A decryption outsourcing Twin-SM9 key encapsulation system and method capable of supporting batch auditing

Abstract

The present invention relates to a decryption outsourcing Twin-SM9 key encapsulation system that can support batch auditing, including a master key distribution center and n key distribution centers; in the system initialization stage, the master key distribution center divides the system master private key into secret share forms and distributes them to each key distribution center; in the user decryption key generation stage, it is divided into two sub-stages, each key distribution center generates a user decryption key share and sends the generated decryption key share to the user, and the user generates a user decryption key. The present invention effectively solves the single point failure problem caused by the paralysis of a single key distribution center.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and relates to a decryption outsourcing Twin-SM9 key encapsulation system and method based on (t, n) and capable of supporting batch auditing. Background Art

[0002] For a long time, a large number of time-consuming bilinear pairing operations have been an important factor affecting the encryption and decryption efficiency of the IBE scheme. The academic community has done a lot of work on optimizing bilinear pairing operations, but end users still have not experienced a significant reduction in the decryption computing burden. Outsourcing computing is a way to solve this problem. By outsourcing all pairing operations involved in the Twin-SM9 decryption operation to a cloud service center with powerful computing power, while fully utilizing the powerful computing power of the cloud service center, the computing pressure of end users is alleviated, thereby effectively improving the overall decryption efficiency of the system. However, semi-trusted cloud service centers can still use outsourced decryption results to obtain user privacy information, and even maliciously tamper with ciphertexts. Therefore, while outsourcing the time-consuming and huge decryption pairing operations to the cloud service center, the outsourced decryption results also need to be efficient and batch auditable. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a decryption outsourcing Twin-SM9 key encapsulation system and method based on (t, n) that can support batch auditing, so as to effectively solve the single point failure problem caused by the paralysis of a single key distribution center.

[0004] To achieve the above object, the present invention adopts the following technical solution:

[0005] A decryption outsourcing Twin-SM9 key encapsulation system that can support batch auditing includes a master key distribution center and n key distribution centers. In the system initialization phase, the master key distribution center divides the system master private key into secret shares and distributes them to each key distribution center. In the user decryption key generation phase, which is divided into two sub-phases, each key distribution center generates a user decryption key share and sends the generated decryption key share to the user, and the user generates a user decryption key.

[0006] A decryption outsourcing Twin-SM9 key encapsulation method that can support batch auditing includes the following steps:

[0007] M1. The master key distribution center runs the system initialization function to generate system public parameters and master private keys. The system public parameters are sent to the cloud service center and users. The system master private key is divided into n secret shares and secretly sent to n key distribution centers. Each key distribution center secretly stores its own private key share.

[0008] M2. The cloud service center generates a master public and private key pair of the cloud service center using the system public parameters, publishes the master public key of the cloud service center, and secretly stores the master private key of the cloud service center;

[0009] M3. The user generates a public key pair using the system public parameters, sends the public key to the cloud service center, and keeps the private key secret.

[0010] M4. The user submits a key application to n key distribution centers respectively, and at least t key distribution centers call the user key generation algorithm to generate a user key share and send it to the user;

[0011] M5. The user generates a complete user decryption key based on the user key shares sent by t key distribution centers;

[0012] M6. The data holder calls the outsourcing key generation function to generate an outsourcing key and sends it to the cloud service center when the user makes a decryption outsourcing request;

[0013] M7. The data holder calls the encryption algorithm to generate ciphertext and sends it to the cloud service center;

[0014] M8. The cloud service center decrypts the ciphertext part based on the outsourced key to generate the outsourced decryption result and save it;

[0015] M9. The master key distribution center, as a trusted third-party organization, conducts batch audits on outsourced decryption results to verify the correctness of the outsourced results;

[0016] M10. The user obtains the encapsulation key based on the outsourced decryption result and the user's decryption private key.

