A multi-client searchable encryption method based on blockchain

Abstract

The present invention discloses a multi-client searchable encryption method based on blockchain, which belongs to the field of searchable encryption technology. The method includes the following steps: system initialization; index building for dynamic data addition; index building for dynamic data deletion; data owner distributes attribute keys to users and grants search capabilities for certain keywords; users generate keyword tokens and initiate search requests; smart contracts generate search tokens and execute searches; users parse search results. The method has the advantages of low local storage overhead, fine-grained access control, support for multi-client search, support for dynamic data update, no single point of failure, and anti-tampering, and can be used in data sharing scenarios such as medical care and education.

Description

Technical Field

[0001] The present invention belongs to the field of searchable encryption, and specifically is a multi-client searchable encryption method based on blockchain. Background Art

[0002] With the development of cloud computing and big data, more and more individuals and organizations outsource data to cloud service providers for storage and sharing. This outsourcing to a third party can effectively reduce local computing and storage costs, but it may also cause sensitive data leakage or third-party abuse of data. To solve these problems, data can be encrypted and stored in the cloud, but encrypted data will lose its original flexibility and operability, for example, it is impossible to obtain the expected data through conventional keyword retrieval methods.

[0003] Searchable encryption is a cryptographic primitive that supports users to search for keywords on ciphertext. It can save users a lot of network and computing overhead and make full use of the huge computing resources of cloud servers to search for keywords on ciphertext. Blockchain is a distributed shared ledger and database with the characteristics of decentralization, immutability, and traceability. Therefore, it is of great research significance to use blockchain to realize decentralized searchable encryption schemes.

[0004] In actual application scenarios, data owners also want to grant different access capabilities based on user roles. In addition, data is constantly generated, and other clients also have the need to search for ciphertext. Therefore, a mature searchable encryption solution must also have features such as fine-grained access control, dynamic data addition, and support for multi-client search. Summary of the invention

[0005] The purpose of the present invention is to address the problems mentioned in the background technology and propose a multi-client searchable encryption method based on blockchain, which can be applied to various data search and sharing scenarios.

[0006] The specific technical solution for achieving the purpose of the present invention is:

[0007] A multi-client searchable encryption method based on blockchain, comprising the following steps:

[0008] Step 1: System Initialization

[0009] (1.1) Initially, the data owner inputs the security parameter λ, selects a symmetric encryption scheme SE, an attribute-based encryption scheme ABE, a pseudo-random function F, and a cryptographic hash function H;

[0010] (1.2) The data owner randomly selects a key k and two large prime numbers p and q; let n = pq, and select an element Finally, the public key PK is published and the system master key SK is kept secret;

[0011] (1.3) The data owner selects a large positive integer CLen, initializes the global parameter ctr=CLen of the smart contract, and deploys the smart contract to the blockchain; an empty hash table structure EDB is initialized in the smart contract to store indexes;

[0012] Step 2: Dynamically add data

[0013] A dynamic add operation is for a document set;

[0014] (2.1) For the document set DOC, the data owner is for each document doc ind Choose a symmetric key k ind , run the symmetric encryption algorithm SE.Enc() for encryption; finally, upload the encrypted data to the cloud server;

[0015] (2.2) Extract keywords from the document set DOC one by one and build an index; the specific implementation is as follows:

[0016] (2.2a) For the document doc ind ∈DOC extracts the document identifier-keyword set (ind, W ind ),in It is a document doc ind The set of keywords you own;

[0017] (2.2b) For the document doc ind The keyword w∈W extracted from ind , calculate the keyword token kt w =F(k,g 1 / w ), and then calculate the search token st w =H ctr (kt w );

[0018] (2.2c) Select an access policy and the document doc in step (2.1) ind The symmetric key k ind , let m ind =(ind||k ind ||op), run The algorithm obtains the ciphertext C ind , where op is 1 to indicate data addition operation;

[0019] (2.2d) For ciphertext C ind , calculate key = H(st w||0), get value←Map[key], where Map is the hash table storing the data in this add operation; if value is empty, then calculate And add {key, value} to the Map; if value is not empty, then remove {key, value} from the Map first, and then select a random token rt←{0,1} λ , and finally insert it into the Map and

