Multi-time server tre method and system based on secret sharing and homomorphic encryption

Abstract

The application provides a multi-time server TRE method and system based on secret sharing and homomorphic encryption. The method comprises the following steps: setting N time servers, each of which generates a Shamir secret sharing public and private key pair, a Paillier homomorphic encryption public and private key pair, and generates a private key share group containing N private key shares and sends the encrypted private key share group to a time server management institution; the time server management institution calculates a system public key and discloses the system public key, and calculates private key shares and sends the private key shares to the time servers; a receiver generates a private key by using an attribute ID of the receiver; a sender specifies and publishes a decryption time T and a ciphertext C corresponding to a plaintext M, and sends the ciphertext C to the receiver; the time servers calculate sub-time traps and periodically broadcast the sub-time traps to all system users; and the receiver decrypts the ciphertext C to obtain the plaintext M by using a private key of the receiver, at least t sub-time traps and system parameters at the decryption time T.

Description

Technical Field

[0001] The present invention relates to the field of time control encryption technology, and in particular to a multi-time server TRE method and system based on secret sharing and homomorphic encryption. Background Art

[0002] Timed-release encryption (TRE) is a cryptographic primitive with time characteristics. The sender sends an encrypted message to the future and specifies a decryption time T. The receiver can only decrypt the ciphertext at the specified decryption time T. This technology has important applications in time-sensitive real-world scenarios such as sealed bids, electronic confidential files, installment payments, and online competitions.

[0003] Currently, TRE construction methods proposed by researchers are generally based on a time server approach, categorized as either interactive or non-interactive. The former provides absolute publishing time, but because the data recipient must interact with the time server during decryption, it cannot guarantee the privacy of the sender and / or receiver. The latter, on the other hand, does not require user interaction with the time server, thus protecting user privacy. Most current TRE construction methods utilize the latter approach.

[0004] The security of the non-interactive single-time server TRE construction method relies solely on a single time server. If it is attacked from a single point or corrupted, the confidentiality of the information cannot be guaranteed. Therefore, researchers have attempted to "diverge" the single time server to multiple time servers, constructing a non-interactive multi-time server TRE method to improve the security and confidentiality of the TRE system. However, in the currently proposed multi-time server TRE encryption method, the prerequisite for the data receiver to be able to decrypt the data is to obtain the time trapdoor broadcast by all time servers at the specified time T. This places extremely high demands on the overall distribution of time trapdoors by multiple time servers. If a time server is attacked from a single point, or if some time servers fail, the ciphertext data cannot be decrypted on time.

[0005] Attribute-based encryption (ABE) is a new type of identity-based encryption (IBE) in which identity is treated as a set of descriptive attributes. In ABE, both the user's public key and the ciphertext are labeled with a set of descriptive attributes, and a specific private key can decrypt the ciphertext only when the attributes of the ciphertext match the target user's public key. Furthermore, the target receiving entity of the ABE cryptosystem is a user group, not a single user, and the exact identity of each member does not need to be known to the sender. As research develops, ABE schemes can provide increasingly powerful methods for achieving multi-recipient data security and fine-grained access control.

[0006] Patent document CN114422114A proposes three multi-time server TRE schemes. In Implementation Case 1, the receiver must use N sub-time trapdoors generated by all time servers to complete decryption. Therefore, if a time server is compromised by a single point of attack, or if even one time server fails, the ciphertext data cannot be decrypted on time. Implementation Case 2 uses Shamir secret sharing to address the issues of Implementation Case 1, but introduces third-party agents such as the time server management agency and the private key generator. If a dishonest receiver corrupts the time server management agency, they can obtain the time server management agency's private key, thereby recovering the main time trapdoor and decrypting the ciphertext before the specified time T. Similarly, if a dishonest receiver corrupts the private key generator to obtain the temporary public and private keys of the time server, it can obtain the time server private key, thereby restoring the master time trapdoor and decrypting the ciphertext before the specified time T. Implementation Case 3 attempts to use a random number to process the private key share distributed by the time server management agency. However, this random number is known to N time servers and can be obtained by corrupting only one time server, thereby obtaining the processed private key share, thereby restoring the master time trapdoor and decrypting the ciphertext before the specified time T. To address the problems existing in CN114422114A, the present invention proposes a multi-time server TRE method and system based on secret sharing and homomorphic encryption, which can ensure timely and secure decryption of ciphertext and is not easily attacked or cracked. Summary of the Invention

[0007] In response to the problems existing in the above-mentioned existing TRE schemes, such as being able to decrypt ciphertext information in advance or being unable to decrypt it on time, the present invention provides a multi-time server TRE method and system based on secret sharing and homomorphic encryption.

[0008] In one aspect, the present invention provides a multi-time server TRE method based on secret sharing and homomorphic encryption, comprising:

[0009] Step 1: Generate system parameters and make them public;

[0010] Step 2: Set up N time servers. Each time server generates its own Shamir secret sharing public-private key pair and publishes its own Shamir secret sharing public key. Then, it uses the Shamir secret sharing method to secretly share its own Shamir secret sharing private key to generate a private key share group containing N private key shares.

[0011] Each time server generates its own Paillier homomorphically encrypted public-private key pair and publishes its own Paillier homomorphically encrypted public key. It then uses the Paillier homomorphically encrypted public key of the corresponding time server to encrypt the corresponding private key share in the private key share group, and uses onion routing to send the private key share group ciphertext to the time server management agency.