[0017] Furthermore, the M1 is specifically:

[0018] The master key distribution center KGC0 first selects a bilinear group D = (G1, G2, G T ,e,N), the generators of group G1 and group G2 are P1 and P2 respectively, where

[0019] Define two cryptographic hash functions H1:{0,1} * ×Z N →{0,1} klen and H2:{0,1} * ×Z N →{0,1} klen , select three random numbers α, β, δ∈[1,N-1], where α, β are the system master private keys, and calculate the element P in group G1 pub =α·P1 as the system master public key;

[0020] Computation Group G TThe elements in g0=e(P1,P2), g1=e(P1,P2) α ,g2=e(P1,P2) β ; Select the receiver decryption key generation function identifier hid represented by one byte, and output the system public parameter pp = (D, P1, P2, P pub ,g0,g1,g2,H1,H2,hid);

[0021] The system master private key is divided into n secret shares and sent secretly to n key distribution centers. Each key distribution center secretly keeps its own private key share.

[0022] Furthermore, the system master private key is divided into n parts and secretly sent to n key distribution centers, as follows:

[0023] (1) KGC0 selects three t-1 order polynomials and Among them, a0=α, b0=β, c0=δ;

[0024] (2) KGC0 calculates α respectively i =f1(i),β i = f2(i) and δ i =f3(i), (α i ,β i ,δ i ) are secretly sent to the key distribution center KGC i ,i∈[1,n];

[0025] (3) KGC i ,i∈[1,n] receives the private key share and random number share (α i ,β i ,δ i ) to save, any KGC i The values ​​of α, β, and δ are unknown.

[0026] Furthermore, the M4 is specifically:

[0027] (1) Let the user's identity be ID, the bit length of the key encapsulated to the user be klen, KGC i After receiving the key application from the user, t KGCs are required to participate. The participating t KGCs confirm each other through broadcasting and form a set Q;

[0028] (2) KGC i First, in the finite field F N Calculation And to other participating KGC j Send 1i ; When KGCj Received the remaining participating KGC i Sent 1i After merging, s1 = ∑ i∈Q s 1i -(t-1)H1(ID||hid,N)=H1(ID||hid,N)+α;

[0029] Among them, the specific process of merging s1 is as follows:

[0030]

[0031] (3) KGC i Calculate D 0i =δ i ·C c , D 3i =δ i P2, and sends D to the user who requested the key 0i , D 1i , D 2i , D 3i ; So far, KGC i Output the user's decryption key share.

[0032] Furthermore, the M5 is specifically:

[0033] User Computing

[0034] Order sk ID =(K0,K1,K2), user output sk ID As the user decryption key and kept secret; the specific process of the user generating a complete user decryption key is as follows:

[0035]

[0036]

[0037]

[0038] Furthermore, the M7 is specifically as follows: assuming that the user's identity is ID, the bit length of the key encapsulated to the user is klen, the data holder selects a random number γ∈[1,N-1], and calculates C1=γ(H1(ID||hid,N)P1+P pub ), K=H2(C1||w1||w2||ID,klen), let EC=(C0,C1), and output (K,EC), where K is the encapsulated key and EC is the encapsulated ciphertext.

[0039] Furthermore, the cloud service center in M8 decrypts the ciphertext part based on the outsourced key to generate an outsourced decryption result and saves it as follows:

[0040]

[0041]

[0042] Output the outsourced decryption result C'=(C'1, C'2).

[0043] Further, M9 is specifically as follows: after KGC0, as a third-party trusted center, inputs the system master private key, the encapsulated ciphertext, and the outsourced decryption result generated by the cloud service center, for the same user, m outsourced decryption requests have m encapsulated ciphertexts and outsourced decryption results; let the encapsulated ciphertext set {EC i} i∈[m] , outsourced decryption result set {C′ i} i∈[m] ={C′ i,1 ,C′ i,2} i∈[m] , where m is the number of ciphertexts. i,0} i∈[m] ,calculate For the outsourced decryption result set, calculate Judge equation E α =OS1,E β = OS2 is established at the same time; if established, Audit (P pub ,{EC i} i∈[m] ,{C′ i} i∈[m] )=1 means that the cloud service center decrypts correctly, otherwise it means that the cloud service center decrypts incorrectly.

