CN106534092B - A message-dependent key-based encryption method for private data - Google Patents

Abstract

The invention discloses a privacy data encryption method based on message dependence on key, mainly solves the key-related attack and key-related attack caused by not considering the correlation between plaintext and key in the prior art and distributing group public key by e-mail. Key compromise problem. The implementation steps are: 1. The authorization center initializes the system parameters; 2. The user authenticates the user to the authorization center; 3. The authorization center distributes the key to the user who has passed the authentication; 5. The user uploads the ciphertext to the cloud server; 6. When the user uses it, he requests the cloud server to download the ciphertext, and after the request is passed, the ciphertext is obtained for decryption. The invention adopts the encryption method based on the message relying on the key in the single-user mode to realize the secure encryption of the blockchain wallet file, which can avoid key leakage, reduce key-related attacks, and improve the security of the wallet file.

Description

A message-dependent key-based encryption method for private data

technical field

The invention belongs to the technical field of data processing, and in particular relates to a privacy data encryption method, which can be used in the process of encrypting and backing up wallet files in a blockchain and uploading them to a cloud server.

Background technique

Blockchain is a decentralized distributed shared ledger or database on the network, which builds extremely high security through high redundancy. Some refer to this as a "trust machine," the collaboration that creates trust in each other without a central authority. Blockchain technology is applicable to all areas that lack trust, so its application scope will become wider and wider. In the future blockchain, with the increase of user transaction volume, a large number of public and private key pairs need to be generated and stored by users. And these keys are usually generated by the user and stored in a file or simple database, which can be called a wallet. A wallet is a simple collection of multiple addresses and decryption keys. Owning the private key is the only condition for using Bitcoin, so the private key must be kept secret and must be backed up, and the backup must be uploaded to the cloud server in case of accidental loss. Therefore, the encryption security of wallets is particularly important. After the user successfully registers with the authorization center, the authorization center distributes the encrypted symmetric key to the user. Due to key management loopholes or poor security awareness, users may directly use the symmetric key used to encrypt the wallet as the initial private key for generating the public-private key pair used in the transaction. If the wallet is encrypted at this time, the plaintext and keys in the wallet are dependent, and the traditional security definition is not enough to maintain the security of the scheme. Then, after uploading the ciphertext backup to the cloud server, if the user needs to download a file from the cloud server due to problems such as loss of local files, in order not to leak personal privacy information and plaintext information, the user may need to download a file from the cloud server. Download all the ciphertexts on the Internet, and decrypt them locally to get the files you want. In this case, the user needs to perform a large number of decryption operations, which reduces the user's work efficiency and consumes a large amount of computing resources and storage resources.

Wuhan University of Science and Technology in its patent application "A method for secure sharing of cloud storage data with authority and time control" (publication number: 105072180A, application number: 201510475566.4, application date: August 6, 2015) discloses a method with A method for secure sharing of cloud storage data with permission and time control. In this method, after the data owner creates a group, a pair of keys is automatically generated by a public key encryption algorithm. When the data owner shares a file, a symmetric cryptographic mechanism is used to encrypt the file, and then the private key pair of the group to be shared is used to encrypt the file. Symmetric key encryption, send the file ciphertext and key ciphertext to the cloud, and send the public key of the group to all users of the group to be shared by email. If the user has access rights, they can obtain the public key , decrypt the file. The shortcomings of this method are: first, the patent does not consider the security issue of "the plaintext and the key may be related" when encrypting the symmetric key with the private key of the shared group, which may cause key related attacks; In the patent, when the data owner emails the group public key to the group users, it does not consider the security of the email. Once the email is maliciously intercepted, the key will be leaked.

SUMMARY OF THE INVENTION

The purpose of the present invention is to propose a private data encryption method based on a message that depends on a key to avoid the leakage of the key and improve the security of the wallet file.