[0012] Step 3: The time server management agency uses the N public Shamir secret shared public keys to calculate the system public key and publish it. Then, a private key share ciphertext is selected from each of the N private key share group ciphertexts obtained. Then, all selected private key share ciphertexts are calculated and the calculation results are sent to the corresponding time servers until all time servers receive a calculation result.

[0013] Step 4: Each time server uses its own Paillier homomorphic encryption private key to decrypt the received operation result and calculates its own time server public and private key based on the decryption result;

[0014] Step 5: The receiver uses its own attribute ID to generate its own private key;

[0015] Step 6: The sender specifies and announces the decryption time T, uses its own attribute ID′, the system public key, and system parameters to generate the ciphertext C corresponding to the plaintext M, and sends the ciphertext C to the receiver;

[0016] Step 7: Each time server uses its own time server private key and system parameters to calculate a sub-time trapdoor and periodically broadcasts it to all system users;

[0017] Step 8: The receiver uses its own private key, at least t sub-time trapdoors, and system parameters to decrypt the ciphertext C at decryption time T to obtain the plaintext M.

[0018] Furthermore, in step 1, generating system parameters specifically includes:

[0019] Set a safety factor κ, generate a prime number p, a p-order additive group G1, a p-order multiplicative group G2, and a bilinear map e: G1×G2→G2 based on the safety factor κ, and randomly select a generator P∈G1;

[0020] Choose a secure hash function H: {0, 1} * →G1;

[0021] Choose P1∈G1, P2=yP;

[0022] Select a fault tolerance parameter l;

[0023] Define the Lagrange coefficient

[0024] Thus, the system parameters params = {p, G1, G2, P, P1, P2, e, l, H} are obtained.

[0025] Furthermore, step 2 specifically includes:

[0026] Let the i-th time server be TS i , i=1, 2, 3, ..., N;

[0027] TS i Random selection As its own Shamir secret shared private key, calculate s i P shares the public key as its own Shamir secret;

[0028] TS i Select As the secret sharing polynomial coefficient, construct the t-1 degree Shamir secret sharing polynomial f(x) according to formula (1);

[0029]

[0030] Wherein, t represents the threshold value;

[0031] Based on Shamir secret sharing polynomial f(x), TS i According to the identity set D of N time servers = {d1, d2, ..., d N}, calculate the jth private key share slice in its own private key share group ij =f(d j ), j=1, 2, 3,...,N.

[0032] Furthermore, step 2 specifically includes:

[0033] TS i Randomly select two large prime numbers of equal length Satisfy gcd(p i q i ,(p i -1)(q i -1=1; gcd represents the function of finding the greatest common factor of two numbers;

[0034] Calculate n i =p i ·q i , g i =n i +1, thus getting TS i Paillier homomorphic encryption public key pk paillier =(n i , g i );

[0035] Calculating λ i =lcm(p i -1,q i -1) and μ i =(L(g i λ modn i 2 )) -1 modn i , thus obtaining TS i Paillier homomorphic encryption private key sk paillier =(λ i , μ i );in, lcm represents a function for finding the least common multiple of two numbers;

[0036] TS i According to formula (2), use TS j Paillier homomorphic encryption public key (n j , g j ) for the private key share slice ij Encrypt and obtain the corresponding private key share ciphertext c ij , j = 1, 2, 3, ..., N;

[0037]

[0038] Among them, r j Represents a random number;

[0039] Calculate V ij =slice ij P, Release <P,V ij >As a private key share slice ij signature;

[0040] TS i Using onion routing technology, the ciphertext c of the N private key shares generated ij Sent anonymously to the time server administration.

[0041] Furthermore, step 3 specifically includes:

[0042] The time server management agency selects the jth private key share ciphertext c from each of the N private key share group ciphertexts obtained. ij The time server management agency uses the selected N private key share ciphertexts to perform calculations according to formula (4), and calculates the calculation result ps j Send to TS j ;

[0043]

[0044] Correspondingly, step 4 specifically includes:

[0045] TS j Use your own Paillier homomorphic encryption private key (λ j , μ j ) Decrypt ps according to formula (5) j , thus obtaining TS j Time server private key and the public key

[0046]

[0047] in,

[0048] Furthermore, step 5 specifically includes:

[0049] Set the receiver's attribute ID = {v1, v2, ..., v n};in,

[0050] In finite fields Select a Lagrange interpolation polynomial F(·) of order l-1 above; where F(0) = y;

[0051] Calculate intermediate parameters

[0052] Get the recipient's private key

[0053] Furthermore, step 6 specifically includes:

[0054] Set the sender's attribute ID'={v'1, v'2, ..., v' n};in,

[0055] Let the intermediate parameter c1 = ID′;

[0056] Random selection Calculate the intermediate parameter c2 = σP and the intermediate parameter i=1,2....,n;and intermediate parameter C T =e(pk,σH(T))M and intermediate parameter c4=e(P1,P2) σ C T ; Among them, pk represents the system public key;

[0057] Finally get the ciphertext

[0058] Send the ciphertext C to the receiver.

[0059] Furthermore, step 7 specifically includes:

[0060] Let the i-th time server be TS i , i=1, 2, 3, ..., N;

[0061] At the specified decryption time T, TS i Calculate and periodically broadcast sub-time trapdoors in, Indicates TS i The time server private key.

