Smart power grid data encryption method and system

Abstract

A smart power grid data encryption method and system, relating to the technical field of data security. A data owner encrypts a power grid data document by means of a document encryption key generated via initialization, and then uploads same to a cloud server; creates keyword indexes and keyword labels on the basis of a keyword contained in the document, a keyword document quantity counter, a keyword update counter, a keyword encryption index key, and a document number, and uploads same to the cloud server, and grants a data user authorization for the keyword document quantity counter and the keyword update counter; on the basis of values in the two counters and a plurality of keywords to be queried, the data user creates a query trapdoor to perform keyword querying on an encrypted document stored in the cloud server; and, on the basis of keyword labels acquired by using the query trapdoor, the cloud server searches the stored encrypted document. According to the present application, data sharing having privacy protection can be carried out in a cloud environment, multi-keyword joint querying is supported, chosen keyword attacks can be resisted, and data security is guaranteed.

Description

A smart grid data encryption method and system

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on March 18, 2024, with application number 202410302833.7 and invention name “A Smart Grid Data Encryption Method and System”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of data security technology, and in particular to a smart grid data encryption method and system. Background Art

[0003] Uploading sensitive smart grid data to the cloud introduces a host of security and privacy issues. Cloud service providers may become targets of various attacks, including risks of data leakage, unauthorized access, and data tampering. Furthermore, smart grid data often contains information that can identify individual usage patterns. If this information is exposed, it could have serious implications for user privacy.

[0004] Existing technologies enable efficient data searches while protecting data privacy, offering significant application value in cloud environments. However, these technologies lack support for multi-keyword queries or incur significant computational and communication overhead, making them unsuitable for storing and querying massive amounts of data in cloud environments. Therefore, developing encryption methods that support multi-keyword queries while ensuring security and efficiency in cloud environments is an urgent challenge for those skilled in the art.

[0005] Summary of the Invention

[0006] The present application provides a smart grid data encryption method and system for realizing encrypted storage of smart grid data in a cloud environment, ensuring the security of smart grid data, and supporting multi-keyword queries.

[0007] In view of this, the first aspect of the present application provides a smart grid data encryption method, comprising:

[0008] The data owner initializes and generates a document encryption key, a keyword encryption index key, a keyword document quantity counter, a keyword update counter, a finite cyclic group and its generators, and makes the generators public. The keyword document quantity counter is used to store the total number of documents included in the keyword, and the keyword update counter is used to store the number of times the keyword is updated.

[0009] The data owner encrypts the power grid data document to be stored using the document encryption key and generates a document number for the encrypted document. The encrypted document and the corresponding document number are sent to the cloud server. The document encryption key is encrypted and sent to the data user, who then decrypts the encrypted document to obtain the document encryption key.

[0010] The data owner calculates the keyword index based on the keywords in the encrypted document, the keyword document quantity counter, the keyword update counter, and the keyword encryption index key, and calculates the keyword tag of the encrypted document based on the document number, the hash value of the keyword, and the generator;

[0011] The data owner uploads all keyword indexes and keyword tags to the cloud server, which stores the keyword indexes and inserts the keyword tags into the initialized Bloom filter.

[0012] The data owner encrypts the count values ​​in the keyword document quantity counter and the keyword update counter and sends them to the data user. The data user decrypts and obtains the count values ​​in the keyword document quantity counter and the keyword update counter, and constructs a query trap based on the count values ​​and several keywords to be queried to perform keyword queries on the encrypted documents stored on the cloud server. The cloud server determines whether all keyword tags hit the Bloom filter based on the keyword tags obtained by the query trap. If so, the corresponding encrypted document is sent to the data user, and the data user decrypts the received encrypted document using the document encryption key.

[0013] Optionally, the method further includes:

[0014] The data user selects a random number as a private key, calculates a corresponding public key based on the private key and the generator, and makes the public key public.

[0015] Optionally, the data owner encrypts the document encryption key and sends it to the data user, and the data user obtains the document encryption key by decrypting the key, including:

[0016] The data owner encrypts the document encryption key using the public key generated and published by the data user, and sends the encrypted document encryption key to the data user, who then decrypts the encrypted document encryption key using the private key generated by the initialization to obtain the document encryption key.

[0017] Optionally, the data owner calculates a keyword index based on the keywords in the encrypted document, a keyword document quantity counter, a keyword update counter, and a keyword encryption index key, and calculates a keyword tag for the encrypted document based on the document number, a hash value of the keyword, and the generator, including:

[0018] The data owner counts the keywords contained in all encrypted documents to obtain a keyword set;

[0019] Counting the document numbers corresponding to the keywords in the keyword set to obtain a set of document numbers corresponding to the keywords, and updating the count value in the keyword document quantity counter according to the total number of document numbers corresponding to the keywords;

[0020] Calculating the index key of each keyword using a first pseudo-random function according to the keyword encryption index key and the count value corresponding to each keyword in the keyword document quantity counter;

[0021] Calculating the index address of each keyword using a second pseudo-random function according to the keyword encryption index key and the count value corresponding to each keyword in the keyword update counter;

[0022] Traversing the document number set corresponding to each keyword, using two different hash functions to calculate the document auxiliary information under each keyword according to the document number corresponding to each keyword and the count value in the keyword update counter;

[0023] Based on the index address, index key, document number set and document auxiliary information of each keyword, a pseudo-random permutation function is used to construct the keyword index of each keyword;

[0024] The keyword tag of each encrypted document is calculated according to the document number of each encrypted document, the keyword contained in each encrypted document, and the generator.