[0020] (2.3) Call the smart contract, upload the index data formed by this addition operation to EDB, and update the public parameter ctr←ctr-1 of the smart contract;

[0021] Step 3: Dynamic data deletion operation

[0022] (3.1) The data owner sends the document identifier set of the data to be deleted to the cloud server, and then the cloud server returns the encrypted document set and performs the deletion;

[0023] (3.2) Using the symmetric key corresponding to the encrypted document and the symmetric decryption algorithm SE.Dec(), the encrypted document set is decrypted to obtain the original document set DOC';

[0024] (3.3) Extract keywords from the original document set DOC' document by document and build an index; the specific implementation is as follows:

[0025] (3.3a) Documentation doc' ind ∈DOC' can extract the document identifier-keyword set (ind, W' ind ),in is the document doc' ind The set of keywords you own;

[0026] (3.3b) For the document doc' ind The keyword w∈W' extracted from ind , calculate the keyword token kt w =F(k,g 1 / w ), and then calculate the search token st w =H ctr (kt w );

[0027] (3.3c) Select an access policy Let m ind =(ind||op), operation The algorithm obtains the ciphertext C ind , where op is 0, indicating data deletion operation;

[0028] (3.3d) For ciphertext C ind , calculate key = H(st w ||0), get value←Map[key], where Map is the hash table storing the data in this add operation; if value is empty, then calculate And add {key, value} to the Map; if value is not empty, then remove {key, value} from the Map first, and then select a random token rt←{0,1} λ , and finally insert it into the Map and

[0029] (3.4) Call the smart contract, upload the index data generated by this deletion operation to EDB, and update the public parameter ctr←ctr-1 of the smart contract;

[0030] Step 4: Data owner authorizes user

[0031] (4.1) The data owner runs the ABE.KeyGen() algorithm and outputs a user's attribute key sk S , and finally distributed to users through secure channels;

[0032] (4.2) Users apply to the data owner for the ability to search for certain keywords;

[0033] (4.2) The data owner selects a set of keywords W that can be authorized for the user based on the user's identity and attributes; then, the data owner calculates the authorized keyword key sk W , and k, sk W And the authorization keyword set W is sent to the user through a secure channel;

[0034] Step 5: User initiates a keyword search request

[0035] (5.1) According to steps 1 and 4, a user now holds keys k and sk S ,sk W and the authorization keyword set W;

[0036] (5.2) For any keyword w∈W, the user calculates the keyword token kt w , and sent to the smart contract to perform a search for keyword w;

[0037] Step 6: Smart Contract Search

[0038] (6.1) The smart contract is based on the parameters ctr, CLen and the user's keyword token kt w, loop to calculate the new search token st w , perform the search; the specific implementation is as follows:

[0039] Get the public parameter ctr, set j = ctr, and loop through the following steps until j>CLen:

[0040] (6.1a) Calculate the search token st w =H j (kt w );

[0041] (6.1b) According to the search token st w , calculate key = H(st w ||0), get value←EDB[key]; if value is not empty, get an index ciphertext and a random token

[0042] (6.1c) When rt is not empty, calculate value'←EDB[H(rt||0)] and Get an index ciphertext and a new random token rt; when rt is not empty, loop and execute this step;

[0043] (6.1d) Execute j←j+1;

[0044] (6.2) Save the results RES obtained during the search process and return them to the user;

[0045] Step 7: User parsing search results

[0046] (7.1) For each ciphertext C in the result RES, the user uses the attribute key sk S , execute the ABE.Dec() algorithm to get the plaintext m, where m is (ind||k ind ||op) or (ind||op);

[0047] (7.2) The user selects the document identifier with op=1 and its corresponding symmetric key, and requests the cloud server to return the encrypted document;

[0048] (7.3) For the returned encrypted document set, run the symmetric decryption algorithm SE.Dec() to obtain the original data.

