CN117134993A - Detectable method and device for retrieving ciphertext based on cumulative commitment verification - Google Patents

Abstract

The invention discloses a search ciphertext detectable method and equipment based on accumulated promise verification, wherein the method comprises an accumulated vector promise verification method and a full-dynamic safe ciphertext search and detection method; the verification method capable of accumulating vector promises solves the problem that ciphertext is difficult to update due to fixed vector size, and the invention realizes a data verifiable structure supporting full-dynamic operation, supports concurrent processing of verification operation and promises spending of fixed constant size, so that system efficiency is remarkably improved. The full-dynamic safe ciphertext retrieval and detection method solves the problems of leakage safety caused by dynamic operation and difficult detection of malicious behaviors of a malicious server, achieves forward and backward safety by recording different updating states and other operations, and remarkably improves the system safety by detecting retrieval results returned by the server through an additively vector promised verifiable structure.

Description

Detectable method and device for retrieving ciphertext based on cumulative commitment verification

Technical field

The invention belongs to the technical field of integrity detection ciphertext retrieval in applied cryptography, and relates to a dynamic detection verification structure, a safe retrieval method and equipment, and specifically designs a detectable method and equipment for retrieving ciphertext based on accumulable vector commitment verification. .

Background technique

With the development of cloud storage and cloud computing, cloud storage brings convenience to users but also raises many security issues for outsourced data. Due to the incomplete trust of the server, plain text data stored on the server has great security risks, such as being leaked or tampered with. The method usually adopted is to encrypt and store sensitive data. The plaintext data that the user needs to store is encrypted locally with a key and then uploaded to the server for storage. However, this encrypted storage method will sacrifice the usability of the data, making it difficult for users to access and retrieve all data. Data required.

In order to realize the search of encrypted cloud data, ciphertext retrieval technology is proposed, which ensures the security and privacy of user data while ensuring availability. The initially proposed ciphertext retrieval solutions were all static and could not implement operations such as dynamic addition, update, or deletion of encrypted data uploaded to the server, which was obviously not applicable in real-life scenario requirements. Later, dynamic solutions were proposed to support adding, deleting and modifying data. But most of the above solutions assume that the server is semi-trusted, and the server honestly follows the protocol specifications, but is curious about private information and tries to obtain additional private information. In actual situations, due to cost savings or other factors, the server may return incorrect results and other malicious behaviors, such as only returning the first result that satisfies the keyword. In order to prevent the above-mentioned malicious behavior of the server and ensure the correctness of the search results, the verifiability of the search results is proposed.

Some existing verifiable schemes use cumulative authentication tags or incremental hashes to design verification structures. However, the storage cost of these structures increases linearly with the number of keywords, making them inefficient. In order to be more practical, the ciphertext retrieval scheme that supports verification supports dynamic operations, but does not fully consider the forward and backward security issues caused by dynamic operations, so that the server may analyze the correlation between the updated index and the search token, thereby leaking more information. Multi-keyword information is sent to the server. The current design still has more room for improvement in terms of efficiency and safety. Therefore, how to achieve efficient and safe retrieval and ensure that the retrieval results are detectable is also an urgent problem that needs to be solved in this field.

Contents of the invention

In view of the above requirements for data security, efficiency availability, ciphertext detection, etc., as well as the drawbacks of the above-mentioned traditional solutions, the present invention provides a retrieval ciphertext detectable method and device based on cumulative commitment verification.

The technical solution adopted by the method of the present invention is: a retrieval ciphertext detectable method based on cumulative commitment verification, applied in a retrieval ciphertext detectable system based on cumulative commitment verification; the system participating entities include data owners authors, data users and cloud storage servers;

The specific implementation of the cumulative commitment verification includes the following stages:

During the system initialization phase, enter security parameters , initialize the generated accumulator and vector commitment related parameter information, including the generator/> , vector dimension, random number/> , vector parameters/> , the initial accumulated value acc , the hash function H, the bilinear mapping e and the public parameter par , and the public parameters are provided to the system participating entities;

In the verifiable structure update phase, after the data owner uploads the original data stream to the server, the server first collects the data The elements in generate a new accumulated value/> , then insert all the accumulated values into the corresponding index position of the vector, and finally generate a fixed constant cost commitment value C for the vector element and return it to the data owner;

In the certification information generation and detection stage, after the data user initiates a data query and verification request, the cloud server returns the corresponding certification information. and proof to the data user, and finally the data user performs the verification process.

