CN106534092A - Message-based and key-dependent privacy data encryption method - Google Patents

Abstract

The invention discloses a method for encrypting private data based on a message depending on a key, which mainly solves key-related attacks and key-related attacks caused by distributing group public keys by e-mail without considering the correlation between plaintext and keys in the prior art. Key disclosure issue. The implementation steps are: 1. The authorization center initializes system parameters; 2. The user authenticates to the authorization center; 3. The authorization center distributes the key to the authenticated user; 4. The user processes the plaintext file according to the obtained key to obtain the encrypted key. 5. The user uploads the ciphertext to the cloud server; 6. When the user uses it, he requests the cloud server to download the ciphertext, and obtains the ciphertext for decryption after the request is passed. The invention adopts an encryption method based on a message depending on a key in a single-user mode to realize secure encryption of a blockchain wallet file, which can avoid key leakage, alleviate key-related attacks, and improve the security of the wallet file.

Description

Private data encryption method based on message-dependent key

technical field

The invention belongs to the technical field of data processing, and in particular relates to a method for encrypting private data, which can be used in the process of encrypting, backing up and uploading wallet files to a cloud server in a block chain.

Background technique

Blockchain is a decentralized distributed shared account book or database on the network, which builds extremely high security through high redundancy. Some have dubbed it a "trust machine," or the ability to collaborate with one another to create trust without a central authority. Blockchain technology is applicable to all fields that lack trust, so its application scope will become wider and wider. In the future blockchain, with the increase of user transaction volume, a large number of public-private key pairs need to be generated and stored by users. These keys are usually generated by the user and stored in a file or simple database, which can be called a wallet. A wallet is simply a collection of addresses and decryption keys. Having a private key is the only condition for using Bitcoin, so the private key must be kept secret and must be backed up, and the backup must be uploaded to the cloud server to prevent accidental loss. Therefore, the encryption security of the wallet is particularly important. After the user successfully registers with the authorization center, the authorization center distributes the encrypted symmetric key to the user. Due to key management loopholes or weak security awareness, users may directly use the symmetric key used to encrypt the wallet as the initial private key for generating a public-private key pair for transactions. If the wallet is encrypted at this time, the plaintext and key in the wallet are dependent, and the traditional security definition is not enough to maintain the security of the scheme. Subsequently, after uploading the ciphertext backup to the cloud server, if the user needs to download a file from the cloud server due to problems such as loss of local files, the user may need to download a file from the cloud server in order not to leak personal privacy information and plaintext information. Upload and download all ciphertexts, and only after local decryption can you get the files you want. In this case, the user needs to perform a large number of decryption operations, which reduces the user's work efficiency and consumes a large amount of computing resources and storage resources.

Wuhan University of Science and Technology disclosed a patent in its patent "A cloud storage data security sharing method with authority time control" (publication number: 105072180A, application number: 201510475566.4, application date: August 06, 2015). A cloud storage data security sharing method controlled by permission time. In this method, after the data owner creates a group, a pair of keys is automatically generated using a public key encryption algorithm. When the data owner shares a file, the file is encrypted using a symmetric encryption mechanism, and then the private key of the group to be shared is used to pair the key. Symmetric key encryption, and file ciphertext and key ciphertext are sent to the cloud, and the public key of the group is emailed to all users in the group to be shared. If the user has access rights, the public key can be obtained , to decrypt the file. The shortcomings of this method are: firstly, the patent does not consider the security issue of "the plaintext and the key may be related" when encrypting the symmetric key with the private key of the sharing group, which may cause key-related attacks; secondly, the In the patent, when the data owner sends the group public key to the group users by e-mail, the security of the e-mail is not considered. Once the e-mail is maliciously intercepted, the key will be leaked.

Contents of the invention

The object of the present invention is to address the above-mentioned existing deficiencies, and propose a private data encryption method based on a message that depends on a key, so as to avoid key leakage and improve the security of wallet files.

