collaborative architecture and mainly includes the following five spatially or physically independent entities:

[0062] 1) Trusted Authority (TA): As a fully trusted offline entity, it is responsible for the system's global initialization, security parameter generation, and the issuance of long-term user credentials. The TA controls the system's master key and generates auxiliary public points. After completing initialization, it does not participate in any online query or data retrieval phases.

[0063] 2) Data Owner (DO): Represents the medical institution or centralized medical data management terminal. The DO is responsible for collecting patient physiological and diagnostic records generated by IoT edge devices, building an adaptive multilevel Bloom filter index (AMBFI) during the offline setup phase, and outsourcing the upload of the keyword-indexed encrypted medical dataset to the storage server.

[0064] 3) Query the proxy server ( As one of the distributed servers deployed online, it is configured to handle user access authentication and the cleaning and redirection of query requests. It holds its own authentication key pair, but does not store any substantial medical plaintext or encrypted records, nor can it know the content of the user's query.

[0065] 4) Storage server ( ): As another distributed server deployed online, it is specifically used to maintain an encrypted medical record database and perform unintentional encryption matrices in ciphertext state. From this perspective, there are no real identities or pseudonyms used by any users, and... The non-collusion assumption is satisfied.

[0066] 5) Registered Users (QU): This includes authorized clinicians, mobile healthcare clients, or smart diagnostic terminals. Each QU holds a long-term credential issued by the TA, which is activated locally by entering a password and then initiating a highly secure privacy retrieval request to the cloud.

[0067] As an embodiment of the present invention, in step S1 of the above method, the external privacy leakage function generated by AMBFI during routing is strictly hard-capped, and the amount of routing privacy information exposed in a single query is limited to... Within bits, of which This is a bucket splitting flag, which is set if and only if the target's first-level bucket state is detected as already split. The value is assigned as 1 if the keyword distribution of the input medical dataset is skewed, and the upper limit of the number of candidate records corresponding to the unintentional ciphertext set returned to the user is set by the load balancing threshold. Rigid control limits the communication bandwidth overhead and long-tail fluctuations of a single query to within a preset safety budget.

[0068] Specifically, the construction and bucketing method of the adaptive multi-level Bloom filter index (AMBFI) of the present invention is as follows:

[0069] Please see Figure 2 To mitigate the severe data skew caused by Zipf's law in medical data, this invention implements the following adaptive two-level index construction method on the data owner (DO) side:

[0070] 1) S201. First-layer coarse-grained hash mapping: For the dataset to be outsourced, DO extracts the diagnostic keywords associated with each medical record. The first-layer hash function is used to calculate the keywords and perform a modulo operation, splitting the entire keyword space and mapping it to a preset number of... In the first layer of initial buckets.

[0071] 2) S202. First-level Bloom filter construction: Traverse this... Each initial bucket contains a set of keywords, and each bucket contains a set of keywords. A first-level Bloom filter is then independently constructed for approximate membership verification.

[0072] 3) S203. Dynamic determination of local load: The system introduces a preset load balancing threshold. This threshold defines the maximum number of candidate ciphertexts allowed to be returned to the client in a single unintentional query. The DO (Distribution Object) continuously monitors the first-level bucket being processed and determines whether the absolute cardinality (number of unique keywords) within that bucket exceeds the threshold. If the limit is not exceeded, the single-layer structure is maintained, and the next bucket is checked; if the limit is exceeded, it is determined that the bucket maps to a medical hot topic diagnosis term (such as hypertension, diabetes, etc.), and step S204 is triggered.

[0073] 4) S204. Second-level adaptive local splitting: For the first-level bucket where the keyword quantity overflows, the system marks its status as split. Subsequently, the DO uses independent second-level hash functions to perform secondary hash calculations and modulo operations on all keywords within the overflow bucket, refining and rearranging them to a preset quantity. In the second layer of sub-buckets.

[0074] 5) S205. Construction of secondary Bloom filters: For each of the split secondary sub-buckets, DO constructs an independent secondary Bloom filter for it.

[0075] Through the above two-level dynamic adjustment, the dense data clusters caused by high-frequency words are adaptively dispersed and diluted. When a user initiates a query for a specific keyword, the system calculates its corresponding two-level routing index and split flag, accurately identifying the target retrieval bucket (either an unsplit primary bucket or a split secondary sub-bucket). The number of records contained within each bucket is rigidly controlled within a threshold. Within this range, dynamic load balancing of the entire system is achieved.