As a preference, during the system initialization phase, the security parameters ,/> is the generator of group G ,/> is the generator of group G ₁ ,/> is the generator of group G ₂ , group G is the RSA quotient group, G ₁ , G ₂ , and G _T are three multiplicative groups respectively; the vector dimension size is an integer n and a random number/> , vector parameters/> , initialize the empty vector ,/> Represents the elements in the vector; initial accumulated value/> ;Hash function/> , bilinear mapping/> ;Public parameters/> .

Preferably, during the verifiable structure update phase, after the data owner uploads element y , the server generates a new cumulative value based on the received data information. , and add the new accumulated value/> Continuously update the insert into the vector/> in, for vector/> Generate vector promises/> ;When subsequent data owners perform updates, further generate update promises/> and returned to the data owner for saving, where,/> A vector representing the new update.

Preferably, during the certification information generation and detection stages, after the data user initiates a data query and verification request, the cloud server returns the corresponding certification information. and/> to the data owner; where,/> Represents the index set of vector positions, X represents the set of all accumulated elements, hash value/> , ;The data owner first performs the verification operation/> , determine whether the equation is established; if the equation is not established, 0 is returned to indicate that the verification fails; if the equation is established, it indicates that the verification is passed; the data owner continues to execute the verification algorithm in the vector commitment/> , if the return result is 1, it means the final verification passed, if it returns 0, it means the verification failed.

Preferably, the specific implementation of the method includes the following stages:

In the system initialization phase, enter the security parameter λ , define the vector dimension size n , the symmetric encryption key k , and the vector , the public parameter par and the initial state information σ , generate the pseudo-random function F and hash functions H ₁ and H ₂ required by the system;

In the ciphertext index update phase, the data owner encrypts and protects all data, and uses the pseudo-random function F to process the keyword-document pair ( w , ind ), generate and upload the index ciphertext data addr and value to the cloud server Execute the update process according to the received data information, and generate the corresponding data commitment value C and return it to the user;

In the token retrieval and ciphertext detection phase, data users generate retrieval tokens based on the keyword information they need to detect and send them to the cloud storage server; the cloud storage server executes the retrieval process and returns the retrieval results and verification information to the data users. ; In order to detect whether the cloud server has malicious behavior, the data user executes the cumulative commitment verification algorithm Verify on the received ciphertext information, and executes the decryption process after passing the verification.

As a preference, enter security parameters , initialization vector size/> , generate a symmetric encryption key ;Define pseudo-random function/> ;Hash function/> , ;Initialize the counter of updated keywords/> and empty vector/> , define the initial status information/> , and execute the initialization algorithm of vector commitments/> And the initialization algorithm of the dynamic accumulator/> ;Define public parameters/> .

Preferably, during the ciphertext index update phase, the data owner enters the keyword-document ( w , ind ) pair to perform the index encryption operation; when encrypting a new document with keyword w , a pseudo-random function is calculated value, and define ;Counter/> Synchronously increment by 1 to achieve that the updated index is not associated with the previous search token to achieve forward security; when encrypting ind , the operation record op is bound and calculated , where op includes add or delete operations to distinguish update operations on ind . The final decryption is performed by the data user, ensuring backward security; the data owner sends the ciphertext pair ( addr , value ) to the server;

After the server receives the ciphertext pair, it adds it to the ciphertext database EDB: , and further perform a commitment operation on the received ciphertext data; first map addr to vector index i , and insert the corresponding value into the file collection/> in, generate a collection/> The accumulated value/> and add to vector/> Medium; the last server generated vector/> A constant size of C is committed and sent to the data user for local saving.

Preferably, in the token retrieval and ciphertext detection stages, the data user first needs to generate a list of search token tokens for the search keyword w , where j represents the value in calculator DC[ w ],/> Represents the value of the search token; then the search token list TL is sent to the server; the server performs the search after receiving it, and finally returns the retrieval result list RL to the data user, where/> ,/> ;In order to achieve verification, the server returns member certification information to the data user/> ,in ;When the data user receives the search result RL and the proof information proof , the detection process is executed; the data user first determines/> , if the detection fails, output 0 and terminate the subsequent process; otherwise, the data user will further detect/> , if the detection fails, output 0 and terminate; if all the above detections pass, it means that the cloud server honestly performs the above operation process; finally the data user decrypts the calculation/> ; If op is an add operation, the data user will add ind to the final result list; if op is a delete operation, the data user will delete ind from the final result list.