[0062] Furthermore, step 8 specifically includes:

[0063] Select Collection and |W|=l;

[0064] Select t sub-time trapdoors from the sub-time trapdoors issued by N time servers to form a sub-time trapdoor set STs, and record the corresponding time server identities to form a time server identity set Xs = {x1, x2, ..., x t};

[0065] Calculate the main time trapdoor based on STs and Xs

[0066] Using the main time trapdoor S T and private key U ID Calculated Then get the plaintext

[0067] On the other hand, the present invention provides a multi-time server TRE system based on secret sharing and homomorphic encryption, comprising: N time servers, a time server management agency, a sender, and a receiver;

[0068] The time server is configured to generate its own Shamir secret sharing public-private key pair and disclose its own Shamir secret sharing public key; and then use the Shamir secret sharing method to perform secret sharing on its own Shamir secret sharing private key to generate a private key share group including N private key shares;

[0069] It is used to generate its own Paillier homomorphically encrypted public-private key pair and publish its own Paillier homomorphically encrypted public key; then it uses the Paillier homomorphically encrypted public key of the corresponding time server to encrypt the corresponding private key share in the private key share group, and uses onion routing to send the private key share group ciphertext to the time server management agency;

[0070] It is used to decrypt the received operation results using its own Paillier homomorphic encryption private key, and calculate its own time server public and private keys based on the decrypted results;

[0071] And, used to calculate a sub-time trapdoor using its own time server private key and system parameters, and periodically broadcast it to all system users;

[0072] The time server management mechanism is configured to calculate a system public key using the N publicly disclosed Shamir secret shared public keys and disclose the public key; then select a private key share ciphertext from each of the N private key share group ciphertexts obtained; then perform calculations on all the selected private key share ciphertexts, and send the calculation results to the corresponding time servers until all time servers receive a calculation result;

[0073] The receiver is configured to generate its own private key using its own attribute ID; and to decrypt the ciphertext C at decryption time T using its own private key, at least t sub-time trapdoors, and system parameters to obtain the plaintext M;

[0074] The sender specifies and announces the decryption time T, uses the attribute ID′, the system public key, and the system parameters to generate the ciphertext C corresponding to the plaintext M, and sends the ciphertext C to the receiver.

[0075] Beneficial effects of the present invention:

[0076] (1) In a single time server scenario, if a dishonest receiver / attacker wants to decrypt ciphertext before the decryption time arrives, they only need to corrupt one time server. The present invention "diversifies" a single time server to multiple time servers, so the dishonest receiver / attacker needs to corrupt multiple time servers to achieve their goal. If the number of time servers is appropriately set, the more time servers there are, the greater the bribe cost for the dishonest receiver / attacker, greatly improving the security of the present invention.

[0077] (2) In some multi-time server scenarios, the requirement for multiple time servers to publish time trapdoors is extremely high. If one or a small number of time servers experience downtime or other failures, it is impossible to ensure that the data recipient can decrypt the data on time. This invention introduces Shamir's secret sharing technology. When the number of time trapdoors broadcast by the time server broadcast by the data recipient exceeds or equals the threshold number, decryption can be completed. This can effectively resist the single point failure problem of the non-interactive multi-time server TRE model.

[0078] (3) In existing time server solutions, the system public and private keys are generated by the time server management agency. If the time server management agency is untrustworthy, a dishonest receiver / attacker only needs to bribe the time server management agency to obtain the master time trapdoor, thereby being able to decrypt the ciphertext in advance. The present invention introduces Paillier homomorphic encryption technology. N time servers each generate Shamir secret shared public and private keys and private key shares. The system Shamir secret shared public and private keys and private key shares are synthesized using the Paillier homomorphic addition feature, ensuring that all entities in the method proposed by the present invention are unaware of the system private key. In this way, a dishonest receiver / attacker can only decrypt in advance by bribing N time servers. Therefore, the security of the solution of the present invention is stronger. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 A schematic diagram of a multi-time server TRE method based on secret sharing and homomorphic encryption provided in an embodiment of the present invention;

[0080] Figure 2 A schematic diagram of a time server management agency receiving a ciphertext of a private key share group provided by an embodiment of the present invention;

[0081] Figure 3 A schematic diagram of the structure of a multi-time server TRE system based on secret sharing and homomorphic encryption provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0082] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0083] Example 1

[0084] like Figure 1 As shown, an embodiment of the present invention provides a multi-time server TRE method based on secret sharing and homomorphic encryption (SSAP-TRE method for short), including:

[0085] S101: Generate system parameters and make them public;

[0086] Specifically, a safety factor κ is set, and based on the safety factor κ, a prime number p, a p-order additive group G1, a p-order multiplicative group G2, and a bilinear map e: G1×G2→G2 are generated; a generator P∈G1 is randomly selected; and a secure hash function H is selected: {0, 1} * →G1; select P1∈G1, P2=yP;Select a fault tolerance parameter l;Define the Lagrange coefficient Thus, the system parameters params = {p, G1, G2, P, P1, P2, e, l, H} are obtained.