The technical scheme of the present invention is that, firstly, the authorization center completes the user's identity authentication process, and then the user obtains a symmetric encryption key, and uses the message-dependent key KDM symmetric encryption scheme to encrypt the plaintext to generate ciphertext, so as to resist the key Related attacks, at the same time, use searchable encryption to generate an index for the plaintext to make the ciphertext searchable. The implementation steps include the following:

(1) Initialization:

(1a) The authorization center determines the first security parameter λ, the second security parameter k, the third security parameter γ, the parameter τ of the number of keywords, and the parameter θ=2- ^λ of the Bernoulli distribution, and defines the message length of the plaintext matrix l, dimension N, grouping length m, respectively l=l(λ), N=N(λ), m=m(λ);

(1b) The authorization center defines the generation matrix of error correction codes as G=G _m×l , and sets the number of error correction codes as d=(θ+σ)·m. According to the generation matrix G and the number of error correction codes d Select a set of binary linear error correction codes D, where G _m×l indicates that the generator matrix is of order m×l, and σ is a fixed value selected in the (0,1) interval;

(1c) For any bit string K∈{0,1} ^γ , the authority defines P _K (x) as a pseudo-random permutation function family on the interval {0,1} ^τ , and defines F _K (x) as the domain of {0,1} ^τ , the first pseudorandom function family whose value range is {0,1} ^γ , G _K (x) is defined as the first pseudorandom function family whose definition domain is [1,n] and whose value range is {0,1} Two pseudorandom function families;

(1d) The authorization center publishes the error correction code D, the generator matrix G, the pseudo-random permutation function family P _K (x), the first pseudo-random function family F _K (x), the second pseudo-random function family G _K (x) and public parameters {l,m,N,θ};

(2) Identity registration:

(2a) The user submits personally identifiable information to the authorization center;

(2b) The authorization center examines whether the identity information submitted by the user is true, if true, execute step (3), otherwise, refuse to register;

(3) Key distribution:

(3a) Authorization center defines a finite field selection matrix As the symmetric key for the user to encrypt plaintext, where, is a ring of integers, and 2 is a prime number;

(3b) the authorization center generates the key k _mac required for the HMAC operation of the message authentication code for the user;

(3c) The authorization center sends the message {S||k _mac ||γ||τ} to the user through a secure channel;

Among them, S is the symmetric key for the user to encrypt the plaintext, γ is the third security parameter, τ is the parameter of the number of keywords, and || represents the concatenation symbol;

(3d) The user secretly stores the symmetric key S, the message authentication code HMAC key k _mac , the third security parameter γ and the parameter τ of the number of keywords;

(4) Processing plaintext files:

(4a) When the user encrypts the plaintext file _εj , the plaintext matrix is divided into blocks, and each plaintext matrix block is defined as Among them, 1≤j≤n, n is the total number of plaintext files;

(4b) The user encrypts each plaintext matrix block M according to the symmetric key S, and obtains the corresponding ciphertext matrix block W:

W = (A, C),

where A is from Randomly selected coefficient matrix in , C=A·S+E+G·M, S is the symmetric key, G is the generator matrix of the error correction code D, E is the noise matrix randomly selected from Ber _θ ^m×N , Ber _θ represents the Bernoulli distribution on {0,1}, the probability of 1 is θ, and the probability of 0 is 1-θ;

(4c) concatenate all the ciphertext matrix blocks W of the plaintext file _εj to obtain the ciphertext file _ψj corresponding to the plaintext file _εj ;

(4d) The user calculates the message authentication label T _j of the cipher text file ψ _j according to the message authentication code HMAC key k _mac and the cipher text file ψ _j :

T _j =HMAC(k _mac ,ψ _j ),

Wherein, HMAC() represents the message authentication label generation algorithm;

(4e) The user randomly and uniformly selects the first secret value s∈{0,1} ^γ and the second secret value r∈{0,1} ^γ to generate an index that can record 2 ^τ keywords (i, _wi ) Dictionary, keep the index dictionary and two secret values s, r secretly;

Among them, i is a label, i∈[1,2 ^τ ], _wi is a keyword, _wi ∈{0,1} ^* , * represents any length;

(4f) the user generates the index bit string I _{j of the plaintext file ε j ;}

(5) Data upload:

(5a) The user sends the message authentication code key k _mac to the cloud server through a secure channel, and uploads the message {I _j ||ψ _j ||T _j } to the cloud server, where 1≤j≤n, n is the total number of plaintext files, || represents concatenated symbols;