[0076] As an embodiment of the present invention, in step S2 of the above method of the present invention, the session blinding factor satisfy: .in, These are randomly selected session pseudonyms. To identify the user's real identity. A public key component for long-term user credentials. This is achieved through the session blinding factor. Perform scalar multiplication blinding on long-term vouchers, ensuring that any two query sessions initiated by the same user are hidden on the storage server. From all perspectives, computational indistinguishability is achieved, thus enabling session unlinkability.

[0077] As an embodiment of the present invention, in step S2 of the above method of the present invention, the blinded query commitment... The construction formula is: .in, A temporary random scalar selected randomly for the user's session. For a group generator over a finite field, Search for keywords to target your search. The master key is held by a trusted authority (TA). Generate global auxiliary common points; query the proxy server based on the decisional Diffie-Hellman (DDH) assumption. Offline derivation cannot be achieved through exhaustive dictionary attacks. .

[0078] As an embodiment of the present invention, in step S2 of the above method of the present invention, the Schnorr authentication token includes R, s, and c, and is generated in the following manner: the user selects a random number. And calculate Define the current query context ,in These are the calculated two-level routing indices. Use timestamps; calculate challenge values ​​using the Fiat-Shamir transform. And calculate the response value ,in This is the blinded voucher component;

[0079] The query context The AMBFI routing index and blinded query commitment are forcibly bound in the middle. This is used to counter cross-context replay attacks.

[0080] As an embodiment of the present invention, in step S3 of the present invention, the query proxy server With storage server The non-collusion assumption is satisfied; We possess the user's authentication context and private key, but due to blind query commitments... The existence of these records prevents us from knowing anything about the search keywords and records. It possesses a complete encrypted database and performs unintentional encryption, but the second query request it receives does not contain any identifiers that can deduce the user's true identity, thereby achieving both physical and logical decoupling of identity information and query content.

[0081] As an embodiment of the present invention, in step S3 of the present invention, the query proxy server When verifying a Schnorr authentication token, the following verification equation is executed: .in, The system public key of the trusted authority (TA) is used; the user's identity is determined to be legitimate if and only if the verification equation is true.

[0082] As an embodiment of the present invention, in step S4, after a single query session ends, the user terminal and the query proxy server... and storage servers Immediately physically erase all temporary random scalars corresponding to the current session from memory, including user random scalars. Authentication random number Server-side random number generation and dynamic routing tokens This ensures that the encrypted messages of completed sessions remain computationally unrecoverable based on the Diffie-Hellman (CDH) assumption, thus satisfying forward security.

[0083] Specifically, the four-stage timing interaction process of the unintentional query protocol of the present invention is as follows:

[0084] Please see Figure 3 The online unintentional query and identity decoupling protocol provided in this embodiment of the invention spans the user end and the query proxy server. and storage servers Interactive execution specifically includes the following four processing stages:

[0085] Phase 1: User Request Generation Phase

[0086] 1) Credential Restoration and Session-Based Blinding: Users activate and restore their long-term credentials locally by entering their password. To prevent sessions initiated at different times from being linked, the client randomly selects a unique pseudonym for the current session in memory and calculates a session blinding factor. By using scalar multiplication It is applied to long-term credentials to generate temporary session credentials that are in a completely blind state.

[0087] 2) Keyword Hidden Encoding: To hide the target search keywords, the client selects a temporary random scalar value for the session locally. Furthermore, by combining finite field group generators and global auxiliary common points, a blinded query commitment is constructed. This commitment exhibits random distribution characteristics during public network transmission, enabling it to resist offline dictionary brute-force attacks by third parties.

[0088] 3) Asymmetric, non-interactive authentication token generation: The client constructs a commitment using temporary random numbers and builds a Schnorr authentication token containing a challenge value and a response value based on the Fiat-Shamir transformation. When calculating the challenge value, the previously calculated AMBFI two-level routing index and the blinded query commitment are used. Forced binding within the current query context. The client encapsulates the aforementioned token, pseudonym ciphertext, routing index, blinded query promise, and timestamp into a first query request and sends it to... .

