A verifiable attribute encryption retrieval method and system for a zero trust document library

Abstract

The application discloses a verifiable attribute encryption retrieval method and system for a zero-trust document library, a server constructs a commitment structure to generate a commitment value for an encrypted index item; a client rewrites a natural language query input by a user into a structured retrieval expression and generates a query token; the server determines a candidate encrypted index item and corresponding proof information according to the query token; the client verifies the consistency of the candidate encrypted index item based on the commitment value and the proof information; when the verification is passed, the client decrypts the candidate index item by using an attribute private key to obtain authorized document identification information satisfying an access control policy, and then obtains corresponding policy binding key ciphertext and document ciphertext from the server, and decrypts to obtain an authorized plaintext candidate document set and performs semantic reordering to generate a retrieval result. The method can realize verifiable return of a document retrieval result, controlled decryption of access permission and enhanced semantic retrieval capability.

Description

Technical Field

[0001] This invention relates to the fields of data security and intelligent information retrieval technology, and more specifically to a verifiable attribute-encrypted retrieval method and system for zero-trust document libraries. Background Technology

[0002] As document resources in universities, research institutions, and enterprises gradually migrate from traditional intranet environments to private cloud platforms, unified data centers, or outsourced infrastructure, the security boundaries faced by document management systems have changed significantly. The traditional assumption of trusted intranet deployments is no longer adequate for the practical needs of multi-role collaboration, multi-tenant sharing, and outsourced infrastructure. Particularly in research document repositories, systems typically store sensitive materials such as unpublished papers, experimental data, technical reports, and collaboration agreements. Unauthorized access, result tampering, or data breaches will directly impact user privacy, intellectual property rights, and compliance requirements.

[0003] To address the challenges of secure storage and retrieval of sensitive documents, existing technologies have proposed various solutions, including searchable encryption (SE), attribute-based encryption (ABE), and combinations of both. Searchable encryption enables keyword queries on encrypted data, while attribute-based encryption allows for fine-grained access control based on user attributes. Some solutions can also be extended to scenarios such as multi-keyword retrieval and Boolean retrieval.

[0004] While the above technologies have some effect on improving the usability of encrypted data, they still have the following drawbacks: On the one hand, most existing solutions focus on access control or basic query functions, and still lack sufficient support for issues such as verifying the authenticity of search results, detecting tampering, and identifying missing results in untrusted server environments. In particular, traditional solutions often lack effective result verification mechanisms when servers may return incorrect, forged, or selectively omitted results out of curiosity or malice.

[0005] On the other hand, with the development of large language models and semantic representation learning technologies, users increasingly prefer to express their search needs in natural language and expect systems to possess capabilities such as semantic understanding, query rewriting, relevance reordering, and content summary generation. Compared to traditional encrypted search methods based on keyword matching, semantically enhanced search can improve the user experience in complex, fuzzy, and exploratory query scenarios. However, directly introducing large language models or semantic reordering modules into encrypted document libraries can easily lead to unauthorized content leakage, injection of unauthorized access warnings, and data out-of-domain issues caused by external inference services, making it difficult to simultaneously achieve fine-grained access control and semantic enhancement capabilities. Summary of the Invention

[0006] To address the problems existing in the above-mentioned fields, this invention proposes a verifiable attribute encrypted retrieval method and system for zero-trust document libraries. In an untrusted server environment, it ensures that the retrieval results cannot be tampered with and that sensitive documents are not accessed without authorization. At the same time, without expanding the boundaries of data leakage, it endows the system with the ability of natural language semantic understanding and rearrangement.

[0007] To address the aforementioned technical problems, this invention discloses a verifiable attribute encryption retrieval method for zero-trust document libraries, comprising the following steps: The server obtains the encrypted document text, policy binding key text, and encrypted index entries formed by encrypting the document identification information using attributes of the document to be protected. The server performs deterministic sorting of the encrypted index items and constructs a commitment structure based on the sorted encrypted index items to generate a commitment value that represents the current index state. The client rewrites the natural language query input by the user into a structured search expression in a secure environment, generates a query token based on the structured search expression, and sends the query token to the server; wherein, the structured search expression includes a subset of keywords, filtering conditions, and preference parameters, and the intermediate and final outputs of the rewriting process do not contain plaintext query content; The server performs a search in the encrypted index based on the query token, determines candidate encrypted index items and their corresponding proof information, and returns the candidate encrypted index items and their corresponding proof information to the client. The client performs consistency verification on the candidate encrypted index items based on the commitment value and the proof information. When the verification is successful, the client decrypts the candidate encrypted index items that have passed the consistency verification using the user attribute private key to obtain the authorized document identification information that meets the access control policy. Based on the authorized document identification information, the client obtains the corresponding policy binding key ciphertext and document ciphertext from the server, and decrypts them to obtain the authorized plaintext candidate document set. The client performs semantic reordering of the candidate documents based on the natural language query input by the user and the semantic relevance between the documents in the candidate document set, and generates search results based on the semantically reordered candidate documents.

[0008] Preferably, the server performs deterministic sorting of the encrypted index items and constructs a commitment structure based on the sorted sequence of encrypted index elements to generate a commitment value representing the current index state, specifically including: The server performs deterministic sorting of the encrypted index items based on preset rules, resulting in a sorted sequence of encrypted index elements. The preset rules include first sorting by keyword tags in lexicographical order, and then sorting within the same keyword tags according to a preset arrival order or document identifier order. The server constructs a Merkle tree or cryptographic accumulator based on the sorted sequence of encrypted index elements, and generates a commitment value representing the current index state. When using a Merkle tree to construct the commitment structure, the root hash value of the Merkle tree is used as the commitment value representing the current index state.

[0009] Preferably, the client rewrites the user-input natural language query into a structured search expression in a secure environment, and generates a query token based on the structured search expression; wherein, the structured search expression includes a subset of keywords, filtering conditions, and preference parameters, and the intermediate and final outputs of the rewriting process do not contain plaintext query content, specifically including: The client performs the rewriting in a local or trusted execution environment by combining local context information; the local context information includes at least one of user identity information, research group information, historical search preference information or preset terminology list information, and the local context information is not transmitted to the server; The filtering conditions include time range, project group identifier, document type identifier, and sensitivity level constraints; the preference parameters include upper limit of the number of returned results, sorting priority, and candidate truncation threshold, which are used to constrain the subsequent search sorting and candidate filtering process. When the keyword subset contains multiple keywords, the client uses system public parameters and pseudo-random mapping mechanism to determine each keyword tag, and uses matching index to locate the identifier based on each keyword tag to generate a query token corresponding to each keyword tag; The rewriting process does not output plaintext query content throughout the entire process, and the keyword subset in its structured retrieval expression is represented in the form of pseudo-random labels.

[0010] Preferably, the client performs consistency verification on candidate encrypted index items based on commitment values ​​and proof information, further including: When the client fails to verify the consistency of the candidate encrypted index item based on the commitment value and proof information, it will refuse to accept the candidate encrypted index item returned by the server and terminate the subsequent decryption and semantic reordering process. When a Merkle tree is used to construct the commitment structure, the proof information is the Merkle path proof corresponding to the candidate encrypted index item. The Merkle path proof is used by the client to verify whether the candidate encrypted index item belongs to the current index state based on the commitment value. When a cryptographic accumulator is used to construct the commitment structure, the server maps the sorted encrypted index items to accumulator input elements and performs aggregation operations to obtain the commitment value; the proof information includes the accumulator witness value generated by the server and corresponding to the candidate encrypted index item, and the accumulator witness value is used by the client to verify whether the candidate encrypted index item belongs to the current index state.

[0011] Preferably, the step of decrypting the candidate encrypted index item that has passed the consistency verification using the user attribute private key to obtain the authorized document identification information that satisfies the access control policy specifically includes: The client uses the user's private key to perform attribute decryption on the candidate encrypted index item; If the decryption result is not empty, it indicates that the user attribute set satisfies the access control policy, and the corresponding document identification information and auxiliary information are restored. If decryption fails or the output is empty, it indicates that the access control policy is not met, and candidate encrypted index entries that do not meet the access control policy are removed.

