A dynamic searchable encryption method and system supporting multiple users

Abstract

The present invention discloses a dynamic searchable encryption method and system supporting multiple users, including a system parameter setting module, an index establishment module, a registration module, an authentication module, an encryption module, an update module, a search module, a homomorphic addition module, and a decryption module. The system parameter setting module generates system public parameters and sends them to other modules. The index establishment module establishes a database file index. The registration module registers authorized users. The update module updates the encrypted database information. The authentication module identifies the legitimacy of authorized users. The encryption module encrypts information. The search module searches for information that the user wants to query. The homomorphic addition module obtains an encrypted file index through homomorphic addition search. The decryption module decrypts the encrypted information. Compared with the prior art, the present invention can solve the problems of dynamic searchability and security of multiple users in cloud storage, and the system operation efficiency is high.

Description

Technical Field

[0001] The present invention belongs to the field of information security and relates to a dynamic searchable encryption technology based on forward security and backward security, in particular to a dynamic searchable encryption method and system supporting multiple users. Background Art

[0002] With the rapid development of computer technology and internet applications, the demand for data access and information storage capacity continues to increase. The growing popularity of cloud computing has led to an exponential increase in demand for cloud storage. Cloud computing can be used to develop cloud services for diverse applications, such as industry, healthcare, and transportation, tailored to user needs. Cloud computing enables users to enjoy high-quality services and ubiquitous network access on demand. However, while enjoying the flexibility and convenience of cloud storage, outsourcing data to cloud servers can lead to data privacy concerns. To protect user data privacy, plaintext is often encrypted before being outsourced to cloud servers. However, the encryption process destroys the natural structure of the data, making it impossible to perform queries on the encrypted data.

[0003] To address the searchability issue for encrypted data, Curtmola et al. proposed the definition of Searchable Symmetric Encryption (SSE) in 2006, providing security proofs for both non-adaptive and adaptive scenarios and extending it to multi-user scenarios. Searchable symmetric encryption allows one party to privately encrypt data and outsource its storage to another party (the server), while maintaining the ability to selectively search the encrypted data, eliminating the need to decrypt the data before processing. Early designs for searchable symmetric encryption were designed for static scenarios, enabling only client queries to the database but not client updates (adding and deleting data) to the outsourced database.

[0004] To address the issue of users querying and updating outsourced databases, Kamara et al. proposed the definition of Dynamic Searchable Symmetric Encryption (DSSE) in 2012 and presented the first DSSE scheme. DSSE allows one party to add or delete encrypted data stored on another party. This allows an adversary to observe the database's behavior during updates (additions and deletions), potentially revealing the database's contents as well as information about the search queries and keywords involved.

[0005] To address these leaks, Stefanov et al. proposed two new security concepts in 2014, called forward privacy and backward privacy. Simply put, forward privacy is satisfied if the addition of new files does not leak any information about previously queried keywords, even to any attacker who may continuously observe the interactions between the server and client. Backward privacy is satisfied if previously added and subsequently deleted files do not leak "too much" information within any time period between two search queries for the same keyword. In response to these two security concepts, Bost et al. proposed forward security and three different types of backward security in 2017, each with their own solutions. While research on dynamic searchable encryption based on forward and backward security has progressed, current forward- and backward-secure dynamic searchable encryption methods only consider single-user scenarios and have limited application in multi-user scenarios. Summary of the Invention

[0006] Purpose of the invention: In response to the defects of the dynamic searchable encryption method based on forward security and backward security pointed out in the background technology, a dynamic searchable encryption method and system that supports multiple users is provided. While ensuring the security of dynamic searchability, a user identity authentication mechanism is added to make it suitable for multi-user scenarios.