The technical solution adopted by the device of the present invention is: a retrieval ciphertext detectable device based on cumulative commitment verification, including:

one or more processors;

A storage device configured to store one or more programs, which when the one or more programs are executed by the one or more processors, enable the one or more processors to implement the accumulative commitment-based verification A detectable method for retrieving ciphertext.

Compared with the existing technology, the advantages and positive effects of the present invention are mainly reflected in the following aspects:

(1) The present invention proposes a verification method that can accumulate vector commitments. This method avoids incremental client storage caused by an increase in the number of keywords and achieves a fixed constant size overhead; through concurrent processing during the verification information generation process The accumulator algorithm further improves the efficiency of ciphertext data search and return.

(2) A fully dynamic security ciphertext retrieval and detection method provided by the present invention. By introducing the structure of a dynamic accumulation vector, the method realizes that dynamic data can be updated and server malicious behaviors can be detected; it binds file update counters and operation log records , realizes the forward and backward security of the retrieval process, and improves the system security.

Description of the drawings

Examples and specific implementations are used below to further illustrate the technical solutions herein. In addition, in the process of explaining the technical solution, some drawings are also used. For those skilled in the art, other drawings and the intention of the present invention can also be obtained based on these drawings without exerting creative efforts.

Figure 1 is a system framework diagram in an embodiment of the present invention;

Figure 2 is a structural diagram of an accumulable vector commitment in an embodiment of the present invention;

Figure 3 is a schematic diagram of a fully dynamic secure ciphertext retrieval method in an embodiment of the present invention;

Figure 4 is a schematic diagram of a fully dynamic security ciphertext verification method in an embodiment of the present invention.

Detailed ways

In order to facilitate those skilled in the art to understand and implement the present invention, the present invention is described in further detail below in conjunction with the accompanying drawings and examples. It should be understood that the implementation examples described here are only used to illustrate and explain the present invention, and are not used for define the invention.

Please see Figure 1 and Figure 2. This embodiment provides a detectable ciphertext retrieval method based on accumulative commitment verification, which is applied in a detectable ciphertext retrieval system based on accumulative commitment verification; system participating entities include data owners authors, data users and cloud storage servers;

Please see Figure 2. The specific implementation of cumulative commitment verification in this embodiment includes the following stages:

During the system initialization phase, enter security parameters , initialize the generated accumulator and vector commitment related parameter information, including the generator/> , vector dimension, random number/> , vector parameters/> , the initial accumulated value acc , the hash function H, the bilinear mapping e and the public parameter par , and the public parameters are provided to the system participating entities;

In one embodiment, the security parameters ,/> is the generator of group G ,/> is the generator of group G ₁ ,/> is the generator of group G ₂ , group G is the RSA quotient group, G ₁ , G ₂ , and G _T are three multiplicative groups respectively; the vector dimension size is an integer n and a random number/> , vector parameters/> , initialize empty vector/> , Represents the elements in the vector; initial accumulated value/> ;Hash function/> , bilinear mapping ;Public parameters/> .

In the verifiable structure update phase, after the data owner uploads the original data stream to the server, the server first collects the data The elements in generate a new accumulated value/> , then insert all the accumulated values into the corresponding index positions of the vector, and finally generate a fixed constant cost commitment value C for the vector element and return it to the data owner.

In one implementation, after the data owner uploads element y , the server generates a new cumulative value based on the received data information. , and add the new accumulated value/> Continuously update the insert into the vector/> , for vector Generate vector promises/> ;When subsequent data owners perform updates, further generate update commitments and returned to the data owner for saving, where,/> A vector representing the new update. During this process, the server generates a fixed constant size promise value for verification. Therefore, the communication overhead and client storage generated during the interaction process are constant level, which also greatly improves the efficiency of the invented system.

In the certification information generation and detection stage, after the data user initiates a data query and verification request, the cloud server returns the corresponding certification information. and proof to the data user, and finally the data user performs the verification process.

In one implementation, during the certification information generation and detection stages, after the data user initiates a data query and verification request, the cloud server returns the corresponding certification information and/> to the data owner; where,/> Represents the index set of vector positions, X represents the set of all accumulated elements, hash value/> , ;The data owner first performs the verification operation/> , determine whether the equation is established; if the equation is not established, 0 is returned to indicate that the verification fails; if the equation is established, it indicates that the verification is passed; the data owner continues to execute the verification algorithm in the vector commitment/> , if the return result is 1, it means the final verification passed, if it returns 0, it means the verification failed.