(5b) The cloud server verifies the integrity of each ciphertext file according to the following formula, and the verification result is represented by v _j :

v _j =Verify(k _mac ,ψ _j ,T _j ),

Among them, 1≤j≤n, n is the total number of plaintext files, Verify() indicates the verification algorithm of the message authentication code HMAC;

If v _j = 1, it indicates that ψ _j has not been tampered with during the uploading process, the cloud server receives the message, saves the index string I _j into the index string set I, and returns "ψ _j upload successfully" to the user at the same time announcement of;

If v _j = 0, indicating that ψ _j has been tampered with during the uploading process, the cloud server refuses to receive the message, and returns a notification of "ψ _j upload error" to the user;

(5c) The user determines whether the upload is successful according to the content of the notification received:

If the user receives a notification of "ψ _j uploading successfully", it indicates that ψ _j has been successfully uploaded to the cloud server;

If the user receives the notification of " _ψj upload error", then return to step (5a);

(6) Download the ciphertext and decrypt it:

(6a) The user generates a trapdoor for the keyword w _μ in the file to be downloaded And upload to cloud server;

(6b) Cloud server according to trapdoor The stored file index bit string set I is matched and retrieved, and if the match is successful, the cloud server returns the corresponding ciphertext ψ to the user, and proceeds to step (6c); if the match fails, the cloud server returns "retrieval failure" to the user. Notice;

(6c) The user decrypts the ciphertext ψ to obtain the corresponding plaintext file ε.

Compared with the prior art, the present invention has the following advantages:

First, the present invention adopts the KDM symmetric encryption scheme that depends on the key to encrypt the plaintext due to the consideration of the correlation between the plaintext and the key. When a key management loophole occurs, the key-related attack can be resisted, and the wallet is improved. file security.

Second, since the present invention uses a single user to encrypt, upload and download files, the problem of key leakage when sharing keys with other users is avoided.

Description of drawings

Fig. 1 is the realization flow chart of the present invention;

Fig. 2 is the schematic diagram of processing plaintext file in the present invention;

FIG. 3 is a schematic diagram of downloading and decrypting ciphertext in the present invention.

Detailed ways

The present invention will be further described below with reference to the accompanying drawings.

1, the specific steps of the present invention are as follows.

Step 1, initialization.

The authorization center determines the first security parameter λ, the second security parameter k, the third security parameter γ, the parameter τ of the number of keywords and the parameter θ=2- ^λ of the Bernoulli distribution; the message length 1 of the definition plaintext matrix, the dimension The number N and the packet length m are respectively l=l(λ), N=N(λ), m=m(λ); the authorization center defines the generation matrix of the error correction code as G=G _m×l , and set the de-correction code The number of error codes is d=(θ+σ) m, and a set of binary linear error correction codes D is selected according to the generator matrix G and the number of error correction codes d, where G _m×l indicates that the generator matrix is m×l order, σ is a fixed value selected on the (0,1) interval;

For any bit string K∈{0,1} ^γ , the authority defines P _K (x) as a pseudo-random permutation function family on the interval {0,1} ^τ , and defines F _K (x) as a domain of {0, 1} ^τ , the first pseudo-random function family whose value domain is {0,1} ^γ , define G _K (x) as the second pseudo-random function family whose definition domain is [1,n] and value domain is {0,1} family of functions;

The authorization center publishes the error correction code D, the generator matrix G, the pseudorandom permutation function family P _K (x), the first pseudo random function family F _K (x), the second pseudo random function family G _K (x) and the public parameters { l,m,N,θ}.

Step 2, identity registration.

The user submits the personal identity information to the authorization center, and the authorization center examines whether the identity information submitted by the user is true. If it is true, step (3) is performed, otherwise, the registration is refused.

Step 3, key distribution.

(3a) Authorization center defines a finite field selection matrix As the symmetric key for the user to encrypt plaintext, where, is a ring of integers, and 2 is a prime number;

(3b) The authorization center uses the message authentication code key generation algorithm HMAC-KeyGen(1 ^k ) to generate the key k _mac required for the message authentication code HMAC operation for the user:

k _mac =HMAC-KeyGen(1 ^k ),

Wherein, k is the second security parameter selected by the authorization center;

(3c) The authorization center sends the message {S||k _mac ||γ||τ} to the user through a secure channel;

(3d) The user secretly stores the symmetric key S, the key k _mac of the message authentication code HMAC, the third security parameter γ and the parameter τ of the number of keywords.