The technical solution of the present invention is that first, the authorization center completes the identity authentication process for the user, and then the user obtains the key for symmetric encryption, and uses the message-dependent key KDM symmetric encryption scheme to encrypt the plaintext to generate ciphertext to resist the encryption of the key. Related attacks. At the same time, searchable encryption is used to generate an index for plaintext to search for ciphertext. The implementation steps include the following:

(1) Initialization:

(1a) The authorization center determines the first security parameter λ, the second security parameter k, the third security parameter γ, the parameter τ of the number of keywords and the parameter θ=2- ^λ of the Bernoulli distribution, and defines the message length of the plaintext matrix 1, dimension N, packet length m, are respectively l=l(λ), N=N(λ), m=m(λ);

(1b) The authorization center defines the generation matrix of the error correction code as G=G _m×l , and sets the number of de-error correction codes as d=(θ+σ) m, according to the generation matrix G and the number of de-error correction codes d Select a set of binary linear error correction codes D, where G _m×l means that the generator matrix is of order m×l, and σ is a fixed value selected on the (0,1) interval;

(1c) For any bit string K∈{0,1} ^γ , the authorization center defines P _K (x) as a family of pseudorandom permutation functions on the interval {0,1} ^τ , and defines F _K (x) as the domain of {0,1} ^τ , the first family of pseudorandom functions with a range of {0,1} ^γ , define G _K (x) as the first family of pseudorandom functions with a domain of [1,n] and a range of {0,1} Two families of pseudorandom functions;

(1d) The authorization center discloses the error correction code D, the generation matrix G, the family of pseudo-random permutation functions P _K (x), the first family of pseudo-random functions F _K (x), the second family of pseudo-random functions G _K (x) and public parameters {l,m,N,θ};

(2) Identity registration:

(2a) The user submits personally identifiable information to the authorization center;

(2b) The authorization center checks whether the identity information submitted by the user is true, if true, execute step (3), otherwise, refuse to register;

(3) Key distribution:

(3a) Authorization center defines limited fields selection matrix As the symmetric key for the user to encrypt the plaintext, where, is an integer ring, 2 is a prime number;

(3b) The authorization center generates the key k _mac required for the operation of the message authentication code HMAC for the user;

(3c) The authorization center sends the message {S||k _mac ||γ||τ} to the user through a secure channel;

Among them, S is the symmetric key for the user to encrypt the plaintext, γ is the third security parameter, τ is the parameter of the number of keywords, and || represents the concatenation symbol;

(3d) The user keeps the symmetric key S, the message authentication code HMAC key k _mac , the third security parameter γ and the parameter τ of the number of keywords in secret;

(4) Processing plaintext files:

(4a) When the user encrypts the plaintext file ε _j , the plaintext matrix is divided into blocks, and each plaintext matrix block is defined as Among them, 1≤j≤n, n is the total number of plaintext files;

(4b) The user encrypts each plaintext matrix block M according to the symmetric key S to obtain the corresponding ciphertext matrix block W:

W=(A,C),

where A is from The coefficient matrix randomly selected in , C=A S+E+G M, S is the symmetric key, G is the generation matrix of the error correction code D, E is the noise matrix randomly selected from Ber _θ ^m×N , Ber _θ represents the Bernoulli distribution on {0,1}, the probability of 1 is θ, and the probability of 0 is 1-θ;

(4c) Concatenate all the ciphertext matrix blocks W of the plaintext file ε _j to obtain the ciphertext file ψ _j corresponding to the plaintext file ε _j ;

(4d) The user calculates the message authentication label T _j of the ciphertext file ψ _j according to the message authentication code HMAC key k _mac and the ciphertext file ψ _j :

T _j = HMAC(k _mac ,ψ _j ),

Among them, HMAC () represents the message authentication label generation algorithm;

(4e) The user randomly and uniformly selects the first secret value s∈{0,1} ^γ and the second secret value r∈{0,1} ^γ to generate an index that can record 2 ^τ keywords (i,w _i ) Dictionary, which stores the index dictionary and two secret values s and r secretly;

Among them, i is a label, i∈[1,2 ^τ ], w _i is a keyword, w _i ∈{0,1} ^* , * means any length;

(4f) The user generates the index bit string I _{j of the plaintext file ε j ;}

(5) Data upload:

(5a) The user sends the message authentication code key k _mac to the cloud server through a secure channel, and uploads the message {I _j ||ψ _j ||T _j } to the cloud server, where 1≤j≤n, n is the total number of plaintext files, || represents the concatenation symbol;

