CN114741711A

CN114741711A - Multi-keyword searchable encryption method based on block chain

Info

Publication number: CN114741711A
Application number: CN202210355792.9A
Authority: CN
Inventors: 郑丽娟; 吴朋钢; 赵美茹; 吕亚奇; 宫天; 封柔昕; 杨含玉; 赵博远
Original assignee: Shijiazhuang Tiedao University
Current assignee: Shijiazhuang Tiedao University
Priority date: 2022-04-06
Filing date: 2022-04-06
Publication date: 2022-07-12
Anticipated expiration: 2042-04-06
Also published as: CN114741711B

Abstract

The invention discloses a block chain-based multi-keyword searchable encryption method, which comprises the following steps: initializing; constructing an index; generating a trap door; distributing; retrieving; verifying; decrypting; and (6) arbitration. According to the method, the retrieval tasks are decomposed by using a distribution algorithm and then run by using a plurality of search servers, so that the dependence on a single cloud server is reduced, and the decentralization degree is higher. In the method, the arbitration algorithm and the verification algorithm are used for detecting the malicious behaviors of the cloud server, and the retrieval result is verified, so that fair transaction between the user and the cloud server is ensured. A keyword weight mechanism is designed in a retrieval algorithm, and fuzzy results can be provided based on weights when retrieval results are empty. Experimental analysis and comparison show that the method has high execution efficiency.

Description

Multi-keyword searchable encryption method based on block chain

Technical Field

The invention relates to the technical field of block chains, in particular to a multi-keyword searchable encryption method based on a block chain.

Background

Cloud computing has been vigorously developed in recent years, and a large number of companies have started providing cloud services to society. The cloud service category includes platform as a service, infrastructure as a service, and software as a service. The user can choose to purchase or rent different cloud services according to the needs of the user. More and more organizations are also beginning to move data and applications into cloud servers.

While cloud services bring more convenience, the security and privacy exposure risks of the cloud services cannot be ignored. The most common use of an individual user is to rent a cloud storage server to store personal data. Such as iCloud from apple inc. The user can store photos, videos, and other types of files in the cell phone in the iCloud cloud server. This saves local storage space while the user can view the files in iCloud anywhere and anytime without the device being restricted.

However, since the information is stored in the cloud server in clear text, once the data is leaked, the privacy of the user is seriously damaged. Data security can be protected by uploading encrypted data to the cloud server, but inconvenience is brought to management and use of the data, and particularly, frequent retrieval operation is performed by a user.

In order to implement keyword search on a ciphertext, researchers have proposed searchable encryption. In the existing research of searchable encryption schemes, the improvement of the expression capability of the algorithm is an important research direction. The multi-keyword retrieval is a research hotspot, and scholars explore keyword retrieval schemes supporting logical connection, or calculate and evaluate the similarity between keywords and ciphertext documents by using technologies such as kNN (K-nearest neighbor) and Word2vec, so as to realize the multi-keyword retrieval. Scholars have also proposed more convenient fuzzy search schemes.

However, besides fuzzy retrieval, the existing multi-key searchable encryption scheme can only provide accurate results and realize the ranking of the retrieval results on the basis of the accurate results. When the plurality of keywords searched by the user do not have corresponding documents, the search result is empty, and the user experience is poor.

In a large number of searchable encryption schemes, the cloud server is assumed to be honest, and in practical application, the cloud server may be dishonest or malicious, and the retrieval result provided by the cloud server is unreliable. Therefore, introducing a verification mechanism for the retrieval result so as to prevent malicious behaviors of the cloud server is an important research direction of the searchable encryption scheme, wherein the searchable encryption scheme based on the block chain is a hot point of research. However, the cloud server in these searchable encryption schemes is a logically single node, the centralization degree is high, and the malicious behavior of the cloud server cannot be avoided. For example, when a cloud server maliciously returns a null result, the final retrieval result may be null.

At present, a server is supposed to be honest in a large number of searchable encryption schemes, but in practical application, a cloud server may have dishonest behaviors in the operation process of the scheme due to cost consideration. For example, incomplete search results may be returned to reduce traffic consumption, and random or null results may be returned to conserve computing resources. This is a great detriment to the fairness of transactions between users and cloud servers, and it is necessary to introduce a verification mechanism for the search results.

The application of the block chain technology can effectively solve the problem. Data in the blockchain is not tamperable and can be verified for traceability. The block chain can be used as a trusted party to verify the retrieval result, so that the transaction fairness is guaranteed.

In the existing schemes, transaction fairness is guaranteed to a certain extent through a verification mechanism established by a block chain, but in the schemes, a cloud server is still a single logical node, and the decentralization degree is not high enough. When the cloud server has malicious behaviors, punishment can be carried out only by deducting the deposit, and the cloud server with the malicious behaviors still needs to be relied on in the operation of the scheme.

Disclosure of Invention

The invention aims to solve the technical problem of how to provide a multi-keyword searchable encryption method based on a block chain, which can improve the retrieval efficiency, ensure the fair transaction and has higher flexibility.