[0007] Technical solution: The present invention discloses a dynamic searchable encryption method supporting multiple users, comprising the following steps:

[0008] Step 1: Set the system public parameter params and state σ, the system public parameter params is σ is<n,K,CT> , p is a large prime number, p factorial cyclic group and Bilinear map from Select generators g, h, and select four collision-resistant hash functions H * , H0, H1, H2; select the key K, which is used to store the empty map CT of the current search token and the integer n, n = 2 l , where l is the maximum number of files;

[0009] Step 2: Create a file index bs based on the information you want to update or search;

[0010] Step 3: Generate the user's private key based on the system public parameters params and user ID

[0011] Step 4: According to the system public parameters params, the user's private key And keyword search token index CT, get search token ST c and counter c;

[0012] Step 5: Generate a one-time private key sk based on the keyword key c+1 , encrypt the file index bs to get e c+1 ;

[0013] Step 6: For state σ, update keyword w according to the encrypted database EDB and file index bs to obtain the updated state σ′ and the updated encrypted database EDB′;

[0014] Step 7: For state σ, search the encrypted database EDB for the keyword w that the user wants to search for, and obtain the encrypted file index e;

[0015] Step 8: Based on the encrypted file index e obtained in step 7, the final result Sum is obtained through homomorphic addition e ;

[0016] Step 9: Sum the result of homomorphic addition e and the sum of the one-time private key Sum sk , after decryption, we get the file index bs.

[0017] Furthermore, the hash function H * , H0, H1, H2 use hash functions MD-5, SHA-1, SHA-2 or SHA-3, and H * Only the proxy server and the identity authority know it.

[0018] Furthermore, the step 3 of obtaining the user's private key specifically includes:

[0019] Step 3.1: Generator h = h0 + h1;

[0020] Step 3.2: Identity Authority Calculation As the user's private key, the private key issued to the user by the identity authority is

[0021] Furthermore, the search token ST is obtained in step 4. c And the counter c specifically includes:

[0022] Step 4.1: Authorizer's Proxy Server Calculation h u =h0(1-u)+h1u sent h u Authenticate with the identity authority;

[0023] Step 4.2: Identity authority receives and calculates

[0024] Step 4.3: The identity authority searches the token index CT based on the keyword and returns the current keyword search token ST c and counter c to the user.

[0025] Furthermore, the step 5 encrypts the file index bs to obtain e c+1 Specifically include:

[0026] Step 5.1: The encryptor passes a keyed pseudorandom function F with a key K K Generate K′ w ;

[0027] Step 5.2: Calculate the one-time private key sk c+1 =H2(K′ w ,c+1);

[0028] Step 5.3: Calculate the encrypted file index e c+1 =sk c+1 +bs c+1 mod n,bs c+1 Index of the c+1th file.

[0029] Furthermore, the step 6 includes:

[0030] Step 6.1: The authorizer's proxy server uses a keyed pseudo-random function F with a key K K Generate K w ;

[0031] Step 6.2: Search for token ST based on the current keyword in step 4 c And the counter c determines whether it is empty. If it is empty, then c←-1, ST c ←{0,1} λ ; If it is not empty, continue to perform the following steps;

[0032] Step 6.3: Proxy server executes ST c+1 ←{0,1} λ , will (ST c+1 ,c+1) is stored in CT;

[0033] Step 6.4: Calculate the update token UT c+1 =H0(K w ,ST c+1 ), masking the previous search token

[0034] Step 6.5: The proxy server will Send to database server;

[0035] Step 6.6: The database server updates the state and encryption database based on the information sent by the proxy server.

[0036] Furthermore, the step 7 specifically includes:

[0037] Step 7.1: The authorizer's proxy server uses a keyed pseudo-random function F with a key K K Generate K w ;

[0038] Step 7.2: Search for token ST based on the current keyword c And counter c determines whether it is empty, if it is empty, returns If it is not empty, continue with the following steps;

[0039] Step 7.3: Send (K w ,ST c ,c) to the database server;

[0040] Step 7.4: The database server loops forward from counter position c to position 0 and executes the following steps;

[0041] Step 7.5: Calculate UT i =H0(K w ,ST i ), retrieve all encrypted bit strings e corresponding to the keyword w that the user wants to search for i .

[0042] Furthermore, the step 8 specifically includes: the database server generates the encrypted bit string e according to the i , loop forward from counter position c to position 0 and perform the following steps: Calculate Sum e =e i-1 +e i mod n.

