Running data confidential comparison system and method based on GQ authentication protocol, and attribute-preserving hash system

Abstract

The present invention relates to a running data secret state comparison system and method based on the GQ authentication protocol, and an attribute-preserving hash system, comprising a key generation device, a ciphertext generation device, and a ciphertext comparison device. The key generation device is used to generate a hash key msk = (s, α, x0, x1, x2, e) and a test key ck = (y0, y1, y2); the ciphertext generation device is used to encrypt a message m and generate a ciphertext c = (c0, c1, ..., c n The ciphertext comparison device is configured to respond to a ciphertext c comparison instruction, obtain a ciphertext c′ and a matching test key, compare ciphertext c and ciphertext c′ using the test key, and output a comparison result. Using these devices can reduce the computational complexity of the encryption, decryption, and comparison processes of the sequence-unveiling cipher, thereby improving the efficiency of encryption, decryption, and comparison.

Description

Technical Field

[0001] The present invention relates to a sequence-revealing encryption method, and in particular to a running data secret state comparison system and method based on a GQ authentication protocol, and an attribute-preserving hash system. Background Art

[0002] Sensitive data needs to be encrypted before it can be stored on the server or in the cloud. Order-Revealing Encryption (ORE) is a searchable encryption algorithm based on symmetric cryptography. By comparing two ciphertexts, the size relationship of the corresponding plaintexts can be obtained, so that the encrypted data can be effectively range-queried, sorted, or threshold-filtered. As a generalization and extension of order-preserving encryption (OPE), order-revealing encryption mainly addresses the problems of insufficient security of order-preserving encryption algorithms and their inability to resist inference attacks. The encryption algorithm has a leakage function built in, which can provide stronger security guarantees and resist offline inference attacks compared to existing order-preserving encryption algorithms.

[0003] Patent document CN113254971A discloses a multi-data type ciphertext comparison method based on sequence-revealing encryption, including a system establishment algorithm ORE.Setup, an encryption algorithm ORE.Encrypt, a decryption algorithm ORE.Decrypt, a comparison algorithm ORE.Compare, and ciphertext comparison methods for multiple data types; wherein, a pseudo-random function F and a symmetric encryption algorithm are used, enabling it to achieve IND-OCPA security, that is, ordered chosen-plaintext attack indistinguishable security.

[0004] Although this technical solution can improve the security of the decryption method, with the development of the Internet of Things, data is characterized by large volume, multiple types, rapid changes and the need for real-time processing. The existing decryption method has a large amount of calculation, and the encryption and decryption process is inefficient and cannot meet the needs of short delay. Summary of the Invention

[0005] The purpose of the present invention is to provide a running data confidential comparison system and method based on the GQ authentication protocol, and an attribute-preserving hash system to reduce the amount of computation required in the encryption, decryption, and comparison processes of sequence-unveiling encryption and improve the efficiency of encryption, decryption, and comparison.

[0006] The technical solution of the present invention is:

[0007] A running data secret state comparison system based on the GQ authentication protocol includes a key generation device, a ciphertext generation device and a ciphertext comparison device. The key generation device is used to generate a hash key msk = (s, α, x0, x1, x2, e) and a test key ck = (y0, y1, y2); the ciphertext generation device is used to encrypt a message m and generate a ciphertext c = (c0, c1, ..., c n ); the ciphertext comparison device is used to respond to the ciphertext c comparison instruction, obtain the ciphertext c′ and the matching test key, use the test key to compare the ciphertext c and the ciphertext c′, and output the comparison result.

[0008] Preferably, the key generation device is used to implement the following steps:

[0009] Randomly select an integer Calculate the public key y0=x0 -e , y1=x1 -e , y2=x2 -e ;

[0010] Output the hash key msk=(s, α, x0, x1, x2, e) and the test key ck=(y0, y1, y2).

[0011] Preferably, let the message length be n, and define the hash function Hash function The ciphertext generating device is used to implement the following steps:

[0012] Select a random permutation function π, and use the random permutation function π to randomly permute the i-th index of the message m to π(i);

[0013] Select the message encoding function ε, use the message encoding function ε to encode the secret value s, message m and π(i), expressed as

[0014] ε(s,m,π(i))=F(s,π(i)||m [：i-1] ||0 n-i+1 )+m [i] mod2 λ

[0015] Among them, 0 n-i+1 is a zero string with a length of (n-i+1);

[0016] Let the encoded value of the i-th bit of message m be u i =ε(s, m, π(i)), calculate and

[0017] Calculating Commitment Challenge Value and response Among them, {ui, k / / wi, k}i∈[n], k∈{0, 1, 2} represents the connection of all encoded hash values ​​and corresponding commitments, that is,

[0018] Let c0 = σ, c i =(z i ,0,z i ,1,z i , 2), then the ciphertext of message m c=(c0,c1,...,c n ).