[0012] Preferably, the client obtains the corresponding policy binding key ciphertext and document ciphertext from the server based on the authorized document identification information, and decrypts them to obtain a set of authorized plaintext candidate documents, specifically including: The client requests the corresponding encrypted document record from the server based on the authorized document identification information. The encrypted document record includes the policy binding key ciphertext and the document ciphertext. The client uses the user's private key to perform attribute decryption on the policy-bound key ciphertext, recovering the document's symmetric key. The client uses the document's symmetric key to perform symmetric decryption on the document's ciphertext, recovering the document's plaintext, thereby obtaining a set of authorized plaintext candidate documents.

[0013] Preferably, the client performs semantic reordering of the candidate document set based on the semantic relevance between the user-input natural language query and the documents in the candidate document set, specifically including: The client uses a pre-trained semantic coding model to perform vector encoding on the natural language query input by the user, thus obtaining the query vector; The client uses the pre-trained semantic coding model to perform vector encoding on the authorized plaintext candidate documents to obtain document vectors; The semantic relevance score is determined based on the query vector and document vector. The client uses a two-stage semantic reordering mechanism based on semantic relevance scores. First, it selects a preset number of highly relevant candidate documents from the set of authorized plaintext candidate documents based on dense vector similarity. Based on the joint modeling of semantic associations between queries and candidate documents using cross-encoders, highly relevant candidate documents are re-ranked in a fine-grained manner. It generates summary results, question-and-answer results, or search results based on the top-ranked authorized documents in the sorting results.

[0014] Preferably, before the server obtains the encrypted document text, policy binding key text, and encrypted index entry formed by encrypting the document identification information using attributes, the data owner performs the following preprocessing steps: Obtain the symmetric key of the document to be protected; The document to be protected is encrypted using a symmetric key to obtain the ciphertext of the document. Based on the access control policy corresponding to the document to be protected, the symmetric key is encrypted using attribute encryption to obtain the policy binding key ciphertext. For the keyword set of the document to be protected, an index item is constructed that includes at least document identification information and auxiliary information. Based on the corresponding access control policy, the document identification information and auxiliary information are encrypted using attribute encryption to obtain the encrypted index item. The auxiliary information includes timestamp, version number, document type identifier, project group identifier, and sensitivity level identifier. The keyword tags in the keyword set are obtained based on a pseudo-random mapping mechanism, and the keyword tags are used as index positioning identifiers for encrypted index items.

[0015] Preferably, when the client calls an external inference service to generate search results, the method further includes an external call boundary control step: Before the client sends the context to the external inference service, it selects several document fragments that are most relevant to the natural language query from the authorized plaintext candidate document set, performs length truncation, redundancy removal, field filtering, content splicing and sensitive identifier de-identification processing on the document fragments, and sends the truncated authorized context to the external inference service. After the client receives the result returned by the external inference service, it performs a consistency check on the result to determine whether the document or fact source referenced in the result belongs to the authorized plaintext candidate document set; if it does not belong, the result is rejected, truncated, or an alarm is triggered.

[0016] Preferably, it also includes a verifiable attribute encrypted retrieval system for zero-trust document libraries, a client device, and a server device; The server device includes: The preprocessing module is used to obtain the encrypted document text, policy binding key text, and encrypted index entries formed by encrypting the document identification information through attribute encryption of the document to be protected. The commitment generation module is used to deterministically sort the encrypted index items, construct a commitment structure based on the sorted encrypted index items, and generate a commitment value that represents the current index state. The retrieval and verification module is used to perform a retrieval in the encrypted index based on the query token, determine candidate encrypted index items and their corresponding verification information, and return the candidate encrypted index items and the verification information to the client device. The client device includes: The query processing module is used to rewrite the natural language query input by the user into a structured search expression in a secure environment, and generate a query token based on the structured search expression; wherein, the structured search expression includes a subset of keywords, filtering conditions and preference parameters, and the intermediate and final outputs of the rewriting process do not contain plaintext query content; The verification and decryption module is used to perform consistency verification on candidate encrypted index items based on commitment value and proof information; when the verification is successful, the user attribute private key is used to decrypt the candidate encrypted index item that has passed the consistency verification to obtain authorized document identification information that meets the access control policy; and based on the authorized document identification information, the corresponding policy binding key ciphertext and document ciphertext are obtained from the server device and decrypted to obtain a set of authorized plaintext candidate documents. The semantic enhancement module is used to semantically reorder the set of candidate documents based on the semantic relevance between the natural language query input by the user and the documents in the set of candidate documents for authorization plaintext, and to generate search results based on the semantically reordered candidate documents for authorization plaintext.

[0017] Compared with the prior art, the present invention has the following beneficial effects: This invention proposes a verifiable attribute-based encrypted retrieval method for zero-trust document libraries. By constructing a commitment structure on the encrypted index, it makes proof verification based on the commitment value a mandatory threshold for decryption. This mechanism establishes a baseline for the authenticity and integrity of the returned results at the cryptographic level before the client exposes any attribute private keys or plaintext data, fundamentally eliminating the possibility of the server acting maliciously without being detected and ensuring a trustworthy starting point for subsequent processing. Fine-grained access control policies are embedded in the attribute encryption mechanism, establishing a logic of authorization upon decryption. Users can only successfully decrypt index entries whose attributes satisfy the policy; for unauthorized data, decryption is mathematically infeasible and is naturally eliminated. This mechanism requires no additional explicit authentication interaction, eliminating the risk of unauthorized document identification leakage and defining an absolutely secure data boundary for subsequent plaintext processing. The input to semantic processing is strictly anchored to a set of plaintext candidates that have been verified and successfully decrypted. Semantic rearrangement and result generation are completely confined within the verified and authorized security boundary, completely cutting off the possibility of the semantic model accessing unauthorized data or unauthorized references. This enables encrypted document libraries to possess natural language understanding and intelligent interaction capabilities without compromising fine-grained access control and data confidentiality, thus solving the industry pain point of the difficulty in balancing security and intelligence. Attached Figure Description

[0018] Figure 1 This is a flowchart of the verifiable attribute encryption retrieval method for zero-trust document libraries proposed in this invention. Figure 2 A flowchart illustrating the query rewriting, query token generation, and server retrieval proof return process provided in this embodiment of the invention; Figure 3 The flowchart of client verification, authorization decryption, candidate document recovery and semantic processing provided in the embodiments of the present invention; Figure 4 This is a schematic diagram of external model call boundary control, audit logging, and anomaly detection provided in an embodiment of the present invention. Figure 5 The system architecture diagram provided in this embodiment of the invention includes system initialization, index construction, and commitment generation; Figure 6 The system architecture diagram provided in this embodiment of the invention includes a data owner, a data user, a server, and a client. Detailed Implementation

[0019] The following will refer to the appendices in the embodiments of the present invention. Figures 1-6 The technical solutions in the embodiments of the present invention will be clearly and completely described. It should be understood that the terminology used in the present invention is only for describing particular implementation methods and is not intended to limit the present invention.

[0020] Example like Figure 1 As shown, this invention proposes a verifiable attribute encryption retrieval method for zero-trust document libraries, comprising the following steps: S1: The server obtains the encrypted document text, policy binding key text, and encrypted index entries formed by encrypting the document identification information using attributes. Specifically, this includes: Before the server obtains the encrypted document text, policy binding key text, and encrypted index entries formed by encrypting the document identification information, the symmetric key of the document to be protected is obtained from the data owner; the server uses the symmetric key to encrypt the document to be protected to obtain the encrypted document text.

[0021] Based on the access control policy corresponding to the document to be protected, the server uses attribute encryption to encrypt the symmetric key, thus obtaining the policy-bound key ciphertext. For the set of keywords in the document to be protected, the server constructs an index item that includes at least document identification information and auxiliary information. Based on the corresponding access control policy, the server uses attribute encryption to encrypt the document identification information and auxiliary information to obtain encrypted index items. The auxiliary information includes timestamp, version number, document type identifier, project group identifier, and sensitivity level identifier. The server obtains the keyword tags from the keyword set based on a pseudo-random mapping mechanism, and uses the keyword tags as index positioning identifiers for encrypted index items.