(5b) The cloud server performs integrity verification on each ciphertext file according to the following formula, and the verification result is represented by _vj :

v _j = Verify(k _mac ,ψ _j ,T _j ),

Among them, 1≤j≤n, n is the total number of plaintext files, and Verify() indicates the verification algorithm of the message authentication code HMAC;

If v _j = 1, it means that ψ _j has not been tampered with during the upload process, then the cloud server receives the message, saves the index string I _j in the index string set I, and returns "ψ _j uploaded successfully" to the user announcement of;

If v _j = 0, it indicates that ψ _j has been tampered with during the upload process, then the cloud server refuses to receive the message, and returns a notification of "ψ _j upload error" to the user;

(5c) The user determines whether the upload is successful according to the content of the notification received:

If the user receives the notification "ψ _j uploaded successfully", it means that ψ _j has been successfully uploaded to the cloud server;

If the user receives the "ψ _j upload error" notification, return to step (5a);

(6) Download the ciphertext and decrypt it:

(6a) The user generates a trapdoor for the keyword w _μ in the file to be downloaded And upload to the cloud server;

(6b) The cloud server according to the trapdoor Perform matching search on the stored file index bit string set I, if the matching is successful, the cloud server returns the corresponding ciphertext ψ to the user, and continue to step (6c); if the matching fails, the cloud server returns the "retrieval failed" message to the user Notice;

(6c) The user decrypts the ciphertext ψ to obtain the corresponding plaintext file ε.

Compared with the prior art, the present invention has the following advantages:

First, because the present invention considers the correlation between the plaintext and the key, the message depends on the key KDM symmetric encryption scheme to encrypt the plaintext. When a key management loophole occurs, it can resist key-related attacks and improve the security of the wallet. Document Security.

Second, because the present invention uses a single user to encrypt, upload and download files, it avoids the key leakage problem that exists when sharing keys with other users.

Description of drawings

Fig. 1 is the realization flowchart of the present invention;

Fig. 2 is a schematic diagram of processing plaintext files in the present invention;

Fig. 3 is a schematic diagram of downloading and decrypting ciphertext in the present invention.

detailed description

The present invention will be further described below in conjunction with the accompanying drawings.

With reference to Fig. 1, concrete steps of the present invention are as follows.

Step 1, initialization.

The authorization center determines the first security parameter λ, the second security parameter k, the third security parameter γ, the parameter τ of the number of keywords and the parameter θ=2- ^λ of the Bernoulli distribution; the message length l and dimension of the plaintext matrix are defined The number N and the packet length m are respectively l=l(λ), N=N(λ), m=m(λ); the authorization center defines the generation matrix of the error correction code as G=G _m×l , and sets the decorrection The number of error codes is d=(θ+σ) m, and a group of binary linear error correction codes D is selected according to the generator matrix G and the number d of error correction codes, where G _m×l means that the generator matrix is m×l order, σ is a fixed value selected on the (0,1) interval;

For any bit string K∈{0,1} ^γ , the authorization center defines P _K (x) as a family of pseudorandom permutation functions on the interval {0,1} ^τ , and defines F _K (x) as a domain of {0, 1} ^τ , the first family of pseudorandom functions with a range of {0,1} ^γ , define G _K (x) as the second family of pseudorandom functions with a domain of [1,n] and a range of {0,1} function family;

The authorization center discloses the error correction code D, the generator matrix G, the pseudo-random permutation function family P _K (x), the first pseudo-random function family F _K (x), the second pseudo-random function family G _K (x) and public parameters { l,m,N,θ}.

Step 2, identity registration.

The user submits the personal identity information to the authorization center, and the authorization center checks whether the identity information submitted by the user is true, and if true, executes step (3); otherwise, refuses to register.

Step 3, key distribution.

(3a) Authorization center defines limited fields selection matrix As the symmetric key for the user to encrypt the plaintext, where, is an integer ring, 2 is a prime number;

(3b) The authorization center uses the key generation algorithm HMAC-KeyGen(1 ^k ) of the message authentication code to generate the key k _mac required for the operation of the message authentication code HMAC for the user:

k _mac = HMAC-KeyGen(1 ^k ),

Wherein, k is the second security parameter selected by the authorization center;

(3c) The authorization center sends the message {S||k _mac ||γ||τ} to the user through a secure channel;

(3d) The user keeps the symmetric key S, the key k _mac of the message authentication code HMAC, the third security parameter γ and the parameter τ of the number of keywords in secret.