[0019] Preferably, the ciphertext comparison device is used to implement the following steps:

[0020] Respond to the ciphertext c comparison instruction and parse the ciphertext c as (σ, z 1，0 , z 1，1 , z 1，2 …z n，0 , z n，1 , z n，2 );

[0021] Get the ciphertext c′ and the matching test key, and parse the ciphertext c′ as (σ′, z′ 1，0 , z′ 1，1 , z′ 1，2 …z′ n，0 , z′ n，1 , z′ n，2 );

[0022] i takes 1, 2, ..., n, and calculates the verification value v respectively i，0 =((z i，0 ) e (y0) σ ) σ′ ; j takes 1, 2, ..., n, and calculates the verification value v′ respectively j，1 =((z′ j，1 ) e (y1) σ′ ) σ and v′ j，2 =((z′ j，2 ) e (y2) σ′ ) σ ;

[0023] If there is v i，0 =v′ j，1 (i=1,2,…,n;j=1,2,…,n), then c>c′; if there exists v i，0 =v′ j，2(i=1,2,…,n;j=1,2,…,n,then c<c′;if i takes 1,2,…,n and j takes 1,2,…,n, vi does not exist, 0=v′j,1, and v does not exist i，0 =v′ j，2 , then c=c′;

[0024] Output comparison results.

[0025] A method for using the aforementioned GQ authentication protocol-based operating data confidentiality comparison system includes a server S and a user A;

[0026] During the system initialization phase, server S uses a key generation device to save user A’s test key ck and sends the hash key msk to user A;

[0027] User A uses the hash key msk and the ciphertext generation device to encrypt the message m to obtain the ciphertext c, and uploads the ciphertext c to the server S. The server S compares the currently uploaded ciphertext c with the previously stored ciphertexts, finds the first ciphertext c′ that is greater than c, and stores the ciphertext c in a position before the ciphertext c′. If no ciphertext c′ greater than c is found, the ciphertext c is stored after all the ciphertexts.

[0028] Preferably, when user A wants to query the plaintext in the range [x, y], the hash key msk and the ciphertext generating device are used to encrypt the message x to obtain the ciphertext E x , encrypt the message y to obtain the ciphertext E y , generate and send ciphertext {E x , E y}Query command;

[0029] Server S receives the ciphertext {E x , E y}After querying the command, the response ciphertext {E x , E y}Query instruction, use the ciphertext comparison device and the matching test key to compare the ciphertext E x and the ciphertext in the ciphertext sequence, ciphertext E y and the ciphertext in the ciphertext sequence, find the first ≥E in the ciphertext sequence x The ciphertext is The last one in the ciphertext sequence is ≤E y The ciphertext is If the ciphertext The order is less than or equal to the ciphertext The target ciphertext segment is found, and the target ciphertext segment is the ciphertext in the ciphertext sequence. and ciphertext The ciphertext between Feedback query results.

[0030] Furthermore, the server S also decrypts the symmetrically encrypted ciphertext segment corresponding to the target ciphertext segment. for return To user A.

[0031] An attribute-preserving hash system includes a key generation device, a ciphertext generation device, and a ciphertext comparison device, wherein the key generation device is used to generate a hash key hk=(s, x, e, y) and a test key tk=(κ); the ciphertext generation device is used to encrypt a message bit m [i] , generate message bit m [i] Ciphertext The ciphertext comparison device is used to respond to the ciphertext Compare instructions to obtain ciphertext and a matching test key, using which the ciphertext is compared and ciphertext Output comparison results.

[0032] Preferably, the key generation device is used to implement the following steps:

[0033] Randomly select an integer Calculate the public key y = x -e ;

[0034] Output hash key hk=(s, x, e, y) and test key tk=(κ).