Step 4, process the plaintext file.

Set the total number of plaintext files to be encrypted by the user as n, each plaintext file is represented by ε _j , 1≤j≤n,

Referring to Figure 2, the steps for the user to process the plaintext file _εj are as follows:

(4a) The user blocks the plaintext matrix in the plaintext file _εj , and defines each plaintext matrix block as Encrypt each plaintext matrix block M according to the symmetric key S to obtain the corresponding ciphertext matrix block W ₌ (A, C), and concatenate all the ciphertext matrix blocks W of the plaintext file εj to obtain the corresponding plaintext file _εj ciphertext file ψ _j ;

where A is from Randomly selected coefficient matrix in , C=A·S+E+G·M, S is the symmetric key, G is the generator matrix of the error correction code D, E is the noise matrix randomly selected from Ber _θ ^m×N , Ber _θ represents the Bernoulli distribution on {0,1}, the probability of 1 is θ, and the probability of 0 is 1-θ;

(4b) According to the message authentication code HMAC key k _mac and the ciphertext file ψ _j , the user uses the following formula to calculate the message authentication label T _{j of the ciphertext file ψ j :}

T _j =HMAC(k _mac ,ψ _j );

(4c) The user generates the index bit string I _j for the plaintext file ε _j as follows:

(4c1) The user randomly and uniformly selects the first secret value s∈{0,1} ^γ and the second secret value r∈{0,1} ^γ to generate an index that can record 2 ^τ keywords (i, _wi ) dictionary, where i is the label, i∈[1,2 ^τ ], _wi is the keyword, _wi ∈{0,1} ^* , * denotes any length, the index dictionary and the two secret values s, r are secret save;

(4c2) The user selects the pseudo-random permutation function P _s (x) in the pseudo-random permutation function family P _K (x) according to the first secret value s, and selects the first pseudo-random function family F _K (x) according to the second secret value r ) in the function F _r (x);

(4c3) The user calculates the subscript value ri =F _r ( _i ), i∈[1,2 ^τ ], and selects the function G _ri (x ₎ in the second pseudo-random function family G _K (x) according to the value of ri );

(4c4) The user generates an initial bit string I _j ′ with a length of 2 ^τ for the plaintext file ε _j according to whether the keyword _wi is contained in ε _j :

If the plaintext file ε _j contains the keyword _wi , set the P _s (i)th bit of the initial bit string I _j ′ to 1, that is, I _j ′[P _s (i)]=1;

If the plaintext file ε _j does not contain the keyword _wi , set the P _s (i)th bit of the initial bit string I _j ′ to 0, that is, I _j ′[P _s (i)]=0;

Traverse all the values of i to obtain the initial bit string I _j ';

(4c5) The user performs an exclusive OR operation on the value of the ith bit of the initial bit string I _j ' and the function value G _ri (j), that is, Obtain the value of the ith bit of the index bit string I _j , and traverse all the values of i to obtain the index bit string I _j .

Step 5, data upload.

(5a) The user sends the message authentication code key k _mac to the cloud server through a secure channel, and uploads the message {I _j ||ψ _j ||T _j } to the cloud server, where 1≤j≤n, n is the total number of plaintext files, || represents concatenated symbols;

(5b) The cloud server uses the verification algorithm Verify() of the message authentication code HMAC to verify the integrity of each ciphertext file, and the verification result is represented by v _j , that is, v _j =Verify(k _mac ,ψ _j ,T _j ) , where 1≤j≤n, n is the total number of plaintext files;

If v _j = 1, it indicates that ψ _j has not been tampered with during the uploading process, the cloud server receives the message, saves the index string I _j into the index string set I, and returns "ψ _j upload successfully" to the user at the same time announcement of;

If v _j = 0, indicating that ψ _j has been tampered with during the uploading process, the cloud server refuses to receive the message, and returns a notification of "ψ _j upload error" to the user;

(5c) The user determines whether the upload is successful according to the content of the notification received:

If the user receives a notification of "ψ _j uploading successfully", it indicates that ψ _j has been successfully uploaded to the cloud server;

If the user receives the notification of " _ψj uploading error", go back to step (5a).