[0022] In this embodiment, the set of documents to be protected in the document library is represented as: ; in, Indicates the first One document to be protected. Indicates the total number of documents; compared with the first... The document identifier corresponding to each document is represented as: ; and the The set of keywords associated with a document is represented as The complete set of user attributes in the system is denoted as... ,user The set of attributes possessed is denoted as .

[0023] For each document The server is pre-configured with the corresponding access control policy. The access control policy is a Boolean policy expression applied to a set of attributes. A user is allowed to access a document only if the user's attribute set satisfies the corresponding access control policy. ; The above relationship is used to define the boundary of access authorization in this invention, that is, only when the conditions are met... Only authorized users can further restore access to the document. The relevant document identification information, document key, and document content. This satisfaction process can be achieved through attribute tree evaluation, access structure determination, linear secret sharing matrix determination, or other equivalent methods.

[0024] In this embodiment, a combination of symmetric encryption and access policy-based attribute encryption is used to provide layered protection for document content and document keys.

[0025] Specifically, regarding the first One document First, randomly generate the corresponding symmetric key. Then, a symmetric encryption algorithm is used to encrypt the document content, resulting in the ciphertext document: ; Subsequently, based on the document Corresponding access control policy The symmetric key is encrypted using an attribute encryption algorithm. Encryption is performed to obtain the policy-bound key ciphertext: ; in, This represents a symmetric encryption algorithm. This represents the encryption process in the attribute encryption algorithm. This indicates the encrypted public parameters of the attribute.

[0026] The two-layer encryption structure described above allows for the separation of document content protection from access control policy binding. In other words, the server only stores the encrypted document and the encrypted key bound to the access policy, without directly accessing the plaintext document.

[0027] To support subsequent searches, in this embodiment, for each document... Extract the corresponding keyword set And build an encrypted index around the keywords. For any keyword and document identifiers containing the keyword Combined with document identifiers and auxiliary information Construct the index payload and construct the encrypted index entries. Its form is: ; in, This refers to supplementary information related to the retrieval process. This supplementary information may include, but is not limited to, timestamps, version numbers, document type identifiers, project group identifiers, or sensitivity level identifiers. This indicates a splicing operation.

[0028] Auxiliary information can be set to one or more of the following based on specific business needs: version number, timestamp, document type identifier, project group identifier, and sensitivity level identifier. Therefore, when the client possesses the corresponding attribute private key, it can recover the document identifier and auxiliary information from the index entries; while the server only perceives the tagged index structure. After construction is complete, the document owner or client will use the tuple... Send to the server to build a server-side encrypted inverted index.

[0029] By placing document identifiers and auxiliary information together under attribute encryption protection, the server enables clients to recover document identifiers and auxiliary information if they meet the access control policy, while users who do not meet the policy cannot complete the decryption.

[0030] S2: The server performs deterministic sorting of the encrypted index items and constructs a commitment structure based on the sorted encrypted index items, generating a commitment value representing the current index state, specifically including: The server performs deterministic sorting of the encrypted index items based on preset rules, resulting in a sorted sequence of encrypted index elements. The preset rules include sorting by keyword tags first, and then sorting within the same tag by arrival order, document identifier order, or preset internal order. The server constructs a Merkle tree or cryptographic accumulator based on the sorted sequence of encrypted index elements, and generates a commitment value representing the current index state. When constructing the Merkle tree, the root value of the Merkle tree is used as a commitment value representing the current index state.

[0031] In this embodiment, to enable the client to verify the search results returned by the server, the commitment structure can be implemented using a Merkle tree or a cryptographic accumulator. When using a Merkle tree, the server takes the sorted encrypted index items as leaf node inputs, calculates the hash values ​​layer by layer to obtain the root value, and uses this root value as the commitment value. .

[0032] The server receives all or part of the index tuples it has received. Then, perform the index preparation and commitment generation steps.

[0033] Specifically, the server first performs a deterministic sorting of all received index items according to predetermined rules to form a globally ordered sequence.

[0034] The sorting rule is to first sort by keyword tags. First, sort the elements lexicographically, then within the same tag, sort them according to arrival order, document identifier order, or a preset internal order. Let the resulting sequence of index elements after sorting be: ; in, This represents the total number of elements in the current index, and each index element... This corresponds to a combination of a set of tags and encrypted index entries.

[0035] Each index element can be represented as: ; The server constructs a commitment structure based on the sequence of index elements to generate a commitment value representing the current index state. .

[0036] In the preferred implementation using a Merkle tree as the commitment structure, the server assigns each index element... Calculate the leaf hash values ​​separately: ; And construct the Merkle tree according to the aforementioned deterministic order. The root of the Merkle tree is obtained by aggregating layer by layer. The root value of the Merkle tree is used as the index commitment value, denoted as: ; Commitment value This uniquely identifies the overall state of the server-side encrypted index at the current moment. To enable clients to verify in subsequent queries whether the results returned by the server are consistent with the current index state, the key and policy management entity or other trusted issuing entity can commit a value. After signing and publishing, the client first verifies the authenticity of the source of the commitment value before performing retrieval verification.

[0037] In other implementations that use a cryptographic accumulator as the commitment structure, the server may also map the sorted index elements to accumulator input elements and calculate the accumulated value as the commitment value. .

[0038] In this case, the proof information returned by the server can be provided in the form of a witness value to support the client's verification of the consistency between the returned result and the commitment value. Considering the differences in computational overhead, proof size, and update efficiency among different commitment structures, this invention does not limit itself to a single commitment structure. As long as a verifiable binding to the index state can be provided, it can be considered an equivalent implementation of this invention.

[0039] In this embodiment, after completing the above steps, the server ultimately saves two types of core data: one is a collection of encrypted document records. Another type is a cryptographic index structure based on tag organization. At the same time, the client or trusted issuing entity holds or can verify the current commitment value. And its signature information. Thus, the system completes the transformation from the original document to a verifiable encrypted retrieval state, providing a foundation for subsequent query token generation, candidate result return, proof generation, and client verification and decryption.

[0040] In some implementations, when the document library is updated, deleted, or the policy changes, the document ciphertext construction, index item reconstruction, and commitment value update processes related to the affected documents can be re-executed to maintain consistency between the document ciphertext, encrypted index, and commitment value. For incremental update scenarios, only the affected index items can be partially reconstructed and new commitment values ​​regenerated, which are then signed and published by the trusted publishing entity. Thus, this invention can support both static document libraries and dynamically updated document management scenarios. This part is an optional extension implementation of this invention.

[0041] S3: The client rewrites the user's natural language query into a structured search expression in a secure environment, generates a query token based on the structured search expression, and sends the query token to the server; specifically including: The client performs the rewriting in a local or trusted execution environment by combining local context information; the local context information includes at least one of the following: user identity information, research group information, historical search preference information, or preset terminology list information, and the local context information is not transmitted to the server; The structured search expression includes a subset of keywords, filtering conditions, and preference parameters. The intermediate and final outputs of the rewriting process do not contain plaintext query content, so as to protect the privacy of the query intent.

[0042] The filtering conditions include time range, project group identifier, document type identifier, and sensitivity level constraints; the preference parameters include the upper limit of the number of results returned, sorting priority, and candidate truncation threshold, which are used to constrain the subsequent search sorting and candidate filtering process.

[0043] When the keyword subset contains multiple keywords, the client uses system public parameters and pseudo-random mapping mechanism to determine each keyword tag, and uses matching index to locate the identifier based on each keyword tag to generate a query token corresponding to each keyword tag.

[0044] The rewriting process does not output plaintext query content throughout the entire process; the keyword subset in its structured search expression is represented in the form of pseudo-random labels.

[0045] In this embodiment, the client receives user input, which is first presented in the form of a natural language query, denoted as... To ensure compatibility with the encrypted retrieval interface, natural language query execution and query rewriting are performed sequentially on the client's local machine or in a trusted execution environment, such as... Figure 2 As shown, a structured retrieval expression compatible with the server-side encrypted index is generated, denoted as... The transformation relationship can be expressed as: ; in, This represents a subset of keywords extracted or expanded from a natural language query. Indicates the filtering conditions. This represents the preference parameter. The query rewrite function can be implemented using a large language model, a lightweight semantic model, a rule template matching module, or a combination of both; filtering conditions. This can include time range, project team identifier, document type identifier, sensitivity level constraints, and preference parameters. This can include the maximum number of results to be returned, sorting priority, candidate truncation threshold, etc.