Please see Figure 3 and Figure 4. The present invention provides a detectable method for retrieving ciphertext based on cumulative commitment verification. The specific implementation includes the following stages:

In the system initialization phase, enter the security parameter λ , define the vector dimension size n , the symmetric encryption key k , and the vector , the public parameter par and the initial state information σ , generate the pseudo-random function F , hash function H ₁ , H ₂ and other information required by the system;

In one embodiment, entering security parameters , initialization vector size/> , generate a symmetric encryption key/> ;Define pseudo-random function/> ;Hash function/> , ;Initialize the counter of updated keywords/> and empty vector/> , define the initial status information/> , and execute the initialization algorithm of vector commitments/> And the initialization algorithm of the dynamic accumulator/> ;Define public parameters/> .

In the ciphertext index update phase, the data owner encrypts and protects all data, and uses the pseudo-random function F to process the keyword-document pair ( w , ind ), generate and upload the index ciphertext data addr and value to the cloud server Execute the update process according to the received data information, and generate the corresponding data commitment value C and return it to the user;

In one implementation, the data owner enters a keyword-document ( w , ind ) pair and performs an index encryption operation; when encrypting a new document with keyword w , a pseudo-random function is calculated value, and define ;Counter/> Synchronously increment by 1 to achieve that the updated index is not associated with the previous search token to achieve forward security; when encrypting ind , the operation record op is bound and calculated , where op includes add or delete operations to distinguish update operations on ind . The final decryption is performed by the data user, ensuring backward security; the data owner sends the ciphertext pair ( addr , value ) to the server;

After the server receives the ciphertext pair, it adds it to the ciphertext database EDB: , and further perform a commitment operation on the received ciphertext data; first map addr to vector index i , and insert the corresponding value into the file collection/> in, generate a collection/> The accumulated value/> and add to vector/> Medium; the last server generated vector/> A constant size of C is committed and sent to the data user for local saving.

In the token retrieval and ciphertext detection phase, data users generate retrieval tokens based on the keyword information they need to detect and send them to the cloud storage server; the cloud storage server executes the retrieval process and returns the retrieval results and verification information to the data users. ; In order to detect whether the cloud server has malicious behavior, the data user executes the cumulative commitment verification algorithm Verify on the received ciphertext information, and executes the decryption process after passing the verification.

In one implementation, the data user first needs to generate a list of search token tokens for the search keyword w , where j represents the value in calculator DC[ w ],/> Represents the value of the search token; then the search token list TL is sent to the server; the server performs the search after receiving it, and finally returns the retrieval result list RL to the data user, where/> ,/> ;In order to achieve verification, the server returns member certification information to the data user/> , of which/> ;When the data user receives the search result RL and the proof information proof , the detection process is executed; the data user first determines , if the detection fails, output 0 and terminate the subsequent process; otherwise, the data user will further detect/> , if the detection fails, output 0 and terminate; if all the above detections pass, it means that the cloud server honestly performs the above operation process; finally the data user decrypts the calculation ; If op is an add operation, the data user will add ind to the final result list; if op is a delete operation, the data user will delete ind from the final result list.

This embodiment also provides a detectable device for retrieving ciphertext based on cumulative commitment verification, including:

one or more processors;

A storage device configured to store one or more programs, which when the one or more programs are executed by the one or more processors, enable the one or more processors to implement the accumulative commitment-based verification A detectable method for retrieving ciphertext.

The present invention solves the problem that original vector commitment cannot realize dynamic operation, designs a dynamic verifiable structure that can accumulate vector commitment, and realizes constant-size client storage and efficient retrieval efficiency; the application of this structure in the field of ciphertext retrieval , which can realize forward and backward security of the retrieval process and detect malicious behavior of the server, further improving the security of the system.

The invention can provide users with a reliable and safe search ciphertext detection method in cloud storage, data security, blockchain and other fields.

The present invention conducts extensive experimental analysis and randomly extracts the original Enron data set into sub-data sets of different sizes to evaluate the client-side storage overhead of the verification structure in the retrieval ciphertext detectable system that can accumulate commitment verification, search The computational overhead of the phase and the computational overhead of the verification phase.

This experiment uses GNU MP library version 6.2.1 and PBC library version 0.5.14, Linux Ubuntu 20.04, and C++ language to implement all technical solutions. The pseudo-random function PRF and the hash function are instantiated using the SHA-256 hash function and the ZUC algorithm. All test experiments were run on a Windows 10 Enterprise system, a desktop computer configured with Inter(R) Core(TM) i5-11400 CPU@2.6GHz and 16.0 GB RAM.