[0025] Optionally, the calculating the keyword tag of each encrypted document according to the document number of each encrypted document, the keywords contained in each encrypted document, and the generator includes:

[0026] Calculating the hash value of the keyword contained in each encrypted document using a first hash function, and calculating the hash value of the document number of each encrypted document using a second hash function;

[0027] A power operation on the group is performed with the generator as the base and the product of the two hash values ​​as the exponent to obtain the keyword label of each encrypted document.

[0028] Optionally, the query trapdoor construction process includes:

[0029] The data user determines the target keyword containing the least document data from the plurality of keywords to be queried according to the keyword document quantity counter;

[0030] Calculating the index key of the target keyword using a first pseudo-random function according to the keyword encryption index key and the count value corresponding to the target keyword in the keyword document quantity counter;

[0031] Calculating an index address of a target keyword using a second pseudo-random function according to the keyword encryption index key and a count value corresponding to the target keyword in the keyword update counter;

[0032] Calculating respectively a hash value of the non-target keyword and a hash value of a combination of the target keyword and a count value corresponding to the target keyword in the keyword update counter, and calculating a query token of the non-target keyword based on the two hash values ​​and the generator;

[0033] Construct a query trapdoor by the index key of the target keyword, the index address and the query token of the non-target keyword.

[0034] Optionally, the cloud server determines whether all keyword tags obtained by querying the trapdoor match the Bloom filter, and if so, sends the corresponding encrypted document to the data user, including:

[0035] The cloud server matches the keyword index according to the index address of the target keyword in the query trapdoor, and uses the index key of the target keyword to decrypt the matched keyword index to obtain the document number set and document auxiliary message corresponding to the target keyword;

[0036] Traverse the document numbers in the document number set corresponding to the target keyword, and for each target encrypted document in the document number set corresponding to the target keyword, perform a group power operation with the query token of the non-target keyword as the base and the document auxiliary message corresponding to each target encrypted document as the exponent to obtain the keyword label of each target encrypted document;

[0037] Determine whether all keyword tags of each target encrypted document hit the Bloom filter. If so, add the document numbers of all the hit target encrypted documents to the ciphertext retrieval set. After traversing the document number set corresponding to the target keyword, send the ciphertext retrieval set to the data user.

[0038] Optionally, the method further includes:

[0039] When the data owner adds a new power grid data document to the cloud server, the new power grid data document is encrypted using the document encryption key to obtain a newly added encrypted document, and a document number for the newly added encrypted document is generated;

[0040] updating count values ​​in a keyword update counter and a keyword document quantity counter according to keywords in a new power grid data document;

[0041] Calculate a new keyword index based on the keywords in the newly added encrypted document, the updated keyword document quantity counter, the updated keyword update counter, and the keyword encryption index key, and calculate a keyword tag for the newly added encrypted document based on the document number, keywords, and the generator of the newly added encrypted document;

[0042] The newly added encrypted document, the new keyword index and the keyword tag of the newly added encrypted document are sent to the cloud server, which stores the newly added encrypted document and the new keyword index and inserts the keyword tag of the newly added encrypted document into the Bloom filter.

[0043] Optionally, the method further includes:

[0044] When the data owner deletes an encrypted document from the cloud server, the count values ​​in the keyword update counter and the keyword document quantity counter are updated according to the keywords in the encrypted document to be deleted;

[0045] Calculate a new keyword index based on the keywords in the encrypted document to be deleted, the updated keyword document quantity counter, the updated keyword update counter, and the keyword encryption index key, and calculate a keyword tag for the encrypted document to be deleted based on the document number, keywords, and the generator of the encrypted document to be deleted;

[0046] The document number of the encrypted document to be deleted, the new keyword index and the keyword tag of the encrypted document to be deleted are sent to the cloud server, which stores the new keyword index, deletes the corresponding encrypted document according to the document number of the encrypted document to be deleted, and deletes the keyword tag of the encrypted document to be deleted from the Bloom filter.

[0047] A second aspect of the present application provides a smart grid data encryption system, comprising:

[0048] The data owner is responsible for initializing and generating document encryption keys, keyword encryption index keys, keyword document quantity counters, keyword update counters, finite cyclic groups, and their generators, and publishing the generators. The keyword document quantity counter is used to store the total number of documents included in the keyword, and the keyword update counter is used to store the number of times the keyword is updated.

[0049] Encrypting the power grid data document to be stored using the document encryption key and generating a document number for the encrypted document, sending the encrypted document and the corresponding document number to the cloud server, encrypting the document encryption key and sending it to the data user, who then decrypts the document encryption key to obtain the document encryption key;

[0050] Calculating a keyword index based on the keywords in the encrypted document, a keyword document quantity counter, a keyword update counter, and a keyword encryption index key, and calculating a keyword tag of the encrypted document based on the document number, a hash value of the keyword, and the generator;

[0051] Upload all keyword indexes and keyword tags to the cloud server, which stores the keyword indexes and inserts the keyword tags into the initialized Bloom filter.