[0046] Through the above rewriting process, natural language queries can be converted into internal expressions compatible with encrypted retrieval interfaces, while also adapting query semantics to complex retrieval scenarios. Since this rewriting process is completed locally on the client or in a trusted execution environment, the server does not directly access the plaintext query content.

[0047] In some implementations, the query rewriting process can also be performed in conjunction with limited local context information. This local context information may include user identity information, research group affiliation information, historical search preferences, or pre-defined terminology lists. By introducing context information, the client can transform temporal, scope, and domain-specific expressions in natural language into structured conditions more suitable for encrypted index retrieval.

[0048] For example, representative works in a certain direction over the past three years are analyzed as time interval filtering conditions and a set of domain keywords, while relevant technical reports from this group are analyzed as project group identifier filtering conditions and document type filtering conditions. It should be noted that in this invention, context information only participates in query rewriting on the client's local machine or in a trusted execution environment, and is not directly sent to the server.

[0049] After the query rewriting is completed, the client uses the structured search expression. Keyword subset Generate a query token. Specifically, for any keyword... The client uses system public parameters and a pseudo-random mapping mechanism to calculate the corresponding keyword tags. Its form is: ; in, Represents a pseudo-random function. Represents the pseudo-random function key. Based on keyword tags. The client then generates the corresponding query token. The query token generation process can be represented as follows: ; in, This indicates the query token generation function. Indicates system common parameters, Represents the set of attributes of the current user. The corresponding attribute private key.

[0050] In a more direct implementation, query token Can be labeled It is combined with necessary local permission information; in other implementations, further encapsulation, randomization, or salting can be used to reduce the risk of exposure of attribute-related information during the retrieval process.

[0051] When structured search expression When multiple keywords are included, the client can generate a corresponding set of query tokens for each keyword. And combine the query token set with the filtering conditions Preference parameters The commitment identifier corresponding to the current index status is also encapsulated into a query description and sent to the server.

[0052] For single-keyword queries, the client can also send only a single query token. This is related to the current commitment identifier. In this way, the server can perform location and candidate extraction on the tagged encrypted index without directly obtaining the plaintext query keywords.

[0053] Through the above rewriting process, the user's natural language retrieval requirements can be mapped into an internal query expression compatible with the encrypted index. Furthermore, since the rewriting process is completed locally on the client or in a trusted execution environment, its output is ultimately converted only into tags. The corresponding filtering conditions are submitted to the server, thereby avoiding the direct exposure of plaintext query content on the server side.

[0054] During the retrieval and decryption phase, the client relies on structured retrieval expressions. A query token is generated and sent to the server. The server returns candidate encrypted index items and corresponding proof information based on the query token.

[0055] S4: The server performs a search in the encrypted index based on the query token, determines candidate encrypted index items and their corresponding proof information, and returns the candidate encrypted index items and their corresponding proof information to the client. The client performs consistency verification on the candidate encrypted index items based on the commitment value and proof information. When the verification is successful, the client uses the user attribute private key to decrypt the candidate encrypted index items that have passed the consistency verification to obtain the authorized document identification information that meets the access control policy, and removes the candidate encrypted index items that do not meet the access control policy. Based on the authorized document identification information, the client obtains the corresponding policy binding key ciphertext and document ciphertext from the server, and decrypts them to obtain the authorized plaintext candidate document set.

[0056] Specifically, in step S41: the server performs a retrieval in the encrypted index based on the query token, determines the candidate encrypted index items and their corresponding proof information, and performs consistency verification on the proof information based on the commitment value. When the consistency verification of the candidate encrypted index item based on the commitment value and proof information fails, the server refuses to accept the candidate encrypted index item returned this time and terminates the subsequent decryption and semantic reordering process.

[0057] When a Merkle tree is used to construct the commitment structure, the proof information is the Merkle path proof corresponding to the candidate encrypted index item. The Merkle path proof is used by the client to verify whether the candidate encrypted index item belongs to the current index state based on the commitment value. When a cryptographic accumulator is used to construct the commitment structure, the server maps the sorted encrypted index items to accumulator input elements and performs aggregation operations to obtain the commitment value. The proof information includes the accumulator witness value generated by the server and corresponding to the candidate encrypted index item. The accumulator witness value is used by the client to verify whether the candidate encrypted index item belongs to the current index state.

[0058] After receiving the query token sent by the client, the server uses the query token to encrypt the index structure. The search is performed within the context of the query token corresponding to a specific keyword. The server uses the tag associated with the query token. Locate the corresponding index range in the encrypted index and extract all or part of the encrypted index items associated with the tag.

[0059] For a single-keyword query, the set of candidate index items returned by the server can be represented as: ; in, Representation and keywords and documents The corresponding encrypted index item.

[0060] For structured search expressions containing multiple keywords and filtering conditions, the server can use the keyword set... and filtering conditions The candidate result set is preferably represented as follows: ; in, This indicates that the filtering conditions are met. Under the premise of keywords The corresponding set of candidate index items.

[0061] Depending on actual business needs, the method of forming the candidate result set can also be changed from union to intersection, weighted merging, or other Boolean combinations.

[0062] After the server completes the extraction of candidate encrypted index items, a proof generation process is further executed to compare the candidate results with the current commitment value. Establish verifiable associations.

[0063] When the commitment structure uses a Merkle tree, the server generates a corresponding path proof for each encrypted index item in the candidate results and aggregates multiple path proofs to form a candidate result set. proof information .

[0064] In single-keyword scenarios, the server can also directly process the candidate set. Generate aggregate proof The server-side retrieval and proof generation process can be summarized as follows: ; Alternatively, in a single-keyword scenario, it can be represented as: ; in, This represents the server-side retrieval and proof generation function, which is based on an encrypted index structure. Query description and current commitment value Output the candidate results and their corresponding proof information.

[0065] In some preferred embodiments, to enhance the verifiability of the boundaries of the results returned by the server, in addition to returning the path proof corresponding to the candidate encrypted index item, the server may also return proof information corresponding to the boundary elements adjacent to the target label. The boundary elements can be adjacent elements in the label sequence located before or after the target label interval.

[0066] By introducing boundary element proofs, the client can further verify the consistency between the server-returned range and the target label range in subsequent verification stages.

[0067] It should be noted that boundary element proof is an optional enhancement mechanism of the present invention, which is applicable to scenarios where it is necessary to further strengthen the verification of result coverage; while in embodiments that do not use boundary element proof, the present invention can still verify the authenticity of the returned result and the tampering behavior through path proof corresponding to the candidate result.

[0068] In this embodiment, after receiving the set of candidate encrypted index items and corresponding proof information returned by the server, the client first performs a result verification process instead of directly entering the index item decryption and document recovery process. Specifically, the client performs the verification based on system public parameters. The commitment value corresponding to the current index state The server returns a set of candidate results and corresponding proof information. A verification function is then called to perform consistency checks on the returned results. For structured search expressions... The corresponding return result.

[0069] For any query, the corresponding validation result can be represented as: ; in, Indicates system common parameters, This represents a structured search expression. This represents the set of candidate results returned by the server based on this structured search expression. This represents the proof information corresponding to the candidate result set. Represents the verification function; when When the server returns a result consistent with the index status bound to the current commitment value, the client is allowed to proceed with the subsequent decryption and candidate document recovery process; when If the verification fails, the client will refuse to accept the search results and terminate the subsequent decryption and semantic processing.

[0070] In this way, the present invention moves the verification step of the server-returned result to the forefront, thereby avoiding the client directly processing the server-returned content without confirming the authenticity of the result.

[0071] The above verification process allows the client to verify whether the server's returned result is consistent with the current index state before decryption.