[0035] Preferably, define a hash function Hash function The ciphertext generating device is used to implement the following steps:

[0036] Randomly select random numbers Calculate the message bit m [i] The hash code value of and

[0037] Calculating Commitment and challenge value

[0038] Generate a random public key rpk=yr e and response Encode the challenge value as

[0039] Output ciphertext

[0040] Preferably, define a hash function The ciphertext comparison device is used to implement the following steps:

[0041] Response ciphertext Compare instructions and recover ciphertext Challenge value

[0042] Get ciphertext and the matching test key, recover the ciphertext Challenge value

[0043] Calculate ((z0) e (rpk′) c九 ) ch′ 、((z1′) e (rpk) ch′ ) ch 、((z0′) e (rpk) ch′ ) c九 and ((z1) e (rpk′)c9) ch′ ;

[0044] If ((z0) e (rpk′) ch ) ch′ =((z1′) e (rpk) ch′ ) ch , then c>c′;

[0045] If ((z0′) e (rpk) ch′ ) ch =((z1) e (rpk′) ch ) ch′ , then c <c′;

[0046] If ((z0) e (rpk′) ch ) ch′ ≠((z1′) e (rpk) ch′ ) ch , and ((z0′) e (rpk) ch′ ) c九 ≠((z1) e (rpk′) c九 ) ch′ , then c=c′;

[0047] Output comparison results.

[0048] The beneficial effects of the present invention are:

[0049] 1. Most existing ORE schemes still use bilinear pairing operations for ciphertext comparison, which greatly reduces the execution speed of the scheme. However, the encryption method and ciphertext comparison method of the present invention do not use bilinear pairings, which simplifies the calculation and greatly reduces the amount of computation in the encryption, decryption, and ciphertext comparison processes, thereby improving the encryption efficiency, decryption efficiency, and comparison efficiency.

[0050] 2. The ORE scheme of the present invention is constructed based on the GQ authentication protocol. Compared with the ORE scheme in the prior art, it can effectively reduce the ciphertext length and the storage space of the ciphertext data. The ORE scheme constructed based on the GQ protocol and PPH ensures the security of the de-sequence encryption ciphertext comparison query. In this way, the present invention can take into account both the efficiency and security of de-sequence encryption.

[0051] 3. The operating data confidentiality comparison system based on the GQ authentication protocol of the present invention and its use method are suitable for large amounts of data, multiple types, fast changes and high real-time processing environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 Schematic diagram of a GQ-pORE solution of the present invention. DETAILED DESCRIPTION

[0053] The present invention is described below in the form of embodiments in conjunction with the accompanying drawings to assist those skilled in the art in understanding and implementing the present invention. Unless otherwise specified, the following embodiments and the technical terms therein should not be understood without reference to the technical background of the present art.

[0054] Description of symbols used in the present invention.

[0055] 1. General Symbols

[0056] The set of integers consisting of 1, 2, ..., N-1.

[0057] λ: System security parameter, usually 128.

[0058] F(·): hash function,

[0059] H c (·): hash function, which is

[0060] m [i] : The i-th bit of message m.

[0061] m [：i] : The i-bit prefix of message m, m [：i] =m [1] ||m [2]||…||m [i] 。

[0062] x: The privacy key determined by the cloud server.

[0063] y: The public key determined by the cloud server.

[0064] s, κ: Secret values.

[0065] e: Public exponent.

[0066] b: Output flag, 1 indicates m > m′, -1 indicates m < m′, 0 indicates they are equal.

[0067] II. Symbol Explanation in PPH

[0068] The encoding hash value of a certain plaintext message bit m [i] of.

[0069] w0, w1: Commitment values of. <00​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​

[0082] u i : The encoded value of the i-th bit of the plaintext message.

[0083] The k-th encoded hash value of the i-th position of the plaintext message, k∈{0,1,2}.

[0084] w i，k : The commitment value of , k∈{0, 1, 2}.

[0085] z i，k : Response value.

[0086] σ: the challenge value of message m.

[0087] c: ciphertext of message m c = (c0, c1, ..., c n ).

[0088] The Guillou-Quisquater (GQ) identity authentication protocol is an interactive zero-knowledge protocol used for tamper-resistant device authentication. The protocol allows users to collaborate with each other, making a group of cooperating users appear like a new entity, while each member does not reveal their own secrets. This patent draws on the data structure construction ideas during GQ protocol interaction and proposes an ORE scheme and system based on the GQ authentication protocol for smart grids. By modifying the encryption function, the ORE comparison function is converted from bilinear pairing comparison to a secure exponential comparison. While ensuring the correctness of the scheme range query, the bilinear pairing operation is eliminated, making the scheme efficient, greatly reducing the amount of computation for grid users, and meeting the characteristics of grid data.

