Distributed detection-based responsibility-traceable data retrieval system

Abstract

The invention discloses a responsibility-traceable data retrieval system based on distributed detection, which comprises a system administrator KMC node, an Internet of Things terminal equipment IoT node, a cloud server CS node, a distributed verification server VS node and a user U node, the data processing process comprises a system initialization stage, a key generation and distribution stage, a data collection and encryption stage, a user query stage, a query detection and responsibility investigation stage, a search matching stage, a data decryption stage and a user updating stage. According to the method, a system administrator allocates identities and accessible data sets to users so as to dynamically control user permissions and responsibility investigation; during responsibility investigation, query information and user identity of a user are verified by using a distributed credible verification server and a blacklist technology, so that a search request is shunted, and message processing of a cloud server and a system administrator is greatly simplified; meanwhile, the integrity of the data, stored in the cloud server, of the Internet of Things equipment can be verified after a user inquires the data.

Description

Technical Field

[0001] This invention relates to the field of searchable encryption technology in the Industrial Internet of Things (IoT), specifically to a traceable data retrieval system based on distributed detection. Background Technology

[0002] The Internet of Things (IoT) technology is now widely used in the Industrial Internet of Things (IIoT), such as in intelligent transportation, medical services, and automated manufacturing. It interconnects various devices, enabling data sharing and exchange, and allows administrators to monitor and analyze all devices, achieving real-time data processing and improving production efficiency. However, IoT devices also have drawbacks such as limited computing power and vulnerability to attacks. Furthermore, the sheer volume of data necessitates the transmission of large amounts of data and complex calculations to servers for encrypted storage or computation, ensuring timely retrieval when necessary. Simultaneously, the need for cross-enterprise and cross-industry data sharing necessitates secure data storage and access guarantees. Therefore, data protection stored on servers and data access protection have become current research priorities.

[0003] During the interaction between users and servers, there may be issues such as users accessing the server without authorization; within the server, there may also be issues such as incomplete or tampered data being returned; at the same time, if maliciously authorized users access the server too frequently using illegal traps, it will lead to excessive pressure on the cloud server and system crashes; it may also result in multiple accountability for the same user, wasting resources. Summary of the Invention

[0004] In view of the above-mentioned problems existing in the prior art, the present invention provides a traceable data retrieval system based on distributed detection. By constructing the industrial Internet of Things data system and designing the node data transmission process, the system ensures effective management of node permissions and data transmission, reduces server pressure, and saves resources.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A traceable data retrieval system based on distributed detection includes a system administrator KMC node, an IoT terminal device IoT node, a cloud server CS node, a distributed verification server VS node, and a user U node.

[0007] The system's data processing process includes:

[0008] S10, System Initialization Phase: Select security parameter ξ, generate and publish system parameter PP.

[0009] S20, Key Generation and Distribution Stage:

[0010] S21. KMC nodes select random numbers to generate and distribute public-private key pairs for each system node.

[0011] S22, KMC node assigns an identity ID to each user U node, and based on the established binding relationship between the user U node and the designated IoT terminal device IoT node, grants the user U node access rights to the data set consisting of the data collected by the designated IoT terminal device IoT node. The access rights are represented by the number set S of the corresponding data set.

[0012] S30, Data Collection and Encryption Stage: After collecting data, IoT terminal devices (IoT nodes) extract keyword information KW and generate data index C and encrypted data C. M and data validation label M V Then, the label data L = (C M M V C) Submit to the cloud server CS node for storage.

[0013] S40. User Query Phase: User U node calculates the search trapdoor Tr = (Tr1, Tr2, Tr3, Tr4, Tr5, Tr6, Tr7, Tr8, Tr9), and compares the search trapdoor Tr with the user U node's identity information ζ. id The user retrieval information Q = (ζ) is formed by combining the authorized data set number set S with the authorized data set number set S. id ,Tr,S) are sent to the verification server VS node.

[0014] S50, Query Detection and Accountability Phase: After the VS node receives the search trapdoor Tr,

[0015] S51 and VS nodes check the integrity of the search trapdoor Tr. If the search trapdoor Tr is incomplete, the process stops. If the search trapdoor Tr is complete, the process checks whether the trapdoor Tr4 representing the user's identity information exists in the user's cancellation list. If it exists, the process stops; otherwise, the process proceeds to the next step of trapdoor validity check.

