CN110807021B - A database audit system and method based on searchable encryption - Google Patents

Abstract

The invention discloses a database auditing system and method based on searchable encryption, including an initialization module, a client-side searchable encryption module, a port mirroring module, a server-side driver module and a database auditing module, a key selection key and an anti-collision hash function , determine and use the audit keyword dictionary, after obtaining the plaintext SQL statement, generate the audit keyword set through the audit keyword dictionary, use the key to encrypt the audit keyword set, and obtain the ciphertext audit keyword Set, use searchable encryption operation to generate audit certificate from the ciphertext keyword set, combine the audit certificate and the audit keyword dictionary, perform matching operation, obtain and display the audit plaintext, so that the database can not only encrypt transmission, but also Can audit the transmitted ciphertext.

Description

A database audit system and method based on searchable encryption

technical field

The invention relates to the field of database security auditing, in particular to a database auditing system and method based on searchable encryption.

Background technique

Database auditing is mainly used to record various operation behaviors on the database, analyze various operations against the database, and include them in the audit database, so as to facilitate the query, analysis and filtering of auditors. Realize the monitoring and auditing of database user operations. The problem faced by current database auditing is that the premise of auditing is to ensure that the transmission of the database client and server is transparent (using plaintext data), and the data packets transmitted by the database (except the login password) are: Plaintext data, but during the transmission process, not only the database audit system can obtain data packets, but also the plaintext data of SQL statements can be obtained by adversaries who invade their own networks. In order to avoid the adversary's monitoring, many users use SSL tunnels for transmission, but encrypted tunnels The establishment of the database also excludes the database auditing system of bypass monitoring, and the auditing system cannot work normally, so that the current database cannot perform encrypted transmission and auditing of transmitted ciphertext at the same time.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a database auditing system and method based on searchable encryption, so that the database can not only be encrypted and transmitted, but also can audit the transmitted ciphertext.

In order to achieve the above object, in the first aspect, the present invention provides a database auditing method based on searchable encryption, including:

Choose a key and a collision-resistant hash function;

Identify and use a dictionary of audit keywords;

Obtain plaintext SQL statements, and generate audit keyword sets through the audit keyword dictionary;

Encrypting the audit keyword set using the key to obtain a ciphertext audit keyword set;

generating an audit certificate by using the ciphertext keyword set;

Combining the audit certificate and the audit keyword dictionary, a matching operation is performed to obtain and display the audit plaintext keywords.

Wherein, the selection key and anti-collision hash function include:

Obtain the key and system parameters encrypted by AES, and select an anti-collision hash function, wherein the anti-collision hash function is an input binary string of arbitrary bits, and the output is the obtained binary string of the system parameter bits.

Wherein, the determining and using the audit keyword dictionary includes:

Obtain plaintext keywords related to auditing, and combine with corresponding ciphertexts to form an audit keyword dictionary.

Wherein, the obtaining plaintext SQL statement, and generating the audit keyword set through the audit keyword dictionary, include:

For the acquired plaintext SQL statement, n plaintext keywords are randomly selected from the plaintext keywords in the audit keyword dictionary to form an audit keyword set.

Wherein, generating an audit certificate through the ciphertext keyword set includes:

Select the first 8 encrypted elements of the i-th keyword in the ciphertext audit keyword set to calculate the first hash value set, and calculate the first hash value set with a randomly selected first length that is 8 lengths less than the i-th encrypted element. The large random number is spliced to obtain a hash to obtain a second hash value set, and the first 8 encrypted elements of the second hash value set are spliced with the first large random number to obtain a first variable set. The variable set and the corresponding ciphertext audit keyword perform exponential operation bit by bit to generate an audit certificate, wherein the number of elements in the ciphertext audit keyword set is n, and 1≤i≤n.

Wherein, in combination with the audit certificate and the audit keyword dictionary, a matching operation is performed to obtain and display the audit plaintext keywords, including:

Obtain and parse the audit certificate, combine with the audit keyword dictionary, and traverse the first 8 elements of the ciphertext keyword in the audit keyword dictionary to calculate a third hash value. Traverse the ciphertext set in the audit certificate to obtain a second variable set, and perform an exponential operation on the second variable set and the ciphertext set in the audit keyword dictionary to obtain a third variable set.

