A public key encryption method capable of temporarily searching a keyword

Abstract

The application provides a public key encryption method capable of temporarily searching a keyword, belongs to the field of encryption technology, and solves the technical problem that the prior art cannot realize the fine-grained and active time-constrained access control that the trapdoor is only valid within the time interval specified by the user. The technical scheme comprises the following steps: S1, a system initialization stage; S2, a secret key generation stage; S3, a trapdoor generation stage; S4, an encryption keyword stage; and S5, a search stage. The method realizes the fine-grained search of the cloud service provider on the time interval to generate the ciphertext, and the time complexity of all algorithms is logarithmic with the maximum number of time periods.

Description

Technical Field

[0001] This invention relates to the field of public key encryption technology with searchable keywords, and more particularly to a public key encryption method with temporarily searchable keywords. Background Technology

[0002] With the widespread adoption of cloud computing technology, outsourcing data storage and management to cloud servers has become a common choice for individuals and businesses. To protect data privacy, sensitive information must be uploaded after encryption. However, traditional encryption technologies make data retrieval extremely difficult, severely limiting the availability of cloud data. To address this, searchable encryption technology has emerged, allowing users to directly search for keywords in ciphertext without decryption. Among these, Public Key Searchable Encryption (PEKS), due to its asymmetric nature, is particularly suitable for multi-sender, single-receiver email gateways or cloud storage scenarios, where the sender can generate searchable ciphertext without pre-sharing keys with the recipient.

[0003] Despite significant progress in PEKS, its static access control is increasingly becoming a bottleneck for practical deployment. In standard PEKS schemes, a search trapdoor generated by the recipient is permanently valid for all historical and future encrypted data matching that keyword. This "one-time authorization, permanent access" model lacks necessary flexibility and can lead to over-authorization. For example, in medical data sharing, a researcher might only be authorized to query patient data from a specific phase of a clinical trial (e.g., July to December 2024); in commercial auditing, an auditor might only need access to transaction records for a specific fiscal quarter. In these scenarios, a trapdoor without time constraints poses an unacceptable risk of data breaches.

[0004] In recent years, researchers have attempted to introduce a time dimension into searchable encryption. Related work mainly falls into two categories: one is a variant of time-release encryption, which focuses on ensuring that ciphertext can only be decrypted after a specific point in time, rather than controlling searchability; the other is forward-secure searchable encryption, which aims to ensure that current key leakage does not jeopardize the security of past ciphertexts, but does not actively limit the future effectiveness of trapdoors. Therefore, existing schemes cannot yet achieve fine-grained, proactive time-constrained access control where "trapdoors are only valid within a user-specified, flexible time interval." Summary of the Invention

[0005] The purpose of this invention is to provide a public-key encryption method that allows for temporary keyword searching. Addressing the problem that existing methods cannot achieve fine-grained, proactive time-constrained access control where "trapdoors are only valid within a user-specified, flexible time interval," this invention divides time into several time periods, such as one day, and specifies a maximum number of time periods. ,in For safety parameters, for The method employs a polynomial function; the ciphertext is related to a time period, and the retrieval trapdoor is related to a time interval. A successful retrieval occurs when the time period in the ciphertext falls within the time interval of the retrieval trapdoor and the keywords in the ciphertext match those in the trapdoor. This achieves fine-grained, proactive time-constrained access control, ensuring that "trapdoors only exist within a user-specified, flexible time interval." To shorten the trapdoor length, the method introduces a complete binary tree into the construction of time interval trapdoors. Utilizing the covering set of the complete binary tree, trapdoors where keywords share certain time periods can be implemented, reducing the trapdoor complexity to a logarithmic relationship with the maximum number of time periods, significantly reducing the workload for the receiver in constructing trapdoors.