[0087] S102: N time servers are set up, each of which generates its own Shamir secret sharing public-private key pair and publishes its own Shamir secret sharing public key; then, the Shamir secret sharing method is used to perform secret sharing on its own Shamir secret sharing private key to generate a private key share group containing N private key shares;

[0088] Specifically, the i-th time server is recorded as TS i ,i=1,2,3,...,N; with TS i For example, this step specifically includes:

[0089] S1021:TS i Random selection As its own Shamir secret shared private key, calculate s i P shares the public key as its own Shamir secret;

[0090] S1022:TS i Select As the secret sharing polynomial coefficients, and construct the t-1 degree Shamir secret sharing polynomial f(x) according to formula (1);

[0091]

[0092] Where t represents the threshold, that is, any time trapdoor greater than or equal to t from N time trapdoors can recover the secret;

[0093] S1023: Based on the constructed Shamir secret sharing polynomial f(x), TS i According to the identity set D of N time servers = {d1, d2, ..., d N}, calculate the jth private key share slice in its own private key share group ij =f(d j ), j = 1, 2, 3, ..., N; thus, TS i The private key share group {slice i1 , slice i2 , slice i3 , ..., slice iN}.

[0094] Each time server generates its own Paillier homomorphically encrypted public-private key pair and publishes its own Paillier homomorphically encrypted public key. It then uses the Paillier homomorphically encrypted public key of the corresponding time server to encrypt the corresponding private key share in the private key share group, and uses onion routing to send the private key share group ciphertext to the time server management agency.

[0095] Specifically, TS i For example, this step specifically includes:

[0096] S1024:TS i Randomly select two large prime numbers of equal length Satisfy gcd(p i q i ,(p i -1qi-1=1; gcd represents the function of finding the greatest common factor of two numbers;

[0097] Calculate n i =p i ·q i , g i =n i +1, thus getting TS i Paillier homomorphic encryption public key (n i , g i );

[0098] Calculating λi =lcm(p i -1,q i -1) and μ i =(L(g i λ modn i 2 )) -1 modn i , thus obtaining TS i Paillier homomorphic encryption private key (λ i , μ i );in, lcm represents a function for finding the least common multiple of two numbers;

[0099] S1025:TS i According to formula (2), use TS j Paillier homomorphic encryption public key (n j , g j ) for the private key share slice ij Encrypt and obtain the corresponding private key share ciphertext c ij ;

[0100]

[0101] Among them, r j Represents a random number;

[0102] By analogy, TS i The private key share group {slice i1 , slice i2 , slice i3 , ..., slice iN} corresponds to the private key share group ciphertext {c i1 , c i2 , c i3 ,...,c iN};

[0103] To further ensure the validity of the private key share, this step also includes: calculating V ij =slice ij P, Release <P,V ij >As a private key share slice ij signature;

[0104] S1026:TS i Using onion routing technology, the ciphertext c of the N private key shares generated ij Sent anonymously to the time server administration.

[0105] S103: The time server management agency calculates the system public key using the N public Shamir secret shared public keys and makes it public. A private key share ciphertext is then selected from each of the N private key share group ciphertexts obtained. An addition operation is then performed on all the selected private key share ciphertexts, and the addition result is sent to the corresponding time server until all time servers receive an addition result.

[0106] Specifically, it includes the following sub-steps:

[0107] S1031: The time server management agency calculates the system public key pk according to formula (3);

[0108]

[0109] Among them, pk i Indicates TS i Shamir Secret Shared Public Key, TS i Represents the i-th time server.

[0110] S1032: The time server management agency receives N private key share group ciphertexts from N time servers (such as Figure 2 As shown, Figure 2 In the example, the i-th row represents the time server TS i The N private key share ciphertexts generated, column j represents the ciphertext used to synthesize the time server TS j The result of the operation ps j N private key share ciphertexts of the obtained N private key share group ciphertexts); select the jth private key share ciphertext c from each private key share group ciphertext in the obtained N private key share group ciphertexts ij , get N private key share ciphertexts: c 1j , c 2j , c 3j ,...,c Nj ;

[0111] Then the selected N private key share ciphertexts are calculated according to formula (4); finally, the calculation result ps j Send to TS j , TS j represents the jth time server;

[0112]

[0113] S104: Each time server uses its own Paillier homomorphic encryption private key to decrypt the received addition operation result, and calculates its own time server public and private key based on the decryption result;

[0114] Specifically, TS jFor example, TS j uses its own Paillier homomorphism encryption private key (λ j , μ j ) to decrypt the operation result ps j received by it according to formula (5), to obtain the decryption result slice j ;

[0115]

[0116] Wherein,

[0117] Thus, the time server private key of TSj is obtained, and the time server public key of TS j is obtained

[0118] Correspondingly, in order to ensure the validity of the private key share signature, this step further includes: TS j calculates e (P, V j1 ) · e (P, V j2 ) · e (P, V j3 ) ··· e (P, V jN ) If the calculation result is equal to , it proves that the signature is valid.

[0119] Based on the above, the N decryption results obtained by the N time servers can finally be expressed as formula (6):

[0120]

[0121] S105: The receiver generates its own private key using its own attribute ID;

[0122] Specifically, set the attribute UD of the receiver = {v1, v2,..., v n}; wherein, select an l-1 order Lagrange interpolation polynomial F (·) on a finite field ; wherein, F (0) = y; calculate the intermediate parameter to obtain the private key of the receiver

[0123] S106: The sender specifies and publishes the decryption time T ∈ {0, 1} * , using its own attribute ID', system public key and system parameters, generates the ciphertext C corresponding to the plaintext M, and sends the ciphertext C to the receiver;

[0124] Specifically, set the attribute ID' of the sender = {v'1, v'2,..., v' n}; wherein, Let the intermediate parameter c1 = ID'; randomly select Calculate the intermediate parameter c2 = σP and the intermediate parameter and the intermediate parameter C T =e(pk,σH(T))M and intermediate parameter c4=e(P1,P2) σ C T ; Among them, p k Represents the system public key; finally obtain the ciphertext Send the ciphertext C to the receiver.