Wherein, performing a matching operation in combination with the audit certificate and the audit keyword set to obtain and display the audit plaintext keywords, further comprising:

The last 8 bits and the remaining bit elements of the third variable set are assigned as R and L respectively, L and the third hash value set are spliced and hashed to obtain a fourth hash value set, and the fourth hash value set is judged. Check whether the first 8 hash values of the hash value set are equal to the R, and then obtain the audit plaintext keywords according to the correspondence between the plaintext and the ciphertext in the audit keyword dictionary, and display them after visual processing.

Wherein, the judging whether the first 8-bit hash value of the fourth hash value is equal to the R includes:

If the first 8 hash values of the fourth hash value set are equal to the R, then the audit ciphertext corresponding to the second variable set is the ciphertext;

If the first 8 hash values of the fourth hash value set are not equal to the R, then re-acquire the next variable value in the second variable set, and recalculate to obtain a new third variable set and the first variable set. Set four hash values, and re-judg whether the first 8 hash values of the fourth set of hash values are equal to the R, until all ciphertext keywords in the audit certificate are traversed.

In a second aspect, the present invention provides a database auditing system based on searchable encryption. The database auditing system based on searchable encryption includes an initialization module, a client-side searchable encryption module, a port mirroring module, a server-side driver module, and a database auditing module. module, the initialization module, the client searchable encryption module, the port mirroring module, and the server driver module are electrically connected in sequence, and the port mirroring module and the database audit module are electrically connected,

The initialization module is used to select a key and an anti-collision hash function, and determine a keyword dictionary;

The client-side searchable encryption module is used for extracting keywords for auditing in plaintext, forming an auditing keyword set according to the auditing keyword dictionary, encrypting the auditing keyword set using a key, and generating an audit certificate using searchable encryption operations , and send the ciphertext data and audit certificate to the server driver module in JSON format;

The server driver module is used to obtain JSON format data packets, extract the ciphertext data and decrypt it, forward it to the database, and generate the data or status results fed back by the database in the same way, including the ciphertext data and the audit certificate. JSON format data, returned to the client searchable encryption module;

The port mirroring module is used to forward the data traffic of one or more of the client-side searchable encryption module and the server-side driver module to the database audit module;

The database auditing module is used for acquiring the data traffic forwarded by the port mirroring module, extracting the auditing certificate therein, parsing the auditing information therein, and obtaining and displaying plaintext data.

A database auditing system and method based on searchable encryption of the present invention, the database auditing system based on searchable encryption includes an initialization module, a client-side searchable encryption module, a port mirroring module, a server-side driver module and a database auditing module, The initialization module, the client-side searchable encryption module, the port mirroring module, and the server driver module are electrically connected in sequence, and the port mirroring module is electrically connected to the database audit module, and the key and Anti-collision hash function, determine and use an audit keyword dictionary, after obtaining plaintext SQL statements, generate an audit keyword set through the audit keyword dictionary, and use the key to encrypt the audit keyword set to obtain a password. The audit key set is used to generate an audit certificate from the cipher text key set using searchable encryption operations, and the audit certificate and the audit key dictionary are combined to perform a matching operation to obtain and display the audit plain text key words, so that the database Not only can encrypt the transmission, but also audit the transmitted ciphertext.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

FIG. 1 is a schematic diagram of the steps of the database auditing method based on searchable encryption of the present invention.

FIG. 2 is a schematic structural diagram of the database auditing system based on searchable encryption of the present invention.

1-Initialization module, 2-Client searchable encryption module, 3-Port mirroring module, 4-Server driver module, 5-Database audit module.

Detailed ways

The following describes in detail the embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals refer to the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary, and are intended to explain the present invention and should not be construed as limiting the present invention.

Referring to FIG. 1, the present invention provides a database auditing method based on searchable encryption, including:

S101. Select a key and an anti-collision hash function.

Specifically, in the initialization module 1, the AES encryption key k is determined, and the system parameter λ and an anti-collision hash function H are randomly selected, wherein the anti-collision hash function H is: {0,1} ^* →{ 0,1} ^λ , the input is a binary string of arbitrary length, the output is a λ-bit binary string, and then the key k and the anti-collision hash function H are sent to the client-side searchable encryption module 2 and the server driver module 4.

S102, determine and use the audit keyword dictionary.