[0044] Further, the M10 is specifically as follows: after receiving the outsourced decryption result C' of the cloud service center, the user first determines whether the decryption result of the cloud service center is correct based on the audit result of the trusted third-party organization KGC0. If correct, calculate Calculate and output the encapsulation key K'=H2(C1||w′1||w′2||ID,klen). After the user recovers the encapsulation key K', he can decrypt the encapsulated ciphertext to obtain the corresponding plaintext;

[0045] The calculation process of the recovery key K' is as follows:

[0046]

[0047]

[0048] K'=H2(C1||w'1||w'2||ID,klen)=H2(C1||w1||w2||ID,klen).

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] Without changing the overall architecture of the decryption outsourcing Twin-SM9 key encapsulation solution that supports batch auditing, the present invention expands the original solution of key distribution to users by a single key distribution center to multiple key distribution centers cooperating to generate user keys, thereby effectively solving the single point failure problem caused by the paralysis of a single key distribution center. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a flow chart of the method of the present invention;

[0052] Figure 2 It is a schematic diagram of a decryption outsourcing Twin-SM9 key encapsulation mechanism based on a (t, n) threshold and capable of supporting batch auditing in one embodiment of the present invention. DETAILED DESCRIPTION

[0053] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0054] The present invention provides a decryption outsourcing Twin-SM9 key encapsulation system that can support batch auditing, including a master key distribution center and n key distribution centers; in the system initialization stage, the master key distribution center divides the system master private key into secret share forms and distributes them to each key distribution center; in the user decryption key generation stage, it is divided into two sub-stages, each key distribution center generates a user decryption key share and sends the generated decryption key share to the user, and the user generates a user decryption key.

[0055] In this embodiment, the symbols and definitions are as follows:

[0056] G1: The additive cyclic group of order prime number N.

[0057] G2: The additive cyclic group of order prime number N.

[0058] G T : The multiplicative cyclic group of order prime number N.

[0059] P1: Generator of group G1.

[0060] P2: Generator of group G2.

[0061] e: From G1×G2 to G T Bilinear map of .

[0062] H1: A cryptographic function derived from a cryptographic hash function.

[0063] H2: Key derivation function.

[0064] t: The minimum number of key distribution centers required to collaborate in generating user decryption keys.

[0065] n: the number of key distribution centers.

[0066] γ: a random number.

[0067] δ: A random number.

[0068] α, β: System encryption master private key.

[0069] [1,N-1]: The set of integers not less than 1 and not greater than N-1.

[0070] P pub : System encryption master public key.

[0071] KGC0: Master Key Distribution Center.

[0072] KGC i : A key distribution center used to generate user decryption key shares.

[0073] Q: The set of key distribution centers that participate in generating keys for data users.

[0074] HID: The encryption private key generation function identifier represented by one byte, selected and made public by the master key distribution center.

[0075] klen: length of the encapsulation key in bits.

[0076] c c : Cloud service center master private key.

[0077] C c : Cloud service center master public key.

[0078] s u : Data user master private key.

[0079] (S u ,Z u ): Data user master public key.

[0080] sk s : Encapsulated user decryption key.

[0081] tk s: The outsourced computing key generated by the cloud service center.

[0082] sk u : User decryption private key.

[0083] EC: Encapsulate ciphertext.

[0084] C0: Commitment value ciphertext about γ, belonging to the multiplicative group G T The elements in .

[0085] C1: SM9 standard ciphertext, belonging to the multiplication group G T The elements in .

[0086] (C′1,C′2): outsourced decryption result, belonging to the multiplicative group G T The elements in .

[0087] m: Number of decryption outsourcing requests.

[0088] {EC i} i∈[n] : Encapsulates a ciphertext set.