[0125] S107: Each time server uses its own time server private key and system parameters to calculate a sub-time trapdoor, and periodically broadcasts it to all system users;

[0126] Specifically, TS i For example, TS i Sub-time trapdoor in, Indicates TS i The time server private key; in this embodiment, therefore,

[0127] S108: The receiver uses its own private key, at least t sub-time trapdoors, and system parameters to decrypt the ciphertext C at decryption time T to obtain the plaintext M;

[0128] Specifically, it includes the following sub-steps:

[0129] S1081: The receiver receives the ciphertext C and selects the set and |W|=l;

[0130] S1082: Select t sub-time trapdoors from the sub-time trapdoors issued by N time servers to form a sub-time trapdoor set STs, and record the corresponding time server identities to form a time server identity set Xs = {x1, x2, ..., x t}; It can be understood that Xs is a subset of set D.

[0131] S1083: Calculate the main time trapdoor based on STs and Xs

[0132] use The derivation process of this formula for solving the main time trapdoor is as follows: the selected t sub-time trapdoors are denoted as slice1′, slice2′, slice3′, ..., slice t′, then there exists: slice1′=slice1·H(T), slice2′=slice2·H(T),…, slice t ′=slice t ·H(T); Based on the above formula (6), we can get formula (7), which shows that: The solution formula for the main time trapdoor is valid.

[0133]

[0134] S1084: Using the main time trapdoor S T and private key U ID Calculated Then get the plaintext

[0135] Example 2

[0136] The embodiment of the present invention provides a multi-time server TRE system based on secret sharing and homomorphic encryption (abbreviated as SSAP-TRE system), such as Figure 3 As shown, it includes: N time servers, a time server management agency, a sender and a receiver;

[0137] The time server is configured to generate its own Shamir secret sharing public-private key pair and disclose its own Shamir secret sharing public key; and then use the Shamir secret sharing method to perform secret sharing on its own Shamir secret sharing private key to generate a private key share group including N private key shares;

[0138] It is used to generate its own Paillier homomorphically encrypted public-private key pair and publish its own Paillier homomorphically encrypted public key; then it uses the Paillier homomorphically encrypted public key of the corresponding time server to encrypt the corresponding private key share in the private key share group, and uses onion routing to send the private key share group ciphertext to the time server management agency;

[0139] Used to decrypt the received addition result using its own Paillier homomorphic encryption private key, and calculate its own time server public and private keys based on the decrypted result;

[0140] And, used to calculate a sub-time trapdoor using its own time server private key and system parameters, and periodically broadcast it to all system users;

[0141] The time server management mechanism is configured to calculate a system public key using the N publicly disclosed Shamir secret shared public keys and disclose the calculated public key; then select a private key share ciphertext from each of the N obtained private key share group ciphertexts; then perform a calculation on all the selected private key share ciphertexts, and send the calculation results to the corresponding time servers until all time servers receive a calculation result;

[0142] The receiver is configured to generate its own private key using its own attribute ID; and to decrypt the ciphertext C at decryption time T using its own private key, at least t sub-time trapdoors, and system parameters to obtain the plaintext M;

[0143] The sender specifies and announces the decryption time T, uses the attribute ID′, the system public key, and the system parameters to generate the ciphertext C corresponding to the plaintext M, and sends the ciphertext C to the receiver.

[0144] It should be noted that the TRE system provided in the embodiment of the present invention is for implementing the above method. Its specific functions can be referred to the above method embodiment and will not be described in detail here.

[0145] Example 3

[0146] In order to verify the performance of the method and system of the present invention, the present invention also conducted the following experiments.

[0147] (1) Calculation time statistics

[0148] It should be noted that only the computational time of the data encryption phase and the data decryption phase is counted, and the computational cost of other phases is not counted (these can be completed in advance and are not included in the statistical scope). p (p is a 512-bit prime number) and the supersingular elliptic curve is y 2 =x 3 +1(modp), the prime order q is 160 digits, and the bilinear mapping uses Tate pairs. Based on the open source large number operation library MIRACL in cryptography, the above basic operations are implemented, and the PM ec The approximate ratio method of basic operations is used to record the time consumption of other basic operations, and the relative time consumption table of basic operations is obtained. BP, PA ec , Add, Sub, Mul, Div and Hash operations relative to PM ec The computation time is shown in Table 1.

[0149] Table 1 Relative to PM ec Other operation time statistics table

[0150]

[0151] In Table 1, BP represents bilinear pairing operation; PM ec and PA ec Represents point multiplication and addition operations on the elliptic curve group; Add, Sub, Mul, and Div represent Modular addition, modular subtraction, modular multiplication and modular division operations on G1; Hash represents a hash function that maps a binary string of 0s and 1s of any length to an element on the G1 group.

[0152] Operating environment settings: Intel(R) Core(TM) i5-7500CPU 3.40GHz processor, 64-bit PC host, 8GB memory, Microsoft Visual Studio 2017. 987654321 is used as the random number seed, and PM is executed once after running the program. ec The operation time is approximately 1.5208 milliseconds.

