A high-efficient publicly verifiable searchable property-based encryption method

Abstract

The present application relates to the technical field of data security, in particular to a high-efficiency publicly verifiable searchable attribute-based encryption method, which solves the technical problem that the existing method only "transfers" the calculation task to different time periods, does not actually reduce the total amount of calculation of the resource-constrained device, and the calculation amount of the offline part is still positively correlated with the number of attributes and the size of the access control policy, thereby increasing the storage and calculation burden of the resource-constrained device, and ingeniously combines outsourcing encryption and offline stage encryption, so that the outsourcing encryption calculation process does not contain the secret information of the data owner, and any honest public verifier can verify the correctness of the outsourcing ciphertext with public parameters and offline stage calculation results, without introducing any trusted third party.

Description

Technical Field

[0001] This invention belongs to the field of data security technology, specifically relating to an efficient, publicly verifiable, searchable attribute-based encryption method. Background Technology

[0002] Since the storage and computing capabilities of resource-constrained devices are the bottleneck of the entire network, cloud platforms are typically used for data storage and processing to reduce the resource consumption of sensors. However, with the explosive growth of IoT applications, the massive amounts of data generated pose a severe challenge to the system's availability and real-time processing capabilities. Furthermore, the long communication distance between the static cloud and end users makes it difficult to meet the real-time application needs of widely deployed IoT devices. Therefore, a new computing paradigm called fog computing has been proposed. Fog computing can be seen as an extension of cloud computing, with fog nodes deployed between the static cloud and end users, closer to them, providing low-latency, distributed computing and storage services. Combined with traditional cloud services, the resulting "cloud-fog-terminal" model not only reduces the computing load on cloud servers caused by massive IoT devices but also provides real-time computing and storage services for distributed IoT applications.

[0003] To address the challenge of applying computationally complex algorithms to resource-constrained devices, researchers have proposed outsourcing encryption / decryption techniques at the algorithm level. This involves delegating computationally intensive encryption and decryption tasks to cloud servers, effectively reducing the overall computational load on resource-constrained devices. However, existing solutions require a high level of trust in the cloud servers and lack verification of the correctness of the outsourced ciphertext.

[0004] Compared to outsourced encryption technology, which delegates the heavy encryption tasks to cloud servers for collaborative processing, online / offline technology breaks down the task into different time slices. Both keyword indexing and encryption are computed in online and offline phases, allowing resource-constrained devices to quickly synthesize keyword indexes and ciphertext with minimal online computation. While online / offline technology reduces the computational burden on resource-constrained devices during online operation and enables real-time ciphertext synthesis, existing methods merely "transfer" the computational tasks to different time periods without actually reducing the total computational load on resource-constrained devices; in fact, they may even increase some computational redundancy. Furthermore, in the construction of attribute-based cryptography schemes, the offline computational load remains positively correlated with the number of attributes and the size of access control policies, increasing the storage and computational burden on resource-constrained devices. Summary of the Invention

[0005] This invention discloses an efficient, publicly verifiable, searchable attribute-based encryption method, which aims to solve the technical problem that the computational and storage burden of the attribute-based encryption stage is too large and difficult to apply to resource-constrained devices.

[0006] To solve the aforementioned technical problems, the present invention adopts the following technical solution:

[0007] S1. Generate global public parameters and system master key through an authorized agency;

[0008] S2. Generate an attribute authority public key and an attribute authority private key based on the global public parameters and the attribute set managed by attribute authority, and publish the attribute authority public key;

[0009] S3. Generate an attribute private key as a unique identifier based on the intersection of the system master key and the user attributes and the attributes managed by the attribute authority.

[0010] S4. Data encryption is completed jointly by the data owner and an outsourced encrypted cloud server, and the ciphertext is stored in the fog node.

[0011] S5. Generate a keyword index based on the access control policy size and upload it to the storage cloud server for storage;

[0012] S6. Generate a keyword trapdoor based on the keyword to be queried and the attribute private key;

[0013] S7. Determine if the keyword index and the trapdoor match. If they do not match, the search fails and the ciphertext is not the result the data user wants to search for; otherwise, proceed to step S8.

[0014] S8. Data decryption is completed jointly by outsourced decryption cloud servers and data users;

[0015] S9. Execute the ciphertext public verification algorithm through the public verifier and output the verification result.