[0089] {C i '} i∈[n] : Outsourced decryption result set.

[0090] K: The encapsulated key.

[0091] K': decrypted encapsulation key.

[0092] w1,w2: temporary variables, belonging to the multiplication group G T The elements in .

[0093] w′1,w′2: temporary variables, belonging to the multiplicative group G T The elements in .

[0094] Please refer to Figure 1 The present invention also provides a decryption outsourcing Twin-SM9 key encapsulation method that can support batch auditing, comprising the following steps:

[0095] M1. The master key distribution center runs the system initialization function to generate system public parameters and master private keys. The system public parameters are sent to the cloud service center and users. The system master private key is divided into n secret shares and secretly sent to n key distribution centers. Each key distribution center secretly stores its own private key share.

[0096] M2. The cloud service center generates a master public and private key pair of the cloud service center using the system public parameters, publishes the master public key of the cloud service center, and secretly stores the master private key of the cloud service center;

[0097] M3. The user generates a public key pair using the system public parameters, sends the public key to the cloud service center, and keeps the private key secret.

[0098] M4. The user submits a key application to n key distribution centers respectively, and at least t key distribution centers call the user key generation algorithm to generate a user key share and send it to the user;

[0099] M5. The user generates a complete user decryption key based on the user key shares sent by t key distribution centers;

[0100] M6. The data holder calls the outsourcing key generation function to generate an outsourcing key and sends it to the cloud service center when the user makes a decryption outsourcing request;

[0101] M7. The data holder calls the encryption algorithm to generate ciphertext and sends it to the cloud service center;

[0102] M8. The cloud service center decrypts the ciphertext part based on the outsourced key to generate the outsourced decryption result and save it;

[0103] M9. The master key distribution center, as a trusted third-party organization, conducts batch audits on outsourced decryption results to verify the correctness of the outsourced results;

[0104] M10. The user obtains the encapsulation key based on the outsourced decryption result and the user's decryption private key.

[0105] In this embodiment, M1 is specifically:

[0106] The master key distribution center KGC0 first selects a bilinear group D = (G1, G2, G T ,e,N), the generators of group G1 and group G2 are P1 and P2 respectively, where

[0107] Define two cryptographic hash functions H1:{0,1} * ×Z N →{0,1} klen and H2:{0,1} * ×Z N →{0,1} klen , where three random numbers α, β, δ∈[1,N-1] are selected, where α, β are used as the system master private key, and the element P in group G1 is calculated pub =α·P1 as the system master public key;

[0108] Computation Group G T The elements in g0=e(P1,P2), g1=e(P1,P2) α ,g2=e(P1,P2) β; Select the receiver decryption key generation function identifier hid represented by one byte, and output the system public parameter pp = (D, P1, P2, P pub ,g0,g1,g2,H1,H2,hid);

[0109] The system master private key is divided into n parts and sent secretly to n key distribution centers. Each key distribution center secretly keeps its own share of the private key.

[0110] The system master private key is divided into n parts and secretly sent to n key distribution centers, as follows:

[0111] (1) KGC0 selects three t-1 order polynomials and Among them, a0=α, b0=β, c0=δ;

[0112] (2) KGC0 calculates α respectively i =f1(i),β i = f2(i) and δ i =f3(i), (α i ,β i ,δ i ) are secretly sent to the key distribution center KGC i ,i∈[1,n];

[0113] (3) KGC i ,i∈[1,n] receives the private key share and random number share (α i ,β i ,δ i ) to save, any KGC i The values ​​of α, β, and δ are unknown.

[0114] In this embodiment, the cloud service center in M2 generates the cloud service center master public and private key pair as follows:

[0115] Generate a random number c c ∈[1,N-1], let sk c =c c As the private key of the cloud service center, calculate pk c =C c =c c P2 is used as the public key of the cloud service center and is made public.