Step 4, process the plaintext file.

Set the total number of plaintext files that the user needs to encrypt as n, each plaintext file is represented by ε _j , 1≤j≤n,

Referring to Figure 2, the steps for the user to process the plaintext file ε _j are as follows:

(4a) The user blocks the plaintext matrix in the plaintext file ε _j , and defines each plaintext matrix block as Encrypt each plaintext matrix block M according to the symmetric key S to obtain the corresponding ciphertext matrix block W=(A, C), and concatenate all the ciphertext matrix blocks W of the plaintext file ε _j to obtain the corresponding plaintext file ε _j The ciphertext file ψ _j ;

where A is from The coefficient matrix randomly selected in , C=A S+E+G M, S is the symmetric key, G is the generation matrix of the error correction code D, E is the noise matrix randomly selected from Ber _θ ^m×N , Ber _θ represents the Bernoulli distribution on {0,1}, the probability of 1 is θ, and the probability of 0 is 1-θ;

(4b) The user calculates the message authentication label T _j of the ciphertext file ψ _j according to the message authentication code HMAC key k _mac and the ciphertext file ψ _j :

T _j = HMAC(k _mac ,ψ _j );

(4c) The user generates the index bit string I _j for the plaintext file ε _j according to the following steps:

(4c1) The user randomly and uniformly selects the first secret value s∈{0,1} ^γ and the second secret value r∈{0,1} ^γ to generate an index that can record 2 ^τ keywords (i,w _i ) Dictionary, where i is a label, i∈[1,2 ^τ ], w _i is a keyword, w _i ∈ {0,1} ^* , * means any length, and the index dictionary and two secret values s, r secret save;

(4c2) The user selects the pseudorandom permutation function P _s (x) in the pseudorandom permutation function family P _K (x) according to the first secret value s, and selects the first pseudorandom function family F _K (x) according to the second secret value r ) function F _r (x);

(4c3) The user calculates the subscript value r _i =F _r (i), i∈[1,2 ^τ ], and selects the function G _ri (x) in the second pseudorandom function family G _K (x) according to the value of r _i );

( ^4c4 ) The user generates a 2τ-long initial bit string I _j ′ for the plaintext file ε _j according to whether ε _j contains the keyword w _i :

If the plaintext file ε _j contains the keyword w _i , then set the P _s (i) bit of the initial bit string I _j ′ to 1, that is, I _j ′[P _s (i)]=1;

If the plaintext file ε _j does not contain the keyword w _i , then set the P _s (i) bit of the initial bit string I _j ′ to 0, that is, I _j ′[P _s (i)]=0;

Traverse all the values of i to get the initial bit string I _j ′;

(4c5) The user performs an XOR operation on the value of the i-th bit of the initial bit string I _j ′ and the function value G _ri (j), that is Obtain the value of the i-th bit of the index bit string I _j , traverse all the values of i, and obtain the index bit string I _j .

Step 5, data upload.

(5a) The user sends the message authentication code key k _mac to the cloud server through a secure channel, and uploads the message {I _j ||ψ _j ||T _j } to the cloud server, where 1≤j≤n, n is the total number of plaintext files, || represents the concatenation symbol;

(5b) The cloud server uses the verification algorithm Verify() of the message authentication code HMAC to verify the integrity of each ciphertext file, and the verification result is represented by v _j , that is, v _j = Verify(k _mac ,ψ _j ,T _j ) , where, 1≤j≤n, n is the total number of plaintext files;

If v _j = 1, it means that ψ _j has not been tampered with during the upload process, then the cloud server receives the message, saves the index string I _j in the index string set I, and returns "ψ _j uploaded successfully" to the user announcement of;

If v _j = 0, it indicates that ψ _j has been tampered with during the upload process, then the cloud server refuses to receive the message, and returns a notification of "ψ _j upload error" to the user;

(5c) The user determines whether the upload is successful according to the content of the notification received:

If the user receives the notification "ψ _j uploaded successfully", it means that ψ _j has been successfully uploaded to the cloud server;

If the user receives the notification of "ψ _j upload error", return to step (5a).