[0153] In the data encryption phase of the present invention, running the Enc algorithm requires the following: 1 PM ec Operation σP, n PM ec Operation σ(P1+H(ν i '))(where (P1+H(ν i ′) can be calculated in advance and is not counted here), where i = 1, 2, ..., n. 1 Hash, 1 PM ec , 1 BP and 1 PA ec Operation C T =e(pk,σH(T))M, 1 PM ec and 1 PA ec Operation e(P1, P2) σ C T , (where e(P1, P2) can be calculated in advance and is not counted here). In the sub-time trapdoor release phase, running the TS_Rel algorithm requires completing: 1 Hash and 1 PM ec Operation

[0154] In the data decryption phase, the Dec algorithm needs to complete: 2t*(t-1) Sub, 2t*(t-2) Mul, t Div, t PM ec and (t-1) PAs ec Operation Total (2t 2 -2t)·Sub+(2t 2 -4t)·Mul+t·Div+(t-1)·PA ec +tPM ec ; 2(l-1) times Sub, 2(l-1) times Mul, 1 time Div, 1 time PMec Operation The above operation needs to be performed l times, and (l-1) times PA ec , a BP operation Total (2l 2 -2l)·Sub+(2l 2 -2l)·Mul+l·Div+(l-1)·PA ec +l·PM ec +BP; 2(l-1) times Sub, 2(l-1) times Mul, 1 time PM ec Operation 1 BP operation The above operation needs to be performed l times, and (l-1) times PA ec Total (2l 2 -2l)·Sub+(2l 2 -2l)·Mul+l·Div+(l-1)·PA ec +l·PM ec +1·BP. Requires 1 PA ec Operation 1 PA required ec , 1 BP operation

[0155] The statistical results of the time consumption of each stage and the total time consumption are shown in Table 2.

[0156] Table 2 Time consumption of the present invention

[0157]

[0158] Assume there are 10 time servers, set n = 5, l = 3, and t = 6. The computation takes 43.2393 seconds, which corresponds to a real time of 0.06 seconds.

[0159] (2) Safety analysis

[0160] The proposed SSAP-TRE method assumes that the selected time server authority and time servers are both "honest and curious," and that they all provide services according to the rules. They do not actively collude with each other, but each attempts to recover the master time trapdoor from the information it receives, in order to decrypt the ciphertext in advance.

[0161] (1) The probability that the time server and the time server management mechanism mentioned in the present invention can recover the system master time trapdoor is negligible.

[0162] For the time server, N time servers are used in the method of the present invention, wherein each time server only knows a set of Shamir secret sharing public-private key pairs and Shamir secret sharing private key shares generated by the time server, and according to its own responsibilities, uses onion routing technology to anonymously send the encrypted private key shares to the time server management agency. It is difficult for the time server itself to know the Shamir secret sharing public-private key pairs and Shamir secret sharing private key shares generated by other time servers.

[0163] For the time server management agency, it will perform homomorphic addition operations on the ciphertexts of the N groups of partial private key shares. Since the security of the Paillier encryption method can be reduced to the Decisional Composite Residuosity Assumption (DCRA), that is, given a composite number n and an integer z, it is determined whether z is in n. 2 It is difficult to determine whether it is an n-times remainder, so the time server management agency cannot decipher N groups of private key shares, and cannot obtain the main time trapdoor.

[0164] (2) The probability of a dishonest receiver decrypting in advance in the present invention is negligible.

[0165] In the method of the present invention, the important component of the main time trapdoor is The master time trapdoor is generated by N time servers. A dishonest receiver who wishes to recover the master time trapdoor would need to corrupt all of them, a difficult, if not impossible, task. Furthermore, given the current difficulties of ECDLP and BDH, it is extremely difficult for an unsophisticated receiver to decrypt the ciphertext before the specified time, given the known system public key, the specified decryption time T, their own private key, and the system's public parameters.

[0166] (3) The intermediate data in the present invention is verifiable.

[0167] Since the partial public keys generated by all time servers in the present invention are public, the time servers can calculate And calculate whether it is equal to pk, so that the public key pk is verifiable. The time server successfully decrypts After that, we can calculate e(P, V i1 )·e(P,V i2 )·e(P,V i3 )·····e(P,V iN ) is equal to Make The sub-time trapdoor is generated by the public hash function, the specified decryption time and the time server private key. Its security relies on the ECDLP problem, that is, given a point P on an elliptic curve and an integer n, it is difficult to calculate the point Q on the elliptic curve such that P = nQ. When the time server TS i Regularly broadcast the time trapdoor s to the data receiver i H(T), the data receiver can use bilinear calculation and comparison Are they equal? ​​Make the time trap obtained Verifiability. The verifiability of intermediate data can, to a certain extent, resist attackers from intercepting and tampering with the data, and can also effectively detect whether the transmitted data bit stream has been damaged by factors such as noise.

[0168] (4) In the present invention, the data receiver receives the time traps broadcast by the time server at the specified time T, and can arbitrarily select no less than t time traps from them to achieve decryption.

[0169] In similar multi-time server TRE encryption methods, the data receiver must obtain the time trapdoors broadcast by all time servers at a specified time T in order to decrypt the data. If a time server is compromised by a single point of attack, or if some time servers fail, the ciphertext data cannot be decrypted on time. In this method, decryption requires only at least t time trapdoors, greatly increasing the practicality of the multi-time server TRE encryption method.

[0170] (5) Compared with the general TOR method, the present invention has stronger robustness.

[0171] The goal of this invention is to send a request to a time server and promptly receive a trapdoor back to decrypt the message. If a malicious attacker attempts a brute force attack, their success is limited by a timeframe; the attacker must complete the decryption within a specified timeframe. However, if an attacker attempts to achieve their goal by maliciously destroying certain nodes, the broadcast encryption technology of this invention can address this issue. Even if one or more nodes are destroyed, the present invention can automatically reconstruct the path using alternate nodes without requiring re-encryption.