[0016] Furthermore, the specific implementation method of step S1 is as follows:

[0017] S1-1, Input security parameter κ; Generate multiplicative cyclic groups G and G1 of prime order p through the central authority, let g and g1 be the generators of groups G and G1 respectively, satisfying the bilinear mapping e: G×G→G T and e:G×G1→G T Define a hash function H:{0,1} * →G maps the global identity (GID) to elements in the group G. Define the hash function. The extracted keyword bitstream and global identity are used for mapping and grouping. The elements on the [database]. Define a hash function H. bls :{0,1} * →G, used for outsourced ciphertext components and public verification components for random hash generation. CA is randomly selected. According to the formula:

[0018] GP={G,GT ,p,g,g λ ,f,H,H1,H bls}

[0019] Obtain the global common parameter GP;

[0020] S1-2, Output global public parameters and system master key msk={λ}.

[0021] Furthermore, the specific implementation method of step S2 is as follows:

[0022] S2-1. Input the global common parameter GP; for any attribute under attribute authority management, randomly select two random numbers α. i ,β i ∈Z p As the authoritative private key for attributes, according to the formula:

[0023]

[0024] Obtain the authoritative public key for the APK. i,j And it is publicly disclosed, where e is a bilinear mapping, g is a generator of the group G, and S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management;

[0025] S2-2, According to the formula:

[0026]

[0027] Obtain the attribute authority private key ASK i,j And retain, where S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set of management, α i ,β i ∈Z p .

[0028] Furthermore, the specific implementation method of step S3 is as follows:

[0029] According to the formula:

[0030]

[0031] Obtain Attribute Authority A j The set of private keys SK corresponding to all attributes of the managed attributes GID Where GID is a globally unique identifier, α i ,β i ∈Z pTwo random numbers randomly selected for the attribute authority are used here as the attribute authority's private key. g is a generator of group G, H and H1 are hash functions, and S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management, K 1,i and K 2,i It is attribute authority A j The specific attribute private key generated by the managed attribute i.

[0032] Furthermore, the specific implementation method of step S4 is as follows:

[0033] S4-1. According to the formula:

[0034]

[0035] Obtain the conversion key TK GID Where GID is a globally unique identifier and H is a hash function. S GID K is the complete set of attributes owned by the user. 2,i K', K3 is the user's private key used for outsourced encrypted computation, K 2,i For attribute authority A j The specific attribute private key generated by the managed attribute i;

[0036] S4-2, Randomly selected via fog nodes Calculate and generate the portion of offline ciphertext in the offline ciphertext resource pool that does not change with attribute authority:

[0037]

[0038] Obtain the outsourced encrypted component:

[0039]

[0040] According to the formula:

[0041]

[0042] PVC component obtained through public verification j ,in g is a generator of group G, f∈G, e is a bilinear mapping, and OCC j.i For outsourced encrypted components, S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management, CTC 1,i CTC 2,i CTC3,i CTC 4,i CTC 5,i CTC 6,i For encrypted components;

[0043] S4-3. Before uploading the outsourced encrypted component and the public verification component to the storage cloud server, sign the outsourced encrypted component and the public verification component using a fog node, and calculate the signature public key pk. sig and signing private key sk sig :

[0044] sk sig =v,pk sig =g1 v

[0045] According to the formula:

[0046]

[0047] We obtain the signatures made by the fog node using the BLS signature private key for the outgoing ciphertext component and the public verification component, where g1 is the generator of the multiplicative cyclic group G1 of order p. H serves as the private key for signing. bls For hash functions, OCC j.i For outsourced encrypted components, S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management, PVC j For the public verification component, the symbol || indicates concatenation; upload the outsourced encrypted component and the public verification component to the storage cloud server;

[0048] S4-4. Calculate the outsourced ciphertext using the outsourced encrypted cloud server for all attribute-authoritative outsourced ciphertext components:

[0049]

[0050] According to the formula:

[0051]

[0052] The final offline ciphertext resource pool contains the complete intermediate ciphertext, where IT c For the part that does not change with attribute authority, IT j,i For attribute-related parts of attribute authority management, α i ,β i ∈Z p For attribute authority private key, CTC 1,i CTC 2,i CTC3,i CTC 4,i CTC 5,i CTC 6,i For encrypted components, C 1,i ′,C 2,i ′,C 3,i ′ represents the outsourced ciphertext in the outsourced computation, and I0, I1, I2, and E1 are the offline ciphertext portions in the offline ciphertext resource pool that do not change with attribute authority.