In order to solve the technical problems, the technical scheme adopted by the invention is as follows: a multi-keyword searchable encryption method based on a block chain is characterized in that:

initialization: a data owner generates public parameters and a secret key, creates an intelligent contract, discloses the public parameters and the public key and keeps the private key secret;

index construction: a data owner generates a ciphertext file, an index, a shared key and other parameters, sends the generated ciphertext file to a storage server, sends the index to a search server, sends the shared key to other users, and keeps the generated other parameters secret;

and (3) trap door generation: a user generates a retrieval trapdoor by a plurality of keywords to be retrieved and initiates a retrieval request;

distributing: the intelligent contract decomposes the retrieval request of the user and then sends the decomposed retrieval request to each search server;

and (3) retrieval: the search server processes the search request and sends the obtained search result to the user and the intelligent contract;

and (3) verification: the intelligent contract verifies the retrieval result and initiates an arbitration request to the result of verification failure;

and (3) decryption: the user calculates according to the retrieval result, requests a corresponding ciphertext file from the storage server according to the calculation result, decrypts the ciphertext file to obtain a corresponding plaintext file, and initiates an arbitration request if the calculation or decryption fails;

arbitration: the data owner processes the arbitration request and verifies the retrieval result.

Adopt the produced beneficial effect of above-mentioned technical scheme to lie in: 1) the method uses a decentralized multi-server architecture to deliver data storage and data retrieval to a plurality of cloud servers respectively. On the basis, a distribution algorithm is designed, retrieval tasks containing multiple keywords can be distributed to a plurality of search servers for execution after being decomposed, retrieval efficiency is improved, and load balance is achieved.

2) According to the method, the verification algorithm and the arbitration algorithm are designed, the retrieval result can be verified, the malicious behavior of the cloud server is prevented, and the fair transaction is guaranteed. A keyword weight mechanism is introduced into the retrieval algorithm, the fuzzy result with the highest weight can be returned to the user when the retrieval result is empty, and the flexibility is stronger.

3) A comparison experiment is carried out on a real data set, and the application is proved to have higher efficiency.

Drawings

The invention is described in further detail below with reference to the drawings and the detailed description.

FIG. 1 is a diagram of a model of a method according to an embodiment of the invention;

FIG. 2 is a flow chart of a method according to an embodiment of the invention;

FIG. 3 is a comparison graph of the time consumption of the index building phase in the embodiment of the present invention;

FIG. 4 is a comparison graph of the time consumption of the trapdoor generation phase in the embodiment of the invention;

FIG. 5 is a comparison of the time consumption of the keyword retrieval phase in an embodiment of the present invention;

FIG. 6 is a graph of the impact of the number of search servers on the overall time consumed by the method in an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention are clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention, but the present invention may be practiced in other ways than those specifically described and will be readily apparent to those of ordinary skill in the art without departing from the spirit of the present invention, and therefore the present invention is not limited to the specific embodiments disclosed below.

The embodiment of the application discloses a multi-keyword searchable encryption method based on a block chain, as shown in fig. 1:

the participants of the embodiment of the present application include a Data Owner (DO), a storage server (S _ Store), a Search server (S _ Search), and a user (DU), which are all used as a block link node. And the data owner is responsible for encrypting the document to generate ciphertext data and establishing an index. The storage server is responsible for storing the ciphertext data generated by the data owner. The search server is responsible for storing the index data and calculating and retrieving the corresponding index data according to the retrieval trapdoor uploaded by the user. And the user calculates and generates a retrieval trapdoor according to the retrieval requirement of the user, and sends the retrieval trapdoor to the search server through the block chain to acquire corresponding index data. And the user requests the corresponding ciphertext data from the storage server according to the index data.

The present application includes the following 8 polynomial time algorithms:

1) initialization algorithm Setup (λ) → (pub, P)_DO,S_DO,P_u,S_u). The algorithm takes a security parameter lambda as input, a data owner generates a public parameter pub, and an intelligent contract is deployed on a block chain. The data owner and other users generate a public and private key pair, and the private key S is used_DOAnd S_uKeeping secret, using public key P_DOAnd P_uIs disclosed;

2) index construction algorithm Buildindex (pub, W, M, S)_DO) → (C, I, Key, VC, VRs, VRu). The algorithm uses a public parameter pub, a plaintext keyword set W, a plaintext file set M and a data owner private key S_DOAnd outputting a ciphertext file set C, a ciphertext index I, a shared Key Key and sets VC, VRs and VRu for result verification for input. The algorithm is executed by a data owner, the set C and the index I are respectively sent to the storage server and the search server, the search Key Key is sent to other users, the generated set VC is disclosed on the block chain, and the sets VRs and VRu are kept secret.

3) Trapdoor generation algorithm GenTrapdoor (Key, W', S)_u,P_DO) → Tw. The algorithm searches a Key Key, a Key set W' to be retrieved and a user private Key S_uAnd a data owner public key P_DOFor input, the trap door set Tw is generated and sent to the smart contract. The algorithm is executed by the user and, when executed, may assign a weight to each keyword.

4) Distribution algorithm distribute (Tw) → ({ TS)₁,TS₂,TS₃… }). The algorithm takes a trapdoor set Tw sent by a user as input, and an intelligent contract executes the algorithm to output a decomposed trapdoor set { TS }₁,TS₂,TS₃… }, wherein

5) Search algorithm Search (TS)_i,I,P_u)→(RS_i,R_TS_i). Algorithm to trap gate set TS_iCiphertext index I, user public key P_uFor input, each search server executes the algorithm to output a retrieval result RS_iAnd R _ TS_i。

6) Verification algorithm Verify (RS)_i) → 0, 1. The algorithm is executed by intelligent contract and the algorithm is based on the search result RS sent by each search server_iAnd outputting a verification result for inputting, and sending deposit and service fee according to the verification result.