Step 6, download the ciphertext and decrypt it.

Referring to Fig. 3, the concrete realization of this step is as follows:

(6a) The user generates a trapdoor for the keyword w _μ in the file to be downloaded And upload to cloud server:

(6a1) The user finds the label μ corresponding to the keyword w _μ from the index dictionary;

(6a2) The user selects the pseudo-random permutation function P _s (x) in the pseudo-random permutation function family P _K (x) according to the first secret value s, and selects the first pseudo-random function family F _K (x) according to the second secret value r ) in the function F _r (x);

(6a3) The user calculates the replacement label p=P _s (μ) according to the label μ;

(6a4) The user calculates the function index value f=F _r (p) according to the replacement label p;

(6a5) Use the permutation label p and the function index value f to form a trapdoor

(6b) Cloud server according to trapdoor Perform matching retrieval on the stored file index bit string set I:

(6b1) The cloud server performs an exclusive OR operation on the bit value corresponding to the replacement label p in the index bit string I _j and the function value G _f (j), that is, Obtain the bit value corresponding to the permutation label p in the initial bit string I _j ', where p is the trapdoor permutation label in , f is a trapdoor The function index value in , G _f (x) is a pseudo-random function selected from the second pseudo-random function family G _K (x) according to the value of f, I _j '[p] represents the permutation in the initial bit string I _j ' The bit value corresponding to the label p, I _j [p] represents the bit value corresponding to the replacement label p in the index bit string I _j , Represents an XOR operation;

(6b2) The cloud server traverses all the values of j. If j∈[1,n] exists, so that the bit value corresponding to the replacement label p in the initial bit string I _j ′ is 1, that is, I _j ′[p]=1, then If the matching is successful, the cloud server returns the corresponding ciphertext ψ to the user, and proceeds to step (6c); if it does not exist, the matching fails, and the cloud server returns a notification of "retrieval failure" to the user;

(6c) The user decrypts the ciphertext ψ to obtain the corresponding plaintext file ε:

(6c1) The user calculates the intermediate matrix Q according to the symmetric key S and each ciphertext matrix block W=(A, C) in the ciphertext file ψ:

Q=C-A·S;

(6c2) the user calls the error correction code D to decode each column of the intermediate matrix Q, and obtains the corresponding plaintext matrix block M;

(6c3) The user concatenates all the plaintext matrix blocks M to obtain the corresponding plaintext file ε.

The above description is only a specific example of the present invention, and does not constitute any limitation to the present invention. Obviously, for those skilled in the art, after understanding the content and principle of the present invention, they may not deviate from the principle and structure of the present invention. Under certain circumstances, various corrections and changes in form and details are made, but these corrections and changes based on the idea of the present invention are still within the scope of protection of the claims of the present invention.

Claims (6)