[0072] In the preferred implementation using a Merkle tree as the commitment structure, the client can perform verification on each candidate encrypted index item individually or in aggregate based on the path proof returned by the server to determine whether the candidate encrypted index item truly belongs to the index state represented by the current commitment value com. When the server returns the proof information corresponding to the boundary elements, the client can further verify the consistency between the target label range and the range of results returned by the server to enhance the ability to perceive the boundary of the result coverage.

[0073] It should be noted that, in embodiments that do not include boundary element proofs, the present invention can still verify the authenticity, forgery, and contamination behavior of the returned results through path proofs; further enhancement of result coverage can be considered as an optional implementation of the present invention.

[0074] After the server completes the retrieval and proof generation, it returns the set of candidate encrypted index items and their corresponding proof information to the client. In some implementations, the server may also simultaneously return the document ciphertext identifier corresponding to the candidate encrypted index item, so that the client can directly request the corresponding document ciphertext after subsequent verification and authorization decryption. For scenarios with multiple keywords and multiple filtering conditions, the server may also perform preliminary truncation or sorting of the candidate set based on the preference parameter Pref, for example, returning only candidate results within a preset limit, or performing preliminary rearrangement based on auxiliary information such as time and version; however, such preliminary truncation or sorting does not change the main process of the client performing semantic rearrangement based on the authorized plaintext candidate set.

[0075] In this embodiment, query rewriting, query token generation, server-side retrieval, and proof return form a complete data flow: the client is responsible for converting the natural language query into a structured retrieval expression and generating a query token; the server is responsible for candidate extraction and proof generation based on a tagged encrypted index, without directly accessing the plaintext query content; simultaneously, the candidate results returned by the server are not raw results, but rather a combination of results and proofs bound to the current commitment value, providing input for subsequent client-side result verification, authorization decryption, and semantic processing. This process retains the ease of use of natural language queries while maintaining security boundaries and verifiable mechanisms in encrypted retrieval scenarios.

[0076] In some optional implementations, if the client determines that the current commitment identifier has expired, the signature is invalid, or it is inconsistent with the local record, it can refuse to initiate a search or request to obtain the latest commitment identifier again. If the server detects that the index status has been updated, it can also return a new commitment identifier in the response to prompt the client to update the local verification basis. This part belongs to the extended implementation of consistency maintenance in the query phase of the present invention.

[0077] This invention uses successful verification as a prerequisite for subsequent decryption and acquisition of plaintext.

[0078] Step S42: When the verification is successful, use the user attribute private key to decrypt the candidate encrypted index entries that have passed the consistency verification to obtain the authorized document identification information that meets the access control policy, and remove the candidate encrypted index entries that do not meet the access control policy.

[0079] In this embodiment, after successful verification, the client uses its own attribute private key to decrypt the candidate encrypted index item in order to recover the document identification information that meets the access control policy.

[0080] Specifically, for any candidate encrypted index entry returned by the server The client performs attribute decryption, preferably represented as follows: ; in, Represents the current user attribute set The corresponding attribute private key. If the decryption result is not empty, it indicates that the current user attribute set satisfies the access control policy associated with the index entry, and the client can recover the corresponding document identifier. and auxiliary information If decryption fails or the output is empty, it indicates that the current user does not meet the access control policy corresponding to the index entry. The client automatically ignores the candidate encrypted index entry and will not include it in the subsequent document recovery process.

[0081] In this way, the present invention embeds access permission determination into the index item decryption stage, so that unauthorized candidates can be naturally filtered out without the need for an additional permission determination module.

[0082] Based on the above decryption results, the client can form a set of authorized document identifiers corresponding to the current query. The set of authorized document identifiers can be represented as: ; ; Among them, the symbol " "Indicates decryption failed. Authorized document identifier set" This represents the set of documents that, under the current query conditions, are both returned by the server and satisfy the current user access control policy. Through this set, the client can distinguish between the server's candidate results and the results that are actually accessible to the user, thus forming a clear input boundary for subsequent encrypted document recovery and semantic processing.

[0083] Recover the authorized document identifier set Subsequently, the client further requests the corresponding encrypted document record from the server based on the authorized document identifier set. Alternatively, in implementations where the server has synchronously returned the encrypted document identifier, the corresponding encrypted document record can be obtained directly.

[0084] Step S43: Based on the authorized document identification information, the client obtains the corresponding policy binding key ciphertext and document ciphertext, and obtains a set of authorized plaintext candidate documents.

[0085] For any authorized document identifier The client first uses the attribute private key to bind the policy binding key ciphertext corresponding to the document. Perform attribute decryption to recover the document's symmetric key. Subsequently, a symmetric key is used. encrypted documents Perform symmetric decryption to recover the plaintext document. Therefore, the client obtains a set of authorized plaintext candidate documents corresponding to the current query. for: ; In this invention, the authorized plaintext candidate document set It is the sole source of document input for subsequent semantic reordering and result generation processes, thus strictly limiting the semantic processing boundary to the set of candidate documents that have passed verification and meet access control policies.

[0086] S5: The client performs semantic reordering of the authorized plaintext candidate document set based on the semantic relevance between the natural language query input by the user and the documents in the authorized plaintext candidate document set, and generates search results based on the semantically reordered authorized plaintext candidate documents.

[0087] In this embodiment, in order to improve search performance without violating access control boundaries, only the authorized plaintext candidate document set is processed. Perform semantic relevance calculation.

[0088] Specifically, the client performs natural language queries. Perform query encoding to obtain the query vector; simultaneously, process the set of candidate documents for authorization plaintext. Each document in the document is encoded to obtain a corresponding document vector.

[0089] set up This indicates the query encoding function. This represents the document encoding function. The relevance scoring function is defined for any authorized plaintext candidate document. Its relationship with natural language query The semantic relevance score between them can be expressed as: ; Among them, the scoring function It can be a dot product, cosine similarity function, neural network-based matching function, or other equivalent similarity calculation methods.

[0090] The client reorders the candidate plaintext documents for authorization based on semantic relevance scores and selects the top k documents with the highest scores as context input for result generation or question-answer generation. Since this process only applies to... The documents within the framework are so that even with the introduction of semantic enhancement modules, the underlying access control boundaries remain unchanged. Semantic reordering and result generation can be based on candidate documents that have passed verification and meet access control policies.

[0091] In some preferred embodiments, the client may employ a two-stage semantic reordering mechanism. In the first stage, dense vector representations are used to process the set of candidate plaintext authorization documents. Perform a rapid relevance score and filter out a preset number of results. In the first stage, highly relevant candidate documents are selected; in the second stage, a cross-encoder or other fine-grained matching model is used to further reorder these highly relevant candidate documents to obtain more accurate ranking results. This approach controls the overall semantic processing overhead while maintaining high retrieval performance. For scenarios with a large number of candidates, the two-stage mechanism is particularly beneficial for achieving semantically enhanced retrieval for natural language queries within an acceptable latency.

[0092] After semantic reordering is completed, the client can generate results, summaries, or question-answering based on the top-ranked authorized documents. Preferably, the result generation process can be represented as: processing natural language queries... Compared with the sorting results, the first The module takes multiple authorized documents as input and outputs natural language results corresponding to the current query. This is because the context upon which the results are generated is strictly derived from the set of authorized plaintext candidate documents. Therefore, the generation process can be built on verifiable and authorized documents, thereby avoiding open generation directly on the entire library of documents or unauthorized documents.

[0093] In some optional implementations, when an external model service needs to be invoked, the client can also perform context trimming and sensitive identifier de-identification processing on the authorized plaintext candidate documents, and then send the processed context to the external model service as input to the external model. After the model returns the results, the client can also perform consistency checks on the document references, identifier references, or fact sources appearing in the results to determine whether the output exceeds the set of authorized documents. The above measures can further constrain the input and output boundaries of external model services, reducing the risk of unauthorized information leakage.

[0094] In this embodiment, client verification, authorization decryption, candidate document recovery, and subsequent semantic reordering constitute a strictly controlled post-processing chain: the server is only responsible for returning candidate results and proofs; the client first completes result verification; if verification fails, the verification result is rejected; only after successful verification does the client proceed to index item decryption and document ciphertext recovery; only after recovering the set of authorized plaintext candidate documents does the client perform semantic reordering, such as... Figure 3 As shown, this invention can simultaneously ensure result verifiability, fine-grained access control, and enhanced semantic retrieval capabilities in an untrusted server environment.