7) Decryption algorithm Dec (R _ TS)_i,P_DOKey) → M. The algorithm is executed by the user to retrieve the result R _ TS_iData owner public key P_DOAnd inputting the search Key Key to obtain a plaintext file M corresponding to the retrieval result.

8) The arbitration algorithm Arbitrate (w ", Nw", x) → {0,1 }. The algorithm is executed by the data owner, and takes the retrieval result Nw 'to be arbitrated, the keyword w' (optional) to be arbitrated and the secret information x as input to output the verification result.

As shown in fig. 2, an embodiment of the present invention discloses a block chain-based multi-key searchable encryption method, and specific contents and execution flows of 8 polynomial time algorithms included in the method are as follows:

an initialization algorithm: setup (λ) → (pub, P)_DO,S_Do,P_u,S_u)。

The present application first needs to execute an initialization algorithm Setup (), which corresponds to step (r) in fig. 2. The algorithm is executed as follows:

1) the data owner generates two multiplicative cyclic groups G of prime order p₁And G₂G is G₁The generator of (1). Generating a bilinear map e G₁×G₁→G₂. Choosing a pseudorandom function F: {0,1}^*→{0,1}^k. Selecting two cryptographic hash functions H₁:{0,1}^*→G₁And H₂:G₂→{0,1}^kAnd k is an integer. Selecting an anti-collision hash function H₃:{0,1}^*→{0,1}^k，H₄:{0,1}^*→{0,1}^k. A symmetric encryption algorithm (Enc, Dec) is selected. Data owner publishes system public parameter pub ═ { p, G₁,G₂,e,F,H₁,H₂,H₃,H₄(Enc, Dec) }, and issues it to the blockchain.

Randomly selecting s to be Z by a data owner_pCalculating S_DO＝g^sAs a private key and computing a public key

User randomly selects u e to Z_pCalculating

As private key, the user public key P is calculated_u＝g^u. The data owner and the user store the private key and issue the public key as public information to the blockchain.

2) The data owner creates an intelligent contract and issues it to the blockchain. The user and the search server need to call the intelligent contract in the scheme execution process to complete the whole retrieval process. The functions of the intelligent contract comprise: temporarily storing the service fee of the user and the deposit of the search server; decomposing and sending a retrieval task; and verifying the retrieval result. After each retrieval, the user can extract the deposit withheld in the intelligent contract.

An index construction algorithm: buildindex (pub, W, M, S)_DO)→(C,I,Key,VC,VRs,VRu)。

After the initialization is completed, the data owner needs to execute the Buildindex () algorithm, corresponding to step two in fig. 2. The algorithm performs the following:

1) the data owner splits the plaintext file into keywords to obtain a keyword set W ═ W₁,w₂,w₃… }. And the data owner encrypts the plaintext file by using a symmetric algorithm to obtain a ciphertext file. Randomly selecting x epsilon Z_pFor plaintext file M_iIts ciphertext file C_i＝Enc(M_iK), k is a symmetric key, k ═ H₂(e(g,g^x)). The ciphertext file set is C ═ C₁,C₂,C₃… } for file C_iAfter the ciphertext files are sorted, the file numbers FN are distributed according to the sequence numbers i_i＝2^i-1And calculate H₄(C_i) Obtaining a set VC { [ FN ]₁,H₄(C₁)],[FN₂,H₄(C₂)],…,[FN_i,H₄(C_i)]}. And the data owner sends all the ciphertext files C and the serial numbers thereof to the storage server and issues the VC to the block chain. At this time, the hash values of the ciphertext files are all anchored on the block chain and can be used for checking the retrieval result.

2) The data owner constructs a keyword-document number file index I by using the cipher text file number and the corresponding keyword thereof, and the calculation process is as follows:

set the number set of the ciphertext file containing the keyword w as { FN₁,FN₂,FN₃,…}。

2-1) calculating y ═ H using the keyword w₃(w)。

2-2) calculation of C_w＝e(g^x,g^y)＝e(g,g)^xy。

2-3) let Key be g^sxAnd b ═ f (key) is calculated.

2-4) calculating verify _ bit ═ e (H)₁(w),Key)mod 2。

2-5) calculating the aggregated file number Nw ═ FN₁&FN₂&FN₃&…, and inserts verify _ bit into the b-th bit of Nw,&representing an and operation.

The index corresponding to the keyword w is Iw ═ Cw, Nw]. The data owner performs the above operation on each keyword in the keyword set W, and generates an index I ═ Iw₁,Iw₂…, and then uploading the index to the respective search server. At the same time, the data owner calculates VN ═ H₄(Nw||x)，Vw＝H₄(w | | Nw | | x) the generation set VRs ═ VN₁,VN₂,VN₃… and VRu ═ Vw₁,Vw₂,Vw₃… for arbitrating the disputed search results.

3) The data owner sets the shared Key Key g^sxTo each user, the user must use this key to construct a legitimate retrieval trapdoor. Data owner will x, VRs, VRu, S_DOStored as secret information.