[0116] In this embodiment, the user in M3 generates a user master public-private key pair as follows:

[0117] Generate random numbers u ∈[1,N-1], let sk u =s u As the user's master private key, calculate the element S in group G2u =s u P2, Group G T Elements in Let pk u =(S u ,Z u ) as the user's master public key and make it public.

[0118] In this embodiment, the M4 is specifically:

[0119] (1) Let the user's identity be ID, the bit length of the key encapsulated to the user be klen, KGC i After receiving the key application from the user, t KGCs are required to participate. The participating t KGCs confirm each other through broadcasting and form a set Q;

[0120] (2) KGC i First, in the finite field F N Calculation And to other participating KGC j Send 1i ; When KGC j Received the remaining participating KGC i Sent 1i After merging, s1 = ∑ i∈Q s 1i -(t-1)H1(ID||hid,N)=H1(ID||hid,N)+α;

[0121] Among them, the specific process of merging s1 is as follows:

[0122]

[0123] (3) KGC i Calculate D 0i =δ i ·C c , D 3i =δ i P2, and sends D to the user who requested the key 0i , D 1i , D 2i , D 3i ; So far, KGC i Output the user's decryption key share.

[0124] In this embodiment, M5 is specifically:

[0125] User Computing

[0126] Order skID =(K0,K1,K2), user output sk ID As the user decryption key and kept secret; the specific process of the user generating a complete user decryption key is as follows:

[0127]

[0128]

[0129]

[0130] In this embodiment, in M6, the outsourced calculation key is tk ID =sk ID =(K0,K1,K2).

[0131] In this embodiment, M7 is specifically as follows: assuming that the user's identity is ID, the bit length of the key encapsulated to the user is klen, the data holder selects a random number γ∈[1,N-1], and calculates C1=γ(H1(ID||hid,N)P1+P pub ), K=H2(C1||w1||w2||ID,klen), let EC=(C0,C1), and output (K,EC), where K is the encapsulated key and EC is the encapsulated ciphertext.

[0132] In this embodiment, the cloud service center in M8 decrypts the ciphertext part based on the outsourced key to generate an outsourced decryption result and saves it as follows:

[0133]

[0134]

[0135] Output the outsourced decryption result C'=(C'1, C'2).

[0136] In this embodiment, M9 is specifically: after KGC0, as a third-party trusted center, inputs the system master private key, the encapsulated ciphertext, and the outsourced decryption result generated by the cloud service center, for the same user, m outsourced decryption requests have m encapsulated ciphertexts and outsourced decryption results; let the encapsulated ciphertext set {EC i} i∈[m] , outsourced decryption result set {C′ i} i∈[m] ={C′ i,1 ,C′ i,2} i∈[m] , where m is the number of ciphertexts. i,0} i∈[m] ,calculate For the outsourced decryption result set, calculate Judge equation E α =OS1,E β = OS2 is established at the same time; if established, Audit (P pub ,{EC i} i∈[m] ,{C′ i} i∈[m] )=1 means that the cloud service center decrypts correctly, otherwise it means that the cloud service center decrypts incorrectly.

[0137] In this embodiment, M10 is specifically: after receiving the outsourced decryption result C' of the cloud service center, the user first determines whether the decryption result of the cloud service center is correct based on the audit result of the trusted third-party organization KGC0. If correct, then calculate Calculate and output the encapsulation key K'=H2(C1||w′1||w′2||ID,klen). After the user recovers the encapsulation key K', he can decrypt the encapsulated ciphertext to obtain the corresponding plaintext;

[0138] The calculation process of the recovery key K' is as follows:

[0139]

[0140]

[0141] K'=H2(C1||w'1||w'2||ID,klen)=H2(C1||w1||w2||ID,klen).