[0043] Furthermore, the step 9 includes:

[0044] Step 9.1: The decryptor loops forward from counter position c to position 0 and performs the following steps;

[0045] Step 9.2: Calculate sk i =H2(K′ w ,i), perform modular addition operation on each sk calculated to obtain the sum of the one-time private key Sum sk , where K′ w The encryptor passes a keyed pseudorandom function F with a key K K generated;

[0046] Step 9.3: After the loop ends, the user calculates bs = Sume -Sum sk mod n gets the file index you want to search.

[0047] The present invention also discloses a dynamic searchable encryption system supporting multiple users, comprising:

[0048] System parameter setting module: input security parameter λ, return system public parameter params and status σ;

[0049] Index building module: input database DB and build file index bs;

[0050] Registration module: Generate the user's private key based on the system's public parameters params and user ID Where k = 1, 2, ..., N. There are N authorizers in the system;

[0051] Authentication module: Enter the authorizer's private key according to the system's public parameters params and the current keyword search token index CT, return the search token ST c and counter c;

[0052] Encryption module: The encryptor enters a one-time private key sk c+1 Encrypt the file index bs to obtain the encrypted file index e c+1 ;

[0053] Update module: The database server updates the encrypted database EDB according to the state σ and the keyword w that the authorizer needs to update, and obtains the updated state σ′ and encrypted database EDB′;

[0054] Search module: The database server searches the encrypted database EDB based on the state σ and the keyword w that the authorizer wants to query, and obtains the encrypted file index e;

[0055] Homomorphic addition module: The database server applies the homomorphic addition algorithm to homomorphically add all encrypted file indexes e corresponding to the keyword w that the authorizer wants to query, and obtains the sum of the encrypted file indexes Sum e ;

[0056] Decryption module: The decryptor uses the sum of the one-time private key Sum sk Sum of encrypted file indexes e Decrypt and get the file index bs.

[0057] Beneficial effects:

[0058] Compared to conventional dynamic searchable encryption methods, the multi-user dynamic searchable encryption method provided by this invention adds a user identity registration and verification module, making it applicable to verifying the legitimacy of users in multi-user scenarios. Furthermore, this dynamic searchable encryption method offers both forward and backward security. Even if an adversary knows the current search keyword, they cannot access the results of previous searches or previously updated content, thus ensuring data security during updates. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 Schematic diagram of the operation of the encryption system of the present invention;

[0060] Figure 2 is a flow chart of the encryption method of the present invention;

[0061] Figure 3 Schematic diagram of the encryption system of the present invention. DETAILED DESCRIPTION

[0062] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention.

[0063] The mathematical theory used in this invention is as follows:

[0064] Zero-knowledge proof (ZKP) means that the prover can convince the verifier that a certain assertion is correct without providing any useful information to the verifier. The ZKP scheme used in this paper is the ZKP scheme introduced by Camenisch and Stadler, which is described in detail as follows:

[0065] Define the zero-knowledge proof for integers α, β, and γ as where g and h are cyclic groups The generator of It's a group The integers α, β, and γ are the knowledge to be proved, and the other values are used by the verifier to verify whether the equation holds.

[0066] like Figure 1 As shown, the dynamic searchable encryption system supporting multiple users disclosed in the present invention includes the following nine modules:

[0067] System parameter setting module (Setup): input security parameter λ, return system public parameter params and status σ.

[0068] Index building module (BuildIndex): input database DB and build file index bs.

[0069] Registration module (Register): Generates the user's private key based on the system's public parameters params and user ID Where k = 1, 2, ..., N. There are N authorizers in the system.

[0070] Authentication module (Authorize): According to the system public parameters params, enter the authorizer private key and the current keyword search token index CT, return the search token ST c and counter c.

[0071] Encryption module (Enc): The encryptor enters a one-time private key sk c+1 Encrypt the file index bs to obtain the encrypted file index e c+1 .

[0072] Update module (Update): The database server updates the encrypted database EDB according to the state σ and the keyword w that the authorizer needs to update, and obtains the updated state σ′ and encrypted database EDB′.

[0073] Search module (Search): The database server searches the encrypted database EDB according to the state σ and the keyword w that the authorizer wants to query, and obtains the encrypted file index e.