[0053] S4-5, Randomly select γ∈G by the data owner. T The symmetric key k is derived. se =h(γ), using the secure symmetric encryption algorithm Enc to calculate the ciphertext of plaintext M: The secret value γ is encrypted according to the access control policy A==(M,ρ), where M is an l×n matrix and ρ is a function that maps each row of matrix M to a corresponding attribute. The secret value is then randomly selected. Calculate the ciphertext: C = γ·e(g,g) s The data owner randomly constructs a vector starting with the secret value s. Calculate the secret share: Then randomly construct a vector starting with 0. Calculate the zero secret share: Where M i Denotes the i-th row of matrix M, where i∈{1,2,...,l};

[0054] Get the encrypted message online:

[0055]

[0056] According to the formula:

[0057] CT′=(C,CT m ,{CT on} i∈[1,l] )

[0058] The final generated online partial ciphertext CT′ is obtained, where i∈{1,2,...,l},CT on For online encrypted text, CT m To compute the ciphertext of plaintext M using the secure symmetric encryption algorithm Enc, C is the ciphertext encrypted with the secret value γ;

[0059] S4-6. After the fog node receives the online ciphertext CT′ from the data owner, it calculates the following based on the required offline ciphertext pool resources:

[0060]

[0061] CTF 2,i =C 2,ρ(i) ′

[0062]

[0063]

[0064] Obtain instantaneous synthesized encrypted CT final Where i∈{1,2,...,l}, e is a bilinear mapping, g is a generator of group G, and λ i For a secret share, w i For zero secret share, C 1,ρ(i) ′,C 2,ρ(i) ′,C 3,ρ(i) ' is the outsourced encrypted text for the temporarily pending outsourced computation, C 1,i and C 3,i For outsourced computation of ciphertext, ρ(i) is a function that maps the i-th row of the matrix to the corresponding attribute, α ρ(i) ,β ρ(i) ,r ρ(i) ∈Z p ;

[0065] According to the formula:

[0066] CT = (C, CT) m ,{CT final} i∈[1,l] )

[0067] The final fog node is obtained to generate the complete encrypted CT, where CT final C is the ciphertext synthesized in real time, and CT is the ciphertext used to encrypt the secret value γ. m This is to obtain the ciphertext of the message after encrypting the plaintext M using a secure symmetric encryption algorithm.

[0068] Furthermore, the specific implementation method of step S5 is as follows:

[0069] S5-1, The data owner extracts the encrypted CT scan. m Keyword information W = {kw1,kw2,...,kw} m}, randomly selected Construct the polynomial: g(x)=d(x-H1(kw1))…(x-H1(kw1)) m ))+1=η m x m +η m-1 x m-1 +…+η0; where H1 is a hash function, η0,η1,…,η m For coefficients;

[0070] S5-2. The data owner, based on the secret information σ1 obtained from the fog node, blinds the coefficients of each term of the polynomial g(x) and calculates:

[0071]

[0072] Obtain the keyword index, where I 3,x For offline encrypted text and indexes or parts related to keywords, η x denoted as the coefficients of each term in the polynomial g(x);

[0073] S5-3: The data owner sends the keyword index to the aggregation node, which then uploads it to the storage cloud server for storage.

[0074] Furthermore, the specific implementation method of step S6 is as follows:

[0075] S6-1. Data users search for data containing W'={kw1',kw2',...,kw n The encrypted text contains keywords such as '}, where n ≤ m. The data user generates a keyword trapdoor using the attribute private key and the set of keywords to be searched, and randomly selects... For all attributes i∈S of the data user GID calculate:

[0076]

[0077] Get the trapdoor T related to the attribute 1,i Where H1 is the hash function, GID is the globally unique identifier, g is the generator of group G, and α i ∈Z p ,

[0078] S6-2, According to the formula:

[0079]

[0080] Get the trapdoor T related to the keyword 2,x Where x∈{0,1,...,m}, H is a hash function, ∑ is the summation symbol, and kw i ′ represents the keyword to be searched.

[0081] S6-3, According to the formula:

[0082]

[0083] Obtain the complete keyword trapdoor form T KW T 1,i For trapdoors related to attributes, T 2,xH1 is a trapdoor related to keywords, and H1 is a hash function. f∈G, GID is a globally unique identifier, S GID All attributes for the data user.

[0084] Furthermore, the specific implementation method of step S7 is as follows:

[0085] S7-1, The storage cloud server first determines the attribute set S of the data user. GID If the access control policy for the encrypted CT authorization is not satisfied, it means that there is no permission to access the data, and the algorithm outputs 0; if it is satisfied, the storage cloud server determines whether the encrypted text is the encrypted text that the data user is searching for by judging whether the keyword index and the trapdoor match.

