Identity-based oblivious pseudo-random function construction method and end-to-same-end encryption method realized by national secret standard

Abstract

The invention discloses a construction method of an inadvertent pseudo-random function based on identity and an end-to-same-end encryption method realized by a national secret standard, and belongs to the technical field of data security. Blind cloud storage, portability, application server login embedded in a cloud storage server and deployable cloud storage data encryption are realized and met through an algorithm specified by a national secret standard. According to the method, the identity-based casual pseudo-random function is constructed by combining an identity-based pseudo-random function, a confusion circuit and a casual transmission protocol, a national secret standard implementation mode of the method of the identity-based casual pseudo-random function is given, and the identity-based casual pseudo-random function is realized by utilizing the national secret standard provided by the invention. And national secret standard implementation of the end-to-same-end encryption method is given.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and specifically relates to a method for constructing an identity-based oblivious pseudo-random function and an end-to-end encryption method implemented in accordance with national secret standards. Background Art

[0002] With the development of cloud service technology, more and more applications and services are storing user data on third-party cloud storage servers. On the one hand, this saves application service providers the expense of investing in data storage infrastructure. On the other hand, for users, user data is only transferred to the application service provider when they need to use the application service, which enhances the protection of user data privacy.

[0003] Storing data on cloud servers brings a series of new problems. First, from the perspective of data privacy, we need to be concerned about whether the data is stored blindly. Blind cloud storage means that although user data is stored on the cloud server, the privacy of this data will not be disclosed to the cloud service provider, as if the cloud server is "blind" to the data. Usually, this requires that the original data cannot be directly stored in plain text on the cloud server, but the data needs to be encrypted before being stored in ciphertext. This also means that in addition to keeping the passwords for logging into the application server and cloud storage server, users may also need to keep or somehow store and obtain the keys used to encrypt and decrypt data on an online platform. All data stored on the cloud server must first be encrypted with the key, and data obtained from the cloud storage server must also be decrypted with the key before it can be used.

[0004] Secondly, it's also important to consider whether this cloud data storage method is portable for users. Portability means that users can log in and access user data and application services in the same way across different devices. This generally means that passwords used to log in to application servers and cloud storage servers, as well as keys used to encrypt and decrypt cloud-stored data, should not be stored locally. This not only increases the risk of keys and passwords being stolen after a local system compromise, but also requires users to import keys and passwords to new devices, compromising portability. Portability also implies that login passwords that users must remember should not be overly complex, as otherwise, they would be inconvenient. However, the keys used to encrypt and decrypt stored data should not be too simple, as this would easily allow malicious cloud storage servers to steal data privacy. However, portability also requires that keys and login passwords, like login passwords, should not be stored locally.

[0005] Another consideration is whether application server login can be integrated into the cloud storage server login required to access data. On the one hand, when users need application services, they must log in to both the application server and the cloud storage server to access the service. Therefore, it is generally not possible to log in to the application server without logging in to the cloud storage server. Requiring an additional login would reduce user convenience. On the other hand, in reality, users often use the same or similar passwords for multiple logins to facilitate their memorization and use. If a user uses similar login passwords for both the application server and the cloud server, if one of the application servers is malicious or compromised, it is likely that the login password for the cloud storage server could be inferred and the user's private data could be obtained. Therefore, users also hope to use a login mechanism that, without compromising data privacy, can integrate the application server login process with the cloud storage server login process. This way, data privacy is no longer required to remember two different login passwords, but is instead protected by a designed login protocol, so users only need to log in once to access application services.

[0006] If you want to use some cryptographic technologies (such as multi-party computing, secret sharing with password protection, etc.) to protect the privacy of data cloud storage and meet the portability of stored data, you also need to consider whether they are deployable in current real-world business scenarios. This is because these cryptographic technologies often require both application servers and cloud storage servers to support some algebraic operations on data. However, most cloud storage servers now only provide interfaces for functions such as login, storage, retrieval, and deletion, and do not support the algebraic operations required by cryptographic technologies. As a result, some cryptographic technologies may not be deployable in current real-world business scenarios.

[0007] Currently, the cryptographic technologies used for cloud storage data security mainly include password-enhanced encryption, oblivious key management services, and password-protected secret sharing, but none of them can simultaneously meet the above-mentioned four properties: blind cloud storage, portability, application server login embedded in the cloud storage server, and deployability.

[0008] In the paper "End-to-Same-End Encryption: Modularly Augmenting an App with an Efficient, Portable, and Blind Cloud Storage" (USENIX Security Symposium. USENIX Association, 2022, pp. 2353–2370), authors Long Chen and others proposed a method called end-to-same-end encryption. Similar to the end-to-end encryption required between two communicating parties to protect data privacy in communication applications, cloud storage services also require encryption when accessing and storing data on the cloud storage server. In this process, encryption occurs not between the two endpoints but on the cloud storage server itself, hence the name "end-to-same-end encryption."

[0009] The end-to-end encryption method utilizes a cryptographic protocol called an identity-based oblivious pseudorandom function (IBP), which allows users to input a short, memorable password and their identity information into a pseudorandom function provided by the application server. This generates a strong password uniquely determined by their identity and the short, memorable password, which they use to log into the cloud storage server. The IBP ensures that the application server cannot obtain the short password or the strong password. A key generation function then uses the short password and a random number as input to generate a credential for logging into the application server and a key used to re-encrypt the key used to encrypt data stored on the cloud server. The encrypted key is stored on the application server, and the random number is stored on the cloud storage server. This ensures that users only need to remember a single short password and can obtain the strong password, the application server login credential, and the key used to encrypt and decrypt data stored on the cloud server by repeatedly accessing both the application server and the cloud storage server. This approach simultaneously achieves four key properties: blind cloud storage, portability, application server login embedded within the cloud storage server, and deployability.

[0010] Although end-to-end encryption provides a secure and convenient solution for logging into and accessing data on cloud storage servers, there is currently no implementation of end-to-end encryption based on the national commercial cryptographic algorithm standard. If applications are to be deployed in real business scenarios, it is necessary to provide an implementation of end-to-end encryption based on the national cryptographic standard.

[0011] Some existing cloud storage login protection technologies may have problems in actual applications. For example, enhanced password encryption cannot meet the requirements of blind cloud storage; oblivious key management services can enable users to securely manage their own keys on untrusted cloud storage servers, but lack authentication of user identities; secret sharing of protected passwords can meet the requirements of blind cloud storage and is also portable, but it does not embed the login to the cloud storage service into the login of the application server. Users need to remember two passwords, and secret sharing of protected passwords requires the cloud storage server to support some complex arithmetic operations, which may not be deployable in current real-world business scenarios.

[0012] End-to-same-end encryption simultaneously meets the four properties of blind cloud storage, portability, application server login embedded in the cloud storage server, and deployability. The paper "End-to-Same-End Encryption: Modularly Augmenting an App with an Efficient, Portable, and Blind Cloud Storage" provides the protocol steps of end-to-same-end encryption and some required cryptographic components (such as identity-based oblivious pseudo-random functions and key generation functions), but does not limit the specific implementation schemes of these components, nor does it provide a specific implementation method for end-to-end encryption based on the national commercial cryptographic algorithm standard.