(1) This experimental analysis is tested based on the commonly used Enron email data set. According to the number of different keyword document pairs, sub-datasets of different sizes are first extracted, as shown in Table 1 below:

Table 1: Sub-dataset extraction status table

(2) For the different sub-data sets extracted above, analyze the storage overhead of the verification data structure of the present invention on the client, and further compare and analyze it with existing technologies. The relevant test data is shown in Table 2.

As can be seen from Table 2, the storage overhead of the verification structure on the client side in the technical route of the present invention is the lowest, requiring only 0.31KB. The storage overhead based on the cumulative authentication label technology continues to increase with the increase of the data set. When the complete Enron data set requires 230.5MB of storage overhead. Although the storage overhead based on incremental hashing technology is also constant level, it requires 0.65KB of storage overhead. Obviously, the storage efficiency of the technical route of the present invention is more advantageous.

Table 2: Comparison of storage overhead of different verification structures on the client

(3) Conduct test analysis on the time overhead in the retrieval process of the technology of the present invention, and compare it with existing technology. When the number of retrieved documents is from 1000 to 10000, it can be found that the retrieval time overhead of the existing incremental hashing technology solution increases from 0.0463 seconds to 0.3486 seconds, and the retrieval operation time overhead of the cumulative authentication tag technology solution increases from 0.0178 seconds to From 0.0931 seconds, the retrieval time of the present invention increases from 0.0087 seconds to 0.0857 seconds, which is obviously the most efficient. The relevant experimental test data are shown in Table 3.

Table 3: Retrieval process time overhead table

(4) Conduct a test and analysis on the time overhead required for the verification process of the technology of the present invention, and conduct a comparative analysis with the existing technology. When the number of documents that need to be verified increases from 1000 to 10000, it can be found that the verification time of the existing incremental hashing technology solution increases from 1.3795 seconds to 5.6937 seconds, and the verification operation time overhead of the cumulative authentication label technology solution increases from 0.0493 to 0.0769. The verification time of the technology of the present invention is basically stable at about 0.0341 seconds within the acceptable range of reasonable experimental errors. It can be seen that the verification overhead of the present invention is the lowest. The relevant experimental test data are shown in Table 4.

Table 4: Verification process time overhead table

It should be understood that the above description of the preferred embodiments is relatively detailed and cannot therefore be considered to limit the scope of patent protection of the present invention. Those of ordinary skill in the art, under the inspiration of the present invention, may not deviate from the claims of the present invention. Within the scope of protection, substitutions or modifications can be made, all of which fall within the scope of protection of the present invention. The scope of protection claimed by the present invention shall be determined by the appended claims.

Claims (9)