[0086] S7-2. Verify the success of keyword indexing and trapdoor matching. If the following conditions are met:

[0087]

[0088] This indicates that the data user has successfully found the ciphertext containing their search keywords. The algorithm outputs 1. Otherwise, it indicates that the ciphertext is not the result the data user wants to search for, and the algorithm outputs 0. Where T... 1,ρ(i) For trapdoors related to attributes, T 2,x For trapdoors related to keywords, ∏ represents multiplication, ∑ is the summation symbol, and I 3,x I0, I1, and E1 are the parts of the offline ciphertext that are indexed or related to keywords, and are offline ciphertext that do not change with attribute authority in the offline ciphertext resource pool.

[0089] Furthermore, the specific implementation method of step S8 is as follows:

[0090] S8-1, According to the formula:

[0091]

[0092] The outsourced decryption cloud server will partially decrypt the ciphertext CT. part ,in, The two parts returned by the outsourced decryption Satisfying ∑ i∈I ω i ·M i ={1,0,...,0}, M i Let C represent the i-th row of matrix M, and let C be the ciphertext used to encrypt the secret value γ. K 2,i K3 is the user's private key, CT m To obtain the ciphertext after encrypting plaintext M using a secure symmetric encryption algorithm;

[0093] S8-2, Partially decrypted ciphertext CT part Returned to data users as search results;

[0094] S8-3. After receiving the partially decrypted outsourced ciphertext, the user uses the secret information z of the generated outsourced conversion key to calculate the secret information of the derived symmetric key: The symmetric key k is then derived using the calculation result γ. se =h(γ), according to the formula:

[0095]

[0096] The decrypted plaintext M is obtained, where Dec is the decryption algorithm, and CT is the decryption algorithm. m This is the ciphertext obtained after encrypting the plaintext.

[0097] Furthermore, the specific implementation method of step S9 is as follows:

[0098] S9-1, Based on the signature Sig j,i PK with the signature public key of the fog node sig Perform integrity verification on both outsourced encrypted and public verification components. If the following conditions are met:

[0099]

[0100] This indicates that the outsourced ciphertext and public verification components were indeed calculated by fog nodes and have not been maliciously tampered with, allowing verifiers to perform batch verification of the algorithm; conversely, it indicates that the integrity of the outsourced ciphertext and public verification components has been compromised, the algorithm outputs 0, and the storage cloud server is instructed to restore the correct outsourced ciphertext and public verification components, as well as recalculate the outsourced ciphertext.

[0101] S9-2. Obtain the size P of the offline resource pool and perform rapid batch verification. If the following conditions are met:

[0102]

[0103] The algorithm outputs 1 if the verification passes, and 0 otherwise; where C 1,i ′,C 2,i ′,C 3,i ' is the encrypted outsourcing calculation for the temporarily pending outsourcing, PVC 4,i For public verification components, α ρ(i) ,β ρ(i) For randomly selected members of Z p Two random numbers;

[0104] S9-3, Public validators randomly select {a i ,b i ,c iFor the verifier ∈ [1,k]|i=1,2,...P}, to reduce the computational cost of modular exponentiation during verification, k is chosen as a small random integer. P is the size of the offline resource pool, calculated by the verifier based on the publicly available parameters of the authority for each attribute.

[0105]

[0106] Obtain authoritative verification parameters {PAP j,i} i∈[P],j∈SA , where α ρ(i) ,β ρ(i) For randomly selected members of Z p Two random numbers;

[0107] S9-4. According to the formula:

[0108]

[0109] Get offline encrypted PC out,j Where PVC1, PVC2, and PVC3 are publicly verified components, g is a generator of group G, and CTC 4,i CTC 5,i CTC 6,i An outsourced encrypted component for attribute authority.

[0110] S9-5. The verifier performs rigorous batch verification of the outsourced encrypted text. If the following conditions are met:

[0111]

[0112] If the verification passes, the algorithm outputs 1; otherwise, it outputs 0.

[0113] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0114] The solution uses online / offline technology to divide computationally complex encryption algorithms into online and offline stages for computation, and uses outsourced encryption technology to enable cloud servers to collaboratively compute ciphertext in the offline stage, which reduces the storage pressure on fog nodes and enables efficient and secure data sharing on resource-constrained devices.

