Method for encrypted image retrieval with fusion of access control and copyright protection in cloud environment

Abstract

The application discloses a kind of encrypted image retrieval methods of fusing access control and copyright protection under cloud environment, including data owner generates encryption key and access control key set and index structure and encryption, upload encryption result to cloud server;Search user registers to obtain relevant attribute and key to authorized agent center, and authorized agent center generates user-specific watermark and embeds watermark-related key;Search trapdoor is generated, and search request is sent to cloud server;Watermark and key are sent to cloud server simultaneously;Cloud server carries out access permission authentication, and search user decides search permission and the specific category of access, and carries out image retrieval;Cloud server embeds watermark in search result;Search user obtains the search result with watermark from cloud server;Authorized agent center extracts watermark and arbitrates whether it is user malicious forwarding.The application has high search accuracy, can realize accurate access control and copyright protection, and can prevent user malicious use of search result.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of computer security, and particularly relates to an encrypted image retrieval method fusing access control and copyright protection in a cloud environment. BACKGROUND

[0002] With the advent of the big data era and the intelligent era, people's demand for data processing is becoming greater and greater. With the rapid development of the multimedia era, people's demand for image and other multimedia data processing is also becoming higher and higher.

[0003] At present, content-based image retrieval has been widely used in people's production and life. In the process of image retrieval, in order to protect the privacy of data, the retrieval process usually performs encryption operation on the data, and the addition of the encryption operation makes the image retrieval technology in the plaintext field unable to be effectively used. Therefore, the image retrieval technology based on ciphertext arises at the historic moment. However, the traditional ciphertext image retrieval technology, although it guarantees the security of the data in the retrieval process, has the problems of low retrieval accuracy, lack of access control and copyright protection, and inability to prevent malicious use of the retrieval results by users.

[0004] The main purpose of access control is to limit the access of the access subject to the object, so as to guarantee that the data resources can be effectively used and managed within the legal scope. In order to achieve the above purpose, access control needs to complete two tasks: identifying and confirming the user of the access system, and deciding what type of access the user can perform on a certain system resource. The main purpose of copyright protection is to prevent the legal retrieval user from illegally forwarding and using the retrieved data under the inducement of interests. Considering that the image data uploaded by the data owner on the cloud server contains some sensitive data such as identity card number, telephone number, home address and some private medical data. If a large number of malicious users retrieve these sensitive private data, without an access control mechanism, the burden on the server will be increased, and the sensitive private data cannot be better protected; if the legal user maliciously forwards and illegally uses these private data, it seriously infringes the copyright of the data owner and the legal rights and interests of the data owner. However, the existing encrypted image retrieval method does not well solve the two problems, which limits the development of image retrieval technology under ciphertext. SUMMARY

[0005] The present application aims to provide an encrypted image retrieval method fusing access control and copyright protection in a cloud environment, which has high retrieval accuracy, can realize accurate access control and watermark-based copyright protection of data, and can effectively prevent malicious use of retrieval results by users.

[0006] The encrypted image retrieval method fusing access control and copyright protection in a cloud environment provided by the present application comprises the following steps:

[0007] S1. The data owner generates an encryption key set and an access control key set;

[0008] S2. The data owner generates an index structure and encrypts it, and the encrypted index structure is encrypted again using CP-ABE to obtain a final ciphertext index structure, realizing access control;

[0009] S3. The data owner encrypts the image data owned by itself according to the generated key set;

[0010] S4. The encrypted data obtained in step S3 and the final ciphertext index structure obtained in step S2 are uploaded to a cloud server;

[0011] S5. A search user registers with an authorized agent center to obtain relevant attributes and keys, and the authorized agent center generates a specific watermark of the user and a related key of the embedded watermark according to the ID of the user, generates a search trapdoor, and sends a search request to the cloud server. Meanwhile, the watermark and the related key are sent to the cloud server;

[0012] S6. The cloud server performs access permission authentication according to the search trapdoor obtained in step S5, and the search user decides the search permission according to the attributes of itself, decides the specific category of access according to the specific attributes of itself, and further performs image search;

[0013] S7. The cloud server finds the corresponding watermark and the related embedded watermark key according to the watermark obtained from step S5 according to the ID of the search user, and embeds the watermark in the search result;

[0014] S8. The search user obtains the corresponding search result with the watermark from the cloud server;

[0015] S9. The authorized agent center extracts the watermark according to the search result obtained in step S8 and arbitrates whether it is maliciously forwarded by a certain search user.