Trap door generation algorithm: GenTrapdoor (Key, W', S)_u,P_DO)→Tw。

The user needs to execute the GenTrapdoor () algorithm to generate a search trapdoor for the keyword needing to be searched, which corresponds to the step three in FIG. 2. The algorithm is executed as follows:

1) setting the set of keywords to be searched as W ═ W₁,w₂,w₃…, the user needs to assign a weight p to each keyword at the same time to obtain a set W_p＝{[w₁,p₁],[w₂,p₂],[w₃,p₃]… }. The weights represent the retrieval priority of each keyword, and are mainly used for calculating fuzzy results when the retrieval results are empty, and the keywords with higher weights are more likely to be contained in the retrieval results. If the user does not specify a weight, then the order is assigned by default, p_i＝2ⁱAnd i is the key sequence number.

For the keyword W ∈ W', the calculation procedure of the trapdoor is as follows:

1-1) calculating y ═ H₃(w)。

1-2) randomly selecting r epsilon Z_pCalculating

t2＝e(Key·g^y·g^r,P_DO)＝e(g^rsxy,P_DO)＝e(g,g)^rxy。

1-3) search trapdoor for keyword w

2) After the operations are executed on each keyword to be retrieved, a trapdoor set Tw { [ Tw ] is obtained₁,p₁],[tw₂,p₂],[tw₃,p₃]…, after which the user sends the trapdoor set Tw and the service charge to the smart contract. Since the intelligent contract may require arbitration by the data owner when verifying the retrieval result, the service fee sent by the user may include a portion of the arbitration fee. When the arbitration cost is insufficient, the contract authentication function is affected to some extent.

A distribution algorithm: distributute (Tw) → ({ TS)₁,TS₂,TS₃,…})。

The user sends the trapdoor and the service fee to the intelligent contract, the intelligent contract executes a Distribute () algorithm to decompose the retrieval task, and sends the subtasks to each search server node, which corresponds to the step (iv) in fig. 2. The algorithm is executed as follows:

1) and the search server participating in the retrieval sends the deposit to the contract account within the time t after the contract account receives the trapdoor set and the service fee sent by the user. After the contract account receives the deposit, the search servers which successfully pay the deposit within the time t are sorted according to the payment sequence, the user trapdoors are distributed to the servers, and the transaction of the overtime payment deposit is returned to the original account. And finally obtaining a search server set S participating in retrieval.

2) In order to ensure the reliability of the retrieval result, each trapdoor is retrieved by 2 or more than 2 search servers; using 2 search servers as an example, the intelligent contract utilizes the set S of search servers and the receivedSearching the trapdoors Tw executes the following Algorithm Algorithm 1, wherein n represents the number of cloud servers, m represents the number of trapdoors in Tw, and TS_iRepresenting cloud Server S_iThe set of trapdoors received is then,

after the intelligent contract is executed, TS is added_iAnd distributed to the corresponding search server.

And (3) a retrieval algorithm: search (TS)_i,I,P_u)→(RS_i,R_TS_i)。

The Search server executes the Search () algorithm after receiving the retrieval task sent by the intelligent contract, and sends the result of the algorithm execution to the intelligent contract and the user, corresponding to the fifth step in fig. 2. The algorithm is executed as follows:

1) each search server receives the trap door set TS sent by the intelligent contract_iThen, local retrieval is carried out on each trapdoor in the set to obtain a retrieval result set RS_i＝{Nw₁,Nw₂,…,Nw_jJ ∈ (1, m) }, j represents the trapdoor number, Nw_jRepresenting the search result for the trapdoor numbered j.

2) For each trapdoor when the search server performs local retrieval

Utilizing locally stored index Iw ' ═ Cw ', Nw ']If the equation t1 ', Cw', t2 'holds true, 1 is output, and the corresponding Nw' is added to the set RS_iIn (1). If not, 0 is output and 0 is added into the set RS_iAnd (5) indicating that the retrieval result corresponding to the trapdoor is empty.

3) The search server will search the result set RS_iAnd sending to the intelligent contract for verification. If set RS_iIf the search result is 0, the search result is empty, and the search process is ended. If set RS_iIf the non-0 result exists in the middle search result, the calculation is continued.

4) For trapdoor set TS_iThe search result corresponding to all the keywords in the set is R _ TS_i＝Nw₁&Nw₂&…&Nw_j. The server participating in the retrieval first calculates R _ TS_iIf R _ TS_i>0, indicating that the retrieval result is not null, and then the retrieval result R _ TS is carried out_iAnd sending the data to the user. If R _ TS_iIf 0, then calculate trapdoor TS according to keyword weight_iThe result R _ SubTS with the largest weight_iReturned to the user as a fuzzy result. R _ SubTS_iThe calculation procedure of (c) is as follows as shown in Algorithm 2 and Algorithm 3.