[0016] S52 and VS nodes check the legality of the search trapdoor Tr, and perform an equation judgment on trapdoors Tr1, Tr2, Tr3, Tr4, and Tr5. If the equation is true, blacklist matching is performed; otherwise, the search trapdoor Tr is submitted to the KMC node for user identity tracing.

[0017] S53 and VS nodes perform blacklist matching on user identities, taking trapdoors Tr7 and Tr8 and matching them with blacklist trapdoor Tr′. If a match is found, the process stops; otherwise, the search trapdoor Tr is submitted to the CS node for data retrieval.

[0018] S54. KMC node performs user identity accountability: KMC node attempts to determine the relationship between the search trapdoor Tr and the authorized user, and performs an equation check on trapdoors Tr1, Tr2, Tr3, Tr4, and Tr6. If the equation is true, the search trapdoor Tr is generated by the authorized user and is legal, so the accountability stops. Otherwise, KMC node extracts and parses the identity ID of the user U node to restore it. Otherwise, it stops.

[0019] S60, Search and Matching Phase: The CS node performs data querying, using trapdoors Tr1 and Tr2, the authorized data set number set S, and index C for matching. If a match is successful, the data is returned, the transformation index DT is calculated, and index C, transformation index DT, and ciphertext C are combined. M and data validation label M V The decrypted data of the constructed tag is sent to the user's U node; otherwise, the process stops.

[0020] S70, Data Decryption Stage:

[0021] S71. User U node parses the selected random number δ;

[0022] S72. User U node verifies the integrity and correctness of the data: using the parsed random number δ and the data verification label M V and encrypted data C M Perform an equality check. If the test is not satisfied, stop; otherwise, the user U node uses IDec' to parse the plaintext data.

[0023] S80, User Update Phase: User U-node updates are divided into the following three types.

[0024] S81. New User Registration: The KMC node assigns a key to the newly registered user U node;

[0025] S82, User Revocation: The KMC node adds the user U node to the user revocation list and rejects search queries for the user U node;

[0026] S83. Update the data set for the current user U node: KMC node performs user revocation and new user registration.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] (1) When implementing a distributed service data retrieval system, this invention sets an accessible data set for each user and enables dynamic updates of permissions; during the user's query process, this invention uses a distributed verification server to detect the user's query, diverts the query requests initiated by the user, filters out meaningless accountability, and mitigates external denial-of-service attacks; this invention incorporates a blacklist mechanism to alleviate the accountability pressure on system administrators and prevent the waste of resources from repeatedly holding the same user accountable; finally, this invention verifies the integrity of the query result data.

[0029] (2) The system of the present invention deploys a trusted distributed verification server to filter out illegal query requests and illegal users, which greatly alleviates the pressure on the cloud server; and realizes a traceable data retrieval system based on distributed detection. Attached Figure Description

[0030] Figure 1 This is a schematic diagram of the system framework of an embodiment of the present invention. Detailed Implementation

[0031] The present invention will be further described below with reference to the accompanying drawings and embodiments. The embodiments of the present invention include, but are not limited to, the following embodiments.

[0032] Example

[0033] like Figure 1 As shown, this traceable data retrieval system based on distributed detection consists of a system administrator KMC node, an IoT terminal device IoT node, a cloud server CS node, a distributed verification server VS node, and a user U node.

[0034] The system's data processing process includes:

[0035] S10, System Initialization Phase:

[0036] Select a security parameter ξ, generate and publish system parameters PP; where the initialization parameter PP = {p, G0, G1, g, e, n, H0, H, IEnc, IDec, IEnc′, IDec′}; where G0 is an additive cyclic group of order p with g as the generator, G1 is a multiplicative cyclic group of order p, e: G0 × G0 → G1 is a bilinear mapping representing the mapping from the additive cyclic group to the multiplicative cyclic group; n represents the number of data sets, where one data set corresponds to one set of data collected by an IoT terminal device; IEnc, IDec, IEnc′, IDec′ are two symmetric algorithms, including encryption and decryption operations; select the hash function H0: {0, 1}. * →K and K is the key space for the two symmetric algorithms. It is a multiplicative cyclic group consisting of non-zero elements.