[0006] The inventive concept of this invention is as follows: In the method of this invention, the key generation center inputs security parameters, constructs a bilinear mapping corresponding to the security parameters, sets the maximum number of time periods in the system, and publishes the system's public parameters; each user selects their own private key based on the public parameters. Calculate and publish the corresponding public key The recipient uses their own private key. Keywords and time interval Generate a trapdoor and send it to the cloud service provider; sender Use the recipient public key and time period Keywords Encryption is performed to obtain ciphertext; the cloud service provider uses a trap to target the recipient. Time range Search all ciphertexts within the specified time range to obtain the results. Generated keywords All encrypted text is sent to the recipient. This method enables cloud service providers to manage time intervals. Fine-grained search for generating ciphertext is used to represent time using a complete binary tree, ensuring that the time complexity of all algorithms is logarithmically related to the maximum number of time intervals.

[0007] To achieve the aforementioned objectives, the present invention employs the following technical solution: a public-key encryption method for temporarily searching keywords, comprising the following steps:

[0008] S1. System Initialization Phase: The key generation center inputs security parameters, constructs a bilinear mapping corresponding to the security parameters, sets the maximum number of time periods in the system, and publishes the system's public parameters. ;

[0009] S2, Key Generation Phase: Each user selects their own private key. Calculate and publish the corresponding public key ;

[0010] S3, Trapdoor Generation Phase: The recipient uses their private key... Keywords and time interval Generate a trapdoor , and send it to the cloud service provider;

[0011] S4, Encryption Key Phase: Sender Use the recipient public key and time period Keywords Encryption is performed to obtain ciphertext. ;

[0012] S5. Search Phase: Cloud service providers exploit traps For the recipient Time range Search all ciphertexts within the specified time range to obtain the results. Generated keywords All encrypted text is sent to the recipient. .

[0013] Furthermore, step S1 specifically includes:

[0014] S11. Input security parameters at the key generation center. , generate prime numbers Cyclic group of order and bilinear mapping ;

[0015] S12. The maximum number of time periods that the key generation center can set is... ,in for For polynomial functions, construct a tree of depth . Complete binary tree A top-down approach is used to label each node with a binary string, with the root node labeled with an empty string. If a node is marked as a string Its left child node tag string Right child node tag string Each node represents a binary string, and all leaf nodes correspond to the first, second, and third nodes from left to right. A time period;

[0016] S13. Selection of Key Generation Center Hash function and ， in , , ;

[0017] S14. Public parameters of the key generation center public system .

[0018] Furthermore, step S2 specifically includes:

[0019] S21, User randomly selects generator , ,calculate Set up and expose the public key Set private key And kept it secret.

[0020] Furthermore, step S3 specifically includes:

[0021] S31, Given the recipient's private key Keywords Time range The receiving party constructs a tree with a depth of Complete binary tree This tree is called a trapdoor tree, and the first level contains the keys. The following Layered time structure, Write the length as binary string , ,Will , Placed separately in the trapdoor tree On the corresponding leaf node;

[0022] S32, The receiver constructs a covering set , making Contains leaf nodes on the trapdoor tree To the leaf node An ancestor node of all nodes or the node itself, first the receiver queries the binary string. and China makes minimum index , and then the node To the node Add the right sibling of all nodes on the path to T, and arrive Add all left sibling nodes on the path In the middle, and Add to T, if If it does not exist, then , ;

[0023] S33, For any node The recipient randomly selects ,calculate , Set up nodes The trapdoor Set keywords Time range The trapdoor = and the trapdoor Send it to the cloud service provider.

[0024] Furthermore, step S4 specifically includes:

[0025] S41, Sender Use the recipient public key and time period Keywords Encryption is performed to obtain ciphertext. ;

[0026] The sender will Write as a binary string Random selection , ,calculate , , , , Output ciphertext .

[0027] Furthermore, step S5 specifically includes:

[0028] S51, Regarding ciphertext and trapdoor = ,

[0029] cloud servers will Write as a binary string In the trapdoor Does it exist? Or one of its ancestor nodes If the query is not found, output 0; otherwise... ,calculate ,verify If true, output 1, indicating that the ciphertext contains the keyword. The cloud service provider sends the encrypted message to the recipient. Otherwise, output 0, indicating that the keyword does not contain... .

[0030] Meanwhile, the present invention proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed, it implements the steps of the method described in the present invention.