[0013] The difficulties in implementing the end-to-same-end encryption proposed in the paper End-to-Same-End Encryption: Modularly Augmenting an App with an Efficient, Portable, and Blind Cloud Storage under national encryption standards are:

[0014] (1) It relies on the hash function on the elliptic curve, but there is currently a lack of national cryptographic standards for this cryptographic primitive.

[0015] (2) It relies on the DH key exchange protocol on the elliptic curve. However, the key exchange protocol specified by the SM2 elliptic curve public key cryptography standard of the National Security Administration adds some more complex encryption operations compared to the DH key exchange protocol. The output obtained by calling the SM2 key exchange protocol does not meet the requirements of constructing an oblivious pseudo-random function in the paper.

[0016] Therefore, in order to implement end-to-end encryption under the national encryption standard, the present invention requires:

[0017] (1) Give the implementation method of the hash function mapped to the elliptic curve under the national cryptographic standard.

[0018] (2) A new identity-based construction method for oblivious pseudo-random functions is presented, and this new construction method can be implemented under national encryption standards.

[0019] This invention proposes a novel method for constructing an identity-based oblivious pseudorandom function and its implementation in accordance with national cryptographic standards, and further provides a method for implementing national cryptographic standards for end-to-end encryption. The national standards required in this invention include:

[0020] (1) National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Part 1: General Principles (Standard No.: GB / T 32918.1-2016)

[0021] (2) National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Part 3: Key Exchange Protocol (Standard No.: GB / T32918.3-2016)

[0022] (3) National Secret SM3 Hash Cryptography Algorithm (Standard No.: GB / T 32905-2016)

[0023] (4) National Secret SM4 Block Cipher Algorithm (Standard No.: GB / T 32907-2016)

[0024] (5) Message Authentication Code Parts 1-3 (Standard Numbers: GB / T 15852.1-2020, GB / T 15852.2-2012, GB / T15852.3-2019)

[0025] End-to-end encryption involves the application server, cloud storage server, and user. The cloud storage server password login and data access functions in end-to-end encryption; the application server provides a strengthened password for logging into the cloud storage server through an identity-based oblivious pseudo-random function, and keeps the key used to encrypt and decrypt data stored on the cloud storage server.

[0026] To be consistent with the model representation method in the paper End-to-Same-End Encryption: Modularly Augmenting an App with an Efficient, Portable, and Blind Cloud Storage, the application server will be referred to as the key server and the cloud storage server as the data server. This helps better illustrate the functional roles of the two servers in the end-to-end encryption model, where the encrypted data and the data key used for encryption are stored separately on two servers to ensure the privacy and security of the cloud storage data. Summary of the Invention

[0027] The purpose of the present invention is to propose a method for constructing an identity-based oblivious pseudo-random function by combining three cryptographic primitives: an identity-based pseudo-random function, a garbled circuit, and an oblivious transfer protocol, as well as an end-to-end encryption method implemented in accordance with national secret standards on this basis.

[0028] To achieve the above object, the technical solution adopted by the present invention is as follows:

[0029] A method for constructing an identity-based oblivious pseudo-random function comprises the following steps:

[0030] 1) Steps for constructing an identity-based pseudo-random function implemented according to the national secret standard: Based on the user ID and the short password PP input, the private key msk held by the key server, the hash function constructed according to the national secret SM3 hash cipher algorithm standard, the symmetric encryption algorithm constructed according to the national secret SM4 block cipher algorithm standard, and the hash function constructed according to the national secret SM3 hash cipher algorithm standard, construct the identity-based pseudo-random function implemented according to the national secret standard;

[0031] 2) Constructing a garbled circuit generation algorithm that meets national security standards: Based on the input bit string, wire label value, and the national security standard symmetric encryption and decryption algorithm or hash function, construct a garbled circuit generation algorithm that meets national security standards;

[0032] 3) Steps for constructing a hash function on an elliptic curve implemented according to national cryptographic standards: Based on the national cryptographic SM2 elliptic curve public key cryptography algorithm and the national cryptographic SM3 hash cryptography algorithm, construct a hash function on an elliptic curve implemented according to national cryptographic standards;

[0033] 4) Steps for constructing the oblivious transfer protocol algorithm implemented by the national secret standard: Based on the national secret SM2 elliptic curve public key cryptography algorithm and the hash function on the elliptic curve implemented by the national secret standard, construct the oblivious transfer protocol algorithm implemented by the national secret standard;

[0034] 5) Steps for constructing an identity-based oblivious pseudo-random function implemented in accordance with national secret standards: Based on the above-mentioned identity-based pseudo-random function implemented in accordance with national secret standards, the obfuscated circuit generation algorithm implemented in accordance with national secret standards, and the oblivious transfer protocol algorithm implemented in accordance with national secret standards, construct an identity-based oblivious pseudo-random function implemented in accordance with national secret standards.

[0035] Furthermore, the steps for constructing the identity-based pseudo-random function implemented by the national cryptography standard specifically include:

[0036] 1-1) Hash function constructed using the national secret SM3 hash encryption algorithm standard Map PP to obtain a 128-bit hash value Map msk and id to obtain a 128-bit hash value

[0037] 1-2) Symmetric encryption algorithm constructed using the national secret SM4 block cipher algorithm standard by As input plaintext, As input key, encryption is obtained

[0038] 1-3) And PP input to the Hash function constructed by the national secret SM3 hash encryption algorithm standard Mapped into a 56-bit hash value The hash value is used as the enhanced password pwd for user login;

[0039] 1-4) Pseudo-random function f is determined by msk and id msk,id (·) Enhance PP to a strong password pwd = f msk,id (PP), by f msk,id (PP) and Get the identity-based pseudo-random function implemented by the national secret standard

[0040] Furthermore, the steps for constructing the garbled circuit generation algorithm implemented by the national encryption standard specifically include:

[0041] 2-1) Using a symmetric encryption algorithm or hash function that meets national security standards, encrypt the label values ​​of the two input wires and the corresponding output wires in each row of the circuit gate coding table to obtain the encrypted ciphertext. When calculating the obfuscated circuit, this ciphertext is decrypted using a symmetric decryption algorithm or hash function that meets national security standards to output the wire label values.

[0042] 2-2) Encode the specified function f(·,·) to generate a garbled circuit, the formula is Where λ represents the length of the input bit string, GC represents the garbled circuit after encoding, and Two wire tag values ​​representing each bit of the two input bit strings of the specified function, the wire tag values ​​being calculated in step 2-1);

[0043] 2-3) Based on the encoded obfuscation circuit GC and its encoding value, construct the obfuscation circuit generation algorithm EvalGC implemented by the national secret standard SM (GC,·,·).