[0052] Encrypt the count values ​​in the keyword document quantity counter and the keyword update counter and send them to the data user;

[0053] The data user is used to decrypt and obtain the count values ​​in the keyword document quantity counter and the keyword update counter, and construct a query trap based on the count values ​​and several keywords to be queried to perform keyword queries on the encrypted documents stored on the cloud server;

[0054] The cloud server is used to determine whether the keyword tags obtained by the query trapdoor all hit the Bloom filter. If so, the corresponding encrypted document is sent to the data user, and the data user decrypts the received encrypted document using the document encryption key.

[0055] It can be seen from the above technical solutions that this application has the following advantages:

[0056] In this application, the construction of the keyword index relies on a keyword document counter and a keyword update counter. These two counters are generated by the data owner. Without knowing the values ​​of these two counters, even if the keyword is obtained, illegal data users cannot generate keyword query traps, thereby ensuring the security of smart grid data in the cloud environment.

[0057] The keyword tag of a document is generated by calculating the document number, the hash value of the keyword, and the generator. The server cannot decrypt the keywords contained in the document based on the keyword tag value. At the same time, different documents will generate different keyword tags because of their different document numbers, even if they contain the same keywords. Therefore, this method can perform privacy-preserving data sharing in a cloud environment and resist chosen keyword attacks, further improving the security of smart grid data.

[0058] Moreover, the method provided by this application supports multi-keyword joint query, with high query efficiency and low communication overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0060] FIG1 is a flow chart of a smart grid data encryption method provided by an embodiment of the present application;

[0061] FIG2 is a comparison diagram of keyword query costs provided by an embodiment of the present application;

[0062] FIG3 is a comparison diagram of keyword query communication overhead provided by an embodiment of the present application;

[0063] FIG4 is a schematic structural diagram of a smart grid data encryption system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to help those skilled in the art better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0065] For ease of understanding, please refer to FIG1 . This embodiment of the present application provides a smart grid data encryption method, including:

[0066] Step 101: The data owner initializes and generates a document encryption key, a keyword encryption index key, a keyword document quantity counter, a keyword update counter, a finite cyclic group and its generators, and makes the generators public.

[0067] The data owner needs to perform initialization operations. Specifically, the data owner generates a document encryption key f based on security parameters. k , keyword encryption index key k t , select a finite cyclic group G and its generator g, and make the generator g public. The data owner also initializes the generated keyword document quantity counter Cnt and the keyword update counter UpCnt. The keyword document quantity counter Cnt is used to store the total number of documents contained in the keyword, and the keyword update counter UpCnt is used to store the number of times the keyword performs an update operation.

[0068] It should be noted that after the data owner completes the initialization, the data user selects a random number x as the private key sk , calculate g based on the private key and generator g x As the public key p k , and publish the public key p k After the data owner is initialized, the cloud server initializes a Bloom filter BL and sets it to empty. The Bloom filter BL is used to store the keyword tags of the encrypted document.

[0069] Step 102: The data owner encrypts the power grid data document to be stored using a document encryption key and generates a document number for the encrypted document. The encrypted document and the corresponding document number are sent to the cloud server. The encrypted document encryption key is sent to the data user, who then decrypts the encrypted document to obtain the document encryption key.

[0070] The data owner uses the document encryption key f k , according to the Advanced Encryption Standard (AES), the power grid data file to be sent to the cloud server for storage is encrypted to obtain an encrypted document, and a unique document number (ID) is generated for the encrypted document. The data owner sends the encrypted document and the corresponding document number to the cloud server for storage. By encrypting the power grid data file and storing it, data security is improved. The data owner uses the public key p k The document encryption key f k After encryption, it is sent to the data user, who uses the private key s k Decrypt the received encrypted document encryption key to obtain the document encryption key f k , so that after obtaining the encrypted document, the data user can use the document encryption key f k Decrypt the encrypted document to obtain the original power grid data document.

[0071] Step 103: The data owner calculates the keyword index based on the keywords in the encrypted document, the keyword document quantity counter, the keyword update counter, and the keyword encryption index key, and calculates the keyword tag of the encrypted document based on the document number, the keyword hash value, and the generator.

[0072] A1. The data owner counts the keywords contained in all encrypted documents to obtain a keyword set.

[0073] The data owner counts the keywords contained in all power grid data documents and obtains the keyword set W = {w1, w2, ..., w n}.

[0074] A2. Count the document numbers corresponding to the keywords in the keyword set to obtain a set of document numbers corresponding to the keywords, and update the count value in the keyword document quantity counter according to the total number of document numbers corresponding to the keywords;

[0075] For each keyword in the keyword set W, count the encrypted documents corresponding to each keyword to obtain the document number set corresponding to each keyword. i ∈W, keyword w i The corresponding document number set is t is the keyword keyword w i The number of documents contained (i.e. the document content contains the keyword w i The number of encrypted documents), according to the keyword w i The corresponding document number t updates the keyword document number counter Cnt for keyword w i The count value of And update the keyword counter Set to 0.