[0031] Furthermore, the present invention proposes a computer-readable storage medium having a computer program stored thereon, the computer program being configured to implement the steps of the method described in the present invention when invoked by a processor.

[0032] Finally, the present invention provides a computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method described in the present invention.

[0033] Compared with existing technical solutions, the beneficial effects of this method are:

[0034] (1) This invention discloses a public key encryption method for temporary keyword searching. The ciphertext is related to a time period, and the retrieval trapdoor is related to a time interval. Only when the time period in the ciphertext belongs to the time interval in the retrieval trapdoor, and the keywords in the ciphertext are the same as the keywords in the retrieval trapdoor, can the detection be passed. This realizes the cloud service provider's control over time intervals. Fine-grained search for internally generated ciphertext.

[0035] (2) By introducing a complete binary tree structure into the ciphertext and the retrieval trapdoor, the time complexity of generating the retrieval trapdoor is logarithmically related to the maximum number of time intervals, which greatly reduces the workload of the receiver in generating the retrieval trapdoor. Attached Figure Description

[0036] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0037] Figure 1 The flowchart illustrates a public-key encryption method for temporarily searching keywords provided by this invention.

[0038] Figure 2 This is an example diagram of a set covering a certain time interval in a binary tree provided by the present invention. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. Of course, the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0040] Example 1: See Figure 1 This embodiment provides a technical solution: a public-key encryption method for temporarily searching keywords, such as... Figure 1 As shown, the system includes: system initialization phase; key generation phase; trapdoor generation phase; encryption keyword phase; and retrieval phase. The key generation center inputs security parameters, constructs a bilinear mapping corresponding to the security parameters, sets the maximum number of time periods in the system, and publishes the system's public parameters; each user selects their own private key based on the public parameters. Calculate and publish the corresponding public key The recipient uses their own private key. Keywords and time interval Generate a trapdoor and send it to the cloud service provider; sender Use the recipient public key and time period Keywords Encryption is performed to obtain ciphertext; the cloud service provider uses a trap to target the recipient. Time range Search all ciphertexts within the specified time range to obtain the results. Internally generated keyword All encrypted text is sent to the recipient. .

[0041] Figure 2 The recipient For keywords Time interval Covering the set construction process, receiver For keywords Time interval The process of constructing a covered set is as follows:

[0042] Will Write as a binary string , Write as a binary string ,but , , making minimum index , and then the node To the node The right sibling of all nodes on the path Add to In the middle, arrive All left sibling nodes on the path Add to In the middle, and Add to Therefore, the covering set is...

[0043] This embodiment provides a public-key encryption method for temporarily searching keywords, specifically including the following steps:

[0044] S1. System Initialization Phase: The key generation center inputs security parameters, constructs a bilinear mapping corresponding to the security parameters, sets the maximum number of time periods in the system, and publishes the system's public parameters. ;

[0045] S2, Key Generation Phase: Each user selects their own private key. Calculate and publish the corresponding public key ;

[0046] S3, Trapdoor Generation Phase: The recipient uses their private key... Keywords and time interval Generate a trapdoor , and send it to the cloud service provider;

[0047] S4, Encryption Key Phase: Sender Use the recipient public key and time period Keywords Encryption is performed to obtain ciphertext. ;

[0048] S5. Search Phase: Cloud service providers exploit traps For the recipient Time range Search all ciphertexts within the specified time range to obtain the results. Generated keywords All encrypted text is sent to the recipient. .

[0049] Further, step S1 specifically includes:

[0050] S11. Input security parameters at the key generation center. , generate prime numbers Cyclic group of order and bilinear mapping ;

[0051] S12. The maximum number of time periods that the key generation center can set is... ,in for For polynomial functions, construct a tree of depth . Complete binary tree A top-down approach is used to label each node with a binary string, with the root node labeled with an empty string. If a node is marked as a string Its left child node tag string Right child node tag string Each node represents a binary string, and all leaf nodes correspond to the first, second, and third nodes from left to right. A time period;

[0052] S13. Selection of Key Generation Center Hash function and ， in , , ;

[0053] S14. Public parameters of the key generation center public system .