Step 6, download the ciphertext and decrypt it.

Referring to Figure 3, the specific implementation of this step is as follows:

(6a) The user generates a trapdoor for the keyword w _μ in the file to be downloaded And upload to the cloud server:

(6a1) The user finds the label μ corresponding to the keyword w _μ from the index dictionary;

(6a2) The user selects the pseudorandom permutation function P _s (x) in the pseudorandom permutation function family P _K (x) according to the first secret value s, and selects the first pseudorandom function family F _K (x) according to the second secret value r ) function F _r (x);

(6a3) The user calculates the replacement label p=P _s (μ) according to the label μ;

(6a4) The user calculates the function index value f=F _r (p) according to the replacement label p;

(6a5) Use the permutation label p and the function index value f to form a trapdoor

(6b) The cloud server according to the trapdoor Carry out matching retrieval to the stored file index bit string set I:

(6b1) The cloud server performs an XOR operation on the bit value corresponding to the replacement label p in the index bit string I _j and the function value G _f (j), that is Get the bit value corresponding to the replacement label p in the initial bit string I _j ′, where p is a trapdoor The permutation label in , f is the trapdoor The function index value in , G _f (x) is a pseudo-random function selected from the second pseudo-random function family G _K (x) according to the value of f, and I _j ′[p] represents the permutation in the initial bit string I _j ′ The bit value corresponding to the label p, I _j [p] represents the bit value corresponding to the replacement label p in the index bit string I _j , Indicates XOR operation;

(6b2) The cloud server traverses all values of j, if j∈[1,n] exists, so that the bit value corresponding to the replacement label p in the initial bit string I _j ′ is 1, that is, I _j ′[p]=1, then If the matching is successful, the cloud server returns the corresponding ciphertext ψ to the user, and continues to step (6c); if it does not exist, the matching fails, and the cloud server returns a notification of "retrieval failure" to the user;

(6c) The user decrypts the ciphertext ψ to obtain the corresponding plaintext file ε:

(6c1) The user calculates the intermediate matrix Q according to the symmetric key S and each ciphertext matrix block W=(A,C) in the ciphertext file ψ:

Q=C-A·S;

(6c2) The user calls the error correction code D to decode each column of the intermediate matrix Q, and obtains the corresponding plaintext matrix block M;

(6c3) The user concatenates all plaintext matrix blocks M to obtain the corresponding plaintext file ε.

The above description is only a specific example of the present invention, and does not constitute any limitation to the present invention. Obviously, for those skilled in the art, after understanding the content and principle of the present invention, it is possible without departing from the principle and structure of the present invention. In some cases, various modifications and changes in form and details are made, but these modifications and changes based on the idea of the present invention are still within the protection scope of the claims of the present invention.

Claims (6)

1. the privacy data encryption method of key is depended on based on message, is comprised the steps：

(1) initialize：

(1a) authorization center determines the first security parameter λ, the second security parameter k, the 3rd security parameter γ, the ginseng of keyword number Amount τ and parameter θ=2 of Bernoulli Jacob's distribution^-λ, the message-length l of definition plaintext matrix, dimension N, respectively block length m, l=l (λ), N=N (λ), m=m (λ)；

(1b) generator matrix that authorization center defines error correcting code is G=G_m×l, the number for arranging solution error correcting code is d=(θ+σ) m, Error correcting code number d is conciliate according to generator matrix G and chooses one group of binary linear error correcting code D, wherein, G_m×lExpression generator matrix is m × l ranks, σ be (0, the 1) fixed value chosen on interval；

(1c) for any Bit String K ∈ { 0,1 }^γ, authorization center definition P_KX () is { 0,1 }^τPseudo-random permutation letter on interval Number race, defines F_KX it is { 0,1 } that () is domain of definition^τ, codomain be { 0,1 }^γThe first pseudo-random function race, define G_KX () is definition The second pseudo-random function race that domain is [1, n], codomain is { 0,1 }；