[0115] The solution cleverly combines outsourced encryption and offline encryption, ensuring that the data owner's secret information is not included in the outsourced encryption calculation process. This allows any honest public verifier to verify the correctness of the outsourced ciphertext using public parameters and offline calculation results, without the need to introduce any trusted third party. Attached Figure Description

[0116] The present invention will be described by way of example and with reference to the accompanying drawings, wherein:

[0117] Figure 1 A flowchart of an efficient, publicly verifiable, searchable attribute-based encryption method;

[0118] Figure 2 A system model architecture diagram for an efficient, publicly verifiable, searchable attribute-based encryption method;

[0119] Figure 3 A comparison chart of online encryption times in a comparative experiment of an efficient, publicly verifiable, and searchable attribute-based encryption method;

[0120] Figure 4 A comparison chart of offline encryption times in a comparative experiment of an efficient, publicly verifiable, and searchable attribute-based encryption method;

[0121] Figure 5 A comparison chart of offline encryption storage overhead in a comparative experiment of an efficient, publicly verifiable, and searchable attribute-based encryption method;

[0122] Figure 6 This is a comparison chart showing the running time of the verification algorithm in a comparative experiment of an efficient, publicly verifiable, and searchable attribute-based encryption method. Detailed Implementation

[0123] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the embodiments and accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and marked in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0124] The following is combined Figure 1 The present invention will be described in detail below.

[0125] This invention provides an efficient, publicly verifiable, searchable attribute-based encryption method, as shown in the embodiments of the present invention. Figure 1 As shown, it includes the following steps:

[0126] S1. Generate global public parameters and system master key through an authorized agency;

[0127] S2. Generate an attribute authority public key and an attribute authority private key based on the global public parameters and the attribute set managed by attribute authority, and publish the attribute authority public key;

[0128] S3. Generate an attribute private key as a unique identifier based on the intersection of the system master key and the user attributes and the attributes managed by the attribute authority.

[0129] S4. Data encryption is completed jointly by the data owner and an outsourced encrypted cloud server, and the ciphertext is stored in the fog node.

[0130] S5. Generate a keyword index based on the access control policy size and upload it to the storage cloud server for storage;

[0131] S6. Generate a keyword trapdoor based on the keyword to be queried and the attribute private key;

[0132] S7. Determine if the keyword index and the trapdoor match. If they do not match, the search fails and the ciphertext is not the result the data user wants to search for; otherwise, proceed to step S8.

[0133] S8. Data decryption is completed jointly by outsourced decryption cloud servers and data users;

[0134] S9. Execute the ciphertext public verification algorithm through the public verifier and output the verification result.

[0135] The specific implementation method of step S1 is as follows:

[0136] S1-1, Input security parameter κ; In the field of attribute bases, the institution that generates attribute public keys is called the attribute authority. In a multi-center architecture, it is necessary to select the most central authority to generate global parameters for use by various attribute authorities; Generate a multiplicative cyclic group G and a group G1 of prime order p through the central authority, and let g and g1 be the generators of group G and group G1 respectively, satisfying the bilinear mapping e: G×G→G T and e:G×G1→G T Define a hash function H:{0,1} * →G maps the global identity (GID) to elements in the group G. Define the hash function. The extracted keyword bitstream and global identity are used for mapping and grouping. The elements on the [database]. Define a hash function H. bls :{0,1} * →G, used for outsourced ciphertext components and public verification components for random hash generation. CA is randomly selected. According to the formula:

[0137] GP={G,G T ,p,g,g λ ,f,H,H1,H bls}

[0138] Obtain the global common parameter GP;

[0139] S1-2, Output global public parameters and system master key msk={λ}.

[0140] The specific implementation method of step S2 is as follows:

[0141] S2-1. Input the global common parameter GP; for any attribute under attribute authority management, randomly select two random numbers α. i ,β i ∈Z p As the authoritative private key for attributes, according to the formula:

[0142]

[0143] Obtain the authoritative public key for the APK. i,j And it is publicly disclosed, where e is a bilinear mapping, g is a generator of the group G, and S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management;

[0144] S2-2, According to the formula:

[0145]

[0146] Obtain the attribute authority private key ASK i,j And retain, where S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set of management, α i ,β i ∈Z p .

[0147] The specific implementation method of step S3 is as follows:

[0148] According to the formula:

[0149]

[0150] Obtain Attribute Authority A j The set of private keys SK corresponding to all attributes of the managed attributes GID Where GID is a globally unique identifier, α i ,β i ∈Z p Two random numbers randomly selected for the attribute authority are used here as the attribute authority's private key. g is a generator of group G, H and H1 are hash functions, and S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management, K1,i and K 2,i It is attribute authority A j The specific attribute private key generated by the managed attribute i.