[0044] Furthermore, step 2-1) specifically includes:

[0045] For a row in the circuit gate coding table, the label values ​​of the two input wires are A and B respectively, and the label value of the corresponding output wire is C;

[0046] The symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm standard is used to encrypt C in sequence with A and B as keys to obtain the ciphertext When calculating the obfuscated circuit, the decryption algorithm of the national secret SM4 block cipher algorithm standard is used calculate Decrypt the output wire label value;

[0047] Alternatively, use the hash function constructed according to the national secret SM3 hash algorithm standard to calculate the encrypted ciphertext Calculate when calculating the garbled circuit Decrypt the output wire label value.

[0048] Furthermore, the steps for constructing the hash function on the elliptic curve implemented by the national cryptography standard specifically include:

[0049] 3-1) Select the elliptic curve E(F) according to the national secret SM2 elliptic curve public key cryptography algorithm standard q ):Y 2 =X 3 +aX+b parameters q, a, b, and q≡2(mod 3);

[0050] 3-2 For input r∈E(F q ), according to the national secret SM2 elliptic curve public key cryptography algorithm standard, the elliptic curve E(F q ) is converted into a bit string l r , let m = l r ; If the input is n points Then m=l1||...||l n ;

[0051] 3-3) Construct a hash function based on the SM3 hash algorithm The input is a bit string of arbitrary length; the hash function specified by the National Secret SM3 hash cryptography algorithm standard is called, and the output is a 256-bit bit string; then according to the National Secret SM2 elliptic curve public key cryptography algorithm, the output bit string is converted into a finite field F q The domain elements on Reuse Construct two different Hash functions and

[0052] 3-4) Based on the two Hash functions constructed above and using the Incar function, a Hash function on the elliptic curve implemented according to the national cryptography standard is constructed:

[0053] Furthermore, the steps for constructing the oblivious transfer protocol algorithm implemented by the national encryption standard specifically include:

[0054] 4-1) Select the elliptic curve E(F) according to the national secret SM2 elliptic curve public key cryptography algorithm standard q ):Y 2 =X 3 +aX+b parameters q, a, b, and q≡2(mod 3);

[0055] 4-2) Obtain the elliptic curve E(F) according to the national secret SM2 elliptic curve public key cryptography algorithm standard q )A random point R on A With R B , the user selects two random points r0,r1∈E(F q ), the user selects the index i, and r i Replace with It is a hash function on the elliptic curve implemented by the national cryptography standard; the user sends r0 and r1 to the key server;

[0056] 4-3) The key server calculates the received r0 and r1 Each R i As stipulated by the National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Standard, the R A , and then continue to perform a key exchange protocol with the user; the output obtained by the key server in the two key exchange protocols is and The output obtained by the user in the two key exchange protocols is and Oblivious Transfer Protocol Guarantees and And users cannot pass Calculated

[0057] 4-4) The above three steps implement the 2-choose-1 oblivious transfer protocol under the national encryption standard. The message sent by the user to the key server in the first round of communication is recorded as OT1, and the message sent by the key server to the user in the second round of communication is recorded as OT2. The algorithm for calculating OT1 by the user is recorded as i represents the number selected by the user, and st represents the algorithm R OT The information generated in the user's local storage; the algorithm used by the key server to calculate OT1 is recorded as The user's last calculation to obtain ω i The algorithm is recorded as These three algorithms together constitute the oblivious transfer protocol algorithm implemented by the national encryption standard.

[0058] Furthermore, the steps for constructing the identity-based oblivious pseudo-random function implemented by the national cryptography standard specifically include:

[0059] 5-1) The user calls the hash function constructed by the SM3 hash algorithm to map the input short password into a hash value, and calls the oblivious transfer protocol algorithm implemented by the above-mentioned national secret standard to process each bit of the hash value;

[0060] 5-2) The user sends a request to the key server;

[0061] 5-3) The key server processes the request to call the oblivious transfer protocol algorithm implemented in the above-mentioned national encryption standard;

[0062] 5-4) The key server randomly assigns a wire label value to each wire input into the obfuscated circuit, and uses the obfuscated circuit generation algorithm implemented in accordance with the aforementioned national secret standard to encode the symmetric encryption algorithm constructed using the national secret SM4 block cipher algorithm into an obfuscated circuit;

[0063] 5-5) The key server calls the hash function constructed by the SM3 hashing algorithm to map the private key msk held by the key server and the user ID into a hash value, and encodes it into the input of the obfuscation circuit;

[0064] 5-6) The key server sends the result of step 5-3), the obfuscated circuit encoded in step 5-4), and the input of the obfuscated circuit encoded in step 5-5) as a reply to the user;

[0065] 5-7) After the user receives the reply, the result of step 5-3) is processed using the oblivious transfer protocol algorithm implemented by the above-mentioned national secret standard, and then the obfuscated circuit generation algorithm implemented by the above-mentioned national secret standard and the user's short password are input into the hash function constructed by the national secret SM3 hash cipher algorithm, and then the identity-based pseudo-random function implemented by the above-mentioned national secret standard is called for processing to obtain the identity-based oblivious pseudo-random function.

[0066] An end-to-end encryption method implemented according to national secret standards, based on the identity-based oblivious pseudo-random function constructed by the above construction method Implementation includes the following steps:

[0067] 1) Registration step: The user uses the identity ID and short password PP to access the key server, and uses the function provided by the key server to Get the enhanced password pwd and use id and pwd to register with the data server; the user selects a random number s id Stored on the data server, the login credential t is generated according to the constructed key derivation function KDF1(·,·), and registered with the key server based on t and id;

[0068] 2) Key storage step: The user uses the identity ID and short password PP to access the key server, and uses the function provided by the key server to store the key. Get the enhanced password pwd, and use id and pwd to log in to the data server; after logging in, select a random number r id Stored on the data server, and retrieved from the data server at the same time id The user calculates the login credential t based on the two constructed key derivation functions, selects a data key mk for encrypting the data stored on the data server and encrypts it into a ciphertext ct, and calculates a message authentication code τ based on the key derivation function and ct to prevent ct from being tampered with; the user logs in to the key server and saves ct and τ on the key server;

[0069] 3) Get key step: The user uses the identity ID and short password PP to access the key server, and uses the function provided by the key server to Obtain the enhanced password pwd and use id and pwd to log in to the data server; after logging in, retrieve the stored random number s from the data server id With r id The user calculates the login credential t, intermediate quantities k1 and k2 based on the three key derivation functions constructed above. The user uses id and t to log in to the key server. After logging in, the user retrieves the stored ct and τ from the key server, first verifies ct and τ based on k1 and k2, and decrypts the data key mk after verification.

[0070] 4) Data storage step: When the user retrieves the key, he logs in to the data server and uses the decrypted data key mk to encrypt the desired data m into ciphertext c, and at the same time generates a message authentication code t', and saves c and t' on the data server;

[0071] 5) Data retrieval step: When retrieving the key, the user logs in to the data server, obtains the data key mk from the key server, and obtains the stored encrypted data c and t' from the data server; first, t' is used to verify whether the ciphertext c obtained from the data server has not been tampered with. If the verification is successful, the ciphertext c is decrypted to obtain the plaintext data m before encryption.