[0076] A3. Calculate the index key for each keyword using a first pseudo-random function based on the keyword encryption index key and the count value corresponding to each keyword in the keyword document quantity counter;

[0077] The data owner encrypts the index key k based on the keyword t , keyword w in keyword document number counter i The corresponding count value The first pseudo-random function F1 is used to calculate the keyword w i Index key

[0078] A4. Calculate the index address of each keyword using a second pseudo-random function based on the keyword encryption index key and the count value corresponding to each keyword in the keyword update counter;

[0079] The data owner encrypts the index key k based on the keyword t , keyword update counter keyword w i The corresponding count value The second pseudo-random function F2 is used to calculate the keyword w i Index address

[0080] A5. Traverse the document number set corresponding to each keyword and use two different hash functions to calculate the document auxiliary information for each keyword based on the document number corresponding to each keyword and the count value in the keyword update counter;

[0081] The data owner traverses the keyword w i A collection of document numbers Use two different hash functions according to the keyword w i Corresponding document number Keyword update counter keyword w i The corresponding count value Calculate keyword w i Document auxiliary information for each encrypted document

[0082] A6. Based on the index address, index key, document number set, and document auxiliary information of each keyword, a pseudo-random permutation function is used to construct a keyword index for each keyword.

[0083] According to the keyword w i Index address Index Key Document Number Collection and document assistance messages Use pseudo-random permutation function P to construct keyword w i Keyword index

[0084] A7. Calculate a keyword tag for each encrypted document based on the document number of each encrypted document, the keywords contained in each encrypted document, and the generator.

[0085] The first hash function is used to calculate the hash value of the keywords contained in each encrypted document, and the second hash function is used to calculate the hash value of the document number of each encrypted document; the power operation on the group is performed with the generator as the base and the product of the two hash values ​​as the exponent to obtain the keyword label of each encrypted document. Specifically, the data owner counts the document numbers of all encrypted documents and obtains the total document number set ListID = {ID1, ID2, ..., ID z}, z is the total number of encrypted documents, count the keywords contained in each encrypted document in the total document number set, and get the keyword set corresponding to each encrypted document Traverse the total document number set ListID, and for each encrypted document F.ID∈ListID, use the first hash function H1 to calculate the hash value of each keyword contained in the encrypted document The second hash function H2 is used to calculate the hash value H2(ID) of the document number of each encrypted document, and the power operation on the group is performed with the generator g as the base and the product of the two hash values ​​as the exponent to obtain the keyword label of each keyword in the encrypted document.

[0086] Step 104: The data owner uploads all keyword indexes and keyword tags to the cloud server, which stores the keyword indexes and inserts the keyword tags into the initialized Bloom filter.

[0087] The data owner uploads all keyword indexes and keyword tags to the cloud server, which stores the keyword indexes and inserts the keyword tags into the initialized Bloom filter BL.

[0088] Step 105: The data owner encrypts the count values ​​in the keyword document quantity counter and the keyword update counter and sends them to the data user. The data user decrypts and obtains the count values ​​in the keyword document quantity counter and the keyword update counter, and constructs a query trap based on the count values ​​and several keywords to be queried to perform keyword queries on the encrypted documents stored on the cloud server. The cloud server determines whether the keyword tags obtained by the query trap all hit the Bloom filter based on the keyword tags. If so, the corresponding encrypted document is sent to the data user, and the data user decrypts the received encrypted document using the document encryption key.

[0089] The data owner uses the data user's public key p k The count values ​​in the keyword document quantity counter Cnt and the keyword update counter UpCnt are encrypted and sent to the data user, who uses the private key to decrypt and obtain the count values ​​in the keyword document quantity counter and the keyword update counter. The data user constructs a query trap based on the count value and several keywords to be queried to perform keyword queries on the encrypted documents stored on the cloud server.

[0090] Specifically, data users can generate a joint query Q containing m keywords = w1∧w2∧…∧w m , the data user determines the target keyword with the least document data from multiple keywords to be queried based on the keyword document number counter, assuming that the target keyword is w1; based on the keyword encryption index key k t , the count value corresponding to the target keyword in the keyword document counter The first pseudo-random function F1 is used to calculate the index key of the target keyword w1 Data users encrypt the index key k based on the keyword t , the count value corresponding to the target keyword in the keyword update counter The second pseudo-random function F2 is used to calculate the index address of the target keyword w1

[0091] The data user traverses the query Q except the target keyword w1 (i.e. non-target keyword w j , j=2,3,4,...,m), use the first hash function H1 to calculate the hash value H1(w j ), the hash value of the union of the target keyword and the count value corresponding to the target keyword in the keyword update counter And calculate the non-target keyword w based on the two hash values ​​and the generator g j The query token The data user constructs a query trapdoor using the index key of the target keyword, the index address, and the query token of the non-target keyword. The data user initiates a query request to the cloud server and sends the query trap Send to the cloud server.

[0092] The cloud server searches for the index address of the target keyword in the trapdoor Match keyword index and use the index key of target keyword Decrypt the matched keyword index to obtain the document number set corresponding to the target keyword and document assistance messages

[0093] The cloud server traverses the document number set corresponding to the target keyword The document ID in the target keyword corresponds to the document ID set For each target encrypted document in , we use the query token of the non-target keyword as the base and the document auxiliary message corresponding to each target encrypted document as the exponent to perform a group power operation to obtain the keyword label of each target encrypted document. The cloud server determines whether all keyword tags of each target encrypted document hit the Bloom filter BL. If all hit, the document ID corresponding to all the hit target encrypted documents is added to the ciphertext search set CFSet, and the document ID set corresponding to the target keyword is traversed. Afterwards, the ciphertext retrieval set CFSet is sent to the data user.