[0016] The data owner generates an encryption key set and an access control key set in step S1, specifically including the following steps:

[0017] The data owner obtains an encryption key set K={S, M1, M2, π, V, R, k img} by inputting a parameter ρ, wherein S is a random cutting vector for feature vector encryption, used to divide the feature vector into two feature vectors, S is a d2-dimensional random V=(v1, v2,..., v d1 ) vector; M1 and M2 are both d2*d2-dimensional reversible matrices; π is a random sequence; V is a d1-dimensional vector, v j∈[-ρ1,ρ1]; R is a d1-dimensional vector, and R=(r1,r2,...,r d1 ), r j ∈[-ρ2,ρ2]; ρ1 and ρ2 are random numbers and ρ1 >> ρ2; k img Image encryption key, used to encrypt images; access control related key.

[0018] In step S2, the data owner generates and encrypts an index structure. The encrypted index structure is then encrypted again using CP-ABE to obtain the final ciphertext index structure, thereby implementing access control. This process includes the following steps:

[0019] During retrieval, the similarity between the retrieved image and the category label is first calculated to determine the category to which the retrieved image belongs; then, a one-to-one search is performed, and the similarity of the feature vectors is ranked to obtain a similarity ranking; the data owner extracts two feature vectors f from the image using a pre-trained neural network. i for The first feature vector f i (1) The second feature vector f is used to represent the category information to which the image belongs. i (2) Used to represent the feature information of the image; the first feature vector is clustered using the k-means clustering algorithm to obtain the cluster centers f. c,l for This allows images to be categorized based on similarity; then, based on the second feature vector f... i (2) Construct a mapping index structure that corresponds one-to-one between images and feature information;

[0020] Encrypt the index structure:

[0021] The first feature vector f i (1) Cluster center f c,l Encryption is performed. The encryption process is as follows: First, the cluster centers are transformed by replacing all 0s with -1s to obtain the first intermediate variable. for Then the first intermediate variable Encryption yields a second intermediate variable Complete the encryption of the first segment of the index structure; encrypt the second segment of the feature vector f. i (2) The transformation is performed to obtain the third intermediate variable. for f i f i The modulus; then, through the segmentation vector S, the third intermediate variable... Cut into two random feature vectors and Where S[j]=0 and Equal, that is When S[j]=1 Encryption is performed using an invertible matrix to obtain the second segment of the encrypted feature vector. in M1 is the transpose of the invertible matrix. The transpose of the invertible matrix M2 is given; finally, the encrypted index structure I' is obtained as follows.

[0022] The encrypted index structure is encrypted using the CP-ABE ciphertext strategy. Encryption is performed; data owners define different access trees based on different attributes according to different access permissions, and use different access trees to encrypt different cluster centers, controlling access to different data categories using different access structures; each access policy controls one access structure, allowing access to specific data categories only by possessing specific attributes; retrieval users have different retrieval permissions based on their own attributes, obtaining different data categories they can access; the advantage of this is that different data uses different retrieval permissions, implementing a different level of access settings for data; certain data types are only accessible to specific users; different retrieval users can only access specific data categories based on their different attributes.

[0023] In step S3, the data owner encrypts their own image data according to the generated key set. Specifically, the data owner processes the image into a grayscale image and then uses the image encryption key k. img Encrypt the image data it possesses.

[0024] Step S5 involves the user registering with the authorized agent center to obtain relevant attributes and keys. Simultaneously, the authorized agent center generates a specific watermark for the user based on their ID and a key for embedding the watermark; a search trap is generated, and a search request is sent to the cloud server. The watermark and related keys are also sent to the cloud server. Specifically, this includes the following steps:

[0025] The system retrieves the user's registration information from the authorization center and obtains attributes and related attribute keys; simultaneously, the authorization agent center generates the user's specific watermark and the related key k for embedding the watermark based on the user's ID. emb =(k emb1 ,k emb2 ,k emb3 ,AA), and send the watermark along with the key embedded in the watermark to the cloud server;

[0026] The search user sends a search request to the cloud server; the user with access right can obtain the encrypted index structure to obtain the search result;

[0027] The same neural network as in step S2 is used to extract the feature vector f of the search image q For Transform the vector Replace 0 with -1 to obtain the fourth intermediate variable Then, through the randomly generated d1-dimensional vector U q =(u q,1 ,u q,2 ,...,u q,d1 ), a random sequence π and R, the fourth intermediate variable is encrypted to obtain For

[0028]

[0029] The search user generates a new key W according to the received key set q For Transform to obtain the fifth intermediate variable For Then, the fifth intermediate variable is segmented using the segmentation vector S, when S[j]=1, then and are two equal vectors When S[j]=0, then and are cut into two random vectors and The same reversible matrix as in step S2 is used for encryption to obtain the sixth intermediate variable For δ is a random number;