[0151] The specific implementation method of step S4 is as follows:

[0152] S4-1. According to the formula:

[0153]

[0154] Obtain the conversion key TK GID Where GID is a globally unique identifier and H is a hash function. S GID K is the complete set of attributes owned by the user. 2,i K', K3 is the user's private key used for outsourced encrypted computation, K 2,i For attribute authority A j The specific attribute private key generated by the managed attribute i;

[0155] S4-2, Randomly selected via fog nodes Calculate and generate the portion of offline ciphertext in the offline ciphertext resource pool that does not change with attribute authority:

[0156] I0 = g b I1=g λb ,

[0157] Obtain the outsourced encrypted component:

[0158]

[0159] According to the formula:

[0160]

[0161] PVC component obtained through public verification j ,in g is a generator of group G, f∈G, e is a bilinear mapping, and OCC j.i For outsourced encrypted components, S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management, CTC 1,i CTC 2,i CTC 3,i CTC 4,i CTC 5,i CTC 6,i For encrypted components;

[0162] S4-3. Before uploading the outsourced encrypted component and the public verification component to the storage cloud server, sign the outsourced encrypted component and the public verification component using a fog node, and calculate the signature public key pk. sig and signing private key sk sig :

[0163] sk sig =v,pk sig =g1 v

[0164] According to the formula:

[0165]

[0166] We obtain the signatures made by the fog node using the BLS signature private key for the outgoing ciphertext component and the public verification component, where g1 is the generator of the multiplicative cyclic group G1 of order p. H serves as the private key for signing. bls For hash functions, OCC j.i For outsourced encrypted components, S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management, PVC j For the public verification component, the symbol || indicates concatenation; upload the outsourced encrypted component and the public verification component to the storage cloud server;

[0167] S4-4. Calculate the outsourced ciphertext using the outsourced encrypted cloud server for all attribute-authoritative outsourced ciphertext components:

[0168]

[0169] According to the formula:

[0170]

[0171] The final offline ciphertext resource pool contains the complete intermediate ciphertext, where IT c For the part that does not change with attribute authority, IT j,i For attribute-related parts of attribute authority management, α i ,β i ∈Z p For attribute authority private key, CTC 1,i CTC 2,i CTC 3,i CTC 4,i CTC 5,i CTC 6,i For encrypted components, C 1,i ′,C 2,i ′,C3,i ′ represents the outsourced ciphertext in the outsourced computation, and I0, I1, I2, and E1 are the offline ciphertext portions in the offline ciphertext resource pool that do not change with attribute authority.

[0172] S4-5, Randomly select γ∈G by the data owner. T The symmetric key k is derived. se =h(γ), using the secure symmetric encryption algorithm Enc to calculate the ciphertext of plaintext M: The secret value γ is encrypted according to the access control policy A==(M,ρ), where M is an l×n matrix and ρ is a function that maps each row of matrix M to a corresponding attribute. The secret value is then randomly selected. Calculate the ciphertext: C = γ·e(g,g) s The data owner randomly constructs a vector starting with the secret value s. Calculate the secret share: Then randomly construct a vector starting with 0. Calculate the zero secret share: Where M i Denotes the i-th row of matrix M, where i∈{1,2,...,l};

[0173] Get the encrypted message online:

[0174]

[0175] According to the formula:

[0176] CT′=(C,CT m ,{CT on} i∈[1,l] )

[0177] The final generated online partial ciphertext CT′ is obtained, where i∈{1,2,...,l},CT on For online encrypted text, CT m To compute the ciphertext of plaintext M using the secure symmetric encryption algorithm Enc, C is the ciphertext encrypted with the secret value γ;

[0178] S4-6. After the fog node receives the online ciphertext CT′ from the data owner, it calculates the following based on the required offline ciphertext pool resources:

[0179]

[0180] CTF 2,i =C 2,ρ(i) ′

[0181]

[0182]

[0183] Obtain instantaneous synthesized encrypted CT final Where i∈{1,2,...,l}, e is a bilinear mapping, g is a generator of group G, and λ i For a secret share, w i For zero secret share, C 1,ρ(i) ′,C 2,ρ(i) ′,C 3,ρ(i) ' is the outsourced encrypted text for the temporarily pending outsourced computation, C 1,i and C 3,i For outsourced computation of ciphertext, ρ(i) is a function that maps the i-th row of the matrix to the corresponding attribute, α ρ(i) ,β ρ(i) ,r ρ(i) ∈Z p ;

[0184] According to the formula:

[0185] CT = (C, CT) m ,{CT final} i∈[1,l] )

[0186] The final fog node is obtained to generate the complete encrypted CT, where CT final C is the ciphertext synthesized in real time, and CT is the ciphertext used to encrypt the secret value γ. m This is to obtain the ciphertext of the message after encrypting the plaintext M using a secure symmetric encryption algorithm.