[0094] After receiving the ciphertext retrieval set CFSet, the data user uses the document encryption key f k Decrypt the encrypted documents in the ciphertext retrieval set CFSet to obtain the power grid data document and restore all the contents.

[0095] Furthermore, the smart grid data encryption method in the embodiment of the present application further includes:

[0096] Step 106: The data owner performs a document update operation.

[0097] Document updates are divided into two situations: document addition and document deletion.

[0098] When the data owner adds a new power grid data file to the cloud server, the data owner uses the document encryption key f kEncrypting the new power grid data document to obtain a newly added encrypted document, and generating a document number for the newly added encrypted document;

[0099] According to the keywords in the new power grid data document, the count values ​​in the keyword update counter and the keyword document quantity counter are updated; specifically, the data owner extracts the keywords contained in the new power grid data document to obtain the keyword set The data owner traverses the keyword set W F , for keyword w∈W F , update the count value UpCnt of keyword w in the keyword update counter w Add 1, the count value Cnt of keyword w in the keyword document quantity counter w Add 1;

[0100] The data owner calculates a new keyword index based on the keywords in the newly encrypted document, the updated keyword document quantity counter, the updated keyword update counter, and the keyword encryption index key, and calculates the keyword tag of the newly encrypted document based on the document number, keyword, and generator of the newly encrypted document; specifically, the first pseudo-random function F1 is used to calculate the new index key key w =F1(k t ,w||Cnt w ), the query address Inv of the keyword w is calculated using the second pseudo-random function F2 w =F2(k t ,w||UpCnt w ), extract the original document number set Listw and document auxiliary message tpList contained in the keyword w w , to the original document number set List w Add the document number of the newly encrypted document to get the new document number set of keyword w Calculate the document auxiliary message tp of the newly added encrypted document ID,w =H1(w,UpCnt w )H2(ID w ), to the original document auxiliary message tpList of keyword w w Add document auxiliary message tp for newly added encrypted documents ID,w Get new document auxiliary information for keyword w Use the new index key w Re-encryption and Combined with the query address of keyword w, a new keyword index of keyword w is constructed Finally, the data owner calculates the keyword label of each keyword in the newly added encrypted document based on the document ID, keyword w and generator g of the newly added encrypted document.

[0101] The data owner sends the newly added encrypted document, the new keyword index, and the keyword tag of the newly added encrypted document to the cloud server, which stores the newly added encrypted document and the new keyword index and inserts the keyword tag of the newly added encrypted document into the Bloom filter. F After that, a document adding operation is requested from the cloud server, and the newly added encrypted document, new keyword index and new keyword tag are sent to the cloud server. The cloud server stores the newly added encrypted document and new keyword index, and inserts the new keyword tag into the Bloom filter BL.

[0102] When the data owner needs to delete an encrypted document from the cloud server, the count values ​​in the keyword update counter and the keyword document quantity counter are updated according to the keywords in the encrypted document to be deleted; specifically, when the data owner needs to delete an encrypted document from the cloud server, the data owner extracts the keywords contained in the encrypted document to be deleted and obtains the keyword set The data owner traverses the keyword set W F , for keyword w∈W F , update the count value UpCnt of keyword w in the keyword update counter w Add 1, the count value Cnt of keyword w in the keyword document quantity counter w minus 1;

[0103] Calculate a new keyword index based on the keywords in the encrypted document to be deleted, the updated keyword document quantity counter, the updated keyword update counter, and the keyword encryption index key; calculate the keyword tag of the encrypted document to be deleted based on the document number, keywords, and generator of the encrypted document to be deleted; specifically, use the first pseudo-random function F1 to recalculate the new index key key of the keyword w w =F1(k t ,w||Cnt w ), use the second pseudo-random function F2 to recalculate the query address Inv of keyword w w =F2(k t ,w||UpCnt w ), extract the original document number set List contained in the keyword w w and document auxiliary message tpList w , in the original document number set List wDelete the document number of the encrypted document to be deleted and get the new document number set of keyword w Calculate the document auxiliary message tp of each keyword in the encrypted document to be deleted ID,w =H1(w,UpCnt w )H2(ID w ), from the original document auxiliary message tpList of keyword w w Delete the document auxiliary message tp of the encrypted document to be deleted ID,w Get new document auxiliary information for keyword w Use the new index key w Re-encryption and Combined with the query address of keyword w, a new keyword index of keyword w is constructed Finally, the data owner calculates the keyword labels of each keyword in the encrypted document to be deleted based on the document ID, keyword w and generator g of the encrypted document to be deleted.