[0072] Furthermore, in the registration step, a key derivation function KDF1(·,·) with a custom output length is constructed based on the national secret SM2 elliptic curve public key cryptography algorithm.

[0073] Furthermore, in the key storage step, the user constructs two key derivation functions KDF2(·,·) and KDF3(·,·) with custom output lengths according to the SM2 elliptic curve public key cryptography algorithm; first calculate t=KDF1(s id ,PP), then calculate k1=KDF2(r id ,PP) and k2=KDF3(r id ,PP); then call the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm standard calculate Then call the HMac function HMac(·,·) constructed by the national standard message authentication code to calculate τ=HMac(ct,k2).

[0074] Furthermore, in the key acquisition step, the user calculates t=KDF1(s id ,PP)、k1=KDF2(r id ,PP)、k2=KDF3(r id ,PP); first verify whether τ=H SM3 (ct,k2), if it satisfies the requirement, then the decryption algorithm of the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm is called. Calculate the data key

[0075] Furthermore, in the data storage step, the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm is called to encrypt the data m to obtain the ciphertext c, and then the message authentication code algorithm that complies with the national standard is called to calculate the ciphertext c to obtain the message authentication code t'.

[0076] Furthermore, in the data acquisition step, the decryption algorithm of the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm is called to decrypt the ciphertext c to obtain the plaintext data m before encryption.

[0077] The beneficial effects achieved by the present invention are as follows:

[0078] 1. The present invention proposes a method for constructing an identity-based oblivious pseudo-random function, which combines three cryptographic primitives: identity-based pseudo-random function, obfuscation circuit and oblivious transfer protocol. It can directly call the key exchange protocol specified by the national secret SM2 elliptic curve public key cryptography algorithm and other national secret algorithms to construct an identity-based oblivious pseudo-random function.

[0079] 2. Based on the proposed identity-based oblivious pseudorandom function construction method, this invention implements end-to-end encryption in accordance with national security standards, furthering its practical application in real-world scenarios. Compared with existing cloud storage data security technologies such as password-enhanced encryption, oblivious key management services, and password-protected secret sharing, end-to-end encryption simultaneously meets the four properties of blind cloud storage, portability, application server login embedded within cloud storage server login, and deployability, demonstrating promising application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 Flowchart of the construction method of identity-based oblivious pseudo-random function implemented for national cryptographic standards.

[0081] Figure 2 This is a flow chart of each stage of end-to-end encryption. DETAILED DESCRIPTION

[0082] In order to make the various technical features and advantages or technical effects of the above technical solutions of the present invention more obvious and easy to understand, they are described in detail below with reference to the accompanying drawings.

[0083] This paper proposes a method for constructing an identity-based oblivious pseudorandom function. This method utilizes three cryptographic primitives: an identity-based pseudorandom function, a garbled circuit, and an oblivious transfer protocol, as well as a hash function on an elliptic curve. The following steps implement these four cryptographic primitives according to national secret standards:

[0084] (1) Implementation of the National Secret Standard Based on Identity-Based Pseudo-Random Function

[0085] The present invention provides an identity-based pseudo-random function expression as follows:

[0086]

[0087] Where msk is the private key held by the key server, id is the user's identity, PP is the short password entered by the user, and f msk,id It is a pseudo-random function extracted from a family of pseudo-random functions based on the msk and id. The private key msk ensures that even if the specific implementation of the pseudo-random function protocol is accidentally disclosed, as long as the msk is not known, no one except the key server can provide the same pseudo-random function. msk,id (·) is a pseudo-random function determined by msk and id, which can enhance the short password PP entered by the user into a strengthened password pwd=f msk,id(PP), and the data server cannot infer PP from pwd. In addition, the identity-based pseudo-random function also requires that the key management server cannot know the short password PP entered by the user and the strengthened password pwd finally obtained by the user, and the user cannot know the private key msk held by the key management server.

[0088] The hash function constructed on behalf of the National Secret SM3 hash cipher algorithm standard is designed to map an input string of any length into a 128-bit hash value to meet the input key and plaintext block length requirements of the National Secret SM4 block cipher algorithm. It should be noted that the hash value output by the National Secret SM3 cipher is 256 bits. Therefore, according to the method for constructing a key derivation function in Section 5.4.3 of Part 3 of the National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Standard, this method can be used to construct a hash function H with an input bit length of any length v by calling the National Secret SM3 hash cipher algorithm. V (·), take v = 128 to construct the required function.

[0089] This is a symmetric encryption algorithm constructed according to the National Security Agency's SM4 block cipher standard. The subscript on the right of the function represents a 128-bit input key. The input to the function is plaintext of any length, but the plaintext is actually divided into several 128-bit blocks, each of which is encrypted separately. When constructing the identity-based pseudo-random function, the input is exactly one 128-bit block. The final output is 128-bit ciphertext.

[0090] The hash function represents the standard construction of the national secret SM3 hash cipher algorithm. Its purpose is to map an input string of any length into a 256-bit hash value, which is ultimately used as a strengthened password.

[0091] Pseudorandom function f msk,id (PP), It is used to map the short password PP entered by the user into a 128-bit The algorithm inputs plaintext, The purpose is to map the private key msk held by the key server and the user id into a The input key of the algorithm ensures that the pseudo-random function is determined by the private key msk held by the key server and the user id.

[0092] get After calculating the result, you need to add the short password PP entered by the user and enter it together function, this is mainly because in a two-party protocol without paying attention to the pseudo-random function, the user cannot be sure whether the key server is really providing symmetric encryption honestly. Function, in order to prevent the key server from predicting the user's final enhanced password by manipulating the symmetric encryption calculation results obtained by the user, a password PP known only to the user must be added and entered together function, and finally Used as a strong password for logging into the data storage server.

[0093] (2) Implementation of National Security Standards for Obfuscated Circuits

[0094] Obfuscation circuits are a method for multi-party secure computation proposed by Yao Qizhi in his paper "How to generate and exchange secrets" (27th FOCS, pages 162–167. IEEE Computer Society Press, October 1986). In this method, the symmetric encryption algorithm portion of an oblivious pseudorandom function is encoded into an obfuscation circuit, thereby ensuring that the user cannot obtain the key server's input string information to calculate the symmetric encryption result.

[0095] The principle of a garbled circuit is to encode each bit of a function's input as an input wire. The function is then encoded as a circuit consisting of several AND gates and XOR gates, each with two input wires and one output wire. The final output wire forms each bit of the function's output. Each wire must have a value of either 0 or 1, and each possible value of each wire is encoded as a label. This allows the truth table of each gate in the circuit to be encoded as a table with four rows and three columns. The first two columns of each row contain a label value for each of the two input wires, while the third column contains the label value corresponding to the true value of the output wire after the input wires are determined. The resulting ciphertext is then encrypted twice using the label values ​​in the first and second columns as a key. Finally, the rows of the table encoded for each gate are shuffled, effectively encoding the function as a garbled circuit.