1. based on the privacy data encryption method that message depends on key, it is characterized in that, comprise the steps: (1) Initialization: (1a) The authorization center determines the first security parameter λ, the second security parameter k, the third security parameter γ, the parameter τ of the number of keywords, and the parameter θ=2- ^λ of the Bernoulli distribution, and defines the message length of the plaintext matrix l, dimension N, grouping length m, respectively l=l(λ), N=N(λ), m=m(λ); (1b) The authorization center defines the generation matrix of error correction codes as G=G _m×l , and sets the number of error correction codes as d=(θ+σ)·m. According to the generation matrix G and the number of error correction codes d Select a set of binary linear error correction codes D, where G _m×l indicates that the generator matrix is of order m×l, and σ is a fixed value selected in the (0,1) interval; (1c) For any bit string K∈{0,1} ^γ , the authority defines P _K (x) as a pseudo-random permutation function family on the interval {0,1} ^τ , and defines F _K (x) as the domain of {0,1} ^τ , the first pseudorandom function family whose value range is {0,1} ^γ , G _K (x) is defined as the first pseudorandom function family whose definition domain is [1,n] and whose value range is {0,1} Two pseudorandom function families; (1d) The authorization center discloses the binary linear error correction code D, the generator matrix G of the error correction code, the pseudo-random permutation function family P _K (x), the first pseudo-random function family F _K (x), the second pseudo-random function family G _K (x) and public parameters {l,m,N,θ}; (2) Identity registration: (2a) The user submits personally identifiable information to the authorization center; (2b) The authorization center examines whether the identity information submitted by the user is true, if true, execute step (3), otherwise, refuse to register; (3) Key distribution: (3a) Authorization center defines a finite field selection matrix As the symmetric key for the user to encrypt plaintext, where, is a ring of integers, and 2 is a prime number; (3b) the authorization center generates the key k _mac required for the HMAC operation of the message authentication code for the user; (3c) The authorization center sends the message {SPk _mac PγPτ} to the user through the secure channel; Among them, S is the symmetric key of the encrypted plaintext of the user, γ is the third security parameter, τ is the parameter of the number of keywords, and P represents the concatenated symbol; (3d) The user secretly stores the symmetric key S, the message authentication code HMAC key k _mac , the third security parameter γ and the parameter τ of the number of keywords; (4) Processing plaintext files: (4a) When the user encrypts the plaintext file _εj , the plaintext matrix is divided into blocks, and each plaintext matrix block is defined as Among them, 1≤j≤n, n is the total number of plaintext files; (4b) The user encrypts each plaintext matrix block M according to the symmetric key S, and obtains the corresponding ciphertext matrix block W: W = (A, C), where A is from Randomly selected coefficient matrix in , C=A·S+E+G·M, S is the symmetric key, G is the generator matrix of the error correction code D, E is the noise matrix randomly selected from Ber _θ ^m×N , Ber _θ represents the Bernoulli distribution on {0,1}, the probability of 1 is θ, and the probability of 0 is 1-θ; (4c) concatenate all the ciphertext matrix blocks W of the plaintext file _εj to obtain the ciphertext file _ψj corresponding to the plaintext file _εj ; (4d) The user calculates the message authentication label T _j of the cipher text file ψ _j according to the message authentication code HMAC key k _mac and the cipher text file ψ _j : T _j =HMAC(k _mac ,ψ _j ), Wherein, HMAC() represents the message authentication label generation algorithm; (4e) The user randomly and uniformly selects the first secret value s∈{0,1} ^γ and the second secret value r∈{0,1} ^γ to generate an index that can record 2 ^τ keywords (i, _wi ) Dictionary, keep the index dictionary and two secret values s, r secretly; Among them, i is a label, i∈[1,2 ^τ ], _wi is a keyword, _wi ∈{0,1} ^* , * represents any length; (4f) the user generates the index bit string I _{j of the plaintext file ε j ;} (5) Data upload: (5a) The user sends the message authentication code key k _mac to the cloud server through a secure channel, and uploads the message {I _j Pψ _j PT _j } to the cloud server, where 1≤j≤n, n is a plaintext file The total number, P represents the concatenated symbol; (5b) The cloud server verifies the integrity of each ciphertext file according to the following formula, and the verification result is represented by v _j : v _j =Verify(k _mac ,ψ _j ,T _j ), Among them, 1≤j≤n, n is the total number of plaintext files, Verify() indicates the verification algorithm of the message authentication code HMAC; If v _j = 1, it indicates that ψ _j has not been tampered with during the uploading process, the cloud server receives the message, saves the index string I _j into the index string set I, and returns "ψ _j upload successfully" to the user at the same time announcement of; If v _j = 0, indicating that ψ _j has been tampered with during the uploading process, the cloud server refuses to receive the message, and returns a notification of "ψ _j upload error" to the user; (5c) The user determines whether the upload is successful