[0172] In summary, this method has achieved the following improvements in safety compared to the method disclosed in patent document CN114422114A:

[0173] (1) Implementation Example 1 of the method disclosed in Patent Document CN114422114A has very high requirements for the joint operation of time servers. As long as one time server is attacked or "corrupted", decryption cannot be carried out on time.

[0174] In this method, the Shamir secret sharing technology is introduced, and the user only needs to obtain a time trap equal to or greater than the threshold value to complete the decryption work.

[0175] (2) Implementation Example 2 of the method disclosed in patent document CN114422114A requires the temporary public and private keys of the time server when transmitting the private key share. The temporary public and private keys are generated by the private key generator and transmitted to the time server. If the private key generator is "corrupted" and the temporary public and private keys are leaked, the attacker can use the temporary public and private keys to decrypt the private key share, thereby restoring the main time trapdoor, and then the ciphertext can be decrypted before the decryption time T is reached. Although Implementation Example 3 of the method disclosed in CN114422114A proposes to introduce a random number to generate a new public and private key pair, the random number is known to N time servers and can be obtained by bribing one time server. In addition, Implementation Examples 2 and 3 of the method disclosed in CN114422114A do not provide relevant algorithms for verifying whether the temporary private key has been damaged by factors such as noise during the transmission process, causing the bit stream data to be damaged.

[0176] In this method, the private key generator entity is removed, and the public and private keys of the Paillier homomorphic encryption used in the transmission of some private key shares are generated by the time server itself within the range specified by the system, so the above phenomenon will not occur.

[0177] (3) In the implementation case 2 of the method disclosed in patent document CN114422114A, the private key of the time server management agency (i.e., an important component of the main time trapdoor, s in implementation case 2, i.e., the private key of the time server management agency) and the private key of the time server are generated by the time server management agency. If the time server management agency is "corrupted" or the time server management agency proactively discloses its private key information to the data receiver, the data receiver can restore the main time trapdoor and decrypt the ciphertext before the decryption time T is reached. Although implementation case 3 of the method disclosed in CN114422114A proposes to introduce a random number to generate a new time server private key, the random number is known to N time servers, and the random number can be obtained by bribing one time server.

[0178] In this method, the main time trapdoor is composed of It is generated by N time servers. The time server management organization is solely responsible for performing homomorphic operations on the ciphertext. If a dishonest recipient wishes to decrypt the ciphertext before the specified decryption time T, they would need to corrupt all N time servers, which is theoretically difficult to achieve.

[0179] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A multi-time server TRE method based on secret sharing and homomorphic encryption, characterized in that: include: Step 1: Generate system parameters and make them public; Step 2: Set up N time servers. Each time server generates its own Shamir secret sharing public-private key pair and publishes its own Shamir secret sharing public key. Then, it uses the Shamir secret sharing method to secretly share its own Shamir secret sharing private key to generate a private key share group containing N private key shares. Each time server generates its own Paillier homomorphically encrypted public-private key pair and publishes its own Paillier homomorphically encrypted public key. It then uses the Paillier homomorphically encrypted public key of the corresponding time server to encrypt the corresponding private key share in the private key share group, and uses onion routing to send the private key share group ciphertext to the time server management agency. Step 3: The time server management agency uses the N public Shamir secret shared public keys to calculate the system public key and publish it. Then, a private key share ciphertext is selected from each of the N private key share group ciphertexts obtained. Then, all selected private key share ciphertexts are calculated and the calculation results are sent to the corresponding time servers until all time servers receive a calculation result. Step 4: Each time server uses its own Paillier homomorphic encryption private key to decrypt the received operation result and calculates its own time server public and private key based on the decryption result; Step 5: The receiver uses its own attribute ID to generate its own private key; Step 6: The sender specifies and announces the decryption time T, uses its own attribute ID′, the system public key, and system parameters to generate the ciphertext C corresponding to the plaintext M, and sends the ciphertext C to the receiver; Step 7: Each time server uses its own time server private key and system parameters to calculate a sub-time trapdoor and periodically broadcasts it to all system users; Step 8: The receiver uses its own private key, at least t sub-time trapdoors, and system parameters to decrypt the ciphertext C at decryption time T to obtain the plaintext M.

2. The multi-time server TRE method based on secret sharing and homomorphic encryption according to claim 1 is characterized in that: In step 1, generating system parameters specifically includes: Set a safety factor κ, generate a prime number p, a p-order additive group G1, a p-order multiplicative group G2, and a bilinear map e:G1×G2→G2 based on the safety factor κ, and randomly select a generator P∈G1; Choose a secure hash function H: {0,1} * →G1; choose P2=yP; Select a fault tolerance parameter l; Define the Lagrange coefficient Thus, the system parameters params = {p, G1, G2, P, P1, P2, e, l, H} are obtained.

3. The multi-time server TRE method based on secret sharing and homomorphic encryption according to claim 2 is characterized in that: Step 2 specifically includes: Let the i-th time server be TS i , i=1,2,3,…,N; TS i Random selection As its own Shamir secret shared private key, calculate s i P shares the public key as its own Shamir secret; TS i Select As the secret sharing polynomial coefficient, construct the t-1 degree Shamir secret sharing polynomial f(x) according to formula (1); Wherein, t represents the threshold value; Based on Shamir secret sharing polynomial f(x), Ts i According to the identity set D of N time servers = {d1, d2, ..., d N }, calculate the jth private key share slice in its own private key share group ij =f(d j ), j=1,2,3,…,N.

