A method for content auditing of encrypted data

Abstract

The application discloses a content auditing method for encrypted data, which comprises the following steps: 1) setting an encryption module embedded with an auditing key BDK on a user terminal to be audited; 2) when the user terminal to be audited encrypts a message M, the encryption module calculates a random number R used in a KEM key encapsulation algorithm through f(BDK, KI); then the encryption module calculates a session key K and encapsulated ciphertext C1 by using the KEM key encapsulation algorithm, and generates ciphertext C2 by using a message M encryption algorithm; then the encryption module sends the ciphertext C1 and C2 to a receiving terminal; KI is information that can be obtained by an auditing device and the encryption module; 3) the auditing device recovers the random number R by using the auditing key BDK, KI and a function f; then the auditing device calculates the session key K by using the KEM key encapsulation algorithm, decrypts the ciphertext C2 to obtain the message M, and audits the content of the message M. The application can realize real-time detection of encrypted data of the user to be audited, and is very efficient.

Description

Technical Field

[0001] This invention belongs to the field of communications and relates to a content auditing method, particularly a content auditing method for encrypted data. Background Technology

[0002] The hybrid encryption paradigm, combining KEM (Key Encapsulation Mechanism) and DEM (Data Encapsulation Mechanism), is a widely used data encryption method for protecting the confidentiality of communication data. The following example, using the sending of message M to the receiving party, briefly illustrates the encryption and decryption process of this hybrid encryption paradigm:

[0003] (1) Encryption process: The sender uses the receiver's public key as input to call the KEM key encapsulation algorithm, randomly generates a random number R, calculates the session key K and its encapsulated ciphertext C1, and then uses the session key K and message M as input to call the DEM encryption algorithm to generate ciphertext C2. The sender sends ciphertext C1 and ciphertext C2 to the receiver.

[0004] (2) Decryption process: After receiving ciphertext C1 and ciphertext C2, the receiver calls the KEM decapsulation algorithm with its own private key and ciphertext C1 as input to obtain the session key K′, where the probability that K′ is equal to K is close to 1. Then the receiver calls the DEM decryption algorithm to recover message M with the session key K′ and ciphertext C2 as input.

[0005] Note: In the scenario where the random number used by the algorithm is derived from the pseudo-random number generator, the random number R used by the KEM key encapsulation algorithm is the input of the pseudo-random number generator, i.e., the random seed.

[0006] Typical hybrid encryption methods include international standards such as ECIES-HC, PSEC-HC, ACE-HC, and RSA-HC from ISO / IEC. While hybrid encryption paradigms ensure the confidentiality of communication data, they pose challenges to content auditing and hinder information oversight. For example, a company might need to audit the network communication data between its employees and customers or others to ensure that confidential company information is not leaked. Summary of the Invention

[0007] In view of the problems existing in the prior art, the purpose of this invention is to provide a content auditing method for encrypted data.

[0008] The technical solution of this invention is as follows:

[0009] A method for content auditing of encrypted data, comprising the following steps:

[0010] 1) Set up an encryption module with the audit key BDK embedded on the audited user terminal;

[0011] 2) When the audited user terminal encrypts the message M to be sent, the encryption module calculates the random number R used by the KEM key encapsulation algorithm using f(BDK,KI); then, it uses the KEM key encapsulation algorithm to calculate the session key K and the encapsulated ciphertext C1 of the session key K based on the random number R and the user's public key pk at the receiving end; and it uses the session key K to encrypt the message M to generate ciphertext C2; then, it sends ciphertext C1 and ciphertext C2 to the receiving end; wherein, the function f is a function that satisfies the same output size as the size of the random number R, and KI is information that can be obtained by both the auditing device and the encryption module;

[0012] 3) The auditing device audits the data sent by the audited user terminal: The auditing device uses the auditing key BDK, KI and function f to recover the random number R; then uses the KEM key encapsulation algorithm to calculate the session key K based on the random number R and the user public key pk; then uses the session key K to decrypt the ciphertext C2 to obtain the message M and audit its content.