[0095] In this embodiment, the present invention also provides a boundary-constrained external model invocation mechanism for completing external model service invocations without breaching access control boundaries. The prerequisite for this mechanism is that the context participating in the external invocation is derived solely from the authorized plaintext candidate document set. Furthermore, the external model invocation process is subject to the joint constraints of context pruning, de-identification, and result verification.

[0096] Specifically, when it is necessary to invoke an external model service, the client first performs an authorization plaintext candidate document search. Perform context tidying. Context tidying includes: based on the current natural language query... The semantic reordering results are used to select several document fragments most relevant to the current query from the authorized plaintext candidate document set. These selected document fragments are then truncated, redundantly removed, filtered, or have their content concatenated to form a context set adapted to the external model service call. For ease of description, the pruning and desensitization operations before the external model call are denoted as... The processing procedure can then be represented as: ; in, This represents the query expression after necessary adjustments. This represents the set of authorization contexts after clipping and desensitization. Source only A subset that excludes unauthorized document content. This method keeps the input scope of external model services within the boundaries of validated, authorized, and pruned content.

[0097] In some preferred embodiments, The operation also includes sensitive identifier de-identification processing. Specifically, the client can perform replacement, de-identification, hashing mapping, placeholder replacement, or range generalization processing on personnel names, project codes, internal numbers, contract numbers, equipment numbers, email addresses, path identifiers, or other predefined sensitive identifiers in the authorization context, thereby reducing the risk of external model services accessing the original sensitive identifiers. For scenarios that only require summarizing, Q&A, or general content restatement, the client can also retain only the sentences directly related to the question, while removing attached metadata fields, version information, or sensitive annotation information. Thus, the input to the external model service is no longer the complete original document, but an authorization context that is restricted in source and content and has been de-identified.

[0098] After completing the above context preparation, the client will display the standardized query representation. With the trimmed and desensitized authorization context set The results are sent to an external model service to retrieve the output corresponding to the current query. It should be noted that in this invention, the external model service exists only as an optional enhancement module. Even if the external model service is unavailable, disabled, or fails to be invoked, the system can still rely on the client's local encrypted retrieval, verification, authorization decryption, and basic semantic rearrangement capabilities as described in the aforementioned embodiments to return the retrieval results. Therefore, invoking the external model is not a necessary prerequisite for this invention, but rather an optional implementation method to enhance intelligent interaction capabilities.

[0099] To further constrain the boundaries of the external model output, in some implementations, the client performs a consistency check after receiving the results from the external model service. This consistency check verifies whether the documents, fragments, identifiers, or fact sources referenced in the model output fall within a previously determined set of authorization contexts. or its upstream authorized plaintext candidate document set Within the authorized scope. If the client detects unauthorized document references, sensitive identifiers outside the current context, or content that clearly does not belong to the authorized set in the output, it can reject, truncate, regenerate, or issue an alert for the output.

[0100] In this invention, when the client calls an external inference service to generate retrieval results, the method proposed in this invention further includes an external call boundary control step: Before the client sends the context to the external inference service, it selects several document fragments that are most relevant to the natural language query from the set of authorized plaintext candidate documents. It performs length truncation, redundancy removal, field filtering, content splicing and sensitive identifier de-identification on the document fragments, and sends the truncated authorization context to the external inference service. After the client receives the result returned by the external inference service, it performs a consistency check on the result to determine whether the document or fact source referenced in the result belongs to the authorized plaintext candidate document set; if it does not belong, the result is rejected, truncated, or an alarm is triggered.

[0101] like Figure 4 The diagram illustrates the external model call boundary control, audit logging, and anomaly detection provided in this embodiment of the invention. Regarding external model call boundary control, the client first performs context pruning on the authorized plaintext candidate document set, selecting several document fragments most relevant to the natural language query. These document fragments are then subjected to length truncation, redundancy removal, field filtering, content concatenation, and anonymization. The pruned authorization context is then sent to the external inference service. Upon receiving the result from the external inference service, output validation is performed on the result to determine whether the document or factual source referenced in the result belongs to the authorized plaintext candidate document set. If not, rejection, truncation, or an alarm is triggered.

[0102] In terms of operational security governance, the system generates append-only audit logs for security-related operations. These logs are written to the log sequence in chronological order and protected for integrity using signature protection and hash chain mechanisms, forming an operation trajectory that cannot be arbitrarily overwritten. The system analyzes the temporal, frequency, and behavioral distribution characteristics of the audit logs through an anomaly detection module to identify potential abnormal behaviors. Upon detecting an anomaly, it triggers alarms or policy response actions, such as suspending external model calls, increasing the audit level, or switching to local processing mode. Through these mechanisms, this invention further enhances the system's operational visibility, traceability, and continuous monitoring capabilities, building upon cryptographic verification and access control.

[0103] By adding a consistency check step after model invocation, the risk of unauthorized referencing or dissemination of unauthorized content in the model-generated results can be further reduced.

[0104] In this embodiment, an additional audit log mechanism is introduced to enhance the system's accountability and ability to detect abnormal behavior during operation.

[0105] Specifically, the system generates audit logs for at least one of the following security-related operations: document upload, access control policy update, index update, query rewrite, query token generation, server retrieval return, client verification, document decryption, semantic rearrangement, and external model call.

[0106] For each audit record, one or more of the following can be recorded: operation time, operation entity identifier, operation type, related document identifier, related query identifier, commitment value version identifier, call result status, and exception marker information. Audit records are appended to the log sequence in chronological order to form an operation trail that cannot be arbitrarily overwritten.

[0107] In a preferred embodiment, audit logs are protected using a chain-like integrity protection mechanism. Specifically, the system combines the digest of the newly added audit log with the digest of the previous audit log to generate a chain-like digest corresponding to the current record, thus forming a hash chain. Simultaneously, trusted entities or the log service can also sign the audit log blocks or audit digests to enhance the non-repudiation and tamper-detectability of the log records. Through this method, the system can form an append-only, verifiable audit log structure, enabling subsequent operational audits, accountability tracking, and event review to rely on a structured, continuous chain of evidence, rather than unilateral server claims.

[0108] Building upon this foundation, this embodiment further provides an anomaly detection mechanism based on audit logs. Specifically, clients, independent monitoring nodes, or log services can periodically read audit records to analyze the temporal characteristics, frequency characteristics, subject distribution characteristics, query behavior characteristics, access result distribution characteristics, and external model call characteristics of security-related operations. Potential abnormal behaviors can be identified using rule-based detection models, statistical threshold models, sequence anomaly detection models, or machine learning detection models. Potential abnormal behaviors may include, but are not limited to: abnormally high-frequency sensitive queries, a large number of consecutive verification failures within a short period, abnormal access concentrations targeting highly sensitive documents, a suspicious increase in the frequency of external model calls, abnormal fluctuations in result returns, suspected calls that bypass local boundary controls, and abnormal result return patterns on the server side. By detecting these behaviors, it is possible to assist in discovering security risks such as server abuse, internal privilege escalation, index pollution, malicious omissions, injection provocation, or data leakage.

[0109] In some implementations, the anomaly detection module can generate an alarm when an anomaly score exceeds a threshold, and save the alarm along with relevant audit logs, query identifiers, document identifiers, or commitment value version information to support post-event review and accountability. For high-risk anomaly events, the system can also trigger additional control actions, such as suspending external model service calls, increasing the audit level of subsequent queries, requiring the re-acquisition of commitment values, restricting the output format of highly sensitive documents, or switching the current session to local-only processing mode. These control actions can be executed by the policy engine, the client-side local control module, or the security management node.