[0089] This scheme includes a Property-Preserving Hash (PPH) construction example and a smart grid-oriented ORE scheme (GQ-pORE) based on the GQ authentication protocol. The relationship between the two is explained as follows: PPH is essentially a simplified variant of the property-preserving encryption scheme. Similar to the classic HMAC scheme, it requires a hash key hk to calculate the hash value of the message m. The difference is that PPH also has a test key tk, which is used to determine whether two different messages {x, y} are associated with two different hash values ​​{h, h'}. If so, it proves that x = y ± 1 exists. The ORE scheme GQ-pORE is constructed based on the PPH example. It parses the message m into binary form, encodes it bit by bit from high to low, and encrypts and compares it using the PPH encryption algorithm. Therefore, the size comparison relationship between each bit can be obtained, and then the overall size relationship between m and m' can be obtained.

[0090] The PPH (Property-Preserving Hash) instance contains three algorithms: a key generation algorithm, a hash algorithm, and a test algorithm. These three algorithms are the underlying structure of the GQ-pore decryption method.

[0091] PPH.Keygen (key generation algorithm), including:

[0092] a) The cloud server defines two hash functions based on the system security parameter λ and

[0093] b) The cloud server randomly selects an integer Calculate the public key y = x -e ;

[0094] c) Output the hash key hk=(s, x, e, y) and the test key tk=(κ).

[0095] It should be understood that the cloud server randomly selects integers You can either randomly select integers s, κ, x, and e when generating the user key, so that each user's hash key and test key are different. At this time, the cloud server also needs to associate e with the test key. One way to associate is to put e into the test key. At this time, the test key tk = (κ, e); you can also randomly select integers The process consists of two steps: the first is to randomly generate some parameters, such as s and e, during initialization. The second step is to randomly generate some parameters, such as κ and x, during key generation. Generally, the value of x in the key of each user is kept different to prevent unauthorized users from affecting the accuracy of the ciphertext data through ciphertext storage, ciphertext comparison, and ciphertext query operations.

[0096] PPH.Hash (hash algorithm), including:

[0097] a) User A randomly selects a random number Calculate the mm of a message [i] The hash code value of and

[0098] b) Calculation of commitment and challenge value

[0099] c) Generate a random public key rpk=yr e and response Encode the challenge value as

[0100] d) Output hash value

[0101] PPH.Test (testing algorithm), including:

[0102] a) The cloud server S receives the test key tk = (κ) and two hash values and and recovers the challenge values and

[0103] b) Calculate flag as follows and output the value of b as the result:

[0104]

[0105] Analysis of the correctness of the PPH instance is as follows:

[0106]

[0107]

[0108] That is

[0109] At this time, c > c′, output b = 1.

[0110] Similarly, it can be obtained that when c < c′, output b = -1; when c = c′, output b = 0.

[0111] See Figure 1 , the ORE scheme based on the GQ authentication protocol (GQ-pORE) includes three algorithms: key generation algorithm, encryption algorithm and comparison algorithm. κ is publicly available as a common parameter and does not need to participate in the specific operations of the GQ-pORE scheme.

[0112] GQ-pORE.KGen(1 λ )(key generation algorithm), including:

[0113] a) The cloud server defines two hash functions and

[0114] b) The cloud server randomly selects an integer and calculates the public keys y0 = x0 -e , y1 = x1 -e , y2 = x2 -e ;

[0115] c) Output the hash key msk = (s, α, x0, x1, x2, e) and the test key ck = (y0, y1, y2).

[0116] It should be understood that the cloud server randomly selects an integer You can either randomly select integers s, α, x0, x1, x2, e when generating the user key, so that each user's hash key and test key are different. At this time, the cloud server also needs to associate e with the test key. One way to associate is to put e into the test key. At this time, the test key ck = (y0, y1, y2, e); you can also randomly select integers The process consists of two steps. The first is to randomly generate some parameters during initialization, such as s, α, and e. The second step is to randomly generate some parameters when generating the key, such as x0, x1, and x2. Generally, the values ​​of x0, x1, and x2 in the keys of different users are kept different to prevent unauthorized users from affecting the accuracy of ciphertext data through ciphertext storage, ciphertext comparison, and ciphertext query operations.