And (3) verification algorithm: verify (RS)_i)→{0,1}。

The intelligent contract executes the retrieval result RS sent by the Verify () algorithm to the search server_iCross validation was performed, corresponding to step (c) in fig. 2. The algorithm is executed as follows:

1) suppose that the search result of 2 search servers for a certain keyword is Nw_iAnd Nw_i', Smart contract validation Nw_i＝Nw_iIf' is true, namely, if the search results corresponding to the trapdoors with the same number are the same, 1 is output. If not, 0 is output, and an arbitration request is sent to the data owner, wherein the request comprises Nw_iAnd Nw_i'. After all results are verified, the intelligent contract is returnedAnd the deposit of each search server distributes service fees to the search servers according to the number of the retrieved trapdoors. If the verification fails, the intelligent contract reserves a deposit and refuses to pay the service fee of the corresponding search server.

2) And after the intelligent contract is verified, sending a verification result to the user, and simultaneously initiating a transaction to return the deposit to the search server. And after the time t, sending the service fee to the search server. If the user suspects that the retrieval result is possible to initiate an arbitration request to the data owner, the transaction for paying the service fee is suspended during the time t.

And (3) decryption algorithm: dec (R _ TS)_i,P_DO,Key)→M。

After receiving the search result sent by the search server, the user needs to execute the Dec () algorithm to obtain a corresponding plaintext file, which corresponds to step (c) in fig. 2. The algorithm is executed as follows:

1) when the number of the search servers participating in the search is n, the user receives n search results { R _ TS₁,R_TS₂,R_TS₃,…,R_TS_nAnd the retrieval result represents a ciphertext file number set containing the corresponding key word. Obtaining R _ Tw' by intersection of search results, R _ Tw ═ R _ TS₁&R_TS₂&R_TS₃&…&R_TS_n。

The user calculates b ═ f (key), and then deletes the b-th bit of R _ Tw', resulting in the final result R _ Tw. And the user sends the result R _ Tw to the storage server to request the corresponding file. And the storage server splits the file number according to the bit from the R _ Tw, finds the corresponding file and sends the file to the user.

2) After obtaining the ciphertext file C, the user firstly calculates to obtain a symmetric key

And then, executing a symmetric decryption algorithm to obtain the corresponding plaintext file M ═ Dec (C, k). H can also be calculated according to the ciphertext file C₄(C) ' and associate it with H stored in blockchain₄(C) And comparing to judge whether the ciphertext file is tampered.

The above is the normal decryption flow. In addition, the user can perform further logic operation on the retrieval result. For example, when the search key is { a, b, c, d }, and the search result r ═ ra & rb & rc & rd, the result r' ═ (r) & (| rc) can be calculated which includes the key a, b, d and does not include the key c. These logical operation conditions may also be included in the retrieval request.

If the condition that R _ Tw is 0 occurs when calculating the search result R _ Tw, this time indicates that no file containing all keywords at the same time exists, the result with the maximum weight in n search results can be used as a fuzzy result, and the single keyword search result RS in the block chain can be further used as required_iAnd performing logic operation to calculate a corresponding retrieval result.

The arbitration algorithm: arbitrate (w ", Nw", x) → {0,1 }.

The data owner executes the Arbitrate () algorithm to process the arbitration request initiated by the smart contract or the user, corresponding to step # in fig. 2. The algorithm is executed as follows:

1) for arbitration requests from intelligent contracts, the data owner calculates H using the search result Nw ″ to be arbitrated₄(Nw "| | x) ∈ VRs. If yes, 1 is output, and the retrieval result is legal. Otherwise, 0 is output, which indicates that the retrieval result is illegal, and at the moment, the intelligent contract reserves a deposit and refuses to pay the service fee to the search server.

2) For arbitration requests from users, the data owner calculates H using the search result Nw 'to be arbitrated and the original keyword w' submitted by the user₄(w "| | Nw" | | | x) ∈ VRu whether or not. If yes, outputting 1, and indicating that the retrieval result is accurate. Otherwise, 0 is output, which indicates that the retrieval result is not accurate. The data owner broadcasts information corresponding to the search server into the blockchain, and the intelligent contract no longer pays a service fee to the server.

The application introduces a block chain technology in searchable encryption and provides a multi-keyword searchable encryption method based on a block chain. By the aid of the distribution algorithm and the retrieval algorithm designed in the method, a plurality of search servers participate in the retrieval process at the same time, multi-keyword retrieval is achieved, and dependence on a single cloud server node is reduced.

The present application is compared with the scheme of document 1[ Xu P, Tang S, Xu P, et al. practical multi-key and boron search over encrypted e-mail in closed server [ J ]. IEEE Transactions on Services Computing,2019,14(6): 1877-.

The application, the document [1] and the document [2] construct an asymmetric searchable encryption scheme based on bilinear pairing, and realize multi-keyword retrieval. The scheme of the application and the scheme of the document [2] introduces a block chain, meanwhile, the verification of the retrieval result is realized by using an intelligent contract, and the fair transaction is ensured. The two schemes can ensure the indistinguishable security of the trapdoor and resist keyword guessing attacks of internal and external users. The solution of document [2] stores the index in the blockchain, and since the data in the blockchain is transparent, the index presents a certain security risk. This application only needs to disclose the trapdoor in the block chain at the operation in-process, and the security is stronger.

While the solution of document [1] is based on a traditional cloud server architecture, the solution only includes an interaction process between a user and a cloud server. The scheme is constructed based on an honest cloud server model, lacks of verification of a credible party on a retrieval result, cannot guarantee fair transaction, and cannot resist guess attack of internal keywords.