[0104] The document number of the encrypted document to be deleted, the new keyword index and the keyword tag of the encrypted document to be deleted are sent to the cloud server, which stores the new keyword index, deletes the corresponding encrypted document according to the document number of the encrypted document to be deleted, and deletes the keyword tag of the encrypted document to be deleted from the Bloom filter. F After that, a document deletion operation is requested from the cloud server, and the document number of the encrypted document to be deleted, the new keyword index, and the keyword tag of the encrypted document to be deleted are sent to the cloud server. The cloud server stores the new keyword index, deletes the corresponding encrypted document according to the document number of the encrypted document to be deleted, and deletes the keyword tag of the encrypted document to be deleted from the Bloom filter BL.

[0105] The attackers considered in this embodiment are primarily illegal data users and honest and curious cloud servers. The cloud server's goal is to obtain as much keyword privacy as possible from uploaded documents. This application assumes that the data owner and data user are honest. This application can resist chosen keyword attacks. At the same time, only data users with the data owner's permission can access document information. Therefore, the security performance of this application system is analyzed from the perspective of resisting chosen keyword attacks and data access rights, as follows:

[0106] 1) In this application, the construction of the keyword index relies on a keyword document counter and a keyword update counter, the values ​​of which are generated by the data owner. Without knowing the values ​​of these two counters, even if the keyword is obtained, an illegal data user cannot generate a keyword query trap, thus ensuring data security. Therefore, in the solution proposed in this application, data users must be authenticated by the data owner before they can obtain the keyword document counter and the keyword update counter.

[0107] 2) In this application, each keyword update will change the count value in the keyword document quantity counter, thereby changing the keyword's index key and index address. Therefore, the cloud server cannot associate the keyword indexes before and after the update, nor can it use the original keyword encryption index key to decrypt the new index content. For the keyword tag of a document, its value is generated by performing a group power operation on the product of the document number and the keyword hash value. The server cannot decrypt which keywords the document contains based on the document's keyword tag. At the same time, for different documents, because of the different document numbers, even if they contain the same keywords, different keyword tags will be generated. Therefore, this application can resist chosen keyword attacks.

[0108] From the above analysis, it can be seen that illegal data users cannot infer the index content corresponding to the keyword, the cloud server cannot infer the document information corresponding to the keyword from the obtained keyword index, nor can it infer the keyword information contained in the document from the keyword tag of the document. Therefore, the method provided in this application can resist the spying of data content by illegal data users and cloud servers, thereby improving the security of smart grid data.

[0109] To verify the effectiveness of the method provided by this application, a document was randomly generated during the experiment. The keywords contained in the document were 26 English letters, and the file number was a randomly generated 16-byte string. During the experiment, it was compared with existing technical solutions (BDXT solution and ODXT solution).

[0110] 1) In order to illustrate the experience level when data users use this solution to perform multi-keyword joint query operations, the embodiment of the present application evaluates the response time of the multi-keyword query operation of the method proposed in this application. During the experiment, the system response time was tested when the number of documents changed linearly from 200,000 to 1 million. The response time results are shown in Figure 2. It can be observed from Figure 2 that the response time of the cloud server increases slightly with the increase in the number of documents, because the increase in the number of documents will cause the cloud server to traverse more files when performing message retrieval. In addition, after one round of communication, the data user of this solution can directly obtain the corresponding document. In contrast, the existing solution requires an additional round of communication to request the real document from the cloud server after the data user obtains the corresponding document number, and the query time to obtain the actual document will be even longer. Therefore, this solution will reduce the query time of data users and obtain a better user experience.

[0111] 2) To illustrate the user experience when using this solution for multi-keyword joint query operations, the total communication overhead of the multi-keyword query operation proposed in this application was evaluated. The total communication overhead of the system was tested when the amount of updated data linearly varied from 200,000 to 1,000,000. The communication overhead test results are shown in Figure 3. As can be seen from Figure 3, as the amount of data continues to increase, the total communication overhead of the system also gradually increases. The messages sent by the cloud server to the data user are all related to the amount of data: the more documents there are, the more messages are sent, so the total communication overhead gradually increases with the amount of data. However, in this solution, the message sent by the data user during the query is independent of the number of documents corresponding to the keyword, but only depends on the number of keywords. In contrast, in the existing solution, the size of the query message sent by the data owner is also related to the number of documents corresponding to the keyword. Compared with the existing solution, this solution is more user-friendly. Moreover, after the data user obtains the corresponding document number, the existing solution requires an additional round of communication to request the actual document from the cloud server, which results in even greater communication overhead to obtain the actual document. Compared with the existing solution, the communication overhead of the present invention is significantly reduced, and the incremental increase is also smaller. Therefore, the solution of the present invention will not bring any burden to the system during use, and will provide a better experience for data users.

[0112] Referring to FIG4 , an embodiment of the present application further provides a smart grid data encryption system, including: a data owner, a data user, and a cloud server;

[0113] The data owner is used to initialize and generate document encryption keys, keyword encryption index keys, keyword document quantity counters, keyword update counters, finite cyclic groups and their generators, and to make the generators public. The keyword document quantity counter is used to store the total number of documents contained in the keyword, and the keyword update counter is used to store the number of times the keyword is updated.

[0114] The document encryption key is used to encrypt the power grid data document to be stored and generate a document number for the encrypted document. The encrypted document and the corresponding document number are sent to the cloud server. The document encryption key is encrypted and sent to the data user, who then decrypts the document encryption key to obtain the document encryption key.