Specifically, the plaintext keywords M related to auditing are obtained, and the corresponding ciphertext C is combined to form an audit keyword dictionary D. The structure of the audit keyword dictionary D is: D[M:C], and the client can search The encryption module 2 introduces the audit keyword dictionary D.

S103: Acquire a plaintext SQL statement, and generate an audit keyword set by using the audit keyword dictionary.

其中，

S104、使用所述密钥对所述审计关键词集进行加密，得到密文审计关键词集。Specifically, to obtain the input SQL statement, the client-side searchable encryption module 2 randomly selects n plaintext keywords from M in the audit keyword dictionary 2 to form an audit keyword set

in,

S104. Encrypt the audit keyword set using the key to obtain a ciphertext audit keyword set.

进行AES加密，生成密文审计关键词集

Specifically, use the key k to pair the audit keyword set

Perform AES encryption to generate ciphertext audit keyword set

S105. Generate an audit certificate by using the ciphertext keyword set.

所述客户端可搜索加密模块2对每个加密过后的审计关键词

取前8位得到并求第一哈希值集合

其中[0:7]表示取该变量的0到7位的元素，然后随机选取一个长度比第i个加密元素少8个长度的第一大随机数a_i进行拼接，其长度表示为：

拼接得到第二哈希值集合θ₂＝H(a_i||θ₁)，第二哈希值集合的前8个加密元素再和第一大随机数a_i进行拼接，得到第一变量集合t_i＝a_i||θ[0:7]，将所述第一变量集合t与所述密文审计关键词集的每个关键词

逐位进行指数运算，得到审计证书c，计算公式为：

其中，||表示字符串连接，len()表示变量的长度，θ₁表示第一哈希值集合，θ₂表示第二哈希值集合，c_i[x]、

和t_i[x]分别表示审计证书c的第i条的第x位元素、密文审计关键词集

的第i条的第x位元素和第一变量集合t的第i条的第x位元素，将所述审计证书c传给所述数据库审计模块5。Specifically, the ciphertext audit keyword set whose content is ciphertext

The client can search the encryption module 2 for each encrypted audit keyword

Take the first 8 bits to get and find the first hash value set

Wherein [0:7] means to take the elements from 0 to 7 bits of the variable, and then randomly select the first largest random number a _i whose length is 8 lengths less than the i-th encrypted element for splicing, and its length is expressed as:

The second hash value set θ ₂ =H(a _i || θ ₁ ) is obtained by splicing, and the first 8 encrypted elements of the second hash value set are spliced with the first large random number a _i to obtain the first variable set t _i =a _i ||θ[0:7], compare the first variable set t with each keyword of the ciphertext audit keyword set

Perform the exponential operation bit by bit to get the audit certificate c. The calculation formula is:

Among them, || represents the string connection, len() represents the length of the variable, θ ₁ represents the first hash value set, θ ₂ represents the second hash value set, c _i [x],

and t _i [x] respectively represent the x-th element of the i-th item of the audit certificate c, and the ciphertext audit keyword set

The x-th element of the i-th item and the x-th element of the i-th item of the first variable set t are passed to the database audit module 5 .

S106. Perform a matching operation in combination with the audit certificate and the audit keyword dictionary to obtain and display the audit plaintext.

将所述第三变量集合G的后8位和剩余位元素分别赋值为R和L，R＝L[-7:]，L＝G[0:-7]，将L和第三哈希值集合进行拼接，得到第四哈希值集合θ₄＝H(L||θ₃)，判断所述第四哈希值集合的前8位哈希值θ[0:7]是否与所述R相等，若所述第四哈希值集合的前8位哈希值θ[0:7]与所述R相等，则所述第二变量集合c_i对应的审计密文为所述密文C_i；若所述第四哈希值集合的前8位哈希值θ[0:7]与所述R不相等，则重新获取所述审计证书c，重新计算得到新的第三变量集合和第四哈希值集合，并重新判断所述第四哈希值集合的前8位哈希值θ[0:7]是否与所述R相等，直至遍历所述审计证书c中的所有密文关键词，根据所述审计关键词词典D[M:C]，C_i对应的审计明文为M_i，所以M_i就是明文审计信息，然后经过可视化处理展示出来，其中，||表示字符串连接，len()表示变量的长度，θ₃、θ₄表示第三和第四哈希值集合，c_i[x]、C_i[x]和G_i[x]分别表示第二变量集合c的第i条的第x位元素、密文关键词集C的第i条的第x位元素和第三变量集合G的第i条的第x位元素，Specifically, the audit certificate c is forwarded to the database audit module 5 through the port mirroring module 3, and after the database audit module 5 obtains the audit certificate c, it combines the audit keyword dictionary contained in itself D[M:C], select the first 8 bits of the ciphertext C in the audit keyword dictionary D[M:C] to obtain the third hash value set θ ₃ =H(C[0:7]), Traverse the audit certificate to obtain the second variable set c _i , the length of c _i and the ciphertext C _i in the audit keyword dictionary are consistent, and perform an exponential operation on c _i and C _i bit by bit to obtain a third variable set G, the calculation formula for:

The last 8 bits and the remaining bit elements of the third variable set G are assigned as R and L respectively, R=L[-7:], L=G[0:-7], L and the third hash value The sets are spliced to obtain a fourth hash value set θ ₄ =H(L||θ ₃ ), and it is judged whether the first 8 hash values θ[0:7] of the fourth hash value set are the same as the R If the first 8 hash values θ[0:7] of the fourth hash value set are equal to the R, then the audit ciphertext corresponding to the second variable set c _i is the ciphertext C _i ; if the first 8 hash values θ[0:7] of the fourth hash value set are not equal to the R, then re-acquire the audit certificate c, and recalculate to obtain a new third variable set and The fourth hash value set, and re-judge whether the first 8 hash values θ[0:7] of the fourth hash value set are equal to the R, until all ciphertexts in the audit certificate c are traversed Keywords, according to the audit keyword dictionary D[M:C], the audit plaintext corresponding to C _i is M _i , so M _i is plaintext audit information, which is then displayed through visual processing, where || represents string connection , len() represents the length of the variable, θ ₃ , θ ₄ represent the third and fourth hash value sets, c _i [x], C _i [x] and G _i [x] respectively represent the second variable set c The x-th element of the i-th item, the x-th element of the i-th item of the ciphertext keyword set C, and the x-th element of the ith item of the third variable set G,

Referring to FIG. 2, the present invention provides a database auditing system based on searchable encryption. The database auditing system based on searchable encryption includes an initialization module 1, a client-side searchable encryption module 2, a port mirroring module 3, and a server-side driver module. 4 and the database audit module 5, the initialization module 1, the client searchable encryption module 2, the port mirroring module 3, and the server driver module 4 are electrically connected in sequence, and the port mirroring module 3 and all The database audit module 5 is electrically connected,

The initialization module 1 is used to obtain the key k and the anti-collision hash function H, and determine the keyword dictionary D;

使用密钥k加密审计关键词集

使用可搜索加密(AES)运算生成审计证书c，并将密文数据和审计证书c以JSON格式发送给所述服务端驱动模块4；The client can search the encryption module 2, which is used to extract keywords for auditing in plaintext, and form an auditing keyword set according to the auditing keyword dictionary D

Encrypt the audit keyword set with key k

Use searchable encryption (AES) operation to generate audit certificate c, and send ciphertext data and audit certificate c to the server driver module 4 in JSON format;

The server driver module 4 is used to obtain the JSON format data packet, extract the ciphertext data and decrypt it, forward it to the database, and generate the data or status results fed back by the database in the same way, including ciphertext data and audit certificate. c returns the data in JSON format to the searchable encryption module 2 of the client;

The port mirroring module 3 is used to forward the data traffic of one or more of the client-side searchable encryption module 2 and the server-side driver module 4 to the database audit module 5;

The database audit module 5 is configured to acquire the data traffic forwarded by the port mirroring module 3, extract the audit certificate c therein, parse the audit information therein, and obtain and display plaintext data.