[0096] The calculation method of the obfuscated circuit is to query the coding table of the circuit gates of these wires in the obfuscated circuit GC based on the coded label value of each bit on the two sets of input wires of the circuit, and obtain a row corresponding to the label values ​​of the two input wires. Then, use these two label values ​​as the key to decrypt the third column of this row twice to obtain the label value of the output wire. Then, query the next circuit gate input by these output wires until the value of each bit of the last set of output wires is decrypted, and the output value of the function encoded by the obfuscated circuit under two inputs is obtained.

[0097] The key to implementing obfuscated circuits under national security standards lies in the encryption and decryption algorithms for the output wire label values ​​in each row and third column of the encoding table for each circuit gate. There are many ways to construct obfuscated circuits. Here are two examples that can be implemented under national security standards:

[0098] (a) Assume that the label values ​​of the two input wires in a row of the circuit gate coding table are A and B respectively, and the label value of the corresponding output wire is C. Then, the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm standard can be used to encrypt C in sequence with A and B as keys to obtain the ciphertext When calculating the garbled circuit, we calculate Decrypt the output wire label value, It is the decryption algorithm of the national secret SM4 block cipher algorithm standard.

[0099] (b) Assuming that the label values ​​of the two input wires in a row of the circuit gate coding table are A and B respectively, and the label value of the corresponding output wire is C, the hash function constructed by the national secret SM3 hash encryption algorithm standard can be used to calculate the encrypted ciphertext When calculating the garbled circuit, we calculate Decrypt the output wire label value.

[0100] The algorithm for encoding a given function f(·,·) to generate a garbled circuit based on the national encryption standard is denoted as where λ represents the length of the input bit string, f(·,·) represents the encoded function, and Represents the two wire label values ​​for each bit of the two input bit strings of the specified function. The first number in the label value subscript represents the i-th bit of the input bit string, and the second number in the subscript represents the true value of the wire corresponding to the label value is 0 or 1. GC represents the encoded garbled circuit. The corresponding algorithm for calculating the garbled circuit is denoted as EvalGC SM (GC,·,·), EvalGC SM The first input of the function is the garbled circuit after the function is encoded, and the second and third inputs are the garbled circuit encoding values ​​of the two inputs of the function.

[0101] (3) National Cryptography Standard Implementation of Hash Functions on Elliptic Curves

[0102] The hash function can map input information of any length into a hash string of fixed length, but the resulting hash string is not necessarily an element in a specified elliptic curve group. In cryptography, there is a need to map input information to an elliptic curve group through a hash function. In this invention, it is necessary to use a hash function on an elliptic curve constructed according to the national cryptography standard to implement the oblivious transfer protocol.

[0103] The present invention constructs a hash function on an elliptic curve according to the method proposed by Eric Brier et al. in the paper Efficient indifferentiable hashing into ordinary elliptic curves. (CRYPTO (2010), T. Rabin, Ed., vol. 6223 of LNCS, Springer, pp. 237-254.) e :E(F q )→E(F q ). E(F q ) represents the definition in the finite field F q Previous elliptic curve (X, Y): Y 2 =X 3 The group of points on +aX+b.

[0104] Constructing a Hash function on an elliptic curve requires the Incar function f Incar (u)=(x,y):F q →E(F q ):

[0105] y=ux+v

[0106] The Incar function requires a finite field F q Satisfies q≡2(mod 3).

[0107] Next, we will construct a Hash function on the elliptic curve based on the national cryptographic standard.

[0108] (1) According to the provisions of Section 5 of Part 1 of the National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Standard, the elliptic curve E(F) is selected. q ):Y 2 =X 3 The parameters q, a, and b of +aX+b must satisfy q≡2(mod 3).

[0109] (2) For an input r∈E(F q ), according to the provisions of Section 4.2 of Part 1 of the National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Standard, the elliptic curve E(F q ) is converted into a bit string l r , let m = l r ; If the input is n points Then m=l1||...||l n .

[0110] (3) Construct a hash function based on the national secret SM3 hash cipher algorithm The input is a bit string of arbitrary length, and the hash function specified in the National Secret SM3 hash cryptography algorithm standard is called. The output is a 256-bit bit string. Then, according to the provisions of Section 4.2 of Part 1 of the National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Standard, the output bit string is converted into a finite field F q The domain elements on Reuse Construct two different Hash functions and

[0111] (1) The hash function expression on the elliptic curve implemented by the national cryptography standard is:

[0112]

[0113] (4) Implementation of the National Encryption Standard for the Oblivious Transfer Protocol

[0114] Oblivious transfer involves a protocol in which the two parties are a sender holding multiple pieces of information and a receiver seeking to obtain a specific piece of information. Through the oblivious transfer protocol, the receiver can obtain a specific piece of information from the sender without being able to learn about the sender's other information, nor can the sender know which piece of information the receiver has selected. The oblivious transfer protocol in this invention allows users to obtain the garbled circuit encoding tag value corresponding to each bit of the input string from a key server without exposing their input string. Because each bit has a true value of 0 or 1, a 2-choose-1 oblivious transfer protocol is required.

[0115] This invention adopts the method of constructing oblivious transfer from key agreement, as presented in the paper Endemic oblivious transfer (CCS.ACM, 2019, pp.309–326) by D.Masny et al. This oblivious transfer protocol ensures that after the sender generates several keys, the receiver can obtain only one key of its choice. It is important to note that in this invention, it is not necessary for the key server to first specify all the coded label values ​​of the obfuscation circuit input string, and then the user obtains the coded label value of the obfuscation circuit corresponding to the true value of each bit of the input string through the oblivious transfer protocol. Instead, by constructing oblivious transfer from key agreement, the key server generates several "keys" and then specifies these "keys" as all the coded label values ​​of the obfuscation circuit input string, and then constructs the obfuscation circuit.

[0116] The process of implementing the 2-choose-1 oblivious transfer protocol according to the national encryption standard is as follows:

[0117] (1) According to the provisions of Section 5 of Part 1 of the National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Standard, the elliptic curve E(F) is selected.q ):Y 2 =X 3 The parameters q, a, and b of +aX+b must satisfy q≡2(mod 3).

[0118] (2) According to the provisions of Section 6 of Part 3 of the National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Standard, the user and the key server each obtain an elliptic curve E(F q )A random point R on A With R B , the user selects two random points r0,r1∈E(F q ), the user selects the index i, and r i Replace with It is a hash function on the elliptic curve implemented according to the national cryptography standard. The user sends {r0, r1} to the key server.