[0115] Calculate the keyword index based on the keywords in the encrypted document, the keyword document quantity counter, the keyword update counter, and the keyword encryption index key, and calculate the keyword tag of the encrypted document based on the document number, the hash value of the keyword, and the generator;

[0116] Upload all keyword indexes and keyword tags to the cloud server, which stores the keyword indexes and inserts the keyword tags into the initialized Bloom filter.

[0117] Encrypt the count values ​​in the keyword document quantity counter and the keyword update counter and send them to the data user;

[0118] The data user is used to decrypt and obtain the count values ​​in the keyword document quantity counter and the keyword update counter, and construct a query trap based on the count values ​​and several keywords to be queried to perform keyword queries on the encrypted documents stored on the cloud server;

[0119] The cloud server is used to determine whether the keyword tags obtained by the query trapdoor all hit the Bloom filter. If so, the corresponding encrypted document is sent to the data user, and the data user decrypts the received encrypted document using the document encryption key.

[0120] The smart grid data encryption system provided in the embodiment of the present application can perform privacy-protected data sharing in a cloud environment and resist selected keyword attacks; the system supports multi-keyword joint queries, and has high query efficiency and low communication overhead.

[0121] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0122] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0123] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0124] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0125] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0126] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0127] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for executing all or part of the steps of the method described in each embodiment of the present application through a computer device (which can be a personal computer, server, or network device, etc.). The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English full name: Read-Only Memory, English abbreviation: ROM), random access memory (English full name: Random Access Memory, English abbreviation: RAM), disk or optical disk and other media that can store program code.

[0128] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A smart grid data encryption method, characterized in that: include: The data owner initializes and generates a document encryption key, a keyword encryption index key, a keyword document quantity counter, a keyword update counter, a finite cyclic group and its generators, and makes the generators public. The keyword document quantity counter is used to store the total number of documents included in the keyword, and the keyword update counter is used to store the number of times the keyword is updated. The data owner encrypts the power grid data document to be stored using the document encryption key and generates a document number for the encrypted document. The encrypted document and the corresponding document number are sent to the cloud server. The document encryption key is encrypted and sent to the data user, who then decrypts the encrypted document to obtain the document encryption key. The data owner calculates the keyword index based on the keywords in the encrypted document, the keyword document quantity counter, the keyword update counter, and the keyword encryption index key, and calculates the keyword tag of the encrypted document based on the document number, the hash value of the keyword, and the generator; The data owner uploads all keyword indexes and keyword tags to the cloud server, which stores the keyword indexes and inserts the keyword tags into the initialized Bloom filter. The data owner encrypts the count values ​​in the keyword document quantity counter and the keyword update counter and sends them to the data user. The data user decrypts and obtains the count values ​​in the keyword document quantity counter and the keyword update counter, and constructs a query trap based on the count values ​​and several keywords to be queried to perform keyword queries on the encrypted documents stored on the cloud server. The cloud server determines whether all keyword tags hit the Bloom filter based on the keyword tags obtained by the query trap. If so, the corresponding encrypted document is sent to the data user, and the data user decrypts the received encrypted document using the document encryption key.

2. The smart grid data encryption method according to claim 1, characterized in that: The method further comprises: The data user selects a random number as a private key, calculates a corresponding public key based on the private key and the generator, and makes the public key public.

3. The smart grid data encryption method according to claim 1 or 2, characterized in that: The data owner encrypts the document encryption key and sends it to the data user, who then decrypts it to obtain the document encryption key, including: The data owner encrypts the document encryption key using the public key generated and published by the data user, and sends the encrypted document encryption key to the data user, who then decrypts the encrypted document encryption key using the private key generated by the initialization to obtain the document encryption key.

4. The smart grid data encryption method according to claim 1, characterized in that: The data owner calculates a keyword index based on the keywords in the encrypted document, a keyword document quantity counter, a keyword update counter, and a keyword encryption index key, and calculates a keyword tag of the encrypted document based on the document number, the hash value of the keyword, and the generator, including: The data owner counts the keywords contained in all encrypted documents to obtain a keyword set; Counting the document numbers corresponding to the keywords in the keyword set to obtain a set of document numbers corresponding to the keywords, and updating the count value in the keyword document quantity counter according to the total number of document numbers corresponding to the keywords; Calculating the index key of each keyword using a first pseudo-random function according to the keyword encryption index key and the count value corresponding to each keyword in the keyword document quantity counter; Calculating the index address of each keyword using a second pseudo-random function according to the keyword encryption index key and the count value corresponding to each keyword in the keyword update counter; Traversing the document number set corresponding to each keyword, using two different hash functions to calculate the document auxiliary information under each keyword according to the document number corresponding to each keyword and the count value in the keyword update counter; Based on the index address, index key, document number set and document auxiliary information of each keyword, a pseudo-random permutation function is used to construct the keyword index of each keyword; The keyword tag of each encrypted document is calculated according to the document number of each encrypted document, the keyword contained in each encrypted document, and the generator.