according to the content of the notification received: If the user receives a notification of "ψ _j uploading successfully", it indicates that ψ _j has been successfully uploaded to the cloud server; If the user receives the notification of " _ψj upload error", then return to step (5a); (6) Download the ciphertext and decrypt it: (6a) The user generates a trapdoor for the keyword w _μ in the file to be downloaded And upload to cloud server; (6b) Cloud server according to trapdoor The stored file index bit string set I is matched and retrieved, and if the match is successful, the cloud server returns the corresponding ciphertext ψ to the user, and proceeds to step (6c); if the match fails, the cloud server returns "retrieval failure" to the user. Notice; (6c) The user decrypts the ciphertext ψ to obtain the corresponding plaintext file ε. 2. method according to claim 1, is characterized in that, in step (3b), authorization center generates the required key k _mac of message authentication code HMAC operation for the user, calculates according to following formula: k _mac =HMAC-KeyGen(1 ^k ), Among them, k is the second security parameter selected by the authorization center, HMAC-KeyGen(1 ^k ) represents the key generation algorithm of the message authentication code, and k _mac is the generated message authentication code key. 3. method according to claim 1, is characterized in that, in step (4f), user generates the index string I _j of plaintext file ε _j , carries out as follows: (4f1) The user selects the pseudo-random permutation function P _s (x) in the pseudo-random permutation function family P _K (x) according to the first secret value s, and selects the first pseudo-random function family F _K (x) according to the second secret value r ) in the function F _r (x); (4f2) Calculate the subscript value ri =F _r ( _i ), i∈[1,2 ^τ ], and select the function in the second pseudo-random function family G _K (x) according to the value of _ri (4f3) The user generates an initial bit string I′ _j with a length of 2 ^τ for the plaintext file ε _j according to whether ε _j contains the keyword _wi : If the plaintext file ε _j contains the keyword w _i , set the P _s (i)th bit of the initial bit string I′ _j to 1, that is, I′ _j [P _s (i)]=1; If the plaintext file ε _j does not contain the keyword w _i , set the P _s (i)th bit of the initial bit string I′ _j to 0, that is, I′ _j [P _s (i)]=0; Traverse all the values of i to obtain the initial bit string I′ _j ; (4f4) The user compares the value of the _i -th bit of the initial bit string I′j with the function value perform an exclusive OR operation, i.e. Obtain the value of the ith bit of the index bit string I _j , i∈[1,2 ^τ ], Represents an XOR operation; All values of i are traversed to obtain the index bit string I _j . 4. method according to claim 1 is characterized in that, in step (6a), user generates the trapdoor of keyword w _μ in the file that needs to be downloaded Proceed as follows: (6a1) The user finds the label μ corresponding to the keyword w _μ from the index dictionary; (6a2) The user selects the pseudo-random permutation function P _s (x) in the pseudo-random permutation function family P _K (x) according to the first secret value s, and selects the first pseudo-random function family F _K (x) according to the second secret value r ) in the function F _r (x); (6a3) The user calculates the replacement label p=P _s (μ) according to the label μ; (6a4) The user calculates the function index value f=F _r (p) according to the replacement label p; (6a5) Use the permutation label p and the function index value f to form a trapdoor 5. method according to claim 1, is characterized in that, in step (6b), cloud server according to trapdoor The matching retrieval is performed on the stored file index bit string set I, and the steps are as follows: (6b1) The cloud server performs an exclusive OR operation on the bit value corresponding to the replacement label p in the index bit string I _j and the function value G _f (j), that is, Obtain the bit value corresponding to the permutation label p in the initial bit string _I'j , where p is the trapdoor permutation label in , f is a trapdoor The function index value in , G _f (x) is a pseudo-random function selected from the second pseudo-random function family G _K (x) according to the value of f, I′ _j [p] represents the permutation in the initial bit string I′ _j The bit value corresponding to the label p, I _j [p] represents the bit value corresponding to the replacement label p in the index bit string I _j , Represents an XOR operation; (6b2) The cloud server traverses all the values of j. If j∈[1,n] exists, so that the bit value corresponding to the replacement label p in the initial bit string _I′j is 1, that is, _I′j [p]=1, then The match succeeds; if it does not exist, the match fails. 6. method according to claim 1, is characterized in that, user described in step (6c) decrypts ciphertext ψ to obtain corresponding plaintext file ε, carry out according to the following steps: (6c1) The user calculates the intermediate matrix Q according to the symmetric key S and each ciphertext matrix block W=(A, C) in the ciphertext file ψ: Q=C-A·S; (6c2) the user calls the binary linear error correction code D to decode each column of the intermediate matrix Q, and obtains the corresponding plaintext matrix block M; (6c3) The user concatenates all the plaintext matrix blocks M to obtain the corresponding plaintext file ε.