[0030] Finally, the search trapdoor TD is obtained as

[0031] The cloud server according to step S5 performs access right authentication according to the search trapdoor described in step S6, the search user decides the search right according to its own attributes, decides the specific category of access according to its own unique attributes, and further performs image search, which specifically includes the following steps:

[0032] Confirming the access right: the user without the access right stops the retrieval process; the user with the access right can obtain the encrypted index structure, and the node values of the encrypted index structure obtained by the users with different retrieval rights are different, i.e., the accessible data categories are different, which are determined according to the attributes of the retrieval users; the users with different attributes have different access rights, i.e., they can only access specific data categories, and then continue the further retrieval;

[0033] The user with the retrieval right performs the retrieval calculation: the retrieval user first obtains the category information, and calculates the distance between the encrypted first feature vector and the encrypted category center in the image library by using the following formula

[0034] In the formula, mod is the modulus operation, is the XOR operation;

[0035] Judging the size relationship between the calculated distance value and the set threshold value: if the distance value is less than the set threshold value, the current image is classified as the jth image; otherwise, it is not the image.

[0036] After the image category is retrieved, the similarity between the encrypted feature vector of the retrieval image and the encrypted feature vector of the image in the image library is calculated by using the following formula:

[0037]

[0038] In the formula, ||.|| is the modulus operator.

[0039] According to the size of the calculation result of the similarity , the similarity ranking is obtained; then, the images corresponding to the top several similarities are obtained as the image retrieval result of the retrieval user.

[0040] The cloud server in step S7 finds the corresponding watermark and the related embedded watermark key according to the watermark obtained in step S5 based on the ID of the retrieval user, and embeds the watermark in the retrieval result, and the specific steps include the following steps:

[0041] The cloud server finds the corresponding watermark and the related key k emb = (k emb1 , k emb2 , k emb3 , AA) according to the watermark obtained in step S5 based on the ID of the retrieval user, and embeds the watermark in the retrieval result.

[0042] The image obtained in step S6 is divided into non-overlapping blocks of AA*AA; the embedded watermark W is set as W=(w1, w2,..., w Nw ), and the embedded watermark W corresponds to the search user one by one; each watermark is randomly embedded in a block, and the position of the embedded block is represented as k emb1 ;

[0043] The pixel points in each selected block are randomly divided into a first group AA0 and a second group AA1, and the random information is represented as k emb2 ;

[0044] The embedding process is as follows: if the currently embedded watermark information w i =0, the values of the pixel points in the first group AA0 are flipped; if the currently embedded watermark information w i =1, the values of the pixel points in the second group AA1 are flipped; when flipping, the last four bits of the pixel values are randomly flipped, and the random information is represented by k emb3 ; the embedding process is repeated until the watermark W is embedded, and the search result with the embedded watermark is obtained.

[0045] The search user obtains the corresponding search result with the embedded watermark from the cloud server according to step S8, and the specific steps are as follows:

[0046] The search user decrypts the received search result with the embedded watermark using the image encryption key k img , and obtains the search result with the embedded watermark corresponding to the search user one by one.

[0047] The authorized agent center extracts the watermark from the search result obtained in step S8 and arbitrates whether it is malicious forwarding of a certain search user, and the specific steps are as follows:

[0048] When the data owner suspects that a certain image is illegally forwarded by a legal user, the data owner submits the suspicious image to the authorized agent center for arbitration:

[0049] The watermark embedding key k emb =(k emb1 ,k emb2 ,k emb3 ,AA) is used to obtain the set of blocks with embedded watermarks according to the position k emb1 of the embedded block; the obtained blocks with watermarks are grouped according to the random information k emb2 , and the first group AA0 and the second group AA1 are divided; the pixel values of the blocks with embedded watermarks in the first group AA0 are flipped by k emb3 to obtain a new block BB0, and then the pixel values of the blocks with embedded watermarks in the second group AA1 are flipped by kemb3 Flip the corresponding Bit to get a new block BB1;

[0050] The calculation formula of fluctuation value f is In the formula, p x,y The pixel value at the coordinate (x, y); calculate the fluctuation value f0 of the new block BB0 and the fluctuation value f1 of the new block BB1, and judge: if f0 > f1, it is considered that the new block BB0 is the original block before embedding the watermark, and the embedded watermark is 0; if f0 < f1, it is considered that the new block BB1 is the original block before embedding the watermark, and the embedded watermark is 1;

[0051] Repeat the above step until the complete watermark is extracted;

[0052] Compare the extracted watermark with the watermark of the legal user in the original image library: calculate the distance between the extracted watermark and the watermark of the legal user in the original image library, and judge:

[0053] If the distance is greater than the set threshold, it is determined that the image is the illegal forwarding of the legal user;

[0054] If the distance is less than or equal to the set threshold, it is determined that the image is not the illegal forwarding of the legal user.