[0117] GQ-pORE.Enc(msk,m)(encryption algorithm), including:

[0118] a) User A chooses a random permutation function π: [n] → [n] and a message encoding function ε, which takes as input a secret value s, an n-bit message m, and a random permutation π(i) indexed by the i-th bit, ε(s, m, π(i)) = F(s, π(i)||m [：i-1 ]||0 n-i+1 )+m [i] mod2 λ Among them, 0 n-i+1 is a zero string of length (n-i+1). Let the encoding value u of the i-th bit of the plaintext message m be i =ε(s, m, π(i)), calculate and

[0119] b) Calculation of commitment Challenge Value and response Among them, {ui, k / / wi, k}i∈[n], k∈{0, 1, 2} represents the connection of all encoded hash values ​​and corresponding commitments, that is,

[0120] c) Let c0 = σ, c i =(z i.0 , z i.1 , z i，2 ), output the ciphertext c of message m = (c0, c1, ..., c n );

[0121] GQ-pORE.Cmp(ck, c, c′) (comparison algorithm), including:

[0122] a) The cloud server S receives the test key ck = (y0, y1, y2) and two ciphertexts c and c', parses c into (σ, z 1，0 , z 1，1 , z 1，2 …z n，0 , z n，1 , z n，2 ), and parses c' into (σ', z' 1，0 , z' 1，1 , z' 1，2 …z' n，0 , z' n，1 , z' n，2 );

[0123] b) For i taking 1, 2, …, n, calculate the verification value v i，0 = ((z i，0 )(y0) e ); for j taking 1, 2, …, n, calculate the verification values v' σ = ((z'(y1)) σ′ ) and v' j，1 = ((z'(y2)) j，1 ); e (y1) σ′ ) σ and v' j，2 = ((z'(y2)) j，2 ) e (y2) σ′ )<0061>;

[0124] c) Output the value of b according to the following comparison results:

[0125]

[0126] Specifically: if there exists v i，0 = v' j，1 (i = 1, 2, …, n; j = 1, 2, …, n), then c > c', output b = 1; if there exists v i，0 = v'<00001{65> (i = 1, 2, …, n; σ = 1, 2, …, n), then c < c', output b = -1;; if for i taking 1, 2, …, n and j taking 1, 2, …, n, there does not exist v i，0 = v' j，1 , and there does not exist v i，0 = v' j，2 , then c = c', output b = 0.

[0127] [[ID=8{5]]The correctness analysis of the GQ-pORE scheme is as follows:

[0128] Taking the comparison of the i-th bit as an example, assume that the first (i - 1) bits all output b = 0:

[0129]

[0130]

[0131]

[0132] When v i，0 = v' j，1 , that is

[0133] At this time, c > c', output b = 1.

[0134] When v i，0 = v' j，2 , that is

[0135] At this time, c < c', output b = -1.

[0136] If the equation never holds, it proves that c = c', output b = 0.

[0137] From the above correctness analysis, it can be seen that both the PPH instance and the GQ-pORE scheme are correct.

[0138] Embodiment 1: A running data ciphertext comparison system based on the GQ authentication protocol can be obtained from the GQ-pORE scheme, including a key generation device, a ciphertext generation device, and a ciphertext comparison device. The key generation device is used to generate a hash key msk = (s, α, x0, x1, x2, e) and a test key ck = (y0, y1, y2); the ciphertext generation device is used to encrypt the message m and generate the ciphertext c = (c0, c1,..., c n ); the ciphertext comparison device is used to respond to the ciphertext c comparison instruction, obtain the ciphertext c' and the matching test key, and use the test key to compare the ciphertext c and the ciphertext c', and output the comparison result.

[0139] Preferably, the key generation device is used to implement the following steps:

[0140] Randomly select an integer Calculate the public key y0 = x0 -e , y1 = x1 -e , y2 = x2 -e ;

[0141] Output the hash key msk = (s, α, x0, x1, x2, e) and the test key ck = (y0, y1, y2).

[0142] Preferably, let the length of the message m be n, and define the hash function Hash function The ciphertext generating device is used to implement the following steps:

[0143] Select a random permutation function π, and use the random permutation function π to randomly permute the i-th index of the message m to π(i);

[0144] Select the message encoding function ε, use the message encoding function ε to encode the secret value s, message m and π(i), expressed as

[0145] ε(s,m,π(i))=F(s,π(i)||m [：i-1 ]||0 n-i+1 )+m [i] mod2 λ

[0146] Among them, 0 n-i+1 is a zero string with a length of (n-i+1);

[0147] Let the encoded value of the i-th bit of message m be u i =ε(s, m, π(i)), calculate and

[0148] Calculating Commitment Challenge Value and response Among them, {ui, k / / wi, k}r∈[n], k∈{0, 1, 2} represents the connection of all encoded hash values ​​and corresponding commitments, that is,

[0149] Let c0 = σ, c i =(z i ,0,z i ,1,z i , 2), then the ciphertext of message m c=(c0,c1,...,c n ).