[0089] Phase Two: Proxy Verification and Identity Decoupling Routing Phase

[0090] 1) Timeliness and identity verification: Upon receiving the first query request, the timestamp is first verified to combat network replay attacks. Then, The ciphertext of the pseudonym is decrypted using the user's local private key to restore the session pseudonym, and an equality check is performed on the Schnorr authentication token. If the check passes, the user is confirmed as a legitimate registered user of the system.

[0091] 2) Identity stripping and dynamic routing token injection: After verifying the identity, Physically strip and erase in memory any fields containing user characteristics (including blinded credential components, session pseudonyms, etc.) from the first query request. Subsequently, A dynamic routing token is generated locally. and will Injected into the user-submitted blinded query commitment in scalar form using group multiplication. In the process, a completely new second query request is generated and forwarded to the storage server. .

[0092] Phase Three: Server-Side Matrix Unintentional Encryption Phase

[0093] 1) Rigid interception of target candidate set: Upon receiving a second query request without identity information, the target bucket is located directly in the offline-built AMBFI index based on the two-level routing index and flag bits. If the flag bit indicates no splitting, the corresponding first-level bucket record is extracted directly; if the flag bit indicates splitting, the corresponding second-level sub-bucket record is extracted. In either case, the number of extracted candidate encrypted record sets does not exceed a threshold. .

[0094] 2) Unintentional encryption in streaming: Local random selection of server random numbers And for each candidate encryption record within the target bucket, parallelized algebraic transformation encryption is performed one by one. When constructing the encryption key for each record, Injected dynamic routing token, server random number And blind query commitment A fusion operation is performed to generate an unintentional ciphertext set deeply bound to the current session, along with a server integrity tag, which is then transmitted via... Transmitted back to the user's end.

[0095] Phase Four: Client Integrity Verification and Deterministic Decryption Phase

[0096] 1) Server-side integrity verification: After receiving the returned ciphertext set, the client first reconstructs the verification tag using the locally stored scalar and the temporary group element returned by the server, and performs an equality alignment check. If the tags do not match, it is determined that the data has been tampered with during transmission or storage, and the protocol is terminated directly.

[0097] 2) Deterministic unintentional decryption and restoration: If the verification passes, the user terminal uses the local random scalar stored in phase one. Perform reverse algebraic resolution on all items in the ciphertext set:

[0098] Case A (Keyword Matching): For the record in the ciphertext whose original keyword exactly matches the user's target query keyword, due to the alignment of the algebraic structure, the user's decryption key and... The encryption keys are perfectly matched, allowing users to successfully and definitively decrypt and restore the correct plaintext medical records.

[0099] Case B (Keyword Mismatch): For other inconsistent records within the same bucket, the decryption process degenerates into solving the computational Diffie-Hellman (CDH) problem due to unknown auxiliary common points and algebraic terms remaining in the key. Users cannot decrypt in polynomial time and only obtain a meaningless random bitstream.

[0100] After the data decryption is complete, the user client and the query proxy server... and storage servers Immediately move the resident session-level temporary random scalars (including scalars) in memory. Authentication random number Server-side random number generation and dynamic routing tokens The protocol performs physical overwriting and erasure. This ensures that no session-level intermediate state is left after the retrieval is completed. Even in the event of extreme incidents such as the theft of server private keys or long-term credentials during long-term operation, attackers will still be unable to crack the system due to the untraceability of historical temporary scalars and the presence of historical static traffic. This provides the entire medical IoT retrieval system with highly robust forward security protection capabilities.