使用密钥k加密审计关键词集

得到密文审计关键词集

使用可搜索加密(AES)运算生成审计证书c，并将密文数据和审计证书c以JSON格式发送给所述服务端驱动模块4，所述服务端驱动模块4获取JSON格式数据包，提取密文数据并解密，转发给数据库，并将所述数据库反馈的数据或状态结果以同样的方式生成包含密文数据和审计证书c以JSON格式数据，返回给所述客户端可搜索加密模块2，而所述端口镜像模块3将所述客户端可搜索加密模块2和所述服务端驱动模块4之间传输的数据流量转发到所述数据库审计模块5，所述数据库审计模块5获取所述端口镜像模块3转发的数据流量，提取其中的审计证书c，解析其中的审计信息，得到并展示明文数据，使得的数据库不仅可以加密传输，还能对传输密文进行审计。In this embodiment, the database auditing system based on searchable encryption includes an initialization module 1, a client-side searchable encryption module 2, a port mirroring module 3, a server driver module 4 and a database auditing module 5. The initialization module 1 , the client can search the encryption module 2, the port mirroring module 3, the server drive module 4 are electrically connected in sequence, the port mirroring module 3 and the database auditing module 5 are electrically connected, and in the In the initialization module 1, the key k and the anti-collision hash function H are obtained, and the keyword dictionary D is determined, and the key k and the anti-collision hash function H are transmitted to the client-side searchable encryption module 2 and the The server drives the module 4, and the keyword dictionary D is used in the client-side searchable encryption module 2 and the database auditing module 5, and then extracts the keywords used for auditing in plaintext, and the client The searchable encryption module 2 forms an audit keyword set according to the audit keyword dictionary D

Encrypt the audit keyword set with key k

Get ciphertext audit keyword set

Use searchable encryption (AES) operation to generate audit certificate c, and send ciphertext data and audit certificate c to the server driver module 4 in JSON format, and the server driver module 4 obtains the JSON format data packet, extracts the encrypted data. The text data is decrypted, forwarded to the database, and the data or status results fed back by the database are generated in the same way including cipher text data and audit certificate c in JSON format data, returned to the client searchable encryption module 2, The port mirroring module 3 forwards the data traffic transmitted between the client-side searchable encryption module 2 and the server-side driver module 4 to the database auditing module 5, and the database auditing module 5 obtains the port The data traffic forwarded by the mirror module 3 extracts the audit certificate c, parses the audit information, and obtains and displays the plaintext data, so that the database can not only encrypt the transmission, but also audit the transmitted ciphertext.

使用所述密钥k对所述审计关键词集

进行加密，得到密文审计关键词集

使用可搜索加密运算将所述密文关键词集

生成审计证书c，结合所述审计证书c和所述审计关键词词典D，进行匹配运算，得到并展示审计明文关键词，使得数据库不仅可以加密传输，还能对传输密文进行审计。A database auditing system and method based on searchable encryption of the present invention, the database auditing system based on searchable encryption includes an initialization module 1, a client-side searchable encryption module 2, a port mirroring module 3, a server-side driver module 4 and Database audit module 5, the initialization module 1, the client searchable encryption module 2, the port mirroring module 3, and the server driver module 4 are electrically connected in sequence, the port mirroring module 3 and the database The audit module 5 is electrically connected, obtains the key k and the anti-collision hash function H, determines and uses the audit keyword dictionary D, and generates an audit keyword set through the audit keyword dictionary D after acquiring the plaintext SQL statement

Use the key k to pair the audit keyword set

Encrypt to get the ciphertext audit keyword set

Use searchable encryption operations to convert the set of ciphertext keywords

The audit certificate c is generated, and the audit certificate c and the audit keyword dictionary D are combined to perform a matching operation to obtain and display the audit plaintext keywords, so that the database can not only encrypt the transmission, but also audit the transmitted ciphertext.

The above disclosure is only a preferred embodiment of the present invention, and of course, it cannot limit the scope of rights of the present invention. Those of ordinary skill in the art can understand that all or part of the process for realizing the above-mentioned embodiment can be realized according to the rights of the present invention. The equivalent changes required to be made still belong to the scope covered by the invention.

Claims (9)