[0142] Embodiment 1:

[0143] In this embodiment, please refer to Figure 2 The decryption outsourcing Twin-SM9 key encapsulation based on (t, n) threshold that can support batch auditing is divided into 16 steps, specifically:

[0144] First, you need to obtain system parameters and master public key P pub and user ID, start executing step 1 to generate and distribute secret shares (α i ,β i ,δ i ); Execute step 2 to generate a random number c c ,s u ∈[1,N]; execute step 3 and calculate Execute step 4 to calculate the user key share D 0i =δ i ·C c , D 3i =δi P2: Execute step 5 and calculate Execute step 6 to output the user decryption key sk ID =(K0, K1, K2); execute step 7 to generate a random number γ, and execute step 8 to calculate C1 = γ(H1(ID||hid,N)P1+P pub ), execute step 9, calculate After the first 9 steps are completed, the 10th step is executed to output the encapsulated ciphertext EC = (C0, C1); next, the encapsulated ciphertext set {EC i} i∈[m] , outsourced decryption result set {C i ′} i∈[m] and the system master private key (α, β) as input for subsequent steps, and start executing step 11 to calculate the encapsulated ciphertext Execute step 12 to calculate the outsourced decryption result Execute step 13 and judge equation E α =OS1,E β = OS2, execute step 14. If both are true, then Audit(P pub ,{EC i} i∈[m] ,{C′ i} i∈[m] )=1; execute step 15. When it is established, calculate Execute step 16 to calculate K'=H2(C1||w1'||w2'||ID,klen). After steps 11, 12, 13, 14, 15, and 16 are completed, execute step 17 to output the encapsulation key K'.

[0145] The above description is only a preferred embodiment of the present invention. All equivalent changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the present invention.