[0055] The encryption image retrieval method provided by the application fuses access control and copyright protection in the cloud environment, filters a large number of invalid retrievals based on the access control technology of CP-ABE, and malicious retrievals cannot obtain retrieval results. Different access permissions are set for different sensitive data, and only the data with specific access attributes can access specific data categories. According to the difference of the retrieval user attributes, the data categories that the retrieval user can access are different. This has the advantage of better protecting the privacy of data; at the same time, a watermark-based copyright protection scheme is also proposed. Before the retrieval result is returned to the retrieval user, the cloud server embeds the watermark of the user into the returned result. When the data user suspects that a certain image is the malicious forwarding of the legal user, the suspected image is sent to the authorized center for arbitration by extracting the watermark. The extraction and embedding of the watermark is a new technical means. When embedding, it is no longer the fixed several bits of the pixel value, but a random information is used to determine, which better protects the privacy of data. At the same time, the original image before embedding the watermark is no longer needed when extracting the watermark, which reduces the consumption of data storage. Therefore, the application has high retrieval accuracy, can realize access control, and implements different retrieval permissions for different retrieval users, so that the data is better protected. Moreover, the malicious use of the retrieval result by the user can be effectively prevented, the copyright of the data owner is well protected, and the legal rights and interests of the data owner are protected. BRIEF DESCRIPTION OF DRAWINGS

[0056] Figure 1 The method flowchart of the method of the present application is shown.

[0057] Figure 2 The relationship diagram of each party in the method of the present application is shown. DETAILED DESCRIPTION

[0058] As Figure 1 The method flowchart of the method of the present application is shown, Figure 2 The relationship diagram of each party in the method of the present application is shown: the encrypted image retrieval method provided by the present application under the cloud environment fuses access control and copyright protection, and comprises the following steps:

[0059] S1. The data owner generates an encrypted key set and an access control key set; specifically comprising the following steps:

[0060] The data owner obtains the encrypted key set K={S, M1, M2, π, V, R, k img} by inputting the parameter ρ, wherein S is a random cutting vector for feature vector encryption, used for dividing the feature vector into two feature vectors, S is a d2-dimensional random V=(v1, v2,..., v d1 ) vector; M1 and M2 are both d2*d2-dimensional reversible matrices; π is a random sequence; V is a d1-dimensional vector, v j ∈[-ρ1, ρ1]; R is a d1-dimensional vector, and R=(r1, r2,..., r d1 ), r j ∈[-ρ2, ρ2]; ρ1 and ρ2 are random numbers and ρ1>>ρ2; k img is an image encryption key, used for encrypting the image; the key related to access control;

[0061] S2. The data owner generates an index structure and encrypts it, and the encrypted index structure is encrypted again by using CP-ABE to obtain the final ciphertext index structure, realizing access control; specifically comprising the following steps:

[0062] The image owner extracts image features through a pre-trained neural network; the measurement of similar images is measured by the similarity of the feature vectors corresponding to the two images, and the similarity of the feature vectors corresponding to the two similar images is very high; the image features and the images constitute a one-to-one index structure; but this one-to-one index structure is time-consuming; therefore, the present application proposes a class of images as a measurement standard of image similarity, and images with higher similarity are classified into a class;

[0063] During retrieval, the similarity between the retrieved image and the category label is first calculated to determine the category to which the retrieved image belongs; then, a one-to-one search is performed, and the similarity of the feature vectors is ranked to obtain a similarity ranking; the data owner extracts two feature vectors f from the image using a pre-trained neural network. i for The first feature vector f i (1) The second feature vector f is used to represent the category information to which the image belongs. i (2) Used to represent the feature information of the image; the first feature vector is clustered using the k-means clustering algorithm to obtain the cluster centers f. c,l for This allows images to be categorized based on similarity; then, based on the second feature vector f... i (2) Construct a mapping index structure that corresponds one-to-one between images and feature information;

[0064] These tasks are all completed in plaintext. For data security, the image index structure needs to be encrypted so that the index structure can obtain the similarity ranking between the retrieved image and the images in the image library even in encrypted form.