[0049] The present invention has the following advantages:

[0050] 1) Support dynamic addition and deletion of data;

[0051] 2) Data owners only need to store a few privacy parameters locally, and the local storage overhead is reduced to a constant level;

[0052] 3) Using blockchain instead of centralized servers realizes the characteristics of system decentralization, data tamper-proof, and transaction verifiability and traceability;

[0053] 4) Support for multiple clients. After users obtain access to certain keywords, they can generate keyword tokens locally, which reduces the interaction between users and data owners and reduces communication overhead;

[0054] 5) Implemented fine-grained access control for data. The user's ability is subject to dual constraints of keywords and attributes. The user can only search for authorized keywords, and the user attributes are used to control the decryption ability. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 is a system model diagram for implementing the present invention;

[0056] Figure 2 It is the initialization flow chart of the present invention;

[0057] Figure 3 It is a data dynamic adding flow chart of the present invention;

[0058] Figure 4 It is a flow chart of dynamic data deletion of the present invention;

[0059] Figure 5 This is a flowchart of the authorization from the data owner to the user in the present invention;

[0060] Figure 6 This is a flow chart of a keyword search request initiated by a user of the present invention;

[0061] Figure 7 It is a flowchart of smart contract execution search of the present invention;

[0062] Figure 8 It is a flow chart of user parsing search results of the present invention. DETAILED DESCRIPTION

[0063] The technical solution of the present invention is further described in detail below in conjunction with embodiments and drawings, but the implementation manner of the present invention is not limited thereto.

[0064] Figure 1: is a system model diagram for implementing this embodiment, including four entities: data owner, user, blockchain, and cloud server. The data owner is mainly responsible for system initialization, distributing attribute keys, granting users keyword search capabilities, updating data, establishing indexes, and deploying smart contracts; users, i.e. clients, including individuals or organizations, can access authorized data. Depending on the role, the client will be given different keyword search capabilities; the blockchain is mainly responsible for storing searchable ciphertext and executing searches through smart contracts. The cloud server is mainly responsible for storing encrypted data, updating data according to the requirements of the data owner, and returning data to the user. After the system is initialized, the data owner can continuously perform dynamic data addition and deletion operations to update the data, and the user can continuously initiate search requests to search for data.

[0065] Example

[0066] The following are the specific implementation steps of this embodiment:

[0067] Step 1: System Initialization

[0068] Figure 2 This is the initialization flow chart of this embodiment, which mainly includes the following steps:

[0069] (1.1) Initially, the data owner inputs the security parameter λ, selects a symmetric encryption scheme SE = (SE.Enc(), SE.Dec()), an attribute-based encryption scheme ABE = (ABE.Setup(), ABE.KeyGen(), ABE.Enc(), ABE.Dec()), and a pseudo-random function F: {0,1} λ ×{0,1} * →{0,1} λ and a cryptographic hash function H:{0,1} * →{0,1} * Among them, ABE.Setup(), ABE.KeyGen(), ABE.Enc() and ABE.Dec() are attribute base initialization, key generation, encryption and decryption algorithms respectively, SE.Enc() and SE.Dec() are symmetric encryption algorithm and symmetric decryption algorithm respectively.

[0070] (1.2) The data owner randomly selects a key k∈{0,1} λ Then, according to the strong RSA problem, we select two large prime numbers p and q. Let n = pq, and select an element Then, run ABE.Setup(1 λ ) algorithm generates the attribute public key apk and attribute master key ask for distributing attributes. Finally, the public key PK = (F, H, n, apk) is published, and the system master key SK = (k1, p, q, g, ask) is kept secret.

[0071] (1.3) The data owner selects a large positive integer CLen, initializes the global parameter ctr=CLen of the smart contract, and deploys the smart contract to the blockchain. An empty hash table structure EDB is initialized in the smart contract to store indexes.

[0072] Step 2: Dynamically add data

[0073] Figure 3 This is a flowchart of the dynamic data addition in this embodiment. In this embodiment, a dynamic addition operation is for a document set, and mainly includes the following steps:

[0074] (2.1) For the document set DOC, each document has a unique global identifier ind. The data owner is the owner of each document doc in turn. ind ∈DOC selects a symmetric key k ind , run the symmetric encryption algorithm SE.Enc(k ind ,doc ind ) to encrypt. Finally, upload the encrypted data to the cloud server.