Claims

1. A decryption outsourcing Twin-SM9 key encapsulation method that can support batch auditing, characterized in that: The following steps are involved: M1. The master key distribution center runs the system initialization function to generate system public parameters and master private keys. The system public parameters are sent to the cloud service center and users. The system master private key is divided into n secret shares and secretly sent to n key distribution centers. Each key distribution center secretly stores its own private key share. M2. The cloud service center generates a master public and private key pair of the cloud service center using the system public parameters, publishes the master public key of the cloud service center, and secretly stores the master private key of the cloud service center; M3. The user generates a public key pair using the system public parameters, sends the public key to the cloud service center, and keeps the private key secret. M4. The user submits a key application to n key distribution centers respectively, and at least t key distribution centers call the user key generation algorithm to generate a user key share and send it to the user; M5. The user generates a complete user decryption key based on the user key shares sent by t key distribution centers; M6. The data holder calls the outsourcing key generation function to generate an outsourcing key and sends it to the cloud service center when the user makes a decryption outsourcing request; M7. The data holder calls the encryption algorithm to generate ciphertext and sends it to the cloud service center; M8. The cloud service center decrypts the ciphertext part based on the outsourced key to generate the outsourced decryption result and save it; M9. The master key distribution center, as a trusted third-party organization, conducts batch audits on outsourced decryption results to verify the correctness of the outsourced results; M10. The user obtains the encapsulation key based on the outsourced decryption result and the user's decryption private key; The M1 is specifically: The master key distribution center KGC0 first selects a bilinear group D = (G1, G2, G T ,e,N), the generators of group G1 and group G2 are P1 and P2 respectively, where Define two cryptographic hash functions H1:{0,1} * ×Z N →{0,1} klen and H2:{0,1} * ×Z N →{0,1} klen , select three random numbers α, β, δ∈[1,N-1], where α, β are the system master private keys, and calculate the element P in group G1 pub =α·P1 as the system master public key; Computation Group G T The elements in g0=e(P1,P2), g1=e(P1,P2) α ,g2=e(P1,P2) β ; Select the receiver decryption key generation function identifier hid represented by one byte, and output the system public parameter pp = (D, P1, P2, P pub ,g0,g1,g2,H1,H2,hid); The system master private key is divided into n secret shares and secretly sent to n key distribution centers. Each key distribution center secretly stores its own private key share. The system master private key is divided into n parts and secretly sent to n key distribution centers, specifically: (1) KGC0 selects three t-1 order polynomials and Among them, a0=α, b0=β, c0=δ; (2) KGC0 calculates α respectively i =f1(i),β i = f2(i) and δ i =f3(i), (α i ,β i ,δ i ) are secretly sent to the key distribution center KGC i ,i∈[1,n]; (3) KGC i ,i∈[1,n] receives the private key share and random number share (α i ,β i ,δ i ) to save, any KGC i The values ​​of α, β, and δ are unknown; The M4 is specifically: (1) Let the user's identity be ID, the bit length of the key encapsulated to the user be klen, KGC i After receiving the key application from the user, t KGCs are required to participate. The participating t KGCs confirm each other through broadcasting and form a set Q; (2) KGC i First, in the finite field F N Calculation And to other participating KGC j Send 1i ; When KGC j Received the remaining participating KGC i Sent 1i After that, merge s1=Σ i∈Q s 1i -(t-1)H1(ID||hid,N)=H1(ID||hid,N)+α; Among them, the specific process of merging s1 is as follows: (3) KGC i Calculate D 0i =δ i ·C c , D 3i =δ i P2, and sends D to the user who requested the key 0i , D 1i , D 2i , D 3i ; So far, KGC i Output user decryption key share; The M5 is specifically: User Computing Order sk ID =(K0,K1,K2), user output sk ID Serves as the user's decryption key and is kept secret; The specific process of a user generating a complete user decryption key is as follows: The M7 is specifically as follows: suppose the user's identity is ID, the bit length of the key encapsulated to the user is klen, the data holder selects a random number γ∈[1,N-1], and calculates C1=γ(H1(ID||hid,N)P1+P pub ), K=H2(C1||w1||w2||ID,klen), let EC=(C0,C1), and output (K,EC), where K is the encapsulated key and EC is the encapsulated ciphertext; The cloud service center in M8 decrypts the ciphertext part based on the outsourced key to generate the outsourced decryption result and saves it as follows: Output outsourced decryption result C'=(C'1, C'2); Specifically, M9 is as follows: after KGC0, as a third-party trusted center, inputs the system master private key, the encapsulated ciphertext, and the outsourced decryption result generated by the cloud service center, for the same user, m outsourced decryption requests have m encapsulated ciphertexts and outsourced decryption results; let the encapsulated ciphertext set {EC i } i∈[m] , outsourced decryption result set {C' i } i∈[m] ={C' i,1 ,C' i,2 } i∈[m] , where m is the number of ciphertexts; for the encapsulated ciphertext set {C i,0 } i∈[m] ,calculate For the outsourced decryption result set, calculate Judge equation E α =OS1,E β = OS2 is established at the same time; if established, Audit (P pub ,{EC i } i∈[m] ,{C i '} i∈[m] )=1, indicating that the cloud service center decrypts correctly, otherwise it indicates that the cloud service center decrypts incorrectly; The specific M10 is as follows: after receiving the outsourced decryption result C' from the cloud service center, the user first determines whether the decryption result from the cloud service center is correct based on the audit result of the trusted third-party organization KGC0. If correct, then calculate Calculate and output the encapsulation key K'=H2(C1||w1'||w'2||ID,klen); after the user recovers the encapsulation key K', he can decrypt the encapsulated ciphertext to obtain the corresponding plaintext; The calculation process of the recovery key K' is as follows: K'=H2(C1||w'1||w'2||ID,klen)=H2(C1||w1||w2||ID,klen).

2. A decryption outsourcing Twin-SM9 key encapsulation system that can support batch auditing, characterized in that: The system is implemented using a decryption outsourcing Twin-SM9 key encapsulation method that can support batch auditing as described in claim 1; it includes a master key distribution center and n key distribution centers; in the system initialization phase, the master key distribution center divides the system master private key into secret shares and distributes them to each key distribution center; in the user decryption key generation phase, it is divided into two sub-phases, each key distribution center generates a user decryption key share and sends the generated decryption key share to the user, and the user generates a user decryption key.

Images