[0037] S20, Key Generation and Distribution Stage:

[0038] S21, KMC nodes select random numbers and generate and distribute public-private key pairs for each system node; specifically:

[0039] S21a, KMC node selects random number As the private key sk of the CS node, calculate As the public key pk of the CS node, the public-private key pair of the CS node is (sk CS ,pk CS )=(0,u);

[0040] S21b and KMC nodes select multiple random numbers

[0041] v3∈G0,

[0042] calculate v4 = g θ , Where i = (1,2,...,n,n+1,...,2n);

[0043] The public / private key pair (msk, mpk) of the KMC node is

[0044] KMC Private Key

[0045] KMC public key mpk = (v1, v2, v3, V, {h 1,i} i＝1,2,...,n ,{h 2,i} i＝1,2,...n,n+1,...,2n );

[0046] S21c and KMC nodes compute the index key of IoT terminal devices (IoT nodes).

[0047] S21d and KMC nodes assign identity IDs to each of the m distributed authentication server VS nodes, respectively, by selecting random numbers. calculate

[0048] VS y public key

[0049] VS y private key in

[0050] The public / private key pair (sk) that constitutes the VS node VSy ,pk VSy ), where y = (1, 2, ..., m);

[0051] S21e and KMC nodes generate an identity ID for each user U node, and the KMC node selects a random number. Calculate user identity information

[0052] User public key pk au =(X id , X′ id ,X″ id ),in

[0053] User private key exist middle

[0054] S22, KMC nodes assign an identity ID to each user U node, and based on the established binding relationship between the user U node and the designated IoT terminal device IoT node, grant the user U node access rights to the data set consisting of data collected by the designated IoT terminal device IoT node. The access rights are represented by the corresponding data set number set S; user private key sk au In this context, j represents the index of the data set that user node U has access to. For example, if a user node U has access to data set 1-3, denoted as S = {1, 2, 3}, then k is the index of that user node U. au1 In this case, j takes the value {1, 2, 3}. If another user node U has access to the data set 1, 2, 5, and 6, then it is represented as S = {1, 2, 5, 6}, and k of this user node U... au1 The value of j in the middle is {1,2,5,6};

[0055] The KMC node will bind user information B = (ζ) id ,sk au ,S) is distributed to user U nodes.

[0056] S30, Data Collection and Encryption Phase: After collecting data, IoT terminal devices (IoT nodes) extract keyword information, generate data indexes, encrypted data, and data verification tags, and then submit the tag data to the cloud server (CS node) for storage; specifically,

[0057] S31. Keyword Index Generation: IoT terminal devices (IoT nodes) select random numbers. δ∈G1, take the keyword KW to generate index C=(c z,0 ,c z,1 ,c z,2 ,c z,3 ),in z = 1, 2, ..., n;

[0058] S32. Data Encryption: IoT terminal devices (IoT nodes) collect plaintext data M and calculate the data encryption key k. data =H0(δ), the encrypted plaintext data M is obtained as ciphertext. Calculate data verification label M V =H(δ||C M ), and assign the label data L = (C M M V C) Send to the CS node.

[0059] S40. User Query Phase: User node U calculates the search trapdoor Tr, and sends the user retrieval information formed by combining the search trapdoor Tr with the user node U's identity information and the authorized data set number set S to the verification server node VS; specifically:

[0060] User U node computes search trapdoor

[0061] Tr=(Tr1, Tr2, Tr3, Tr4, Tr5, Tr6, Tr7, Tr8, Tr9),

[0062] Get random numbers The calculations for each trapdoor are as follows: Tr6=u t ,

[0063] User node U will retrieve user information Q = (ζ) id ,Tr,S) are sent to the CS node.

[0064] S50, Query Detection and Accountability Phase: After the VS node receives the search trapdoor Tr,

[0065] S51. The VS node verifies the integrity of the search trapdoor Tr: if the verification fails, it stops; if the verification passes, the VS node checks the identity revocation list. If the user U node's identity information is in the user revocation list, it stops; otherwise, the VS node checks the validity of the trapdoor. Specifically:

[0066] The j-th VS node VS j Perform detection

[0067]

[0068] The derivation of the equation here is as follows:

[0069]

[0070] Determine if the equation is true; stop if it is false, otherwise VS j The node queries the user cancellation list. If trapdoor Tr4 exists, the process stops; otherwise, it performs a trapdoor validity check.