[0065] Encrypt the index structure:

[0066] The first feature vector f i (1) Cluster center f c,l Encryption is performed. The encryption process is as follows: First, the cluster centers are transformed by replacing all 0s with -1s to obtain the first intermediate variable. for Then the first intermediate variable Encryption yields a second intermediate variable Complete the encryption of the first segment of the index structure; encrypt the second segment of the feature vector f. i (2) The transformation is performed to obtain the third intermediate variable. for f i f i The modulus; then, through the segmentation vector S, the third intermediate variable... Cut into two random feature vectors and Where S[j]=0 and Equal, that is When S[j]=1 Encryption is performed using an invertible matrix to obtain the second segment of the encrypted feature vector. in is the transpose of the invertible matrix M1, is the transpose of the invertible matrix M2; finally, the encrypted index structure I' is

[0067] The encrypted index structure I' is encrypted by using the CP-ABE ciphertext policy; The data owner formulates different access trees according to different access permissions, encrypts different cluster centers by using different access trees, and controls access to different data categories by using different access structures; each access strategy controls one access structure, and only specific data categories with specific attributes can be accessed; the retrieval user has different retrieval permissions according to different attributes, and can access different data categories; this has the advantages of realizing different retrieval permissions for different data and realizing different levels of access settings for accessing data; only specific users have the access permission of specific data types; different retrieval users can only access specific data categories according to different attributes;

[0068] S3. The data owner encrypts the image data owned by himself according to the generated key set; specifically, the data owner processes the image into a grayscale image, and then encrypts the image data owned by himself by using the image encryption key k img

[0069] S4. The encrypted data obtained in step S3 and the final ciphertext index result obtained in step S2 are uploaded to the cloud server;

[0070] S5. The retrieval user registers with the authorized proxy center to obtain relevant attributes and keys, and the authorized proxy center generates a specific watermark of the user and a related key for embedding the watermark according to the ID of the user; a retrieval trapdoor is generated, and a retrieval request is sent to the cloud server; the watermark and the related key are sent to the cloud server; the specific steps include the following steps:

[0071] The retrieval user registers with the authorized center and obtains attributes and attribute-related attribute keys; meanwhile, the authorized proxy center generates a specific watermark of the user and a related key k emb emb1 emb2 emb3 AA) according to the ID of the user, and sends the watermark and the key for embedding the watermark to the cloud server;

[0072] The retrieval user sends a retrieval request to the cloud server; the user with access permission can obtain the encrypted index structure, and thus obtains the retrieval result;

[0073] The feature vector f of the retrieval image is extracted by using the same neural network as in step S2​​​​q For Transforming the vector to replace 0 with -1, a fourth intermediate variable is obtained q = (u q,1 , u q,2 ,..., u q,d1 ), a random sequence π and R, the fourth intermediate variable is encrypted to obtain For

[0074] The search user generates a new key W according to the received key set q For Transforming to obtain a fifth intermediate variable For Then, the fifth intermediate variable is split using the split vector S, when S[j] = 1, then and are two equal vectors When S[j] = 0, then and are cut into two random vectors and The same invertible matrix as in step S2 is used for encryption to obtain a sixth intermediate variable For δ is a random number;

[0075] Finally, the search trapdoor TD is obtained as

[0076] S6. The cloud server performs access permission authentication according to the search trapdoor obtained in step S5, and the search user decides the search permission according to its own attributes, decides the specific category of access according to its own unique attributes, and further performs image search; specifically including the following steps:

[0077] Confirm the access permission: the search process of the user without access permission ends here; the user with access permission can obtain the encrypted index structure, and the node values of the encrypted index structure obtained by different search users with different search permissions are different, that is, the accessible data categories are different, which are determined according to the search user's own attributes; different search users have different access permissions according to their different attributes, and can only access specific data categories, and then further search is continued;

[0078] The user with search permission performs search calculation: the search user first acquires category information, and calculates the distance between the encrypted first feature vector and the encrypted category center in the gallery using the following formula

[0079]

[0080] where mod is a modulo operation, is an exclusive or operation;

[0081] determining the size relationship between the calculated distance value and the set threshold value: if the distance value is less than the set threshold value, the current image is classified as the jthclass of image; otherwise, it is not classified as the image.