[0075] (2.2) Extract keywords from the document set DOC one by one and build an index. The detailed steps are as follows:

[0076] Document doc ind ∈DOC extracts the document identifier-keyword set (ind, W ind ),in It is a document doc ind The set of keywords owned by the user.

[0077] For the document doc ind ∈DOC extracted keywords w∈W ind , calculate the keyword token kt w =F(k,g 1 / w ), and then calculate the search token st w =H ctr (kt w ).

[0078] Select an access policy and the symmetric key k of the document in step (2.1) ind , let m ind =(ind||k ind ||op), run The algorithm obtains the ciphertext C ind , where op is 1, indicating a data addition operation.

[0079] For ciphertext C ind, calculate key = H(st w ||0), and get value←Map[key], where Map is the hash table storing the data in this add operation. If value is empty, then calculate And add {key, value} to the Map; if value is not empty, then remove {key, value} from the Map first, and then select a random token rt←{0,1} λ , and finally insert it into the Map and

[0080] (2.3) Call the smart contract, upload the index data in the Map to EDB, and update the public parameter ctr←ctr-1 of the smart contract.

[0081] Step 3: Dynamic data deletion operation

[0082] Figure 4 This is a flowchart of dynamic data deletion in this embodiment. In this embodiment, a dynamic deletion operation is for a document set, and mainly includes the following steps:

[0083] (3.1) The data owner sends the document identifier set of the data to be deleted to the cloud server, and then the cloud server returns the encrypted document set and performs the deletion.

[0084] (3.2) Using the symmetric key corresponding to the encrypted document and the symmetric decryption algorithm SE.Dec(), the encrypted document set is decrypted to obtain the original document set DOC'.

[0085] (3.3) Extract keywords from the document set DOC' and build an index. The detailed steps are as follows:

[0086] For document doc' ind ∈DOC' extracts the document identifier-keyword set (ind, W' ind ),in is the document doc' ind The set of keywords owned by the user.

[0087] For the document doc' ind The keyword w∈W' extracted from ind , calculate the keyword token kt w =F(k,g 1 / w ), and then calculate the search token st w =H ctr (kt w ).

[0088] Select an access policy Let mind =(ind||op), operation The algorithm obtains the ciphertext C ind , where op is 0, indicating a data deletion operation.

[0089] For ciphertext C ind , calculate key = H(st w ||0), and get value←Map[key], where Map is the hash table storing the data in this add operation. If value is empty, then calculate And add {key, value} to the Map; if value is not empty, then remove {key, value} from the Map first, and then select a random token rt←{0,1} λ , and finally insert it into the Map and

[0090] (3.4) Call the smart contract, upload the index data in the Map to EDB, and update the public parameter ctr←ctr-1 of the smart contract.

[0091] Step 4: Data owner authorizes user

[0092] Figure 5 This is a flowchart of the data owner authorizing the user in this embodiment, which mainly includes the following steps:

[0093] (4.1) The data owner runs the ABE.KeyGen(ask,S) algorithm and outputs a user's attribute key sk S , and finally distributed to users through secure channels. Where ask is the attribute public key and S is the user's attribute.

[0094] (4.2) The user applies to the data owner for the ability to search for certain keywords.

[0095] (4.2) The data owner selects a set of keywords W that can be authorized for the user based on the user's identity and attributes. Then, the data owner calculates the authorized keyword key

[0096]

[0097] And k, sk W And the authorization keyword set W is sent to the user through a secure channel.

[0098] Step 5: User initiates a keyword search request

[0099] Figure 6 This is a flowchart of a user initiating a keyword search request in this embodiment, which mainly includes the following steps:

[0100] (5.1) According to steps 1 and 4, a user now holds keys k and sk S ,sk W And the authorization keyword set W.