[0187] The specific implementation method of step S5 is as follows:

[0188] S5-1, The data owner extracts the encrypted CT scan. m Keyword information W = {kw1,kw2,...,kw} m}, randomly selected Construct the polynomial: g(x)=d(x-H1(kw1))…(x-H1(kw1)) m ))+1=η m x m +η m-1 x m-1 +…+η0; where H1 is a hash function, η0,η1,…,η m For coefficients;

[0189] S5-2. The data owner, based on the secret information σ1 obtained from the fog node, blinds the coefficients of each term of the polynomial g(x) and calculates:

[0190]

[0191] Obtain the keyword index, where I 3,x For offline encrypted text and indexes or parts related to keywords, η x denoted as the coefficients of each term in the polynomial g(x);

[0192] S5-3: The data owner sends the keyword index to the aggregation node, which then uploads it to the storage cloud server for storage.

[0193] The specific implementation method of step S6 is as follows:

[0194] S6-1. Data users search for data containing W'={kw1',kw2',...,kw n The encrypted text contains keywords such as '}, where n ≤ m. The data user generates a keyword trapdoor using the attribute private key and the set of keywords to be searched, and randomly selects... For all attributes i∈S of the data user GID calculate:

[0195]

[0196] Get the trapdoor T related to the attribute 1,i Where H1 is the hash function, GID is the globally unique identifier, g is the generator of group G, and α i ∈Z p ,

[0197] S6-2, According to the formula:

[0198]

[0199] Get the trapdoor T related to the keyword 2,x Where x∈{0,1,...,m}, H is a hash function, ∑ is the summation symbol, and kw i ′ represents the keyword to be searched.

[0200] S6-3, According to the formula:

[0201]

[0202] Obtain the complete keyword trapdoor form T KW , among which, T 1,i For trapdoors related to attributes, T 2,x H1 is a trapdoor related to keywords, and H1 is a hash function. f∈G, GID is a globally unique identifier.

[0203] The specific implementation method of step S7 is as follows:

[0204] S7-1, The storage cloud server first determines the attribute set S of the data user. GID If the access control policy for the encrypted CT authorization is not satisfied, it means that there is no permission to access the data, and the algorithm outputs 0; if it is satisfied, the storage cloud server determines whether the encrypted text is the encrypted text that the data user is searching for by judging whether the keyword index and the trapdoor match.

[0205] S7-2. Verify the success of keyword indexing and trapdoor matching. If the following conditions are met:

[0206]

[0207] This indicates that the data user has successfully found the ciphertext containing their search keywords. The algorithm outputs 1. Otherwise, it indicates that the ciphertext is not the result the data user wants to search for, and the algorithm outputs 0. Where T... 1,ρ(i) For trapdoors related to attributes, T 2,x For trapdoors related to keywords, ∏ represents multiplication, ∑ is the summation symbol, and I 3,x I0, I1, and E1 are the parts of the offline ciphertext that are indexed or related to keywords, and are offline ciphertext that do not change with attribute authority in the offline ciphertext resource pool.

[0208] The specific implementation method of step S8 is as follows:

[0209] S8-1, According to the formula:

[0210]

[0211] The outsourced decryption cloud server will partially decrypt the ciphertext CT. part ,in, The two parts returned by the outsourced decryption Satisfying ∑ i∈I ω i ·M i ={1,0,...,0}, M i Let C represent the i-th row of matrix M, and let C be the ciphertext used to encrypt the secret value γ. K 2,i K3 is the user's private key, CT m To obtain the ciphertext after encrypting plaintext M using a secure symmetric encryption algorithm;

[0212] S8-2, Partially decrypted ciphertext CT part Returned to data users as search results;

[0213] S8-3. After receiving the partially decrypted outsourced ciphertext, the user uses the secret information z of the generated outsourced conversion key to calculate the secret information of the derived symmetric key: The symmetric key k is then derived using the calculation result γ. se =h(γ), according to the formula:

[0214]

[0215] The decrypted plaintext M is obtained, where Dec is the decryption algorithm, and CT is the decryption algorithm. m This is the ciphertext obtained after encrypting the plaintext.