[0082] After the category to which the image belongs is searched, the similarity between the encrypted feature vector of the search image and the encrypted feature vector of the image in the image library is calculated using the following formula:

[0083]

[0084] where ||·|| is a modulus operator;

[0085] According to the calculation result of the similarity , the similarity ranking is obtained; then the images corresponding to the top several similarities are obtained as the image search result of the search user;

[0086] S7. The cloud server finds the corresponding watermark and the related embedded watermark key according to the watermark of the search user obtained from step S5, and embeds the watermark in the search result; specifically including the following steps:

[0087] The cloud server finds the corresponding watermark and the related key k emb = (k emb1 ,k emb2 ,k emb3 ,AA) according to the watermark of the search user obtained from step S5, and embeds the watermark in the search result;

[0088] The image obtained from step S6 is divided into non-overlapping blocks of AA*AA; the embedded watermark W is set as W = (w1, w2,..., w Nw ), and the embedded watermark W corresponds to the search user one by one; each watermark is randomly embedded in a block, and the position of the embedded block is represented as k emb1 ;

[0089] The pixel points in each selected block are randomly divided into a first group AA0and a second group AA1, and the random information is represented as k emb2 ;

[0090] The embedding process is as follows: if the current embedded watermark information w iIf w i = 0, flip the value of the pixel in the first group AA0; if w emb3 = 1, flip the value of the pixel in the second group AA1; when flipping, the last four bits of the pixel value are flipped randomly, and the random information is represented by k img ; the process of embedding is repeated until the watermark W is embedded completely, and the search result with embedded watermark is obtained;

[0091] S8. The search user obtains the corresponding search result with embedded watermark from the cloud server; specifically including the following steps:

[0092] The search user decrypts the received search result with embedded watermark using the image encryption key k img , and obtains the search result with embedded watermark corresponding to the search user;

[0093] S9. The authorized agent center extracts the watermark from the search result obtained in step S8 and arbitrates whether it is malicious forwarding by a certain search user; specifically including the following steps:

[0094] When the data owner suspects that a certain image is illegally forwarded by a legal user, the data owner submits the suspicious image to the authorized agent center for arbitration:

[0095] The watermark embedding key k emb = (k emb1 , k emb2 , k emb3 , AA) is used to obtain the set of blocks with embedded watermark according to the position k emb1 of the embedded block; the obtained watermark block is grouped according to the random information k emb2 ; the pixel values are grouped to obtain the first group AA0 and the second group AA1; the pixel values of the blocks with embedded watermark in the first group AA0 are flipped using k emb3 ; the corresponding Bit is flipped to obtain a new block BB0, and then the pixel values of the blocks with embedded watermark in the second group AA1 are flipped using k emb3 ; the corresponding Bit is flipped to obtain a new block BB1;

[0096] The calculation formula of the fluctuation value f is In the formula, p x,y is the pixel value at the (x, y) coordinate; the fluctuation value f0 of the new block BB0 and the fluctuation value f1 of the new block BB1 are calculated, and a judgment is made: if f0 > f1, it is considered that the new block BB0 is the original block before embedding the watermark, and the embedded watermark is 0; if f0 < f1, it is considered that the new block BB1 is the original block before embedding the watermark, and the embedded watermark is 1;

[0097] Repeat the previous step until the complete watermark is extracted;

[0098] The extracted watermark is compared with the watermark of the legal user in the original gallery: the distance between the extracted watermark and the watermark of the legal user in the original gallery is calculated, and a judgment is made:

[0099] If the distance is greater than a set threshold, the image is determined to be an illegal forwarding of the legal user;

[0100] If the distance is less than or equal to the set threshold, the image is determined not to be an illegal forwarding of the legal user.