[0054] Further, step S2 specifically includes:

[0055] S21, User randomly selects generator , ,calculate Set up and expose the public key Set private key And kept it secret.

[0056] Furthermore, step S3 specifically includes:

[0057] S31, Given the recipient's private key Keywords Time range The receiving party constructs a tree with a depth of Complete binary tree This tree is called a trapdoor tree, and the first level contains the keys. The following Layered time structure, Write the length as binary string , ,Will , Placed separately in the trapdoor tree On the corresponding leaf node;

[0058] S32, The receiver constructs a covering set , making Contains leaf nodes on the trapdoor tree To the leaf node An ancestor node of all nodes or the node itself, first the receiver queries the binary string. and China makes minimum index , and then the node To the node Add the right sibling of all nodes on the path to T, and arrive Add all left sibling nodes on the path In the middle, and Add to T, if If it does not exist, then , ;

[0059] S33, For any node The recipient randomly selects ,calculate , Set up nodes The trapdoor Set keywords Time range The trapdoor = and the trapdoor Send it to the cloud service provider.

[0060] Further, step S4 specifically includes:

[0061] S41, Sender Use the recipient public key and time period Keywords Encryption is performed to obtain ciphertext. ;

[0062] The sender will Write as a binary string Random selection , ,calculate , , , , Output ciphertext .

[0063] Further, step S5 specifically includes:

[0064] S51, Regarding ciphertext and trapdoor = ,

[0065] cloud servers will Write as a binary string In the trapdoor Does it exist? Or one of its ancestor nodes If the query is not found, output 0; otherwise... ,calculate ,verify If true, output 1, indicating that the ciphertext contains the keyword. The cloud service provider sends the encrypted message to the recipient. Otherwise, output 0, indicating that the keyword does not contain... .

[0066] The following explains some of the names mentioned in this embodiment:

[0067] Bilinear mapping

[0068] set up They are two prime numbers Cyclic group of order, bilinear mapping It is a mapping, and satisfies

[0069] (1) Bilinear: for any , satisfy

[0070] (2) Non-degeneracy: If yes The generator, then yes Generators;

[0071] (3) Computability: For any There exists a polynomial-time algorithm for computation. .

[0072] CBDH assumptions

[0073] set up They are two large prime numbers. Cyclic group of order, bilinear mapping , yes Generators, Algorithm Random selection ,calculate and will Send to the enemy ,adversary Output .like Then they are called adversaries. The advantages of solving the CBDH problem are: If any polynomial time adversary If the advantages of solving the CBDH problem are negligible, then the CBDH hypothesis is said to be negligible in the group. established on.

[0074] Theorem: If the CBDH assumption is in the group If the above holds true, then the public key encryption method for temporarily searching keywords in this invention is provably secure.

[0075] In this example, we will illustrate the comparative advantages of this method and the well-known related scheme BCOP by focusing on the communication overhead of participants and whether fine-grained retrieval is supported.

[0076] Table 1 Performance Comparison of Solutions

[0077]

[0078] This embodiment's public-key encryption method for temporary keyword searching compares with the well-known related scheme BCOP in terms of efficiency and performance, assuming prime numbers. Bilinear group of order middle, Also respectively represent One of the elements. This represents the maximum number of time periods.

[0079] Compared to the BCOP method, this method can search for more ciphertexts and trapdoors, but it also allows cloud service providers to target specific time intervals. Fine-grained search for generating ciphertext is employed, and the time complexity of all algorithms is logarithmically related to the maximum number of time intervals.

[0080] Theorem: If the CBDH assumption is in the group If the above holds true, then the public-key encryption method for temporarily searching keywords in this invention is provably secure under the standard model.

[0081] Table 1 provides a description of the main symbols used in this scheme.

[0082] Table 2 provides a description of the main symbols used in this scheme.

[0083]

[0084] Example 2: This example proposes an electronic system, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method steps of the present invention.

[0085] Example 3: This example proposes a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the steps of the method described in this invention, which will not be repeated here.