[0013] Furthermore, the function f is a pseudo-random function or a hash function.

[0014] Furthermore, the KI is a segment of ciphertext data of a set length generated by the encryption module and used for communication transmission; the auditing device obtains this segment of ciphertext data of the set length from the historical data sent by the audited user terminal; wherein, the encryption module and the auditing device pre-agree on a segment of ciphertext data of a set length before each data transmission as the KI.

[0015] Furthermore, KI is the encryption time of ciphertext C1 or ciphertext C2.

[0016] Furthermore, the KI is the identification information of the encryption module; the auditing device pre-stores the identification information of the encryption module.

[0017] Furthermore, KI is the current count of the counter, which is embedded in the encryption module and used to record the number of encryption attempts; the auditing device obtains the current count by detecting the number of communication transmissions of the encryption module.

[0018] Furthermore, the receiving end uses the KEM decapsulation algorithm and the user's private key sk to decrypt the ciphertext C1 to obtain the session key K′, and then uses the session key K′ and the ciphertext C2 as input to call the DEM decryption algorithm to recover the message M.

[0019] The advantages of this invention are as follows:

[0020] (1) The auditing equipment does not need to obtain the private key of the audited user;

[0021] (2) This method is applicable to any standardized KEM and DEM;

[0022] (3) This method can achieve real-time detection of encrypted data of the audited user and is very efficient. Attached Figure Description

[0023] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0024] The present invention will now be described in further detail with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0025] Figure 1 This describes the main operational process of the audited user, the auditing device, and the message receiver that establishes communication with the audited user in this embodiment of the invention.

[0026] The encrypted data is implemented using a hybrid encryption paradigm of KEM+DEM. This content auditing method mainly operates at three levels, such as... Figure 1 As shown.

[0027] (I) Audited User Terminal Operation: The audited user needs to use an encryption module with the embedded audit key BDK to complete data encryption. The audit key BDK is embedded in the encryption module by the auditor. The encryption module can be software, hardware, or a hybrid platform combining software and hardware. The encryption process described in this invention is consistent with the encryption process of the hybrid encryption paradigm, except for the generation method of the random number R used in the KEM key encapsulation algorithm. In the hybrid encryption paradigm, the random number R used in the KEM key encapsulation algorithm is randomly generated. In this invention, the random number R used in the KEM key encapsulation algorithm during the encryption process is calculated using f(BDK,KI), where f is a function that satisfies the same output size as the size of the random number R, and can be a pseudo-random function, a random function, a hash function, etc.; BDK is the audit key; KI generally refers to information that can be obtained by both the auditing device and the encryption module, such as one of the following four aspects of information, or a combination of these four aspects of information.

[0028] 1. Historical information generated by the encryption module and used for communication transmission, such as ciphertext data generated before this encryption (the encryption module can obtain this historical information by saving the generated ciphertext data, and the auditing device can obtain it by detecting the communication transmission content of the encryption module); the encryption module and the auditing device pre-agree that a set length of ciphertext data before each data transmission is KI;

[0029] 2. Current encryption time information (this information can be obtained by the encryption module and the auditing device by observing the current encryption time);

[0030] 3. Identification information of the encryption module, such as model number, serial number, etc. (This information needs to be embedded in the device during the system initialization phase of the encryption module and the auditing device).

[0031] 4. The counter is currently counting. This counter is embedded in the encryption module and records the number of times the encryption module has encrypted. This counter can be left blank (the encryption module can obtain this information from the current counter count, and the auditing device can obtain it by detecting the number of communication transmissions of the encryption module).

[0032] (II) Audit Equipment Operation: For the encrypted data {C1,C2,…} transmitted by the audited user terminal, the audit equipment completes the audit through the following steps.