(1d) authorization center discloses error correcting code D, generator matrix G, pseudo-random permutation family of functions P_K(x), the first pseudo-random function race F_K (x), the second pseudo-random function race G_K(x) and common parameter { l, m, N, θ }；

(2) identity registration：

(2a) personally identifiable information is submitted to authorization center by user；

(2b) authorization center audits whether the identity information that the user submits to is true, if truly, execution step (3) otherwise, is refused Register absolutely；

(3) key distribution：

(3a) authorization center defines finite fieldChoose matrixAs the symmetrical of user encryption plaintext Key, wherein,It is integer item, 2 is prime number；

(3b) key k of the authorization center for needed for user generates message authentication code HMAC operations_mac；

(3c) authorization center by safe lane by message S | | k_mac| | γ | | τ } it is sent to user；

Wherein, S is the symmetric key of user encryption plaintext, and γ is the 3rd security parameter, and τ is the parameter of keyword number, | | table Show cascade symbol；

(3d) user is by symmetric key S, message authentication code HMAC key k_mac, the 3rd security parameter γ and keyword number ginseng Amount τ is secret to be preserved；

(4) process clear text file：

(4a) user encryption clear text file ε_jWhen, piecemeal is carried out to its plaintext matrix, defining each plaintext matrix block isWherein, 1≤j≤n, n are clear text file sum；

(4b) user encrypts each plaintext matrix block M according to symmetric key S, obtains corresponding ciphertext matrix block W：

W=(A, C),

Wherein, A be fromIn the coefficient matrix that randomly selects, C=A S+E+G M, S are symmetric keys, and G is error correcting code D Generator matrix, E is from Ber_θ ^m×NIn the noise matrix that randomly selects, Ber_θRepresent { 0,1 } on Bernoulli Jacob distribution, 1 it is general Rate is θ, and 0 probability is 1- θ；

(4c) by clear text file ε_jAll of ciphertext matrix block W cascades up, and obtains clear text file ε_jCorresponding cryptograph files ψ_j；

(4d) user is according to message authentication code HMAC key k_macWith cryptograph files ψ_jCalculate cryptograph files ψ_jMessage authentication tag T_j：

T_j=HMAC (k_mac,ψ_j),

Wherein, HMAC () represents message authentication tag generating algorithm；

(4e) user uniformly chooses the first secret value s ∈ { 0,1 } at random^γ, the second secret value r ∈ { 0,1 }^γ, generating one can remember Record 2^τIndividual keyword (i, w_i) index dictionary, will index dictionary and two secret values s, r are secret preserves；

Wherein, i is label, i ∈ [1,2^τ], w_iFor keyword, w_i∈{0,1}^*, * represents random length；

(4f) user generates clear text file ε_jIndex bit string I_j；

(5) data are uploaded：

(5a) channel of the user by safety, by authentication code key k_macIt is sent to Cloud Server, and by message { I_j||ψ_j|| T_jCloud Server is uploaded to, wherein, 1≤j≤n, n are clear text file sum, | | represent cascade symbol；

(5b) Cloud Server carries out integrity verification, the result v according to the following formula to each cryptograph files_jRepresent：

v_j=Verify (k_mac,ψ_j,T_j),

Wherein, 1≤j≤n, n are that clear text file is total, and Verify () represents the verification algorithm of message authentication code HMAC；

If v_j=1, show ψ_jIt is not tampered with upload procedure, then the cloud server message, and by index character string I_jProtect It is stored in index character set of strings I, while returning " ψ to user_jUpload successfully " notice；

If v_j=0, show ψ_jIt is tampered in upload procedure, then Cloud Server rejects the message, and returns " ψ to user_j The notice of upload mistake "；

(5c) user determines whether to upload successfully according to the content of announcement for receiving：

If user receives " ψ_jUpload successfully " notice, show ψ_jIt has been successfully uploaded to Cloud Server；

If user receives " ψ_jUpload mistake " notice, then return to step (5a)；

(6) download ciphertext and decrypt：

(6a) user generates the keyword w that need to be downloaded in file_μTrapdoorAnd it is uploaded to Cloud Server；

(6b) Cloud Server is according to trapdoorFile index bit set of strings I to having stored carries out matching retrieval, if matching into Work(, Cloud Server return corresponding ciphertext ψ to user, continue step (6c)；If it fails to match, Cloud Server is returned to user The notice of " retrieval failure "；

(6c) user's decrypting ciphertext ψ obtains corresponding clear text file ε.