1. a database auditing method based on searchable encryption, is characterized in that, comprises: Choose a key and a collision-resistant hash function; Identify and use a dictionary of audit keywords; Obtain plaintext SQL statements, and generate audit keyword sets through the audit keyword dictionary; Encrypting the audit keyword set using the key to obtain a ciphertext audit keyword set; Generate an audit certificate by using the ciphertext audit keyword set; Combining the audit certificate and the audit keyword dictionary, a matching operation is performed to obtain and display the audit plaintext keywords. 2. a kind of database auditing method based on searchable encryption as claimed in claim 1, is characterized in that, described selection key and anti-collision hash function, comprise: Obtain the key and system parameters encrypted by AES, and select an anti-collision hash function, wherein the anti-collision hash function is an input binary string of arbitrary bits, and the output is a binary string of the acquired system parameter bits. 3. a kind of database audit method based on searchable encryption as claimed in claim 2, is characterized in that, described determining and using audit keyword dictionary, comprises: Obtain plaintext keywords related to auditing, and combine with corresponding ciphertexts to form an audit keyword dictionary. 4. a kind of database auditing method based on searchable encryption as claimed in claim 3, is characterized in that, described acquiring plaintext SQL statement, through described auditing keyword dictionary generating auditing keyword set, comprising: For the acquired plaintext SQL statement, n plaintext keywords are randomly selected from the plaintext keywords in the audit keyword dictionary to form an audit keyword set. 5. a kind of database auditing method based on searchable encryption as claimed in claim 4 is characterized in that, generating audit certificate through described ciphertext audit keyword set, comprising: Select the first 8 encrypted elements of the i-th keyword in the ciphertext audit keyword set to calculate the first hash value set, and calculate the first hash value set with a randomly selected first length that is 8 lengths less than the i-th encrypted element. The large random number is spliced to obtain a hash to obtain a second hash value set, and the first 8 encrypted elements of the second hash value set are spliced with the first large random number to obtain a first variable set. The variable set and the corresponding ciphertext audit keyword perform exponential operation bit by bit to generate an audit certificate, wherein the number of elements in the ciphertext audit keyword set is n, and 1≤i≤n. 6. A searchable encryption-based database auditing method as claimed in claim 5, characterized in that, in combination with the audit certificate and the audit keyword dictionary, a matching operation is performed to obtain and display the audit plaintext keywords, including : Obtain and parse out the audit certificate, combine with the audit keyword dictionary, and traverse the first 8 elements of the ciphertext keyword in the audit keyword dictionary to calculate the third hash value; The ciphertext set is obtained, the second variable set is obtained, and the second variable set and the ciphertext set in the audit keyword dictionary are subjected to exponential operation to obtain the third variable set. 7. A searchable encryption-based database auditing method as claimed in claim 6, characterized in that, in combination with the audit certificate and the audit keyword set, a matching operation is performed to obtain and display the audit plaintext keywords ,Also includes: The last 8 bits and the remaining bit elements of the third variable set are assigned as R and L respectively, L and the third hash value set are spliced and hashed to obtain a fourth hash value set, and the fourth hash value set is judged. Check whether the first 8 hash values of the hash value set are equal to the R, and then obtain the audit plaintext keywords according to the correspondence between the plaintext and the ciphertext in the audit keyword dictionary, and display them after visual processing. 8. A searchable encryption-based database auditing method as claimed in claim 7, wherein the judging whether the first 8-bit hash value of the fourth hash value is equal to the R comprises: If the first 8 hash values of the fourth hash value set are equal to the R, then the audit ciphertext corresponding to the second variable set is the ciphertext; If the first 8 hash values of the fourth hash value set are not equal to the R, then re-acquire the next variable value in the second variable set, and recalculate to obtain a new third variable set and the first variable set. Set four hash values, and re-judg whether the first 8 hash values of the fourth set of hash values are equal to the R, until all ciphertext keywords in the audit certificate are traversed. 9. a database auditing system based on searchable encryption, is characterized in that, described database auditing system based on searchable encryption comprises initialization module, client searchable encryption module, port mirroring module, server driver module and database auditing module , the initialization module, the client searchable encryption module, the port mirroring module, and the server driver module are electrically connected in sequence, and the port mirroring module and the database audit module are electrically connected, The initialization module is used to select a key and an anti-collision hash function, and to determine an audit keyword dictionary; The client-side searchable encryption module is used for extracting keywords for auditing in plaintext, forming an auditing keyword set according to the auditing keyword dictionary, encrypting the auditing keyword set using a key, and generating an audit certificate using searchable encryption operations , and send the ciphertext data and audit certificate to the server driver module in JSON format; The server driver module is used to obtain JSON format data packets, extract the ciphertext data and decrypt it, forward it to the database, and generate the data or status results fed back by the database in the same way, including the ciphertext data and the audit certificate. JSON format data, returned to the client searchable encryption module; The port mirroring module is used to forward the data traffic of one or more of the client-side searchable encryption module and the server-side driver module to the database audit module; The database auditing module is used for acquiring the data traffic forwarded by the port mirroring module, extracting the auditing certificate therein, parsing the auditing information therein, and obtaining and displaying plaintext data.

Images