[0033] (1) Use the audit key BDK, the acquired information KI and function f to recover the random number R used by the KEM key encapsulation algorithm during the encryption process of the audited user's encryption module.

[0034] (2) The session key K generated by the audited user during the hybrid encryption process is calculated using the random number R, the public key pk corresponding to the message receiving end that establishes communication with the audited user, and the key encapsulation algorithm of KEM.

[0035] (3) The plaintext information M transmitted is calculated using the session key K and the ciphertext C2, and finally the content of the plaintext information M is audited.

[0036] (III) Message Receiving End Operation: After receiving the ciphertext message, the message receiving end completes the decryption according to the decryption process of the hybrid encryption paradigm. Specifically, after receiving ciphertext C1 and ciphertext C2, the receiving end calls the KEM decapsulation algorithm with its own private key sk and ciphertext C1 as input to obtain the session key K′. Then, the receiving end calls the DEM decryption algorithm with the session key K′ and ciphertext C2 as input to recover the message M.

[0037] The method does not impose any special restrictions on KEM and can be any standardized key encapsulation mechanism, such as ECIES-KEM, PSEC-KEM, ACE-KEM, RSA-KEM, etc. in the ISO / IEC 18033-2 standard, as well as quantum-resistant key encapsulation mechanisms such as CRYSTALS-KYBER, Classic McEliece, BIKE, and HQC that are being standardized by NIST.

[0038] The method does not impose any restrictions on the DEM and can be any standardized authentication encryption algorithm, such as AES-GCM, AES-CBC, AES-CCM, CHACHA-POLY, SM4-ECB, SM4-CBC, SM4-GCM, SM4-CCM, etc.

[0039] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A method for content auditing of encrypted data, comprising the steps of: 1) setting an encryption module embedded with an auditing key BDK at a user terminal to be audited; 2) when the user terminal to be audited encrypts a message M to be sent, the encryption module calculates a random number R by f(BDK, KI) for a KEM key encapsulation algorithm, then calculates a session key K and an encapsulation ciphertext C1 of the session key K according to the random number R and a user public key pk of a receiving terminal by the KEM key encapsulation algorithm, and generates a ciphertext C2 of the message M by a DEM encryption algorithm using the session key K, and then sends the ciphertext C1 and the ciphertext C2 to the receiving terminal; wherein the function f is a function satisfying the same size of the output and the random number R, and KI is information available to both the auditing device and the encryption module; 3) the auditing device audits the data sent by the user terminal to be audited: the auditing device recovers the random number R using the auditing key BDK, KI and the function f, then calculates the session key K by the KEM key encapsulation algorithm using the random number R and the user public key pk, and then decrypts the ciphertext C2 using the session key K to obtain the message M and audits the content thereof.

2. The method of claim 1, wherein, The function f is a pseudo-random function or a hash function.

3. The method according to claim 1 or 2, characterized in that, The KI is a piece of ciphertext data of a set length generated by the encryption module and used for communication transmission; the auditing device obtains the piece of ciphertext data of the set length from historical data sent by the user terminal to be audited; wherein the encryption module and the auditing device previously agree that a piece of historical ciphertext data of a set length before each transmission of data is the KI.

4. The method according to claim 1 or 2, characterized in that, The KI is the encryption time of the ciphertext C1 or the ciphertext C2.

5. The method according to claim 1 or 2, characterized in that, The KI is identification information of the encryption module; the auditing device pre-stores the identification information of the encryption module.

6. The method of claim 1 or 2, wherein, The KI is the current count of a counter embedded in the encryption module and used to record the number of encryptions; the auditing device obtains the current count by detecting the number of communication transmissions of the encryption module.

7. The method of claim 1, wherein, The receiving terminal decrypts the ciphertext C1 using a KEM unencapsulation algorithm and a user private key sk to obtain a session key K', and then calls a DEM decryption algorithm using the session key K' and the ciphertext C2 as inputs to recover the message M.

Images