5. The smart grid data encryption method according to claim 4, characterized in that: The step of calculating the keyword tag of each encrypted document according to the document number of each encrypted document, the keywords contained in each encrypted document, and the generator includes: Calculating the hash value of the keyword contained in each encrypted document using a first hash function, and calculating the hash value of the document number of each encrypted document using a second hash function; A power operation on the group is performed with the generator as the base and the product of the two hash values ​​as the exponent to obtain the keyword label of each encrypted document.

6. The smart grid data encryption method according to claim 1, characterized in that: The query trapdoor construction process includes: The data user determines the target keyword containing the least document data from the plurality of keywords to be queried according to the keyword document quantity counter; Calculating the index key of the target keyword using a first pseudo-random function according to the keyword encryption index key and the count value corresponding to the target keyword in the keyword document quantity counter; Calculating an index address of a target keyword using a second pseudo-random function according to the keyword encryption index key and a count value corresponding to the target keyword in the keyword update counter; Calculating respectively a hash value of the non-target keyword and a hash value of a combination of the target keyword and a count value corresponding to the target keyword in the keyword update counter, and calculating a query token of the non-target keyword based on the two hash values ​​and the generator; Construct a query trapdoor by the index key of the target keyword, the index address and the query token of the non-target keyword.

7. The smart grid data encryption method according to claim 6, characterized in that: The cloud server determines whether all keyword tags obtained by querying the trapdoor match the Bloom filter. If so, it sends the corresponding encrypted document to the data user, including: The cloud server matches the keyword index according to the index address of the target keyword in the query trapdoor, and uses the index key of the target keyword to decrypt the matched keyword index to obtain the document number set and document auxiliary message corresponding to the target keyword; Traverse the document numbers in the document number set corresponding to the target keyword, and for each target encrypted document in the document number set corresponding to the target keyword, perform a group power operation with the query token of the non-target keyword as the base and the document auxiliary message corresponding to each target encrypted document as the exponent to obtain the keyword label of each target encrypted document; Determine whether all keyword tags of each target encrypted document hit the Bloom filter. If so, add the document numbers of all the hit target encrypted documents to the ciphertext retrieval set. After traversing the document number set corresponding to the target keyword, send the ciphertext retrieval set to the data user.

8. The smart grid data encryption method according to claim 1, characterized in that: The method further comprises: When the data owner adds a new power grid data document to the cloud server, the new power grid data document is encrypted using the document encryption key to obtain a newly added encrypted document, and a document number for the newly added encrypted document is generated; updating count values ​​in a keyword update counter and a keyword document quantity counter according to keywords in a new power grid data document; Calculate a new keyword index based on the keywords in the newly added encrypted document, the updated keyword document quantity counter, the updated keyword update counter, and the keyword encryption index key, and calculate a keyword tag for the newly added encrypted document based on the document number, keywords, and the generator of the newly added encrypted document; The newly added encrypted document, the new keyword index and the keyword tag of the newly added encrypted document are sent to the cloud server, which stores the newly added encrypted document and the new keyword index and inserts the keyword tag of the newly added encrypted document into the Bloom filter.

9. The smart grid data encryption method according to claim 1, characterized in that: The method further comprises: When the data owner deletes an encrypted document from the cloud server, the count values ​​in the keyword update counter and the keyword document quantity counter are updated according to the keywords in the encrypted document to be deleted; Calculate a new keyword index based on the keywords in the encrypted document to be deleted, the updated keyword document quantity counter, the updated keyword update counter, and the keyword encryption index key, and calculate a keyword tag for the encrypted document to be deleted based on the document number, keywords, and the generator of the encrypted document to be deleted; The document number of the encrypted document to be deleted, the new keyword index and the keyword tag of the encrypted document to be deleted are sent to the cloud server, which stores the new keyword index, deletes the corresponding encrypted document according to the document number of the encrypted document to be deleted, and deletes the keyword tag of the encrypted document to be deleted from the Bloom filter.

10. A smart grid data encryption system, characterized in that: include: The data owner is used to initialize and generate document encryption keys, keyword encryption index keys, keyword document quantity counters, keyword update counters, finite cyclic groups and their generators, and The generator is disclosed, the keyword document quantity counter is used to store the total number of documents included in the keyword, and the keyword update counter is used to store the number of times the keyword is updated; Encrypting the power grid data document to be stored using the document encryption key and generating a document number for the encrypted document, sending the encrypted document and the corresponding document number to the cloud server, encrypting the document encryption key and sending it to the data user, who then decrypts the document encryption key to obtain the document encryption key; Calculating a keyword index based on the keywords in the encrypted document, a keyword document quantity counter, a keyword update counter, and a keyword encryption index key, and calculating a keyword tag of the encrypted document based on the document number, a hash value of the keyword, and the generator; Upload all keyword indexes and keyword tags to the cloud server, which stores the keyword indexes and inserts the keyword tags into the initialized Bloom filter. Encrypt the count values ​​in the keyword document quantity counter and the keyword update counter and send them to the data user; The data user is used to decrypt and obtain the count values ​​in the keyword document quantity counter and the keyword update counter, and construct a query trap based on the count values ​​and several keywords to be queried to perform keyword queries on the encrypted documents stored on the cloud server; The cloud server is used to determine whether the keyword tags obtained by the query trapdoor all hit the Bloom filter. If so, the corresponding encrypted document is sent to the data user, and the data user decrypts the received encrypted document using the document encryption key.

Images