Claims

1. A method for encrypted image retrieval with access control and copyright protection in a cloud environment, comprising the following steps: S1. A data owner generates a set of encryption keys and a set of access control keys; specifically comprising the following steps: The data owner obtains the encryption key set K = {S, M1, M2, π, V, R, k} by inputting parameter ρ. img }, where S is the random segmentation vector used for feature vector encryption, used to divide the feature vector into two feature vector segments. S is a d2-dimensional random vector V = (v1, v2, ..., v d1 ) vector; M1 and M2 are both d2*d2 dimensional invertible matrices; π is a random sequence; V is a d1 dimensional vector, v j ∈[-ρ1,ρ1]; R is a d1-dimensional vector, and R=(r1,r2,...,r d1 ), r j ∈[-ρ2,ρ2]; ρ1 and ρ2 are random numbers and ρ1 >> ρ2; k img Image encryption key, used to encrypt images; access control related key; S2. The data owner generates an index structure and encrypts it, and encrypts the encrypted index structure using CP-ABE to obtain a final ciphertext index structure, realizing access control; specifically comprising the following steps: In the retrieval, firstly, the retrieval image and the category label are subjected to similarity calculation to obtain the category to which the retrieval image belongs; then, one-to-one retrieval is performed, the similarity of the feature vectors is sorted, and the similarity ranking is obtained; the data owner extracts the two feature vectors f i For The first feature vector f i (1) is used to represent the category information to which the image belongs, and the second feature vector f i (2) is used to represent the feature information of the image; the first feature vector is subjected to clustering by using a k-means clustering algorithm to obtain a clustering center f c,l is Thus, the images are divided into different categories according to the similarity; then, according to the second feature vector f i (2) , a mapping index structure one-to-one corresponding to the images and the feature information is constructed; encrypting the index structure: The first segment of feature vector f i (1) The cluster center f c,l is encrypted, and the encryption process is as follows: first, the cluster center is transformed, and all 0s are replaced with -1 to obtain a first intermediate variable Then the first intermediate variable is encrypted to obtain a second intermediate variable The encryption of the first segment of the index structure is completed; the second segment of the feature vector f i (2) is transformed to obtain a third intermediate variable ||f i || is the modulus of f i ; then, by dividing the vector S, the third intermediate variable is cut into two random feature vectors and where when S[j] = 0 and are equal, when S[j] = 1 is encrypted using an invertible matrix to obtain the encrypted second segment of the feature vector where is the transpose of the invertible matrix M1, is the transpose of the invertible matrix M2; finally, the encrypted index structure I' is obtained as ​​​ Encrypting the index structure using CP-ABE ciphertext policy The data owner formulates different access trees according to different access permissions, encrypts different clustering centers by using different access trees, and controls access to different data categories by using different access structures; each access strategy controls one access structure, and only the data category with specific attributes can be accessed; the retrieval user has different retrieval permissions and can access different data categories; S3. The data owner encrypts the image data owned by itself according to the generated key set; S4. Upload the encrypted data obtained in step S3 and the final ciphertext index structure obtained in step S2 to the cloud server; S5. A retrieval user registers with an authorized agent center to obtain relevant attributes and keys, and the authorized agent center generates a specific watermark for the user and a related key for embedding the watermark according to the ID of the user; generates a retrieval trapdoor and sends a retrieval request to the cloud server; and sends the watermark and the related key to the cloud server; S6. The cloud server performs access permission authentication according to the retrieval trapdoor obtained in step S5, the retrieval user decides the retrieval permission according to its own attributes, decides the specific category of access according to its own attributes, and further performs image retrieval; S7. The cloud server obtains the corresponding watermark and the related key for embedding the watermark from step S5 according to the ID of the retrieval user, and embeds the watermark in the retrieval result; S8. The retrieval user obtains the corresponding retrieval result with the watermark from the cloud server; S9. The authorized agent center extracts the watermark from the retrieval result obtained in step S8 and arbitrates whether it is maliciously forwarded by a certain retrieval user. 2.The method of claim 1, wherein The data owner encrypts the image data owned by himself according to the generated key set, specifically, the data owner processes the image into a gray image, and then adopts the image encryption key k img The image data owned by himself is encrypted. 3.The method of claim 2, wherein In step S5, the retrieval user registers with the authorized agent center to obtain relevant attributes and keys, and the authorized agent center generates a specific watermark for the user and a related key for embedding the watermark according to the ID of the user; generates a retrieval trapdoor and sends a retrieval request to the cloud server; and sends the watermark and the related key to the cloud server, specifically comprising the following steps: The searching user registers to the authorized center and obtains the attribute and attribute-related attribute key; meanwhile, the authorized agent center generates the specific watermark of the user according to the ID of the user and the related key k of embedding the watermark emb = (k emb1 , k emb2 , k emb3 , AA), and transmits the watermark to the cloud server together with the key of embedding the watermark; The retrieval user sends a retrieval request to the cloud server; a user with access permission can obtain the encrypted index structure to obtain the retrieval result; The same neural network as in step S2 is used to extract the feature vector f of the search image q is Transforming the vector by replacing 0 with -1, a fourth intermediate variable is obtained q = (u q,1 , u q,2 ,..., u q,d1 ), a random sequence π and R, the fourth intermediate variable is encrypted to obtain is u q,j ∈ [-ρ1, ρ1] The search user generates a new key W according to the received key set q For Transforming to obtain the fifth intermediate variable For Then the fifth intermediate variable is segmented by using the segmentation vector S When S[j] = 1, then and are two equal vectors, When S[j] = 0, then and are cut into two random vectors and The same reversible matrix as in step S2 is used for encryption to obtain the sixth intermediate variable For δ is a random number; Finally, the trapdoor TD is obtained as 4. The encrypted image retrieval method of claim 3, wherein In step S6, the cloud server performs access permission authentication according to the retrieval trapdoor obtained in step S5, the retrieval user decides the retrieval permission according to its own attributes, decides the specific category of access according to its own attributes, and further performs image retrieval, specifically comprising the following steps: Confirm the access permission: The retrieval process of a user without access permission ends here; A user with access permission can obtain the encrypted index structure, and the node values of the encrypted index structure obtained by users with different retrieval permissions are different, the data categories that can be accessed are different, and are determined according to the attributes of the retrieval user; different retrieval users have different access permissions according to their different attributes, and can only access specific data categories, and then further retrieval is performed; The user with the searching right performs searching calculation: the searching user first acquires the category information, and calculates the distance between the encrypted first feature vector and the encrypted category center in the image library by using the following formula where mod is a modulo operation, is an exclusive OR operation; Judge the size relation between the calculated distance value and the set threshold value: if the distance value is less than the set threshold value, the current image is classified as the jth image; otherwise, it is not classified as the image After the category of the image is searched, the similarity between the encrypted feature vector of the searching image and the encrypted feature vector of the image in the image library is calculated by using the following formula: In the formula, ||| is a module length operator According to the calculation result of the similarity The similarity ranking is obtained by ranking the sizes of the similarities. The images corresponding to the top several similarities are obtained as the image retrieval result of the user.