[0074] Homomorphic addition module (Add): The database server applies the homomorphic addition algorithm to homomorphically add all encrypted file indexes e corresponding to the keyword w that the authorizer wants to query, and obtains the sum of the encrypted file indexes Sum e .

[0075] Decryption module (Dec): The decryptor uses the sum of the one-time private key Sum sk Sum of encrypted file indexes e Decrypt and get the file index bs.

[0076] The following will provide a detailed description of each module of the encryption system in conjunction with a flowchart of a dynamic searchable encryption method supporting multiple users.

[0077] like Figure 2 As shown, the execution process of the dynamic searchable encryption method supporting multiple users provided by the present invention is as follows:

[0078] Step 1: Set the system public parameter params and state σ, the system public parameter params is σ is<n,K,CT> , p is a large prime number, p factorial cyclic group and Bilinear map from Select generators g, h, and select four collision-resistant hash functions H * , H0, H1, H2; select the key K, which is used to store the empty map CT of the current search token and the integer n, n = 2 l , where l is the maximum number of files. Hash function H * , H0, H1, H2 use hash functions MD-5, SHA-1, SHA-2 or SHA-3, and H * Only the proxy server and the identity authority know it.

[0079] Step 2: Create a file index bs based on the information you want to update or search.

[0080] Step 3: Generate the user's private key based on the system public parameters params and user ID

[0081] Step 3.1: Generator h = h0 + h1;

[0082] Step 3.2: Identity Authority Calculation As the user's private key, the private key issued to the user by the identity authority is

[0083] Step 4: According to the system public parameters params, the user's private key And keyword search token index CT, get search token ST c and counter c.

[0084] Step 4.1: Authorizer's Proxy Server Calculation h u =h0(1-u)+h1u sent h u Authenticate with the identity authority;

[0085] Step 4.2: Identity authority receives and calculates

[0086] Step 4.3: The identity authority searches the token index CT based on the keyword and returns the current keyword search token ST c and counter c to the user.

[0087] Step 5: Generate a one-time private key sk based on the keyword key c+1 , encrypt the file index bs to get e c+1 .

[0088] Step 5.1: The encryptor passes a keyed pseudorandom function F with a key K K Generate K′ w ;

[0089] Step 5.2: Calculate the one-time private key sk c+1 =H2(K′ w ,c+1);

[0090] Step 5.3: Calculate the encrypted file index e c+1 =sk c+1 +bs c+1 mod n,bs c+1 Index of the c+1th file.

[0091] Step 6: For state σ, according to the encrypted database EDB and file index bs, update the keyword w to obtain the updated state σ′ and the updated encrypted database EDB′.

[0092] Step 6.1: The authorizer's proxy server uses a keyed pseudo-random function F with a key K K Generate K w ;

[0093] Step 6.2: Search for token ST based on the current keyword in step 4 c And the counter c determines whether it is empty. If it is empty, then c←-1, ST c ←{0,1} λ ; If it is not empty, continue to perform the following steps;

[0094] Step 6.3: Proxy server executes ST c+1 ←{0,1} λ , will (ST c+1 ,c+1) is stored in CT;

[0095] Step 6.4: Calculate the update token UT c+1 =H0(K w ,ST c+1 ), masking the previous search token

[0096] Step 6.5: The proxy server will Send to database server;

[0097] Step 6.6: The database server updates the state and encryption database based on the information sent by the proxy server.

[0098] Step 7: For state σ, search the keyword w that the user wants to search for according to the encrypted database EDB, and obtain the encrypted file index e.

[0099] Step 7.1: The authorizer's proxy server uses a keyed pseudo-random function F with a key K K Generate K w ;

[0100] Step 7.2: Search for token ST based on the current keyword c And counter c determines whether it is empty, if it is empty, returns If it is not empty, continue with the following steps;

[0101] Step 7.3: Send (K w ,ST c ,c) to the database server;

[0102] Step 7.4: The database server loops forward from counter position c to position 0 and executes the following steps;

[0103] Step 7.5: Calculate UT i =H0(K w ,ST i ), retrieve all encrypted bit strings e corresponding to the keyword w that the user wants to search for i .