TABLE 1 comparison of safety

Comparing the scheme of the document [1] [2] with the scheme of the document in terms of calculation amount, and analyzing the calculation amount of each algorithm in the index building stage, the trapdoor generation stage and the retrieval stage, as shown in table 2.

n represents the number of plaintext files, m represents the number of keywords, k represents the number of keywords in the query, and r represents the number of files corresponding to the query result (r < < n).

T_MRepresenting the amount of computation of a multiplication, T_HRepresenting the amount of computation of a hash operation, T_ERepresenting the amount of computation of a single exponentiation, T_PRepresenting the amount of computation of a bilinear pairing operation, where T_H<T_M<T_E<T_P。

In the index building stage, the calculation amount of the scheme of document [1] is mainly affected by the number of files due to the difference of the index structure. The scheme of the application and the scheme of the document [2] are greatly influenced by the number of keywords, and the calculated amount is similar.

In the trap door generation stage, the scheme of the application and the scheme of the document [1] [2] are related to the number of the searched keywords, and the document [2] uses power operation to the minimum and has the minimum calculation amount. The application at this stage involves bilinear pairing operations, which are the most computationally intensive.

In the retrieval phase, the scheme of document [1] is affected by the number of keywords and the number of files, and the calculation amount is the highest. The document [2] is not affected by other parameters, and the calculation amount is minimum. The calculation amount of the application is moderate.

In conclusion, the total calculation amount of the application in the three stages is moderate, but the application has stronger flexibility while ensuring safety.

TABLE 2 comparison of calculated amounts

Experimental analysis:

the execution efficiency of the application is analyzed by building an experimental environment. The experimental environment is 64-bit Windows10 operating system, the CPU is AMD Ryzen 74800H 2.90.90 GHz, and the memory is 16 GB. The experiment is carried out in a local virtual machine VMware Ubuntu16.04 virtual machine, the programming language is python, and the version is python 3.5.

The SHA256 algorithm is used as the hash function in the present application, and the AES symmetric encryption algorithm is used to encrypt the plaintext file. The data set used herein is the open acron Email data set, 3000 files of which were selected as original plaintext documents in the experiment, and 1200 keywords of which were extracted for experimental analysis. The time consumption of the method is compared with that of the scheme in the document [1] [2] in three stages of index construction, trapdoor generation and searching. The number of keywords was increased from 200 to 1200 in 200 steps during the experiment. Each experiment was repeated 50 times and the average was taken as the experimental result.

The time consumed in the index build phase is shown in FIG. 3 below. The abscissa is the number of keywords, and the ordinate represents the time taken to compute an index for 3000 plaintext documents based on the corresponding number of keywords. The scheme of document [1] is mainly affected by the number of files in the index building stage, and is hardly affected by the number of keywords. The application is similar in time consumption to the solution of document [2] at this stage, as shown in fig. 3.

The time consumed in the trapdoor generation phase is shown in fig. 4. The abscissa is the number of keys and the ordinate represents the time it takes to compute the search trapdoor for a corresponding number of keys. All three schemes are affected by the number of keywords. Document [2] involves the least amount of computation and takes the least time. The time consumption of the scheme is similar to that of the scheme in the document [1] at this stage, but the time consumption is slightly higher than that of the scheme in the document [1] when the number of the keywords is large because the scheme relates to bilinear pairings.

The time consumed in the search phase is shown in fig. 5, where the abscissa is the number of keywords included in the search request, and the ordinate is the time consumed in completing the corresponding search request. Since the present application supports the use of multiple Search servers to perform the retrieval process, the time consumption of the present application in the case of S _ Search ═ 1 and S _ Search ═ 4 is given in fig. 5, respectively. Wherein S _ Search represents a cloud server. The time consumption of this scheme is linearly related to the number of keywords with the scheme of document [1 ]. The time consumption of document [1] is hardly affected by the number of keywords. The solution is time consuming at this stage, which is moderate compared to the solution of document [1] [2 ].

Finally, the impact of the number of search servers on the overall time consumption of the scheme was tested, as shown in FIG. 6 below. The total time consumption is counted under the condition that 200 keywords and 3000 plaintext documents are in number, and the total time of the index building stage, the trapdoor generating stage and the retrieval stage is counted. And randomly selecting 20 keywords for each retrieval to construct a retrieval trapdoor and distributing the retrieval trapdoor to the search servers participating in the retrieval. It can be seen that the operating efficiency of the present application can be improved by increasing the number of search servers.

The application provides a multi-keyword searchable encryption method based on a block chain, ciphertext data are stored in a storage server, and indexes are stored in a search server. On the basis, a multi-keyword task distribution algorithm and a multi-keyword task retrieval algorithm are designed, so that a plurality of search servers simultaneously participate in the method operation, and the decentralization degree of the method is improved. An arbitration mechanism and an authentication mechanism based on an intelligent contract are designed, malicious behaviors of the cloud server can be prevented, and fair transaction between a user and the cloud server is guaranteed. Meanwhile, a keyword weight mechanism is designed, fuzzy results can be returned to a user when the multi-keyword search results are empty, and the method has higher flexibility. Experimental analysis proves that the method has higher efficiency.