[0150] Preferably, the ciphertext comparison device is used to implement the following steps:

[0151] Respond to the ciphertext c comparison instruction and parse the ciphertext c as (σ, z 1，0 , z 1，1 , z 1，2 …z n，0 , z n，1 , z n，2 );

[0152] Get the ciphertext c′ and the matching test key, and parse the ciphertext c′ as (σ′, z′ 1，0 , z′ 1，1 , z′ 1，2 …z′n，0 , z′ n，1 , z′ n，2 );

[0153] For i taking values 1, 2,..., n, calculate the verification value v respectively i，0 = ((z i，0 )) e (y₀) σ )); σ′ For j taking values 1, 2,..., n, calculate the verification value v′ respectively j，1 = ((z′ j，1 )) e (y₁) σ′ )) σ and v′ j，2 = ((z′ j，2 )) e (y₂) σ′ )); σ ;

[0154] If there exists v i，0 = v′ j，1 (i = 1, 2,..., n; j = 1, 2,..., n), then c > c′; if there exists v i，0 = v′ j，2 (i = 1, 2,..., n; j = 1, 2,..., n, then c < c′; if i takes values 1, 2,..., n in sequence and j takes values 1, 2,..., n in sequence, and there is no vi,0 = v′j,1, and there is no v i，0 = E′ j，2 , then c = c′;

[0155] Output the comparison result. The comparison result is: if c > c′, output b = 1; if c < c′, output b = -1; if c = c′, output b = 0.

[0156] In use, the key generation device and the ciphertext comparison device can be installed in the server, and the ciphertext generation device can be installed in the user. The server corresponds to one user or more than two users. The hash key msk = (s, α, x₀, x₁, x₂, e) generated by the server is sent to user A, and the test key ck = (y₀, y₁, y₂) is saved. After user A generates the ciphertext c = (c₀, c₁,..., c n ) of the message m, the ciphertext c is uploaded, and the server stores the ciphertext c as the ciphertext c′. If user A hopes to query whether the server stores the ciphertext of the message m, encrypt the message m to obtain the ciphertext c = (c₀, c₁,..., c n ), generate and send a ciphertext c comparison instruction. The server responds to the ciphertext c comparison instruction, obtains the ciphertext c′ and the matching test key, compares the ciphertext c and the ciphertext c′ using the test key, and feeds back the comparison result.

[0157] When in use, the key generation device can be installed in the server S1, the ciphertext comparison device can be installed in the server S2, and the ciphertext generation device can be installed in the user. The server corresponds to one user or more than two users. The hash key msk = (s, α, x0, x1, x2, e) generated by the server S1 is sent to user A, and the test key ck = (y0, y1, y2) is generated and sent to the server S2. User A generates the ciphertext c = (c0, c1, ..., c n ), the ciphertext c is uploaded, and the server S2 stores the ciphertext c as ciphertext c'. If user A wants to query whether the ciphertext of message m is stored in server S2, the ciphertext c is obtained by encrypting message m. n ), generates and sends a ciphertext c comparison instruction, server S2 responds to the ciphertext c comparison instruction, obtains the ciphertext c′ and the matching test key, uses the test key to compare the ciphertext c and the ciphertext c′, and feeds back the comparison result.

[0158] Example 2: A method for using the operation data confidentiality comparison system based on the GQ authentication protocol of Example 1 includes two entities: a server S and a user A.

[0159] During the system initialization phase, server S uses a key generation device to save user A's test key ck and sends the hash key msk to user A.

[0160] To prevent the disclosure of sensitive information, user A uses the hash key msk and a ciphertext generator to encrypt message m to obtain ciphertext c. Then, using a symmetric encryption algorithm, user A encrypts message m to obtain ciphertext sc. The two ciphertexts are then uploaded to server S, where they are linked. Server S compares the currently uploaded ciphertext c with previously stored ciphertexts, finds the first ciphertext c′ greater than c, and stores it before ciphertext c′. If no ciphertext c′ greater than c is found, ciphertext c is stored after all ciphertexts and linked to ciphertext sc to form ciphertext c′ and ciphertext sc′. In other words, server S stores ciphertexts in order of size, based on the size of the corresponding plaintexts.

[0161] When user A wants to query the plaintext in the range [x, y], he first uses the hash key msk and the ciphertext generation device to encrypt the message x to obtain the ciphertext E x , encrypt the message y to obtain the ciphertext E y , generate and send ciphertext {E x , E y}Query command.