[0104] Step 8: Based on the encrypted file index e obtained in step 7, the final result Sum is obtained through homomorphic addition e The database server calculates the encrypted bit string e i , loop forward from counter position c to position 0 and perform the following steps: Calculate Sum e =e i-1 +e i mod n.

[0105] Step 9: Sum the result of homomorphic addition e and the sum of the one-time private key Sum sk , after decryption, we get the file index bs.

[0106] Step 9.1: The decryptor loops forward from counter position c to position 0 and performs the following steps;

[0107] Step 9.2: Calculate sk i =H2(K′ w ,i), perform modular addition operation on each sk calculated to obtain the sum of the one-time private key Sum sk , where K′ w The encryptor passes a keyed pseudorandom function F with a key K K generated;

[0108] Step 9.3: After the loop ends, the user calculates bs = Sum e -Sum sk mod n gets the file index you want to search.

[0109] The following describes an example scenario in which the above-mentioned dynamic searchable encryption method and system supporting multiple users are applied to cloud computing.

[0110] According to the steps of the present invention, when user A wishes to update public cloud data, the identity authority executes to obtain public parameters params. The authorizer generates user A's private key and search token. Three collision-resistant hash functions are used to generate an update token, a ciphertext masked from the previous token, and a one-time private key. The one-time private key is used to encrypt the file index, and the update token, the ciphertext masked from the previous token, and the encrypted file index are updated to the cloud database. When user B wishes to query public cloud data, the identity authority executes to obtain public parameters params. The authorizer generates user B's private key and search token, and sends the keyword key and search token to the cloud database. The cloud database homomorphically adds all retrieved results to obtain the sum of the encrypted file index and returns it to the user. The user homomorphically adds all one-time private keys to obtain the sum of the one-time private keys, and decrypts the sum of the encrypted file index. Because this solution protects user privacy and utilizes zero-knowledge proofs to verify user identity, neither malicious authorizers nor malicious users can obtain the identity information of the user who stored data in the cloud. In addition, since a collision-resistant hash function is used to generate the update token, shield the ciphertext of the previous token, and the one-time private key, the scheme meets the requirements of dynamic searchable forward and backward security.

[0111] The above examples are merely illustrative of the basic principles and features of the present invention. Other advantages and variations can be readily appreciated based on these examples. Without departing from the spirit of the present invention, those skilled in the art may derive other technical solutions from the above examples through various equivalent substitutions. Such solutions should be encompassed within the scope of the claims and their equivalents.

Claims

1. A dynamic searchable encryption method supporting multiple users, characterized in that: The steps include: Step 1: Set the system public parameters params and state σ ， The system public parameters params are σ is<n,K,CT> , p is a large prime number, p factorial cyclic group and Bilinear map es: from Select generators g, h, and select four collision-resistant hash functions H * , H0, H1, H2; select key K, used to store the current keyword search token index CT and integer n, n = 2 l , where l is the maximum number of files; Step 2: Create a file index bs based on the information you want to update or search; Step 3: Generate the user's private key based on the system public parameters params and user ID Step 3.1: Generator h = h0 + h1; Step 3.2: Identity Authority Calculation As the user's private key, the private key issued to the user by the identity authority is Step 4: According to the system public parameters params, the user's private key And keyword search token index CT, get search token ST c and counter c; Step 4.1: Authorizer's Proxy Server Calculation h u =h0(1-u)+h1u sent h u Authenticate with the identity authority; Step 4.2: Identity authority receives and calculates Step 4.3: The identity authority searches the token index CT based on the keyword and returns the current keyword search token ST c and counter c to the user; Step 5: Generate a one-time private key sk based on the keyword key c+1 , encrypt the file index bs to get e c+1 ; Step 5.1: The encryptor passes a keyed pseudorandom function F with a key K K Generate K′ w ; Step 5.2: Calculate the one-time private key sk c+1 =H2(K′ w ,c+1); Step 5.3: Calculate the encrypted file index e c+1 =sk c+1 +bs c+1 modn,bs c+1 Index for the c+1th file; Step 6: For state σ, according to the encrypted database EDB, file index bs, and update keyword w, obtain the updated state σ′ and the updated encrypted database EDB′; Step 7: For state σ, search the encrypted database EDB for the keyword w that the user wants to search for, and obtain the encrypted file index e i ; Step 7.1: The authorizer's proxy server uses a keyed pseudo-random function F with a key K K Generate K w ; Step 7.2: Search for token ST based on the current keyword c And counter c determines whether it is empty, if it is empty, returns If it is not empty, continue with the following steps; Step 7.3: Send (K w ,ST c ,c) to the database server; Step 7.4: The database server loops forward from counter position c to position 0 and executes the following steps; Step 7.5: Calculate UT i =H0(K w ,ST i ), retrieve all encrypted bit strings e corresponding to the keyword w that the user wants to search for i , that is, encrypted file index e i ; Step 8: Search the encrypted file index obtained in step 7 i , the final result Sum is obtained by homomorphic addition e ; Step 9: Sum the result of homomorphic addition e and the sum of the one-time private key Sum sk , after decryption, we get the file index bs.