Claims

1. A multi-keyword searchable encryption method based on a block chain is characterized in that:

and (3) trapdoor generation: a user generates a retrieval trapdoor by a plurality of keywords to be retrieved and initiates a retrieval request;

2. The blockchain-based multi-key searchable encryption method of claim 1, wherein said initializing comprises the steps of:

1) the data owner generates two multiplicative cyclic groups G of prime order p₁And G₂G is G₁A generator of (2); generating a bilinear map e: g₁×G₁→G₂(ii) a Selecting a pseudo-random function F: {0,1}^*→{0，1}^k(ii) a Selecting two cryptographic hash functions H₁：{0，1}^*→G₁And H₂：G₂→{0，1}^kK is an integer; selecting an anti-collision hash function H₃：{0，1}^*→{0，1}^k，H₄：{0，1}^*→{0，1}^k(ii) a Selecting a symmetric encryption algorithm (Enc, Dec); data owner publishes system public parameter pub ═ { p, G₁，G₂，e，F，H₁，H₂，H₃，H₄(Enc, Dec) }, and issues it to the blockchain;

User randomly selects u E Z_pCalculating

As private key, the user public key P is calculated_u＝g^u(ii) a The data owner and the user store the private key and release the public key as public information to the block chain;

2) the data owner creates an intelligent contract and issues the intelligent contract to the blockchain; the user and the search server need to call an intelligent contract in the scheme execution process to complete the whole retrieval process; after each retrieval, the user can extract the deposit withheld in the intelligent contract; the functions of the intelligent contract comprise: temporarily storing the service fee of the user and the deposit of the search server, decomposing and sending the search task, and verifying the search result.

3. The blockchain-based multi-key searchable encryption method of claim 1, wherein said index building comprises the steps of:

1) the data owner splits the plaintext file into keywords to obtain a keyword set W ═ W₁，w₂，w₃,.. }; the data owner encrypts a plaintext file by using a symmetric algorithm to obtain a ciphertext file, and randomly selects x e to Z_pFor plaintext file M_iIts corresponding ciphertext file C_i＝Enc(M_iK), k is a symmetric key, k ═ H₂(e(g，g^x) ); the ciphertext file set is C ═ C₁，C₂，C₃,. for file C_iAfter ordering the ciphertext files, distributing file numbers FN according to sequence number i_i＝2^i-1And calculate H₄(C_i) Obtaining VC { [ FN ]₁，H₄(C₁)]，[FN₂，H₄(C₂)]，...，[FN_i，H₄(C_i)]}; and the data owner sends all the ciphertext files C and the serial numbers thereof to the storage server and releases the VC to the block chain.

let the ciphertext file number set containing the key w be { FN₁，FN₂，FN₃，...}；

2-1) using the keyword w,calculating y as H₃(w)；

2-2) calculation of C_w＝e(g^x，g^y)＝e(g，g)^xy；

2-3) let Key be g^sxCalculating b ═ f (key);

2-4) calculating verify _ bit ═ e (H)₁(w)，Key)mod 2；

2-5) calculating the aggregated file number Nw ═ FN₁&FN₂&FN₃&.., and inserts verify _ bit into the b-th bit of Nw,&represents an and operation;

the index corresponding to the keyword w is Iw ═ Cw, Nw]The data owner performs the above operation on each keyword in the keyword set W to generate an index I ═ Iw₁，Iw₂,., then uploading the index to each search server; at the same time, the data owner calculates VN ═ H₄(Nw||x)，Vw＝H₄(w | | Nw | | x) the generation set VRs ═ VN₁，VN₂，VN₃,.. } and VRu ═ Vw₁，Vw₂，Vw₃,., arbitrating disputed search results;

3) the data owner sets the shared Key Key g^sxThe key is sent to each user, and the user can construct a legal retrieval trapdoor by using the key; data owner will x, VRs, VRu, S_DOStored as secret information.

4. The blockchain-based multi-key searchable encryption method of claim 1, wherein the trapdoor generation comprises the steps of:

1) setting the set of keywords to be searched as W ═ W₁，w₂，w₃,., the user needs to assign a weight p to each keyword at the same time to obtain a set W_p＝{[w₁，p₁]，[w₂，p₂]，[w₃，p₃],.. }; the weight represents the retrieval priority of each keyword, and is mainly used for calculating a fuzzy result when the retrieval result is empty, and the higher the weight is, the higher the possibility that the keyword is contained in the retrieval result is; if the user does not point toWeighted, then assigned in order by default, p_i＝2ⁱI is the serial number of the keyword;

1-1) calculating y ═ H₃(w)；

1-2) randomly selecting r epsilon Z_pCalculating

t2＝e(Key·g^y·g^r，P_DO)＝e(g^rsxy，P_DO)＝e(g，g)^rxy；

1-3) search trapdoor for keyword w

2) After the operations are executed on each keyword to be retrieved, a trapdoor set Tw { [ Tw ]) is obtained₁，p₁]，[tw₂，p₂]，[tw₃，p₃],., then the user sends the trap door set Tw and the service fee to an intelligent contract; since the intelligent contract may require arbitration by the data owner when verifying the retrieval result, the service fee sent by the user may include a portion of the arbitration fee.