4. The multi-time server TRE method based on secret sharing and homomorphic encryption according to claim 3 is characterized in that: Step 2 specifically also includes: TS i Randomly select two large prime numbers of equal length Satisfy gcd(p i q i ,(p i -1)(q i -1))=1; gcd represents the function of finding the greatest common factor of two numbers; Calculate n i =p i ·q i , g i =n i +1, thus getting TS i Paillier homomorphic encryption public key pk paillier =(n i ,g i ); Calculating λ i =lcm(p i -1,q i -1) and μ i =(L(g i λ mod n i 2 )) -1 mod n i , thus obtaining TS i Paillier homomorphic encryption private key sk paillier =(λ i ,μ i );in, lcm represents a function for finding the least common multiple of two numbers; TS i According to formula (2), use TS j Paillier homomorphic encryption public key (n j ,g j ) for the private key share slice ij Encrypt and obtain the corresponding private key share ciphertext c ij , j=1,2,3,…,N; Among them, r j Represents a random number; Calculate V ij =slice ij P, Release <P,V ij >As a private key share slice ij signature; TS i Using onion routing technology, the ciphertext c of the N private key shares generated ij Sent anonymously to the time server administration.

5. The multi-time server TRE method based on secret sharing and homomorphic encryption according to claim 4 is characterized in that: Step 3 specifically includes: The time server management agency selects the jth private key share ciphertext c from each of the n private key share group ciphertexts obtained. ij The time server management agency uses the selected N private key share ciphertexts to perform calculations according to formula (4), and calculates the calculation result ps j Send to TS j ; Correspondingly, step 4 specifically includes: TS j Use your own Paillier homomorphic encryption private key (λ j ,μ j ) Decrypt ps according to formula (5) j , thus obtaining TS j Time server private key and the public key in, 6. The multi-time server TRE method based on secret sharing and homomorphic encryption according to claim 5 is characterized in that: Step 5 specifically includes: Set the receiver's attribute ID = {v1, v2, ..., v n };in, In finite fields Select a Lagrange interpolation polynomial F(·) of order l-1 above; where F(0) = y; Calculate intermediate parameters Get the recipient's private key 7. The multi-time server TRE method based on secret sharing and homomorphic encryption according to claim 6 is characterized in that: Step 6 specifically includes: Set the sender's attribute ID' = {v'1, v'2, ..., v' n };in, Let the intermediate parameter c1 = ID′; Random selection Calculate the intermediate parameter c2 = σP and the intermediate parameter i=1,2…,n; and intermediate parameter C T =e(pk,σH(T))M and intermediate parameter c4=e(P1,P2) σ C T ; Among them, pk represents the system public key; Finally get the ciphertext Send the ciphertext C to the receiver.

8. The multi-time server TRE method based on secret sharing and homomorphic encryption according to claim 2 is characterized in that: Step 7 specifically includes: Let the i-th time server be TS i , i=1,2,3,…,N; At the specified decryption time T, TS i Calculate and periodically broadcast sub-time trapdoors in, Indicates TS i The time server private key.

9. The multi-time server TRE method based on secret sharing and homomorphic encryption according to claim 7 is characterized in that: Step 8 specifically includes: Select Collection and |W|=l; Select t sub-time trapdoors from the sub-time trapdoors issued by N time servers to form a sub-time trapdoor set STs, and record the corresponding time server identities to form a time server identity set Xs = {x1, x2, ..., x t }; Calculate the main time trapdoor based on STs and Xs Using the main time trapdoor S T and private key U ID Calculated c4, and then get the plaintext 10. A multi-time server TRE system based on secret sharing and homomorphic encryption, characterized in that: include: N time servers, a time server management organization, a sender, and a receiver; The time server is configured to generate its own Shamir secret sharing public-private key pair and disclose its own Shamir secret sharing public key; and then use the Shamir secret sharing method to perform secret sharing on its own Shamir secret sharing private key to generate a private key share group including N private key shares; It is used to generate its own Paillier homomorphically encrypted public-private key pair and publish its own Paillier homomorphically encrypted public key; then it uses the Paillier homomorphically encrypted public key of the corresponding time server to encrypt the corresponding private key share in the private key share group, and uses onion routing to send the private key share group ciphertext to the time server management agency; It is used to decrypt the received operation results using its own Paillier homomorphic encryption private key, and calculate its own time server public and private keys based on the decrypted results; And, used to calculate a sub-time trapdoor using its own time server private key and system parameters, and periodically broadcast it to all system users; The time server management mechanism is configured to calculate a system public key using the N publicly disclosed Shamir secret shared public keys and disclose the calculated public key; then select a private key share ciphertext from each of the N obtained private key share group ciphertexts; then perform a calculation on all the selected private key share ciphertexts, and send the calculation results to the corresponding time servers until all time servers receive a calculation result; The receiver uses its own attribute ID to generate its own private key; and is used to decrypt the ciphertext C at decryption time T to obtain the plaintext M using its own private key, at least t sub-time trapdoors, and system parameters; The sender specifies and announces the decryption time T, uses the attribute ID′, the system public key, and the system parameters to generate the ciphertext C corresponding to the plaintext M, and sends the ciphertext C to the receiver.

Images