1. A retrieval ciphertext detectable method based on cumulative commitment verification, applied in a retrieval ciphertext detectable system based on cumulative commitment verification; the system participating entities include data owners, data users and cloud storage servers; It is characterized in that the specific implementation of the cumulative commitment verification includes the following stages: During the system initialization phase, enter security parameters , initialize the generated accumulator and vector commitment related parameter information, including the generator/> , vector dimension, random number/> , vector parameters/> , the initial accumulated value acc , the hash function H, the bilinear mapping e and the public parameter par , and the public parameters are provided to the system participating entities; In the verifiable structure update phase, after the data owner uploads the original data stream to the server, the server first collects the data The elements in generate a new accumulated value/> , then insert all the accumulated values into the corresponding index position of the vector, and finally generate a fixed constant cost commitment value C for the vector element and return it to the data owner; In the certification information generation and detection stage, after the data user initiates a data query and verification request, the cloud server returns the corresponding certification information. and proof to the data user, and finally the data user performs the verification process. 2. The detectable ciphertext retrieval method based on cumulative commitment verification according to claim 1, characterized in that: in the system initialization phase, the security parameters ,/> is the generator of group G ,/> is the generator of group G ₁ ,/> is the generator of group G ₂ , group G is the RSA quotient group, G ₁ , G ₂ , and G _T are three multiplicative groups respectively; the vector dimension size is an integer n , and the random number , vector parameters/> , initialize empty vector/> , Represents the elements in the vector; initial accumulated value/> ;Hash function/> , bilinear mapping ;Public parameters/> . 3. The retrieval ciphertext detectable method based on cumulative commitment verification according to claim 2, characterized in that: in the verifiable structure update stage, after the data owner uploads element y , the server generates a new element according to the received data information. The accumulated value of , and add the new accumulated value/> Continuously update the insert into the vector/> in, for vector/> Generate vector promises/> ;When subsequent data owners perform updates, further generate update commitments and returned to the data owner for saving, where,/> A vector representing the new update. 4. The detectable ciphertext retrieval method based on cumulative commitment verification according to claim 3, characterized in that: in the certification information generation and detection stage, after the data user initiates a data query and verification request, the cloud server returns the corresponding certification information and/> to the data owner; where,/> Represents the index set of vector positions, X represents the set of all accumulated elements, hash value/> ,/> ;The data owner first performs the verification operation/> , determine whether the equation is established; if the equation is not established, 0 is returned to indicate that the verification fails; if the equation is established, it indicates that the verification is passed; the data owner continues to execute the verification algorithm in the vector commitment , if the return result is 1, it means the final verification passed, if it returns 0, it means the verification failed. 5. The retrieval ciphertext detectable method based on cumulative commitment verification according to claim 1, characterized in that the specific implementation includes the following stages: In the system initialization phase, enter the security parameter λ , define the vector dimension size n , the symmetric encryption key k , and the vector , the public parameter par and the initial state information σ , generate the pseudo-random function F and hash functions H ₁ and H ₂ required by the system; In the ciphertext index update phase, the data owner encrypts and protects all data, and uses the pseudo-random function F to process the keyword-document pair ( w , ind ), generate and upload the index ciphertext data addr and value to the cloud server Execute the update process according to the received data information, and generate the corresponding data commitment value C and return it to the user; In the token retrieval and ciphertext detection phase, data users generate retrieval tokens based on the keyword information they need to detect and send them to the cloud storage server; the cloud storage server executes the retrieval process and returns the retrieval results and verification information to the data users. ; In order to detect whether the cloud server has malicious behavior, the data user executes the cumulative commitment verification algorithm Verify on the received ciphertext information, and executes the decryption process after passing the verification. 6. The detectable method for retrieving ciphertext based on cumulative commitment verification according to claim 5, characterized in that, input security parameters , initialization vector size/> , generate a symmetric encryption key/> ;Define pseudo-random function ;Hash function/> ,/> ;Initialize the counter of updated keywords/> and empty vector/> , define the initial status information/> , and execute the initialization algorithm of vector commitments/> And the initialization algorithm of the dynamic accumulator ;Define public parameters/> . 7. The detectable method for retrieving ciphertext based on accumulative commitment verification according to claim 6, characterized in that: in the ciphertext index update stage, the data owner enters a keyword-document ( w , ind ) pair and performs indexing Encryption operation; when encrypting a new document of keyword w , calculate a pseudo-random function value, and define/> ;Counter/> Synchronously increment by 1 to achieve that the updated index is not associated with the previous search token, achieving forward security; when encrypting ind , the operation record op is bound and calculated/> , where op includes add or delete operations to distinguish update operations on ind . The final decryption is performed by the data user, ensuring backward security; the data owner sends the ciphertext pair ( addr , value ) to the server; After the server receives the ciphertext pair, it adds it to the ciphertext database EDB: , and further perform a commitment operation on the received ciphertext data; first map addr to vector index i , and insert the corresponding value into the file collection/> in, generate a collection/> The accumulated value/> and add to vector/> Medium; the last server generated vector/> A constant size of C is committed and sent to the data user for local saving. 8. The retrieval ciphertext detectable method based on cumulative commitment verification according to claim 7, characterized in that: in the token retrieval and ciphertext detection stages, the data user first needs to generate a search token token for the retrieval keyword w . list of , where j represents the value in calculator DC[ w ],/> Represents the value of the search token; then the search token list TL is sent to the server; the server performs the search after receiving it, and finally returns the retrieval result list RL to the data user, where/> ,/> ;In order to achieve verification, the server returns member certification information to the data user/> , of which/> ;When the data user receives the search result RL and the proof information proof , the detection process is executed; the data user first determines , if the detection fails, output 0 and terminate the subsequent process; otherwise, the data user will further detect/> , if the detection fails, output 0 and terminate; if all the above detections pass, it means that the cloud server honestly performs the above operation process; finally the data user decrypts the calculation ; If op is an add operation, the data user will add ind to the final result list; if op is a delete operation, the data user will delete ind from the final result list. 9. A detectable device for retrieving ciphertext based on cumulative commitment verification, which is characterized by including: one or more processors; A storage device configured to store one or more programs, which when executed by the one or more processors, causes the one or more processors to implement any of claims 1 to 8 A detectable method for retrieving ciphertext based on cumulative commitment verification.