[0119] (3) The key server calculates the received r0 and r1 Each R i As specified in Section 6 of Part 3 of the National Cryptography SM2 Elliptic Curve Public Key Cryptography Algorithm Standard, the R that should be received from the user A , and then continue to perform a key exchange protocol with the user. The output obtained by the key server in the two key exchange protocols is and The output obtained by the user in the two key exchange protocols is and Oblivious Transfer Protocol Guarantees and And users cannot pass Calculated

[0120] In this way, the 2-choose-1 oblivious transfer protocol is implemented under the national encryption standard. The number of communication rounds required for the entire protocol is equal to the number of communication rounds of the national encryption SM2 elliptic curve public key cryptography algorithm key exchange protocol, that is, two rounds. The message sent by the user to the key server in the first round of communication is recorded as OT1, and the message sent by the key server to the user in the second round of communication is recorded as OT2.

[0121] The algorithm used by the user to calculate OT1 is denoted as i represents the number selected by the user, and st represents the algorithm R OT The information generated in the user's local memory is used to calculate the user's selected information ω i The algorithm used by the key server to calculate OT1 is denoted as The user's last calculation to obtain ω i The algorithm is recorded as

[0122] (V) Implementation of the National Secret Standard for Identity-Based Oblivious Pseudo-Random Functions

[0123] This paper has given the implementation method of three cryptographic primitives, namely identity-based pseudo-random function, confusion circuit, and oblivious transfer protocol under the national secret standard. Next, the three cryptographic primitives are combined to give the implementation method of identity-based oblivious pseudo-random function F under the national secret standard. IBOPRF :(msk,(id,PP))→(⊥,f msk,id (PP)) method, the specific steps are as follows Figure 1 shown.

[0124] (1) The user first calls the Hash function constructed by the National Secret SM3 hash cipher algorithm Map the short password you input into a 128-bit hash value x. For each bit of x i , call the algorithm in the national secret oblivious transfer protocol once

[0125] (2) The user will request Sent to the key server.

[0126] (3) After receiving the request req, the key server 1,i Call the algorithm in the national secret oblivious transfer protocol once

[0127] (4) The key server randomly assigns the garbled circuit encoding label value corresponding to each wire of the first 128-bit input of the circuit Re-specify The garbled circuit encoding label value corresponding to each wire of the second set of 128-bit input of the circuit is used, and the garbled circuit generation algorithm is called. A symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm Encoded into garbled circuit GC.

[0128] (5) The key server then calls the Hash function constructed by the National Secret SM3 hash cipher algorithm Map the private key msk held by the key server and the user id together into a 128-bit hash value k id , then k id The first set of inputs encoded into the garbled circuit represent The truth value of the i-th bit.

[0129] (6) The key server will reply Sent to the user.

[0130] (7) After receiving the reply resp, the user will 2,i Call the algorithm in the national secret oblivious transfer protocol once Then call the garbled circuit calculation algorithm Enter the hash function constructed by the SM3 hashing algorithm together with the user's short password PP to calculate Get the identity-based oblivious pseudo-random function F IBOPRF :(msk,(id,PP))→(⊥,f msk,id (PP)).

[0131] So far, the present invention has provided a method for implementing an identity-based oblivious pseudo-random function under the national secret standard. The function is recorded as Next, the present invention uses the identity-based oblivious pseudo-random function constructed by the above method to propose an end-to-end encryption method implemented according to the national secret standard, which is specifically described as follows.

[0132] End-to-end encryption can be divided into two parts: the key encapsulation mechanism and the data encapsulation mechanism. The key encapsulation mechanism ensures that users can safely store the keys used to encrypt and decrypt data stored on the data server on the key server, and can safely retrieve the keys by only remembering a short password. The key encapsulation mechanism in end-to-end encryption includes three stages: registration, key storage, and key retrieval. The data encapsulation mechanism ensures that users can safely encrypt data and store it on the data server using the keys retrieved from the key server, or decrypt data retrieved from the data server and verify the integrity of the data. The data encapsulation mechanism in end-to-end encryption includes two stages: data storage and data retrieval. End-to-end encryption requires users to complete the registration stage and the key storage stage first. After that, each time the user needs to retrieve or store data, they must first log in to the data server and the key server through the key retrieval stage. After obtaining the key from the key server, they can use the key to securely access data on the data server through the authenticated encryption algorithm. The process of each stage of end-to-end encryption is as follows: Figure 2 shown.

[0133] (1) Registration stage

[0134] (1) The user uses his or her own identity ID and the short password PP to access the key server, and the identity-based pseudo-random function implemented by the national secret standard provided by the key server is used. Get a strong password pwd.

[0135] (2) The user registers with the data server using his / her identity ID and enhanced password pwd. The data server checks whether the user ID has not been registered before. If so, it registers the user ID and login password pwd.

[0136] (3) The user selects a random number s id Then, according to the method of constructing key derivation function specified in Section 5.4.3 of Part 3 of the National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Standard, a key derivation function KDF1(·,·) with a custom output length is constructed, and t=KDF1(s id ,PP), register t as the login credential together with the user id to the key server, and the key server registers the user id and the login credential t.

[0137] (2) Key storage stage

[0138] (1) The user uses his or her own identity ID and the short password PP to access the key server, and the identity-based pseudo-random function implemented by the national secret standard provided by the key server is used. Get a strong password pwd.

[0139] (2) The user logs in to the data server with his / her own identity ID and enhanced password pwd, and then selects a random number r after successful login. id Stored on the data server, and retrieved from the data server at the same time id .

[0140] (3) The user constructs two key derivation functions KDF2(·,·) and KDF3(·,·) with custom output lengths according to the method of constructing key derivation functions in Section 5.4.3 of Part 4 of the National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm. The user first calculates t=KDF1(s id ,PP), then select a data key mk for encrypting the data stored on the data server, calculate k1=KDF2(r id ,PP) and k2=KDF3(r id ,PP). Then call the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm standard calculate The HMac function HMac(·,·), constructed according to the National Standard for Message Authentication Codes, Part 2 (GB / T15852.2-2012), is used to calculate τ = HMac(ct,k²). The user logs in to the key server using their identity id and login credentials t. The ciphertext ct encrypted with the key mk and the message authentication code τ, which protects ct from tampering, are stored on the key server.

[0141] (3) Key acquisition stage

[0142] (1) The user uses his or her own identity ID and the short password PP to access the key server, and the identity-based pseudo-random function implemented by the national secret standard provided by the key server is used. Get a strong password pwd.

[0143] (2) The user logs in to the data server with his / her own identity ID and enhanced password pwd. After successful login, the stored random number s is retrieved from the data server. id With r id .