[0162] Server S receives the ciphertext {E x , E y}After querying the command, the response ciphertext {E x, E y}Query instruction, use the ciphertext comparison device and the matching test key to compare the ciphertext E x and the ciphertext in the ciphertext sequence, ciphertext E y and the ciphertext in the ciphertext sequence, query the first ≥E in the ciphertext sequence x Ciphertext The last one in the ciphertext sequence is ≤E y The ciphertext is; If the ciphertext The order is less than or equal to the ciphertext The target ciphertext segment is found, and the target ciphertext segment is the ciphertext in the ciphertext sequence. and ciphertext The ciphertext between Feedback query results.

[0163] Encryption Range [E x , E y ], use user A's test key ck to execute the GQ-pORE.Cmp algorithm to compare E x , E y With the size of the ciphertext in the database, since the ciphertext is stored in order, when the lower limit is found to be E x and the upper limit is E y Ciphertext and c′ kb When , server S can also perform decryption operations on all ciphertexts in the target ciphertext segment (we also perform basic symmetric encryption operations on each plaintext and store it together with the ciphertext) and return it to user A, thus completing the [x, y] range query. That is, server S also decrypts the symmetric encrypted ciphertext segment corresponding to the target ciphertext segment. for return To user A.

[0164] Example 3: From the PPH example, a running data secret state comparison system based on the GQ authentication protocol can be obtained, including a key generation device, a ciphertext generation device and a ciphertext comparison device, wherein the key generation device is used to generate a hash key hk=(s, x, e, y) and a test key tk=(κ); the ciphertext generation device is used to encrypt the message bit m [i] , generate message bit m [i] Ciphertext The ciphertext comparison device is used to respond to the ciphertext Compare instructions to obtain ciphertext and a matching test key, using which the ciphertext is compared and ciphertext Output comparison results.

[0165] Preferably, the key generation device is used to implement the following steps:

[0166] Randomly select an integer Calculate the public key y = x -e ;

[0167] Output hash key hk=(s, x, e, y) and test key tk=(κ).

[0168] Preferably, define a hash function Hash function The ciphertext generating device is used to implement the following steps:

[0169] Randomly select random numbers Calculate the message bit m [i] The hash code value of and

[0170] Calculating Commitment and challenge value

[0171] Generate a random public key rpk=yr e and response Encode the challenge value as

[0172] Output ciphertext

[0173] Preferably, define a hash function The ciphertext comparison device is used to implement the following steps:

[0174] Response ciphertext Compare instructions and recover ciphertext Challenge value

[0175] Get ciphertext and the matching test key, recover the ciphertext Challenge value

[0176] Calculate ((z0) e (rpk′) ch ) ch′ 、((z1′) e (rpk) ch′ ) ch 、((z0′) e (rpk) ch′ ) ch and ((z1) e (rpk′) ch )ch′ ;

[0177] If ((z0) e (rpk′) ch ) ch ′ = ((z1′) e (rpk) ch ′) ch , then c > c′;

[0178] If ((z0′) e (rpk) ch′ ) ch = ((z1) e (rpk′) ch ) ch′ , then c < c′;

[0179] If ((z0) e (rpk′) ch ) ch′ ≠ ((z1′)<---->(rpk) ch′ ) ch , and ((z0′) e (rpk) ch′ ) ch ≠ ((z1) e (rpk′) ch ) ch′ , then c = c′;

[0180] Output the comparison result. The comparison result is: If c > c′, output b = 1; if c < c′, output b = -1; if c = c′, output b = 0.

[0181] When in use, the key generation device and the ciphertext comparison device can be installed in the server, and the ciphertext generation device can be installed in the user. The server corresponds to one user or more than two users. The hash key hk = (s, x, e, y) generated by the server is sent to the user, and the test key tk = (κ) is saved. User A generates the message bit m [i] 's ciphertext and then uploads the ciphertext The server stores the ciphertext as the ciphertext If user A hopes to query whether the server stores the ciphertext of the message bit m [i] , encrypt the message bit m[i] to obtain the ciphertext ; generate and send the ciphertext comparison instruction, the server responds to the ciphertext comparison instruction, obtains the ciphertext and the matching test key, and uses the test key to compare the ciphertext and ciphertext Feedback comparison results.