Claims

1. An adaptive multi-level accidental query method for skewed medical IoT data, characterized in that, The method is deployed on a server containing a fully trusted offline trusted authority (TA), a data owner (DO), and a non-colluding query proxy server. and storage servers In a distributed architecture, the method includes the following specific steps: Step S1: Adaptive Two-Level Index Construction Steps During the offline initialization phase, the data owner DO constructs an adaptive multi-level Bloom filter index AMBFI for the collected medical dataset; the diagnostic keywords corresponding to each medical record in the dataset are mapped to the corresponding buckets in the first layer through the first layer hash function, and a corresponding first-level Bloom filter is constructed for each bucket. The keyword base number in each first-level bucket is detected. If the keyword base number in any first-level bucket exceeds the preset load balancing threshold, the adaptive splitting mechanism is automatically triggered. The keywords in the first-level bucket are redistributed to the second-level sub-buckets using the second-level hash function. A two-level Bloom filter is built for each second-level sub-bucket, and the first-level bucket is marked as split. Step S2: Client Session Blinding and Query Encoding Steps During the online query phase, the registered user client generates a session pseudonym and authentication token unique to the current session; at the same time, the user client constructs a blind query commitment based on the target query keywords; The client calculates the routing index tuple corresponding to the current target query keyword based on the AMBFI, and encapsulates the authentication token, pseudonym ciphertext containing session pseudonyms, routing index tuple, blinded query commitment, and current timestamp into a first query request and sends it to the query proxy server. ; Step S3: Proxy Authentication Separation and Dynamic Routing Steps Query proxy server Upon receiving the first query request, the client is authenticated using the session pseudonym and authentication token; after successful authentication, the client... All user identity information is stripped from the first query request. A locally randomly generated dynamic routing token is introduced and injected into the blinded query commitment to generate a second query request without user identity information, which is then sent to the storage server. ; Step S4: Server-side unintentional encryption and decryption restoration steps storage server Upon receiving the second query request, the target bucket or sub-bucket is located in the AMBFI based on the routing index tuple. All candidate encrypted records within the target bucket or sub-bucket are extracted, and matrix-style unintentional encryption is performed to generate an unintentional ciphertext set, which is then transmitted via... Transmitted back to the user terminal; After receiving the unintentional ciphertext set, the client performs unintentional decryption on the ciphertext set to obtain the plaintext medical records that match the target query keywords.

2. The adaptive multi-level accidental query method for skewed medical IoT data according to claim 1, characterized in that, In step S1, the amount of routing privacy information exposed by the AMBFI in a single query during routing is limited to... Within bits, where B1 is the number of buckets in the first layer; B2 is the number of buckets in the second layer; This is a bucket splitting flag; it is used when the first layer of buckets in the target is in a splitted state. The value is assigned as 1, otherwise it is assigned as 0; the upper limit of the number of candidate records corresponding to the unintentional ciphertext set returned to the user is rigidly controlled by the load balancing threshold, so that the communication bandwidth overhead and long-tail fluctuation of a single query are limited within the preset security budget.

3. The adaptive multi-level accidental query method for skewed medical IoT data according to claim 2, characterized in that, In step S2, the session blinding factor satisfy: in, For cryptographically secure hash functions, These are randomly selected session pseudonyms. To identify the user's real identity. A public key component for long-term user credentials. The order is a finite field; through the session blinding factor Perform scalar multiplication blinding on long-term vouchers, ensuring that any two query sessions initiated by the same user are hidden on the storage server. From any perspective, computational indistinguishability is observed.

4. The adaptive multi-level accidental query method for skewed medical IoT data according to claim 3, characterized in that, In step S2, the blinded query commitment The construction formula is: in, A temporary random scalar selected randomly for the user's session. For a group generator over a finite field, Search for keywords to target your search. , The master key held by a trusted authority (TA).

5. The adaptive multi-level accidental query method for skewed medical IoT data according to claim 4, characterized in that, In step S2, the Schnorr authentication token, comprising R, s, and c, is generated in the following manner: User selects random number And calculate Define the current query context ,in These are two-level routing indexes. For timestamps; calculate challenge value And calculate the response value ,in These are the blinded voucher components; The query context The AMBFI routing index and blinded query commitment are bound in the middle. This is used to combat cross-context replay attacks.

6. The adaptive multi-level accidental query method for skewed medical IoT data according to claim 5, characterized in that, In step S3, the query proxy server With storage server The non-collusion assumption is satisfied; By mastering the user's authentication context and private key, both physical and logical decoupling of identity information and query content can be achieved.

7. The adaptive multi-level accidental query method for skewed medical IoT data according to claim 6, characterized in that, In step S3, the query proxy server When verifying a Schnorr authentication token, the following verification equation is executed: ,in, The system public key is the trusted authority (TA); the user authentication is successful if and only if the verification equation is true.

8. The adaptive multi-level accidental query method for skewed medical IoT data according to claim 7, characterized in that, In step S4, after a single query session ends, the user client and the query proxy server... and storage servers Immediately physically erase all temporary random scalars corresponding to the current session from memory, including user random scalars. Authentication random number Server-side random number generation and dynamic routing tokens It ensures that the encrypted messages of completed sessions remain computationally unrecoverable based on the Diffie-Hellman assumption, thus satisfying forward security.

Images