[0101] (5.2) For any keyword w∈W, the user computes the keyword token

[0102]

[0103] And send it to the smart contract to perform a search for keyword w.

[0104] Step 6: Smart Contract Executes Search

[0105] Figure 7 This is the smart contract execution search flow chart of this embodiment, which mainly includes the following steps:

[0106] (6.1) Get the public parameter ctr, set j = ctr, and repeat the following steps until j>CLen:

[0107] Calculate the search token st w =H j (kt w ).

[0108] According to the search token st w , calculate key = H(st w ||0), get value←EDB[key]. If value is not empty, get an index ciphertext and a random token

[0109] When rt is not empty, calculate value'←EDB[H(rt||0)] and Get an index ciphertext and a new random token rt. When rt is not empty, loop and execute this step.

[0110] Execute j←j+1.

[0111] (6.2) Save all index ciphertexts obtained during the search process and return them to the user as the result RES.

[0112] Step 7: User parsing search results

[0113] Figure 8 This is a flowchart of user parsing search results in this embodiment, which mainly includes the following steps:

[0114] (7.1) For each ciphertext C in the result RES, if the user's attributes satisfy the access policy of C, then execute ABE.Dec(sk S,C) algorithm, get m, where m type is (ind||k ind ||op) or (ind||op); if the user’s attributes do not satisfy the access policy of C, the output ⊥ cannot be decrypted.

[0115] (7.2) The user removes the document identifiers with op=0 (deleted) and their corresponding symmetric keys, and sends the set of document identifiers with op=1 (still exists) to the cloud server, requesting the response documents.

[0116] (7.3) The cloud server returns the encrypted document corresponding to the identifier. For each encrypted document, the user uses the symmetric key used to encrypt the document to run the symmetric decryption algorithm SE.Dec() to obtain the original document.

Claims

1. A multi-client searchable encryption method based on blockchain, characterized in that: The steps include: Step 1: System Initialization (1.1) Initially, the data owner inputs the security parameter λ, selects a symmetric encryption scheme SE, an attribute-based encryption scheme ABE, a pseudo-random function F, and a cryptographic hash function H; (1.2) The data owner randomly selects a key k and two large prime numbers p and q; let n = pq, and select an element Finally, the public key PK is published and the system master key SK is kept secret; (1.3) The data owner selects a large positive integer CLen, initializes the global parameter ctr=CLen of the smart contract, and deploys the smart contract to the blockchain; an empty hash table structure EDB is initialized in the smart contract to store indexes; Step 2: Dynamically add data A dynamic add operation is for a document set; (2.1) For the document set DOC, the data owner is for each document doc ind Choose a symmetric key k ind , run the symmetric encryption algorithm SE.Enc() for encryption; finally, upload the encrypted data to the cloud server; (2.2) Extract keywords from the document set DOC document by document and build an index; (2.3) Call the smart contract, upload the index data formed by this addition operation to EDB, and update the public parameter ctr←ctr-1 of the smart contract; Step 3: Dynamic data deletion operation (3.1) The data owner sends the document identifier set of the data to be deleted to the cloud server, and then the cloud server returns the encrypted document set and performs the deletion; (3.2) Using the symmetric key corresponding to the encrypted document and the symmetric decryption algorithm SE.Dec(), the encrypted document set is decrypted to obtain the original document set DOC'; (3.3) Extract keywords from the original document set DOC' document by document and build an index; (3.4) Call the smart contract, upload the index data generated by this deletion operation to EDB, and update the public parameter ctr←ctr-1 of the smart contract; Step 4: Data owner authorizes user (4.1) The data owner runs the ABE.KeyGen() algorithm and outputs a user's attribute key sk S , and finally distributed to users through secure channels; (4.2) Users apply to the data owner for the ability to search for certain keywords; (4.2) The data owner selects a set of keywords W that can be authorized for the user based on the user's identity and attributes; then, the data owner calculates the authorized keyword key sk W , and k, sk W And the authorization keyword set W is sent to the user through a secure channel; Step 5: User initiates a keyword search request (5.1) According to steps 1 and 4, a user now holds keys k and sk S ,sk W and the authorization keyword set W; (5.2) For any keyword w∈W, the user calculates the keyword token kt w , and sent to the smart contract to perform a search for keyword w; Step 6: Smart Contract Search (6.1) The smart contract is based on the parameters ctr, CLen and the user's keyword token kt w , loop to calculate the new search token st w , perform a search; (6.2) Save the results RES obtained during the search process and return them to the user; Step 7: User parsing search results (7.1) For each ciphertext C in the result RES, the user uses the attribute key sk S , execute the ABE.Dec() algorithm to get the plaintext m, where m is (ind||k ind ||op) or (ind||op); (7.2) The user selects the document identifier with op=1 and its corresponding symmetric key, and requests the cloud server to return the encrypted document; (7.3) For the returned encrypted document set, run the symmetric decryption algorithm SE.Dec() to obtain the original data.