[0182] When in use, the key generation device can be installed in the server S1, the ciphertext comparison device can be installed in the server S2, and the ciphertext generation device can be installed in the user. The server corresponds to one user or more than two users. The hash key hk = (s, x, e, y) generated by the server S1 is sent to user A, and the test key tk = (κ) is generated and sent to the server S2. User A generates the message bit m [i] Ciphertext After that, upload the ciphertext Server S2 stores the ciphertext Ciphertext If user A wants to query whether the server S2 stores message position m [i] When the ciphertext is m, the encrypted message is m [i] Get the ciphertext Generate and send ciphertext Compare instructions, server S2 responds with ciphertext Compare instructions to obtain ciphertext and a matching test key, using which the ciphertext is compared and ciphertext Feedback comparison results.

[0183] It should be understood that Example 2 describes the method for using the GQ authentication protocol-based running data confidential comparison system in Example 1, and the attribute-preserving hash system in Example 3 can also use this method.

[0184] It should be understood that the key generation device, ciphertext generation device, and ciphertext comparison device in the present invention can be hardware devices or software modules in the form of computer programs.

[0185] The present invention has been described in detail above with reference to the accompanying drawings and embodiments. It should be understood that in practice it is impossible to exhaustively illustrate all possible implementation methods, and the inventive concept of the present invention is explained as much as possible by way of examples. Without departing from the inventive concept of the present invention and without creative work, those skilled in the art who select and combine the technical features in the above embodiments, make experimental changes to the specific parameters, or use the prior art in the field of this technology to conventionally replace the disclosed technical means of the present invention to form specific embodiments should all be considered as implicit disclosures of the present invention.

Claims

1. A running data secret state comparison system based on the GQ authentication protocol, comprising a key generation device, a ciphertext generation device, and a ciphertext comparison device. The GQ authentication protocol is an interactive zero-knowledge protocol characterized in that: The key generating device is used to generate a hash key and test key ; The ciphertext generating device is used to encrypt the message , generate a message Ciphertext ; The ciphertext comparison device is used to respond to the ciphertext Compare instructions to obtain ciphertext and a matching test key, using which the ciphertext is compared and ciphertext , output comparison result; Randomly select an integer , set the message The bit length is , define the hash function , hash function ,in is the system security parameter; The key generation device is used to implement the following steps: Calculate the public key , , ; Output hash key and test key ; The ciphertext generating device is used to implement the following steps: Choose a random permutation function , using a random permutation function Random permutation message No. The bit index is ; Select the message encoding function , using the message encoding function Encoded secret value ,information and , expressed as in, is a length of 0 string; Order message No. The encoded value of the bit ,calculate , and ; Calculating Commitment , Challenge Value and response ,in, represents the concatenation of all encoded hash values ​​and corresponding commitments, i.e. ； make , , then the message Ciphertext .

2. The operation data confidentiality comparison system based on the GQ authentication protocol according to claim 1, characterized in that: The ciphertext comparison device is used to implement the following steps: Response ciphertext Compare instructions and parse ciphertext for ; Get ciphertext and matching test key, parse the ciphertext for ; Pick , respectively calculate the verification value ; Pick , respectively calculate the verification value and ,in For the message The challenge value, z is the response value, and v is the verification value; If exists ,but If it exists ,but ;like Take all , Take all , neither exists , and neither exists ,but ; Output comparison results.

3. A method for using the operation data confidentiality comparison system based on the GQ authentication protocol according to any one of claims 1 to 2, comprising: a server and users ; During the system initialization phase, the server Use the key generator to save the user Test key , hash the key Send to user ; user Using hash keys and ciphertext generating device, encrypting the message Get the ciphertext , upload ciphertext To the server ,server The currently uploaded ciphertext Compare with the previously stored ciphertext and find the first one greater than Ciphertext , and the ciphertext Stored in ciphertext A previous position, if no greater than Ciphertext , then the ciphertext Stored after all ciphertexts.

4. The method of use according to claim 3, wherein: When the user Hope the query is in When the plaintext is in the range, use the hash key and ciphertext generation device, respectively encrypting the message Get the ciphertext , encrypted messages Get the ciphertext , generate and send ciphertext Query command; server Received ciphertext After querying the command, respond with ciphertext Query command, use the ciphertext comparison device and the matching test key to compare the ciphertext and the ciphertext and ciphertext in the ciphertext sequence and the ciphertext in the ciphertext sequence, find the first ≥ The ciphertext is , the last one in the ciphertext sequence ≤ The ciphertext is , if the ciphertext The order is less than or equal to the ciphertext The target ciphertext segment is found, and the target ciphertext segment is the ciphertext in the ciphertext sequence. and ciphertext The ciphertext between , feedback query results.

Images