[0110] It should be noted that the audit logs and anomaly detection mechanism in this invention primarily serve as a runtime supplement to the aforementioned cryptographic verification and access control mechanisms, rather than a replacement. In other words, the result verification, authorization decryption, and boundary-constrained semantic processing in the aforementioned embodiments constitute the main technical chain of this invention; while the supplementary audit logs and anomaly detection in this embodiment are used to enhance the system's runtime visibility, traceability, and continuous monitoring capabilities. Even without enabling the anomaly detection module, the system can still rely on the aforementioned embodiments to complete encrypted retrieval, result verification, and authorization semantic processing; and with the anomaly detection module enabled, the ability to detect abnormal server behavior, internal abuse, and out-of-bounds model calls can be further improved.

[0111] By adopting the above optional implementation methods, the present invention can not only realize the main process of "verification passed before authorization and decryption, authorization followed by semantic processing" in a zero-trust document library environment, but also impose additional constraints on the input and output boundaries of the model when external model services are needed, and enhance the system's accountability and monitoring capabilities through append-only audit logs and anomaly detection mechanisms, thereby forming a complete technical system that takes into account cryptographic protection, boundary control and runtime security governance.

[0112] This invention also proposes a verifiable attribute encrypted retrieval system for zero-trust document libraries, including client devices and server devices; Server equipment includes: The preprocessing module is used to obtain the encrypted document text, the encrypted policy binding key text, and the encrypted index item formed by encrypting the document identification information through attribute encryption of the document to be protected. The commitment generation module is used to deterministically sort the encrypted index items, construct a commitment structure based on the sorted encrypted index items, and generate a commitment value that represents the current index state. The retrieval and verification module is used to perform a retrieval in the encrypted index based on the query token, determine the candidate encrypted index items and their corresponding verification information, and return the candidate encrypted index items and verification information to the client device. Client devices include: The query processing module is used to rewrite the natural language query input by the user into a structured search expression in a secure environment, and generate a query token based on the structured search expression. The structured search expression includes a subset of keywords, filtering conditions, and preference parameters. The intermediate and final outputs of the rewriting process do not contain plaintext query content. The verification and decryption module is used to perform consistency verification on candidate encrypted index items based on commitment values ​​and proof information; when the verification is successful, the user attribute private key is used to decrypt the candidate encrypted index item that has passed the consistency verification to obtain the authorized document identification information that meets the access control policy; and based on the authorized document identification information, the corresponding policy binding key ciphertext and document ciphertext are obtained from the server device and decrypted to obtain the authorized plaintext candidate document set. The semantic enhancement module is used to semantically reorder the set of candidate documents based on the semantic relevance between the natural language query input by the user and the documents in the set of candidate documents for authorization plaintext, and to generate search results based on the semantically reordered candidate documents for authorization plaintext.

[0113] like Figure 5 The diagram shows the system architecture corresponding to the method provided in this embodiment of the invention. The preprocessing module (corresponding to...) in this embodiment... Figure 5 The system initialization, user key generation, document symmetric encryption, and document key attribute encryption modules (corresponding to the commitment generation module) are all part of this process. Figure 5 The process of constructing and generating / publishing encrypted index entries (the encrypted index value) can be completed collaboratively by the key and policy management entity, the document owner, the client, and the server. For ease of description, this process is divided into system initialization steps, user key generation steps, document ciphertext construction steps, encrypted index construction steps, and commitment generation steps.

[0114] In a preferred embodiment, the system architecture corresponding to the method provided in this embodiment constructs a closed-loop secure retrieval system across the entire chain through the collaborative interaction of data owners, data users, servers, clients, key and policy management entities, external model services, audit log services, and anomaly detection modules. Figure 6 As shown.

[0115] In the initialization phase, the data owner performs symmetric encryption on the document, and the policy management entity, in conjunction with the key, completes the attribute encryption of the policy-bound key. Simultaneously, a commitment structure is constructed by deterministically sorting the encrypted index items, and the generated commitment value is distributed to the client or a third party for notarization. When a data user initiates a search through the client, the system localizes the natural language query into an encrypted token and sends it to an untrusted server. The server then returns candidate ciphertext and proof information containing the Path Proof. The client subsequently verifies the consistency of the proof information based on the pre-stored commitment value, ensuring that the result has not been tampered with or omitted. After successful verification, the client uses the attribute private key to decrypt and obtain the authorized plaintext.

[0116] During the semantic enhancement phase, the system invokes external model services (large language model and embedding model) to perform semantic reordering within authorized plaintext boundaries, ensuring the compliance of intelligent search results. Simultaneously, all critical operations throughout the system are pushed to the audit log service in real time to generate immutable log records and hash chain storage, serving as chained audit records. The anomaly detection module then uses these audit records to analyze abnormal behavior and assess threats, thereby achieving a verifiable, controlled, and traceable intelligent search process in a zero-trust environment.

[0117] The method proposed in this invention addresses the problem of untrusted servers potentially forging, tampering with, or omitting search results. This invention constructs a commitment structure on the encrypted index, making proof verification based on the commitment value a mandatory threshold for decryption. This mechanism establishes a baseline for the authenticity and integrity of the returned results at the cryptographic level before the client exposes any attribute private keys or plaintext data, fundamentally eliminating the possibility of malicious actions by the server going undetected and ensuring a trustworthy starting point for subsequent processing.

[0118] To address the risk of unauthorized information exposure caused by traditional methods that require first retrieving results and then authenticating, this invention embeds fine-grained access control policies into an attribute encryption mechanism, establishing a logic where decryption equates to authorization. Users can only successfully decrypt index entries whose attributes satisfy the policy; for unauthorized data, decryption is mathematically infeasible and thus naturally eliminated. This mechanism eliminates the need for additional explicit authentication interactions, thus removing the risk of unauthorized document identification and defining an absolutely secure data boundary for subsequent plaintext processing.

[0119] Existing technologies, when introducing large language models or semantic reordering, often result in the model directly accessing unauthorized encrypted text across the entire database or causing data out-of-domain issues. This invention, through rigorous timing design, strictly anchors the input for semantic processing to a set of plaintext candidates that have been verified and successfully decrypted. Semantic reordering and result generation are completely confined within verified and authorized security boundaries, completely eliminating the possibility of the semantic model accessing unauthorized data or making unauthorized references. Thus, without compromising fine-grained access control and data confidentiality, it endows the encrypted document library with natural language understanding and intelligent interaction capabilities, solving the industry pain point of the difficulty in balancing security and intelligence.

[0120] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

[0121] Furthermore, unless otherwise stated, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. All references to this specification are incorporated by way of citation to disclose and describe methods relating to those references. In the event of any conflict with any incorporated reference, the content of this specification shall prevail.

Claims

1. A verifiable attribute-encrypted retrieval method for zero-trust document libraries, characterized in that, include: The server obtains the encrypted document text, policy binding key text, and encrypted index entries formed by encrypting the document identification information attributes of the document to be protected. The server performs deterministic sorting of the encrypted index items and constructs a commitment structure based on the sorted encrypted index items to generate a commitment value that represents the current index state. The client rewrites the natural language query input by the user into a structured search expression in a secure environment, generates a query token based on the structured search expression, and sends the query token to the server; wherein, the structured search expression includes a subset of keywords, filtering conditions, and preference parameters, and the intermediate and final outputs of the rewriting process do not contain plaintext query content; The server performs a search in the encrypted index based on the query token, determines candidate encrypted index items and their corresponding proof information, and returns the candidate encrypted index items and their corresponding proof information to the client. The client performs consistency verification on the candidate encrypted index items based on the commitment value and the proof information. When the verification is successful, the client decrypts the candidate encrypted index items that have passed the consistency verification using the user attribute private key to obtain the authorized document identification information that meets the access control policy. Based on the authorized document identification information, the client obtains the corresponding policy binding key ciphertext and document ciphertext from the server, and decrypts them to obtain the authorized plaintext candidate document set. The client performs semantic reordering of the candidate documents based on the natural language query input by the user and the semantic relevance between the documents in the candidate document set, and generates search results based on the semantically reordered candidate documents.