5. The blockchain-based multi-key searchable encryption method of claim 1, wherein said distributing comprises the steps of:

1) within the time t after the contract account receives the trapdoor set and the service fee sent by the user, the search server participating in retrieval sends the deposit to the contract account; after the contract account receives the deposit, the search servers which successfully pay the deposit within the time t are sorted according to the payment sequence, the search trapdoors are distributed to the servers, and the transaction of the overtime payment deposit is returned to the original account; finally, a search server set S participating in retrieval is obtained;

2) in order to ensure the reliability of the retrieval result, each trapdoor is retrieved by 2 or more than 2 search servers; to be received by intelligent contractDecomposing a trapdoor set Tw into a plurality of subsets, and then distributing the obtained subsets to a search server, wherein each trapdoor in the Tw is at least contained in 2 subsets; search server S_iThe received subset is TS_i。

6. The blockchain-based multi-key searchable encryption method of claim 1, wherein said retrieving comprises the steps of:

1) all the search servers receive the trapdoor set TS sent by the intelligent contract_iThen, local retrieval is carried out on each trapdoor in the set to obtain a retrieval result set RS_i＝{Nw₁，Nw₂，...，Nw_jJ ∈ (1, m) }, j represents a trapdoor number, Nw_jRepresenting the retrieval result of the trapdoor with the number j;

2) for each trapdoor when the search server performs local retrieval

Utilizing locally stored index Iw ' ═ Cw ', Nw ']Calculating whether equation t1 '· Cw' ═ t2 'holds, and if yes, outputting 1, and adding corresponding Nw' to set RS_iPerforming the following steps; if not, 0 is output and 0 is added into the set RS_iThe detection result indicates that the corresponding retrieval result of the trapdoor is empty;

3) search server sets RS of search result_iSending the information to an intelligent contract for verification; if set RS_iIf the middle retrieval result is 0, the retrieval result is empty, and the retrieval process is ended; if set RS_iIf the non-0 result exists in the medium retrieval result, continuing to calculate;

4) for trapdoor set TS_iThe search result corresponding to all the keywords in the set is R _ TS_i＝Nw₁&Nw₂&...&Nw_jThe server participating in the search first calculates R _ TS_iIf R _ TS_iIf the result is more than 0, the result is not null, and the result R _ TS is searched_iSending the data to a user; if R _ TS_iIf 0, then calculate trapdoor TS according to keyword weight_iIs prepared byWeight of search result of set, result R _ SubTS with maximum weight_iReturned to the user as a fuzzy result.

7. The blockchain-based multi-key searchable encryption method of claim 1, wherein said verifying comprises the steps of:

1) suppose that the search result of 2 search servers for a certain keyword is Nw_iAnd Nw_i', Smart contract validation Nw_i＝Nw_iWhether the information is true or not is judged, namely whether the retrieval results corresponding to the trapdoors with the same number are the same or not is judged, and if yes, 1 is output; if not, 0 is output, and an arbitration request is sent to the data owner, wherein the request comprises Nw_iAnd Nw_i'; after all results are verified, returning the deposit of each search server by the intelligent contract, and distributing service fees to the search servers according to the number of the retrieved trapdoors; if the verification fails, the intelligent contract reserves a deposit and refuses to pay the service fee of the corresponding search server;

2) after the intelligent contract is verified, the verification result is sent to the user, and meanwhile, a transaction is initiated to return the deposit to the search server; after the time t, sending the service charge to the search server; if the user suspects that the retrieval result can initiate an arbitration request to the data owner, the transaction for paying the service fee is suspended during the time t.

8. The blockchain-based multi-key searchable encryption method of claim 1, wherein said decrypting comprises the steps of:

1) when the number of the search servers participating in the search is n, the user receives n search results { R _ TS }₁，R_TS₂，R_TS₃，...，R_TS_nA retrieval result represents a ciphertext file number set containing corresponding keywords; obtaining R _ Tw' by intersection of search results, R _ Tw ═ R _ TS₁&R_TS₂&R_TS₃&...&R_TS_n；

Calculating b ═ F (Key) by a user, and deleting the b-th bit of the R _ Tw' to obtain a final result R _ Tw; the user sends the result R _ Tw to a storage server to request a corresponding file; the storage server splits the file number according to the bit from the R _ Tw, and sends the file number to the user after finding out the corresponding file;

Then, executing a symmetric decryption algorithm to obtain a corresponding plaintext file M ═ Dec (C, k); h can also be calculated according to the ciphertext file C₄(C) ' and associate it with H stored in blockchain₄(C) And comparing to judge whether the ciphertext file is tampered.

9. The blockchain-based multi-key searchable encryption method of claim 1, wherein said arbitrating comprises the steps of:

1) for arbitration requests from intelligent contracts, the data owner calculates H using the search result Nw' to be arbitrated₄(Nw "| | x) whether to belong to VRs or not; if yes, outputting 1 to indicate that the retrieval result is legal; otherwise, outputting 0, indicating that the retrieval result is illegal, and at the moment, deducting a deposit by the intelligent contract and refusing to pay the service fee to the search server;

2) for arbitration requests from users, the data owner calculates H using the search results Nw 'to be arbitrated and the original keywords w' submitted by the users₄(w "| | Nw" | | x) ∈ whether VRu is true; if yes, outputting 1 to indicate that the retrieval result is accurate; otherwise, outputting 0, which indicates that the retrieval result is inaccurate; the data owner broadcasts information corresponding to the search server into the blockchain, and the intelligent contract no longer pays a service fee to the server.