[0071] S52. VS node checks the legality of the search trapdoor Tr: The VS node runs an algorithm to check the relationship between the authorized user U node and the search trapdoor Tr. If it is legal, a blacklist match is performed; if it is illegal, the search trapdoor Tr is sent to the KMC node for user identity verification. Specifically:

[0072] The j-th VS node VS j Execution verification

[0073]

[0074] The derivation of the equation here is as follows:

[0075]

[0076] Determine if the equation is true. If it is true, match the search trapdoor Tr to the blacklist. Otherwise, send the search trapdoor Tr to the KMC node for user identification and accountability.

[0077] S53, VS node performs blacklist matching: The VS node matches the search trapdoor Tr with the blacklist trapdoor Tr′. If a match is found, the process stops; otherwise, the VS node sends the search trapdoor Tr to the CS node for data retrieval. Specifically:

[0078] Let the blacklist trapdoor Tr′ = (Tr7′, Tr8′), and the verification server in the blacklist trapdoor Tr′ be denoted as VS. o The j-th VS node j Perform detection

[0079]

[0080] The derivation of the equation here is as follows:

[0081]

[0082] Determine if the equation is true. If true, the user's U node identity information is blacklisted, and the query stops; otherwise, the node VS... j The search trapdoor Tr is sent to the CS node for data retrieval.

[0083] S54. KMC node performs user identity accountability: The KMC node determines the relationship between the search trapdoor Tr and the authorized user. If the result is true, the search trapdoor Tr was generated by the authorized user, which is valid, and accountability stops. Otherwise, the KMC node extracts and parses the identity ID of the user U node from the search trapdoor Tr; specifically:

[0084] KMC node performs detection

[0085]

[0086] The derivation of the equation here is as follows:

[0087]

[0088] Determine if the equation is true; if true, stop; otherwise, extract the KMC node.

[0089] Restore user U node identity

[0090] S60, Search and Matching Phase: The CS node performs data queries. If a match is found, the data is returned; otherwise, the process stops. Specifically:

[0091] S61, CS node calculation

[0092] S62 and CS nodes perform detection.

[0093]

[0094] The derivation of the equation here is as follows:

[0095]

[0096] Determine if the equation is true; if true, the CS node calculates the data transformation index. The calculation here is as follows:

[0097]

[0098] And the tag parsing data LI=(C M M V , C, DT) are returned to the user's U node.

[0099] S70, Data Decryption Stage:

[0100] S71. User node U parses the selected random number δ;

[0101] S72. User U node verifies the integrity and correctness of the data: using the parsed random number δ and the data verification label M Vand encrypted data C M Perform an equality check. If the test is not satisfied, stop; otherwise, the user U node uses IDec′ to parse the plaintext data.

[0102] The specific process is as follows: User U node calculation The calculation process is as follows:

[0103]

[0104] By performing the detection The data is verified by checking if the equation is true. If it is true, the verification is successful. The data key H0(δ) is obtained based on the random number δ, and the plaintext data is decrypted. Otherwise, the verification will fail and the process will stop.

[0105] S80, User Update Phase: User U-node updates are divided into the following three types.

[0106] S81. New User Registration: The KMC node assigns a key to the newly registered user U node; specifically: the KMC node assigns an identity ID and a public-private key pair (pk) to the user U node. au ,sk au ) and the set of authorized data set numbers S;

[0107] S82, User Revocation: The KMC node will delete the user's U node identity information η id Add the user to the undo list and deny search queries for that user's U node;

[0108] S83. Update the set of data set numbers S for the data set authorized to the current user U node: KMC node first performs user revocation, and then performs new user registration.

[0109] Through the above process, this invention realizes a traceable data retrieval system based on distributed detection for IoT, ensuring dynamic updates of user permissions, diverting user-initiated query requests, filtering out meaningless accountability, mitigating external denial-of-service attacks, and alleviating the accountability pressure on system administrators through a blacklist mechanism, preventing the waste of resources from repeatedly holding the same user accountable.