2. The multi-user dynamic searchable encryption method according to claim 1, characterized in that: The hash function H * , H0, H1, H2 use hash functions MD-5, SHA-1, SHA-2 or SHA-3, and H * Only the proxy server and the identity authority know it.

3. The multi-user dynamic searchable encryption method according to claim 1, characterized in that: The step 6 includes: Step 6.1: The authorizer's proxy server uses a keyed pseudo-random function F with a key K K Generate K w ; Step 6.2: Search for token ST based on the current keyword in step 4 c And the counter c determines whether it is empty. If it is empty, then c←-1, ST c ←{0,1} λ ; If it is not empty, continue to perform the following steps; Step 6.3: Proxy server executes ST c+1 ←{0,1} λ , will (ST c+1 ,c+1) is stored in CT; Step 6.4: Calculate the update token UT c+1 =H0(K w ,ST c+1 ), masking the previous search token Step 6.5: The proxy server will (UT c+1 (e c+1 ,C STc ))Send to the database server; Step 6.6: The database server updates the state and encryption database based on the information sent by the proxy server.

4. The multi-user dynamic searchable encryption method according to claim 1, characterized in that: The step 8 specifically includes: the database server according to all the encrypted bit strings e i , loop forward from counter position c to position 0 and perform the following steps: Calculate Sum e =e i-1 +e i modn.

5. The multi-user dynamic searchable encryption method according to any one of claims 1 to 4, characterized in that: The step 9 comprises: Step 9.1: The decryptor loops forward from counter position c to position 0 and performs the following steps; Step 9.2: Calculate sk i =H2(K′ w ,i), perform modular addition operation on each sk calculated to obtain the sum of the one-time private key Sum sk , where K′ w The encryptor passes a keyed pseudorandom function F with a key K K generated; Step 9.3: After the loop ends, the user calculates bs = Sum e -Sum sk modn gets the file index you want to search.

6. A multi-user dynamic searchable encryption system based on the multi-user dynamic searchable encryption method according to any one of claims 1 to 5, characterized in that: include: System parameter setting module: input security parameter λ, return system public parameter params and status σ; Index building module: input database DB and build file index bs; Registration module: Generate the user's private key based on the system's public parameters params and user ID Where k = 1, 2, ..., N, there are N authorizers in the system; Authentication module: According to the system public parameters params, enter the user's private key and the current keyword search token index CT, return the search token ST c and counter c; Encryption module: The encryptor enters a one-time private key sk c+1 Encrypt the file index bs to obtain the encrypted file index e c+1 ; Update module: The database server updates the encrypted database EDB according to the state σ and the keyword w that the authorizer needs to update, and obtains the updated state σ′ and encrypted database EDB′; Search module: The database server searches the encrypted database EDB according to the state σ and the keyword w that the authorizer wants to query, and obtains the encrypted file index e i ; Homomorphic addition module: The database server applies the homomorphic addition algorithm to index all encrypted files corresponding to the keyword w that the authorizer wants to query into e i Perform homomorphic addition to obtain the sum of the encrypted file indexes Sum e ; Decryption module: The decryptor uses the sum of the one-time private key Sum sk Sum of encrypted file indexes e Decrypt and get the file index bs.

Images