[0086] Example 4: This example proposes a computer program product, including a computer program / instructions. When the computer program / instructions are executed by a processor, they implement the steps of the method described in this invention, which will not be repeated here.

[0087] It should be noted that the processing flow of embodiments 2-4 corresponds to the specific steps of the method provided in embodiment 1 of the present invention, and has the corresponding functional modules and beneficial effects of the method. Technical details not described in detail in this embodiment can be found in the method provided in embodiment 1 of the present invention.

[0088] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0089] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A public-key encryption method for temporarily searching keywords, characterized in that, Includes the following steps: S1. System Initialization Phase: The key generation center inputs security parameters, constructs a bilinear mapping corresponding to the security parameters, sets the maximum number of time periods in the system, and publishes the system's public parameters. ; S2, Key Generation Phase: Each user selects their own private key. Calculate and publish the corresponding public key ; S3, Trapdoor Generation Phase: The recipient uses their private key... Keywords and time interval Generate a trapdoor , and send it to the cloud service provider; S4, Encryption Key Phase: Sender Use the recipient public key and time period Keywords Encryption is performed to obtain ciphertext. ; S5. Search Phase: Cloud service providers exploit traps For the recipient Time range Search all ciphertexts within the specified time range to obtain the results. Generated keywords All encrypted text is sent to the recipient. .

2. The public-key encryption method for temporarily searching keywords according to claim 1, characterized in that, S1 includes the following steps: S11. Input security parameters at the key generation center. , generate prime numbers Cyclic group of order and bilinear mapping ; S12. The maximum number of time periods that the key generation center can set is... ,in for For polynomial functions, construct a tree of depth . Complete binary tree A top-down approach is used to label each node with a binary string, with the root node labeled with an empty string. If a node is marked as a string Its left child node tag string Right child node tag string Each node represents a binary string, and all leaf nodes correspond to the first, second, and third nodes from left to right. A time period; S13. Selection of Key Generation Center Hash function and ， in , , ; S14. Public parameters of the key generation center public system .

3. The public-key encryption method for temporarily searching keywords according to claim 1, characterized in that, S2 includes the following steps: S21, User randomly selects generator , ,calculate Set up and expose the public key Set private key And kept it secret.

4. The public-key encryption method for temporarily searching keywords according to claim 1, characterized in that, S3 includes the following steps: S31, Given the recipient's private key Keywords Time range The receiving party constructs a tree with a depth of Complete binary tree This tree is called a trapdoor tree, and the first level contains the keys. The following Layered time structure, Write the length as binary string , ,Will , Placed separately in the trapdoor tree On the corresponding leaf node; S32, The receiver constructs a covering set , making Contains leaf nodes on the trapdoor tree To the leaf node An ancestor node of all nodes or the node itself, first the receiver queries the binary string. and China makes minimum index , and then the node To the node Add the right sibling of all nodes on the path to T, and arrive Add all left sibling nodes on the path In the middle, and Add to T, if If it does not exist, then , ; S33, For any node The recipient randomly selects ,calculate , Set up nodes The trapdoor Set keywords Time range The trapdoor = and the trapdoor Send it to the cloud service provider.

5. The public-key encryption method for temporarily searching keywords according to claim 1, characterized in that, S4 includes the following steps: S41, Sender Use the recipient public key and time period Keywords Encryption is performed to obtain ciphertext. ; The sender will Write as a binary string Random selection , ,calculate , , , , Output ciphertext .

6. The public-key encryption method for temporarily searching keywords according to claim 1, characterized in that, S5 includes the following steps: S51, Regarding ciphertext and trapdoor = , cloud servers will Write as a binary string In the trapdoor Does it exist? Or one of its ancestor nodes If the query is not found, output 0; otherwise... ,calculate ,verify If true, output 1, indicating that the ciphertext contains the keyword. The cloud service provider sends the encrypted message to the recipient. Otherwise, output 0, indicating that the keyword does not contain... .

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the computer program is executed, it implements the steps of the method as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program is configured to implement the steps of the method according to any one of claims 1 to 6 when invoked by a processor.

9. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6.

Images