[0110] The above embodiments are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any changes made based on the design principles of the present invention, or any non-creative modifications made thereon, shall fall within the scope of protection of the present invention.

Claims

1. A traceable data retrieval system based on distributed detection, characterized in that, The system includes system administrator KMC nodes, IoT terminal device IoT nodes, cloud server CS nodes, distributed verification server VS nodes, and user U nodes. The data processing process of the system includes: S10. System Initialization Phase: Select security parameters, generate and publish system parameters PP; Initialize parameters PP = {p, G0, G1, g, e, n, H0, H, IEnc, IDec, IEnc′, IDec′}; where G0 is an additive cyclic group of order p with g as the generator, G1 is a multiplicative cyclic group of order p, e: G0 × G0 → G1 is a bilinear mapping representing the mapping from the additive cyclic group to the multiplicative cyclic group; n represents the number of data sets; IEnc, IDec, IEnc′, IDec′ are two symmetric algorithms, including encryption and decryption operations; Select hash function H0: {0, 1} * →K and K is the key space for the two symmetric algorithms. It is a multiplicative cyclic group composed of non-zero elements; S20, Key Generation and Distribution Stage: S21. The KMC node selects a random number and generates and distributes a public-private key pair for each system node: S21a, KMC node selects random number As the private key sk of the CS node, calculate As the public key pk of the CS node, the public-private key pair of the CS node is (sk CS ,pk CS )=(β0,u); S21b and KMC nodes select multiple random numbers calculate v4 = g θ , Where i = (1,2,...,n,n+1,...,2n); The public / private key pair (msk, mpk) of the KMC node is mpk=(v1,v2,v3,V,{h 1,i } i＝1,2,...,n ,{h 2,i } i＝1,2,...n,n+1,...,2n ); S21c and KMC nodes compute the index key of IoT terminal devices (IoT nodes). S21d and KMC nodes assign identity IDs to each of the m distributed authentication server VS nodes, respectively, by selecting random numbers. calculate The public / private key pair (sk) that constitutes the VS node VSy ,pk VSy ), where y = (1, 2, ..., m); S21e and KMC nodes generate an identity ID for each user U node, and the KMC node selects a random number. Calculate user identity information Public key PK au =(X id , X′ id ,X″ id ),in Private key exist middle S22, KMC node assigns an identity ID to each user U node, and based on the established binding relationship between the user U node and the designated IoT terminal device IoT node, grants the user U node access rights to the data set consisting of the data collected by the designated IoT terminal device IoT node. The access rights are represented by the number set S of the corresponding data set. The KMC node will bind user information B = (ζ) id ,sk au S) is distributed to user U node; S30. Data Collection and Encryption Phase: After collecting data, IoT terminal devices (IoT nodes) extract keyword information, generate data indexes, encrypted data, and data verification tags, and then submit the tag data to the cloud server (CS node) for storage; the process is as follows: S31. Keyword Index Generation: IoT terminal devices (IoT nodes) select random numbers. δ∈G1, take the keyword KW to generate the data index C=(c z,0 ,c z,1 ,c z,2 ,c z,3 ),in S32. Data Encryption: IoT terminal devices (IoT nodes) collect plaintext data M and calculate the data encryption key k. data =H0(δ), the encrypted plaintext data M is obtained as ciphertext. Calculate data verification label M V =H(δ||C M ), and assign the label data L = (C M M V C) Send to the CS node; S40. User Query Phase: User U node calculates the search trapdoor Tr, Tr = (Tr1, Tr2, Tr3, Tr4, Tr5, Tr6, Tr7, Tr8, Tr9), where... Tr6=u t , random numbers The user retrieval information, formed by combining the search trapdoor Tr with the identity information of user node U and the authorized data set number set S, is sent to the verification server node VS. S50, Query Detection and Accountability Phase: After the VS node receives the search trapdoor Tr, S51, VS node verification of the integrity of the search trapdoor Tr: the j-th VS node VS j Perform detection Determine if the equation is true. If it is false, the verification fails and the process stops. If it is true, the verification passes and the VS node checks the identity revocation list. It queries the user revocation list to see if there is a trapdoor Tr4 representing the user's identity information. If it exists, the process stops. Otherwise, the VS node checks the validity of the trapdoor. S52. VS node checks the legality of search trapdoors Tr: The VS node runs an algorithm to check the relationship between the authorized user U node and the search trapdoors, and performs an equality check on trapdoors Tr1, Tr2, Tr3, Tr4, and Tr5. If the equation is true, it means it is legal, and blacklist matching is performed. If the equation is false, it means it is illegal, and the search trap Tr is sent to the KMC node to perform user identity tracing. S53, VS node performs blacklist matching: VS node takes trapdoors Tr7 and Tr8 in the search trapdoor Tr and matches them with the blacklist trapdoor Tr′. If the match is successful, it stops; otherwise, VS node sends the search trapdoor Tr to CS node for data retrieval. S54. KMC node performs user identity verification: The KMC node determines the relationship between the search trapdoor Tr and the authorized user, and performs an equality check on trapdoors Tr1, Tr2, Tr3, Tr4, and Tr6. If the equation is true, it means the result is real, then the search trapdoor Tr is generated by an authorized user, which is legal, and the accountability stops; otherwise, the KMC node extracts trapdoor Tr4 from the search trapdoor Tr and parses and restores the identity ID of the user U node. S60, Search and Matching Phase: The CS node performs a data query. If a match is found, the data is returned; otherwise, the process stops. S61, CS node calculation S62 and CS nodes perform detection. Determine if the equation is true; if true, the CS node calculates the data transformation index. And the tag parsing data LI=(C M M V The (,C,DT) data is returned to the user's U node; S70, Data Decryption Stage: S71. User node U parses the selected random number δ; S72. User U node verifies the integrity and correctness of the data: using the parsed random number δ and the data verification label M V and encrypted data C M Perform an equality check. If the test is not satisfied, stop; otherwise, the user U node uses IDec′ to parse the plaintext data. S80, User Update Phase: User U-node updates are divided into the following three types. S81. New User Registration: The KMC node assigns a key to the newly registered user U node; S82, User Revocation: The KMC node adds the user U node to the user revocation list and rejects search queries for the user U node; S83. Update the data set for the current user U node: KMC node performs user revocation and new user registration.