2. The multi-client searchable encryption method according to claim 1, characterized in that: Step (2.2) Extract keywords from the document set DOC one by one and build an index. The specific implementation is as follows: (2.2a) For the document doc ind ∈DOC extracts the document identifier-keyword set (ind, W ind ),in It is a document doc ind The set of keywords you own; (2.2b) For the document doc ind The keyword w∈W extracted from ind , calculate the keyword token kt w =F(k,g 1 / w ), and then calculate the search token st w =H ctr (kt w ); (2.2c) Select an access policy A and the document doc in step (2.1) ind The symmetric key k ind , let m ind =(ind||k ind ||op), run The algorithm obtains the ciphertext C ind , where op is 1 to indicate data addition operation; (2.2d) For ciphertext C ind , calculate key = H(st w ||0), and get value←Map[key], where Map is the hash table storing the data in this adding operation; If value is empty, then calculate value←H(st w ||1)⊕(C ind ||⊥), and add {key, value} to the Map; If value is not empty, then remove {key, value} from the Map first, and then select a random token rt←{0,1} λ Finally, insert {key,H(st w ||1)⊕(C ind ||rt)} and {H(rt||0),H(rt||1)⊕H(rt||1)⊕H(st w ||1)⊕value}.

3. The multi-client searchable encryption method according to claim 1, characterized in that: Step (3.3) Extract keywords from the document set DOC' and build an index. The specific implementation is as follows: (3.3a) Document doc′ ind ∈DOC' can extract the document identifier-keyword set (ind, W′ ind ),in is the document doc' ind The set of keywords you own; (3.3b) For document doc′ ind The keyword w∈W′ extracted from ind , calculate the keyword token kt w =F(k,g 1 / w ), and then calculate the search token st w =H ctr (kt w ); (3.3c) Select an access policy Let m ind =(ind||op), operation The algorithm obtains the ciphertext C ind , where op is 0, indicating data deletion operation; (3.3d) For ciphertext C ind , calculate key = H(st w ||0), and get value←Map[key], where Map is the hash table storing the data in this adding operation; If value is empty, then calculate value←H(st w ||1)⊕(C ind ||⊥), and add {key, value} to the Map; If value is not empty, then remove {key, value} from the Map first, and then select a random token rt←{0,1} λ Finally, insert {key,H(st w ||1)⊕(C ind ||rt)} and {H(rt||0),H(rt||1)⊕H(rt||1)⊕H(st w ||1)⊕value}.

4. The multi-client searchable encryption method according to claim 1, characterized in that: The step (6.1) is specifically implemented as follows: Get the public parameter ctr, set j = ctr, and loop through the following steps until j>CLen: (6.1a) Calculate the search token st w =H j (kt w ); (6.1b) According to the search token st w , calculate key = H(st w ||0), get value←EDB[key]; If value is not empty, get an index ciphertext and a random token (C ind ||rt)←value⊕H(st w ||1); (6.1c) When rt is not empty, calculate value'←EDB[H(rt||0)] and (C′ ind ||rt)←value'⊕H(rt||1) to get an index ciphertext and a new random token rt; when rt is not empty, execute this step repeatedly; (6.1d) Execute j←j+1.

Images