[0144] (3) User calculates t = KDF1(s id ,PP)、k1=KDF2(r id ,PP)、k2=KDF3(r id ,PP). Then use the identity id and login credentials t to log in to the key server. After successful login, retrieve the stored ciphertext ct and the message authentication code τ to prevent ct from being tampered with from the key server. First verify whether τ=H SM3 (ct,k2), if satisfied, then call the decryption algorithm of the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm Calculate the data key

[0145] (4) Data storage stage

[0146] (1) After the user logs in to the data server through the key acquisition phase and obtains the data key mk from the key server, the user uses the key mk to encrypt the data to be stored on the data server using an authenticated encryption method that complies with national secret standards. Authenticated encryption first uses the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm to encrypt the data m to obtain the ciphertext c. The ciphertext is then used with a message authentication code algorithm that complies with national standards (any message authentication code specified in the three standards GB / T 15852.1-2020, GB / T 15852.2-2012, and GB / T 15852.3-2019) to obtain the message authentication code t'.

[0147] (2) The encrypted data (c, t') is sent and stored on the data server.

[0148] (5) Data acquisition stage

[0149] (1) The user logs in to the data server through the key retrieval phase, obtains the data key mk from the key server, and obtains the stored encrypted data (c, t') from the data server.

[0150] (2) The user first verifies whether the ciphertext c obtained from the data server has not been tampered with by using the message authentication code t'. If the verification is successful, the user then calls the decryption algorithm of the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm to decrypt the ciphertext c and obtain the plaintext data m before encryption.

[0151] The innovation of the present invention lies in combining three cryptographic primitives, namely, identity-based pseudo-random function, obfuscation circuit, and oblivious transfer protocol, to implement a method for identity-based oblivious pseudo-random function. Therefore, even if the implementation method of any of the cryptographic primitives is changed, as long as the combination of identity-based pseudo-random function + obfuscation circuit + oblivious transfer protocol is used to construct an identity-based oblivious pseudo-random function and thus implement end-to-same-end encryption, it should be considered as covered by the scope of the present invention.

[0152] Although the present invention has been disclosed as above by way of embodiments, they are not intended to limit the present invention. Any appropriate modification or equivalent substitution of the technical solution of the present invention by a person skilled in the art should be included in the protection scope of the present invention. The protection scope of the present invention shall be based on that defined in the claims.

Claims

1. A method for constructing an identity-based oblivious pseudo-random function, characterized in that: The following steps are involved: 1) Steps for constructing an identity-based pseudo-random function implemented according to the national secret standard: Based on the user ID and the short password PP input, the private key msk held by the key server, the hash function constructed according to the national secret SM3 hash cipher algorithm standard, the symmetric encryption algorithm constructed according to the national secret SM4 block cipher algorithm standard, and the hash function constructed according to the national secret SM3 hash cipher algorithm standard, construct the identity-based pseudo-random function implemented according to the national secret standard; 2) Constructing a garbled circuit generation algorithm that meets national security standards: Based on the input bit string, wire label value, and the national security standard symmetric encryption and decryption algorithm or hash function, construct a garbled circuit generation algorithm that meets national security standards; 3) Steps for constructing a hash function on an elliptic curve implemented according to national cryptographic standards: Based on the national cryptographic SM2 elliptic curve public key cryptography algorithm and the national cryptographic SM3 hash cryptography algorithm, construct a hash function on an elliptic curve implemented according to national cryptographic standards; 4) Steps for constructing the oblivious transfer protocol algorithm implemented by the national secret standard: Based on the national secret SM2 elliptic curve public key cryptography algorithm and the hash function on the elliptic curve implemented by the national secret standard, construct the oblivious transfer protocol algorithm implemented by the national secret standard; 5) Steps for constructing an identity-based oblivious pseudo-random function implemented in accordance with national secret standards: Based on the above-mentioned identity-based pseudo-random function implemented in accordance with national secret standards, the obfuscated circuit generation algorithm implemented in accordance with national secret standards, and the oblivious transfer protocol algorithm implemented in accordance with national secret standards, construct an identity-based oblivious pseudo-random function implemented in accordance with national secret standards.

2. The construction method according to claim 1, wherein: The steps for constructing the identity-based pseudo-random function implemented by the national cryptography standard include: 1-1) Hash function constructed using the national secret SM3 hash encryption algorithm standard Map PP to obtain a 128-bit hash value Map msk and id to obtain a 128-bit hash value 1-2) Symmetric encryption algorithm constructed using the national secret SM4 block cipher algorithm standard by As input plaintext, As input key, encryption is obtained 1-3) And PP input to the Hash function constructed by the national secret SM3 hash encryption algorithm standard Mapped into a 56-bit hash value The hash value is used as the enhanced password pwd for user login; 1-4) Pseudo-random function f is determined by msk and id msk,id (·) Enhance PP to a strong password pwd = f msk,id (PP), by f msk,id (PP) and Get the identity-based pseudo-random function implemented by the national secret standard 3. The construction method according to claim 1, wherein: The construction steps of the garbled circuit generation algorithm implemented by the national encryption standard include: 2-1) Using a symmetric encryption algorithm or hash function that meets national security standards, encrypt the label values ​​of the two input wires and the corresponding output wires in each row of the circuit gate coding table to obtain the encrypted ciphertext. When calculating the obfuscated circuit, this ciphertext is decrypted using a symmetric decryption algorithm or hash function that meets national security standards to output the wire label values. 2-2) Encode the specified function f(·,·) to generate a garbled circuit, the formula is Where λ represents the length of the input bit string, GC represents the garbled circuit after encoding, and Two wire tag values ​​representing each bit of the two input bit strings of the specified function, the wire tag values ​​being calculated in step 2-1); 2-3) Based on the encoded obfuscation circuit GC and its encoding value, construct the obfuscation circuit generation algorithm EvalGC implemented by the national secret standard SM (GC,·,·).

4. The construction method according to claim 3, wherein: Step 2-1) specifically includes: For a row in the circuit gate coding table, the label values ​​of the two input wires are A and B respectively, and the label value of the corresponding output wire is C; The symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm standard is used to encrypt C in sequence with A and B as keys to obtain the ciphertext When calculating the obfuscated circuit, the decryption algorithm of the national secret SM4 block cipher algorithm standard is used calculate Decrypt the output wire label value; Alternatively, use the hash function constructed according to the national secret SM3 hash algorithm standard to calculate the encrypted ciphertext Calculate when calculating the garbled circuit Decrypt the output wire label value.