5. The encrypted image retrieval method of claim 4, wherein The cloud server in step S7 finds the corresponding watermark and the key for embedding the watermark according to the watermark of the searching user obtained in step S5, and embeds the watermark in the searching result, and the specific steps include the following steps: The cloud server, according to the watermark and the related key k obtained from step S5, processes the search result obtained in step S6 according to the ID of the search user emb = (k emb1 , k emb2 , k emb3 , AA), and embeds the watermark in the search result; The image obtained in step S6 is divided into non-overlapping blocks of AA*AA; the embedded watermark W is set as W = (w1, w2,..., w Nw ), and the embedded watermark W corresponds to each user one by one; each watermark is randomly embedded in a block, and the position of the embedded block is represented as k emb1 ; The pixels in each selected block are randomly divided into a first group AA0 and a second group AA1, and the random information is represented as k emb2 ; The embedded process is: if the current embedded watermark information w i =0, then the value of the pixel point in the first group AA0 is flipped. If the current embedded watermark information w i = 1, the value of the pixel point in the second group AA1 is flipped; when flipping, the last four bits in the pixel value are randomly flipped, and the random information is represented by k emb3 The process of repeating embedding is performed until the watermark W is embedded, and the retrieval result of the embedded watermark is obtained.

6. The encrypted image retrieval method of claim 5, wherein The searching user in step S8 obtains the corresponding searching result with the watermark from the cloud server, and the specific steps include the following steps: The search user searches the received search result with the embedded watermark, using the image encryption key k img The decryption is performed to obtain the search result with the embedded watermark corresponding to the search user.

7. The encrypted image retrieval method of claim 6, wherein The authorized agent center in step S9 extracts the watermark according to the searching result obtained in step S8, and arbitrates whether the image is maliciously forwarded by the searching user, and the specific steps include the following steps: When the data owner suspects that an image is maliciously forwarded by a legal user, the data owner submits the suspicious image to the authorized agent center for arbitration: Using a watermark embedding key k emb = (k emb1 , AA), according to the position k emb2 of the embedded block emb3 , AA), according to the position k emb1 of the embedded block emb2 Group the pixel values, and divide to obtain a first group AA0 and a second group AA1; the pixel values of the blocks embedded with the watermark in the first group AA0 are flipped using k emb3 on the last four bits of the pixel values to obtain a new block BB0, and then the pixel values of the blocks embedded with the watermark in the second group AA1 are flipped using k emb3 on the last four bits of the pixel values to obtain a new block BB1; The formula for calculating the fluctuation value f is where p x,y The pixel value at coordinates (x, y); the fluctuation value f0 of the new block BB0 and the fluctuation value f1 of the new block BB1 are calculated, and a judgment is made: if f0 > f1, then the new block BB0 is considered to be the original block before the watermark is embedded, and the embedded watermark is 0; if f0 < f1, then the new block BB1 is considered to be the original block before the watermark is embedded, and the embedded watermark is 1; Repeat the previous step until the complete watermark is extracted; Compare the extracted watermark with the watermark of the legal user in the original image library: calculate the distance between the extracted watermark and the watermark of the legal user in the original image library, and judge: If the distance is greater than the set threshold value, the image is determined to be illegally forwarded by the legal user; If the distance is less than or equal to the set threshold value, the image is determined to be not illegally forwarded by the legal user.

Images