2. The traceable data retrieval system based on distributed detection according to claim 1, characterized in that, In the user query phase of S40, the user U node will retrieve the user search information Q = (ζ id ,Tr,S) are sent to the CS node.

3. The traceable data retrieval system based on distributed detection according to claim 2, characterized in that, The process of query detection and accountability phase in S50 includes: S51, the j-th VS node j Perform detection Determine if the equation is true; stop if it is false, otherwise VS j The node queries the user cancellation list. If trapdoor Tr4 exists, the process stops; otherwise, it performs a trapdoor validity check. S52, the j-th VS node j Execution verification Determine if the equation is true. If it is true, then match the search trapdoor Tr to the blacklist. Otherwise, send the search trapdoor Tr to the KMC node for user identification and accountability. S53. Let the blacklist trapdoor Tr′ = (Tr7′, Tr8′), and the verification server in the blacklist trapdoor Tr′ be denoted as VS. o The j-th VS node j Perform detection Determine if the equation is true. If true, the user's U node identity information is blacklisted, and the query stops; otherwise, the node VS... j Send the search trapdoor Tr to the CS node for data retrieval; S54, KMC node execution detection Determine if the equation is true; if true, stop; otherwise, extract the KMC node. Restore user U node identity 4. The traceable data retrieval system based on distributed detection according to claim 3, characterized in that, The data decryption phase in S70 includes the following process: User U node calculates random numbers By performing the detection To verify the data, check if the equation is true. If it is true, the verification is successful. The data encryption key H0(δ) is obtained from the acquired random number δ, and the plaintext data is decrypted. Otherwise, the verification will fail and the process will stop.

5. The traceable data retrieval system based on distributed detection according to claim 4, characterized in that, The user update phase in S80 includes the following process: If it is a new user registration, the KMC node will assign an identity ID and a public / private key pair (pk) to the user's U node. au ,sk au ) and the set of authorized data set numbers S; If a user needs to be revoked, the KMC node will add the user's identity information to the revocation list; If it is necessary to update the set of numbers S of the authorized data set for a user, the KMC node will first revoke the user's registration and then register a new user.

Images