5. The construction method according to claim 1, wherein: The steps for constructing the Hash function on the elliptic curve implemented by the national cryptography standard include: 3-1) Select the elliptic curve E(F) according to the national secret SM2 elliptic curve public key cryptography algorithm standard q ):Y 2 =X 3 +aX+b parameters q, a, b, and q≡2(mod 3); 3-2 For input r∈E(F q ), according to the national secret SM2 elliptic curve public key cryptography algorithm standard, the elliptic curve E(F q ) is converted into a bit string l r , let m = l r ; If the input is n points Then m=l1||...||l n ; 3-3) Construct a hash function based on the SM3 hash algorithm The input is a bit string of arbitrary length; the hash function specified by the National Secret SM3 hash cryptography algorithm standard is called, and the output is a 256-bit bit string; then according to the National Secret SM2 elliptic curve public key cryptography algorithm, the output bit string is converted into a finite field F q The domain elements on Reuse Construct two different Hash functions and 3-4) Based on the two Hash functions constructed above and using the Incar function, a Hash function on the elliptic curve implemented according to the national cryptography standard is constructed:

6. The construction method according to claim 1, wherein: The construction steps of the oblivious transfer protocol algorithm implemented by the national encryption standard include: 4-1) Select the elliptic curve E(F) according to the national secret SM2 elliptic curve public key cryptography algorithm standard q ):Y 2 =X 3 +aX+b parameters q, a, b, and q≡2(mod 3); 4-2) Obtain the elliptic curve E(F) according to the national secret SM2 elliptic curve public key cryptography algorithm standard q )A random point R on A With R B , the user selects two random points r0,r1∈E(F q ), the user selects the index i, and r i Replace with It is a hash function on the elliptic curve implemented by the national cryptography standard; the user sends r0 and r1 to the key server; 4-3) The key server calculates the received r0 and r1 Each R i As stipulated by the National Secret SM2 Elliptic Curve Public Key Cryptography Algorithm Standard, the R A , and then continue to perform a key exchange protocol with the user; the output obtained by the key server in the two key exchange protocols is and The output obtained by the user in the two key exchange protocols is and Oblivious Transfer Protocol Guarantees and And users cannot pass Calculated 4-4) The above three steps implement the 2-choose-1 oblivious transfer protocol under the national encryption standard. The message sent by the user to the key server in the first round of communication is recorded as OT1, and the message sent by the key server to the user in the second round of communication is recorded as OT2. The algorithm for calculating OT1 by the user is recorded as i represents the number selected by the user, and st represents the algorithm R OT The information generated in the user's local area; the algorithm used by the key server to calculate OT1 is recorded as The user's last calculation to obtain ω i The algorithm is recorded as These three algorithms together constitute the oblivious transfer protocol algorithm implemented by the national encryption standard.

7. The construction method according to claim 1, wherein: The steps for constructing the identity-based oblivious pseudo-random function implemented by the national secret standard include: 5-1) The user calls the hash function constructed by the SM3 hash algorithm to map the input short password into a hash value, and calls the oblivious transfer protocol algorithm implemented by the above-mentioned national secret standard to process each bit of the hash value; 5-2) The user sends a request to the key server; 5-3) The key server processes the request to call the oblivious transfer protocol algorithm implemented in the above-mentioned national encryption standard; 5-4) The key server randomly assigns a wire label value to each wire input into the obfuscated circuit, and uses the obfuscated circuit generation algorithm implemented in accordance with the aforementioned national secret standard to encode the symmetric encryption algorithm constructed using the national secret SM4 block cipher algorithm into an obfuscated circuit; 5-5) The key server calls the hash function constructed by the SM3 hashing algorithm to map the private key msk held by the key server and the user ID into a hash value, and encodes it into the input of the obfuscation circuit; 5-6) The key server sends the result of step 5-3), the obfuscated circuit encoded in step 5-4), and the input of the obfuscated circuit encoded in step 5-5) as a reply to the user; 5-7) After the user receives the reply, the result of step 5-3) is processed using the oblivious transfer protocol algorithm implemented by the above-mentioned national secret standard, and then the obfuscated circuit generation algorithm implemented by the above-mentioned national secret standard and the user's short password are input into the hash function constructed by the national secret SM3 hash cipher algorithm, and then the identity-based pseudo-random function implemented by the above-mentioned national secret standard is called for processing to obtain the identity-based oblivious pseudo-random function.

8. An end-to-end encryption method implemented in accordance with national secret standards, based on an identity-based oblivious pseudo-random function constructed by the construction method according to any one of claims 1 to 7 Implementation, characterized in that The following steps are involved: 1) Registration step: The user uses the identity ID and short password PP to access the key server, and uses the function provided by the key server to Get the enhanced password pwd and use id and pwd to register with the data server; the user selects a random number s id Stored on the data server, the login credential t is generated according to the constructed key derivation function KDF1(·,·), and registered with the key server based on t and id; 2) Key storage step: The user uses the identity ID and short password PP to access the key server, and uses the function provided by the key server to store the key. Get the enhanced password pwd, and use id and pwd to log in to the data server; after logging in, select a random number r id Stored on the data server, and retrieved from the data server the stored random number s id The user calculates the login credential t based on the two constructed key derivation functions, selects a data key mk for encrypting the data stored on the data server and encrypts it into a ciphertext ct, and calculates a message authentication code τ based on the key derivation function and ct to prevent ct from being tampered with. The user logs in to the key server and saves ct and τ on the key server; 3) Get key step: The user uses the identity ID and short password PP to access the key server, and uses the function provided by the key server to Obtain the enhanced password pwd and use id and pwd to log in to the data server; After logging in, retrieve the stored random number s from the data server id With r id The user calculates the login credential t, intermediate quantities k1 and k2 based on the three key derivation functions constructed above. The user uses id and t to log in to the key server. After logging in, the user retrieves the stored ct and τ from the key server, first verifies ct and τ based on k1 and k2, and decrypts the data key mk after verification. 4) Data storage step: When the user retrieves the key, he logs in to the data server and uses the decrypted data key mk to encrypt the desired data m into ciphertext c, and at the same time generates a message authentication code t', and saves c and t' on the data server; 5) Data retrieval step: When retrieving the key, the user logs in to the data server, obtains the data key mk from the key server, and obtains the stored encrypted data c and t' from the data server; first, t' is used to verify whether the ciphertext c obtained from the data server has not been tampered with. If the verification is successful, the ciphertext c is decrypted to obtain the plaintext data m before encryption.

9. The encryption method according to claim 8, wherein: In the registration step, a key derivation function KDF1(·,·) with a custom output length is constructed according to the national secret SM2 elliptic curve public key cryptography algorithm; In the key storage step, the user constructs two key derivation functions KDF2(·,·) and KDF3(·,·) with custom output lengths according to the SM2 elliptic curve public key cryptography algorithm; first calculate t=KDF1(s id ,PP), then calculate k1=KDF2(r id ,PP) and k2=KDF3(r id ,PP); then call the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm standard calculate Then call the HMac function HMac(·,·) constructed by the national standard message authentication code to calculate τ=HMac(ct,k2); In the key acquisition step, the user calculates t=KDF1(s id ,PP)、k1=KDF2(r id ,PP)、k2=KDF3(r id ,PP); first verify whether τ=H SM3 (ct,k2), if it satisfies the requirement, then the decryption algorithm of the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm is called. Calculate the data key 10. The encryption method according to claim 8, wherein: In the data storage step, the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm is called to encrypt the data m to obtain the ciphertext c, and then the message authentication code algorithm that complies with the national standard is called on the ciphertext c to calculate and obtain the message authentication code t'; In the data acquisition step, the decryption algorithm of the symmetric encryption algorithm constructed by the national secret SM4 block cipher algorithm is called to decrypt the ciphertext c to obtain the plaintext data m before encryption.

Images