2. method according to claim 1, it is characterised in that authorization center is that user generates message authentication in step (3b) Key k needed for code HMAC operations_mac, calculate according to the following formula：

k_mac=HMAC-KeyGen (1^k),

Wherein, k be authorization center choose the second security parameter, HMAC-KeyGen (1^k) represent that the key of message authentication code is generated Algorithm, k_macIt is the authentication code key for generating.

3. method according to claim 1, it is characterised in that user generates clear text file ε in step (4f)_jIndex word Symbol string I_j, carry out as follows：

(4f1) user chooses pseudo-random permutation family of functions P according to the first secret value s_KPseudo-random permutation function P in (x)_s(x), First pseudo-random function race F is chosen according to the second secret value r_KFunction F in (x)_r(x)；

(4f2) calculate subscript value r_i=F_r(i), i ∈ [1,2^τ], according to r_iValue choose the second pseudo-random function race G_KIn (x) Function

(4f3) user is according to ε_jIn whether include keyword w_i, it is clear text file ε_jGenerate one 2^τLong bits of original string I '_j：

If clear text file ε_jComprising keyword w_i, then put bits of original string I '_jP_sI () position is 1, i.e. I '_j[P_s(i)]=1；

If clear text file ε_jNot comprising keyword w_i, then put bits of original string I '_jP_sI () position is 0, i.e. I '_j[P_s(i)]=0；

The all values of traversal i, obtain bits of original string I_j′；

(4f4) user is by bits of original string I_jThe value function value of ' i-th bitXor operation is carried out, i.e.,Obtain index bit string I_jI-th bit value, i ∈ [1,2^τ],Represent xor operation；

The all values of traversal i, obtain index bit string I_j。

4. method according to claim 1, it is characterised in that user generates the key that need to be downloaded in file in step (6a) Word w_μTrapdoorCarry out as follows：

(6a1) user is found and keyword w from index dictionary_μCorresponding label μ；

(6a2) user chooses pseudo-random permutation family of functions P according to the first secret value s_KPseudo-random permutation function P in (x)_s(x), First pseudo-random function race F is chosen according to the second secret value r_KFunction F in (x)_r(x)；

(6a3) user calculates displacement label p=P according to label μ_s(μ)；

(6a4) user calculates index functions value f=F according to displacement label p_r(p)；

(6a5) with displacement label p and index functions value f, constitute trapdoor

5. method according to claim 1, it is characterised in that Cloud Server is according to trapdoor in step (6b)To depositing File index bit set of strings I of storage carries out matching retrieval, carries out as follows：

(6b1) Cloud Server is by index bit string I_jMiddle displacement corresponding place value function values G of label p_fJ () carries out xor operation, I.e.Obtain bits of original string I '_jThe middle displacement corresponding place values of label p, wherein, p is trapdoorIn Displacement label, f is trapdoorIn index functions value, G_fX () is from the second pseudo-random function race G according to the value of f_KIn (x) The pseudo-random function of selection, I '_j[p] represents bits of original string I '_jThe middle displacement corresponding place values of label p, I_j[p] represents index ratio Special string I_jThe middle displacement corresponding place values of label p,Represent xor operation；

(6b2) Cloud Server travels through all values of j, if there is j ∈ [1, n] so that bits of original string I '_jMiddle displacement label p correspondences Place value be 1, i.e. I '_j[p]=1, then the match is successful；If not existing, it fails to match.

6. method according to claim 1, it is characterised in that it is right that the user's decrypting ciphertext ψ described in step (6c) is obtained Clear text file ε answered, is carried out as follows：

(6c1) user calculates middle square according to each ciphertext matrix block W=(A, C) in symmetric key S and cryptograph files ψ Battle array Q：

Q=C-A S；

(6c2) user calls error correcting code D to decode every string of intermediary matrix Q, obtains corresponding plaintext matrix block M；

(6c3) all of plaintext matrix block M is cascaded up by user, obtains corresponding clear text file ε.