2. The verifiable attribute encrypted retrieval method for zero-trust document libraries according to claim 1, characterized in that, The server performs deterministic sorting of the encrypted index items and constructs a commitment structure based on the sorted sequence of encrypted index elements to generate a commitment value representing the current index state, specifically including: The server performs deterministic sorting of the encrypted index items based on preset rules, resulting in a sorted sequence of encrypted index elements. The preset rules include first sorting by keyword tags in lexicographical order, and then sorting within the same keyword tags according to a preset arrival order or document identifier order. The server constructs a Merkle tree or cryptographic accumulator based on the sorted sequence of encrypted index elements, and generates a commitment value representing the current index state. When using a Merkle tree to construct the commitment structure, the root hash value of the Merkle tree is used as the commitment value representing the current index state.

3. The verifiable attribute encrypted retrieval method for zero-trust document libraries according to claim 1, characterized in that, The client rewrites the user-input natural language query into a structured search expression in a secure environment and generates a query token based on the structured search expression. The structured search expression includes a subset of keywords, filtering conditions, and preference parameters. The intermediate and final outputs of the rewriting process do not contain plaintext query content, specifically including: The client performs the rewriting in a local or trusted execution environment by combining local context information; the local context information includes at least one of user identity information, research group information, historical search preference information or preset terminology list information, and the local context information is not transmitted to the server; The filtering conditions include time range, project group identifier, document type identifier, and sensitivity level constraints; the preference parameters include upper limit of the number of returned results, sorting priority, and candidate truncation threshold, which are used to constrain the subsequent search sorting and candidate filtering process. When the keyword subset contains multiple keywords, the client uses system public parameters and pseudo-random mapping mechanism to determine each keyword tag, and uses matching index to locate the identifier based on each keyword tag to generate a query token corresponding to each keyword tag; The rewriting process does not output plaintext query content throughout the entire process, and the keyword subset in its structured retrieval expression is represented in the form of pseudo-random labels.

4. The verifiable attribute encrypted retrieval method for zero-trust document libraries according to claim 1, characterized in that, The client performs consistency verification on candidate encrypted index items based on commitment values ​​and proof information, and also includes: When the client fails to verify the consistency of the candidate encrypted index item based on the commitment value and proof information, it will refuse to accept the candidate encrypted index item returned by the server and terminate the subsequent decryption and semantic reordering process. When a Merkle tree is used to construct the commitment structure, the proof information is the Merkle path proof corresponding to the candidate encrypted index item. The Merkle path proof is used by the client to verify whether the candidate encrypted index item belongs to the current index state based on the commitment value. When a cryptographic accumulator is used to construct the commitment structure, the server maps the sorted encrypted index items to accumulator input elements and performs aggregation operations to obtain the commitment value; the proof information includes the accumulator witness value generated by the server and corresponding to the candidate encrypted index item, and the accumulator witness value is used by the client to verify whether the candidate encrypted index item belongs to the current index state.

5. The verifiable attribute encrypted retrieval method for zero-trust document libraries according to claim 1, characterized in that, The step of decrypting the candidate encrypted index entries that have passed the consistency verification using the user attribute private key to obtain the authorized document identification information that satisfies the access control policy specifically includes: The client uses the user's private key to perform attribute decryption on the candidate encrypted index item; If the decryption result is not empty, it indicates that the user attribute set satisfies the access control policy, and the corresponding document identification information and auxiliary information are restored. If decryption fails or the output is empty, it indicates that the access control policy is not met, and candidate encrypted index entries that do not meet the access control policy are removed.

6. The verifiable attribute encrypted retrieval method for zero-trust document libraries according to claim 1, characterized in that, The client obtains the corresponding policy binding key ciphertext and document ciphertext from the server based on the authorized document identifier information, and decrypts them to obtain a set of authorized plaintext candidate documents, specifically including: The client requests the corresponding encrypted document record from the server based on the authorized document identification information. The encrypted document record includes the policy binding key ciphertext and the document ciphertext. The client uses the user's private key to perform attribute decryption on the policy-bound key ciphertext, recovering the document's symmetric key. The client uses the document's symmetric key to perform symmetric decryption on the document's ciphertext, recovering the document's plaintext, thereby obtaining a set of authorized plaintext candidate documents.

7. The verifiable attribute encrypted retrieval method for zero-trust document libraries according to claim 1, characterized in that, The client performs semantic reordering of the candidate document set based on the semantic relevance between the user-input natural language query and the documents in the candidate document set for authorization plaintext. Specifically, this includes: The client uses a pre-trained semantic coding model to perform vector encoding on the natural language query input by the user, thus obtaining the query vector; The client uses the pre-trained semantic coding model to perform vector encoding on the authorized plaintext candidate documents to obtain document vectors; The semantic relevance score is determined based on the query vector and document vector. The client uses a two-stage semantic reordering mechanism based on semantic relevance scores. First, it selects a preset number of highly relevant candidate documents from the set of authorized plaintext candidate documents based on dense vector similarity. Based on the joint modeling of semantic associations between queries and candidate documents using cross-encoders, highly relevant candidate documents are re-ranked in a fine-grained manner. It generates summary results, question-and-answer results, or search results based on the top-ranked authorized documents in the sorting results.

8. The verifiable attribute encrypted retrieval method for zero-trust document libraries according to claim 1, characterized in that, Before the server obtains the encrypted document text, policy binding key text, and encrypted index entry formed by encrypting the document identification information, the data owner performs the following preprocessing steps: Obtain the symmetric key of the document to be protected; The document to be protected is encrypted using a symmetric key to obtain the ciphertext of the document. Based on the access control policy corresponding to the document to be protected, the symmetric key is encrypted using attribute encryption to obtain the policy binding key ciphertext. For the keyword set of the document to be protected, an index item is constructed that includes at least document identification information and auxiliary information. Based on the corresponding access control policy, the document identification information and auxiliary information are encrypted using attribute encryption to obtain the encrypted index item. The auxiliary information includes timestamp, version number, document type identifier, project group identifier, and sensitivity level identifier. The keyword tags in the keyword set are obtained based on a pseudo-random mapping mechanism, and the keyword tags are used as index positioning identifiers for encrypted index items.

9. The verifiable attribute encrypted retrieval method for zero-trust document libraries according to claim 1, characterized in that, When the client calls an external inference service to generate search results, the method further includes an external call boundary control step: Before the client sends the context to the external inference service, it selects several document fragments that are most relevant to the natural language query from the authorized plaintext candidate document set, performs length truncation, redundancy removal, field filtering, content splicing and sensitive identifier de-identification processing on the document fragments, and sends the truncated authorized context to the external inference service. After the client receives the result returned by the external inference service, it performs a consistency check on the returned result to determine whether the document or fact source referenced in the returned result belongs to the authorized plaintext candidate document set. If it does not belong to the category, the returned result will be rejected, truncated, or an alarm will be triggered.

10. A verifiable attribute-encrypted retrieval system for zero-trust document libraries, characterized in that, Including client devices and server devices; The server device includes: The preprocessing module is used to obtain the encrypted document text, the encrypted policy binding key text, and the encrypted index item formed by encrypting the document identification information through attribute encryption of the document to be protected. The commitment generation module is used to deterministically sort the encrypted index items, construct a commitment structure based on the sorted encrypted index items, and generate a commitment value that represents the current index state. The retrieval and verification module is used to perform a retrieval in the encrypted index based on the query token, determine candidate encrypted index items and their corresponding verification information, and return the candidate encrypted index items and the verification information to the client device. The client device includes: The query processing module is used to rewrite the natural language query input by the user into a structured search expression in a secure environment, and generate a query token based on the structured search expression; wherein, the structured search expression includes a subset of keywords, filtering conditions and preference parameters, and the intermediate and final outputs of the rewriting process do not contain plaintext query content; The verification and decryption module is used to perform consistency verification on candidate encrypted index items based on commitment value and proof information; when the verification is successful, the user attribute private key is used to decrypt the candidate encrypted index item that has passed the consistency verification to obtain authorized document identification information that meets the access control policy; and based on the authorized document identification information, the corresponding policy binding key ciphertext and document ciphertext are obtained from the server device and decrypted to obtain a set of authorized plaintext candidate documents. The semantic enhancement module is used to semantically reorder the set of candidate documents based on the semantic relevance between the natural language query input by the user and the documents in the set of candidate documents for authorization plaintext, and to generate search results based on the semantically reordered candidate documents for authorization plaintext.

Images