[0216] The specific implementation method of step S9 is as follows:

[0217] S9-1, Based on the signature Sig j,i PK with the signature public key of the fog node sig Perform integrity verification on both outsourced encrypted and public verification components. If the following conditions are met:

[0218]

[0219] This indicates that the outsourced ciphertext and public verification components were indeed calculated by fog nodes and have not been maliciously tampered with, allowing verifiers to perform batch verification of the algorithm; conversely, it indicates that the integrity of the outsourced ciphertext and public verification components has been compromised, the algorithm outputs 0, and the storage cloud server is instructed to restore the correct outsourced ciphertext and public verification components, as well as recalculate the outsourced ciphertext.

[0220] S9-2. Obtain the size P of the offline resource pool and perform rapid batch verification. If the following conditions are met:

[0221]

[0222] The algorithm outputs 1 if the verification passes, and 0 otherwise; where C 1,i ′,C 2,i ′,C 3,i ' is the encrypted outsourcing calculation for the temporarily pending outsourcing, PVC 4,i For public verification components, α ρ(i) ,β ρ(i) For randomly selected members of Z p Two random numbers;

[0223] S9-3, Public validators randomly select {a i ,b i ,c i For the verifier ∈ [1,k]|i=1,2,...P}, to reduce the computational cost of modular exponentiation during verification, k is chosen as a small random integer. P is the size of the offline resource pool, calculated by the verifier based on the publicly available parameters of the authority for each attribute.

[0224]

[0225] Obtain authoritative verification parameters Where α ρ(i) ,β ρ(i) For randomly selected members of Z p Two random numbers;

[0226] S9-4. According to the formula:

[0227]

[0228] Get offline encrypted PC out,j Where PVC1, PVC2, and PVC3 are publicly verified components, g is a generator of group G, and CTC 4,i CTC 5,i CTC 6,i An outsourced encrypted component for attribute authority.

[0229] S9-5. The verifier performs rigorous batch verification of the outsourced encrypted text. If the following conditions are met:

[0230]

[0231] If the verification passes, the algorithm outputs 1; otherwise, it outputs 0.

[0232] Comparative experiment

[0233] By combining the scheme

[24] (Zhang K, Long J, Wang X, et al. Lightweight searchable encryption protocol for industrial internet of things [J]. IEEE Transactions on Industrial Informatics, 2020, 17(6): 4248-4259.)

[0234] Solution

[60] (Yang K, Jia

[0235] Document

[87] (Lewko A, Waters B. Decentralizing attribute-based encryption [C] / / Annual International Conference on the Theory and Applications ofCryptographic Techniques, Berlin, Germany. Springer, Berlin, Heidelberg, 2011, 6632: 568-588.),

[0236] The scheme

[90] (Xu Q,Tan C,Zhu W,et al.Decentralized attribute-based conjunctive keyword search scheme with online / offline encryption andoutsource decryption for cloud computing[J].Future Generation ComputerSystems,2019,97:306-326.) and the scheme of the present invention are compared and analyzed through simulation experiments. The specific indicators mentioned in the embodiments include online encryption running time, offline encryption running time, offline encryption storage overhead and verification stage running time.

[0237] The experimental environment was an Intel Core i5-11400H processor, and the scheme was simulated and implemented using the Charm cryptography framework based on Python 3.5 under Ubuntu 16.04 system.

[0238] Since Scheme

[24] , Scheme

[90] and this scheme all implement subset search, and Scheme

[90] also uses online / offline encryption technology, they are highly comparable. This invention will mainly compare with these two papers in terms of encryption runtime and storage overhead in each part. Since Scheme

[60] and this scheme are both based on literature

[87] in the method of multi-attribute authority center, and both have ciphertext correctness verification function, they will be mainly compared with each other in the verification stage.

[0239] The specific experimental results are as follows: Figure 3Comparing the online encryption runtime of references

[24] and

[90] , since reference

[24] does not use online / offline encryption technology, the exponential operation in the scheme will increase linearly with the increase of attributes in the access control policy, so the overall runtime of the scheme will also increase linearly with the attributes. However, both this scheme and reference

[90] use online / offline encryption technology, which allows ciphertext to be synthesized instantly with only a constant number of exponential operations. Consistent with the theoretical analysis, the online encryption runtime of this scheme and the scheme of reference

[90] does not increase linearly with the increase of attributes, and the efficiency of the two is comparable. However, the online encryption runtime of reference

[24] is significantly higher than that of this scheme and reference

[90] . When the number of attributes reaches 100, the online encryption runtime of this scheme is 5% of that of reference

[24] . It can be seen that online / offline encryption technology greatly reduces the computational burden of resource-constrained devices.

[0240] Figure 4 , 5 The offline encryption runtime and storage overhead of the present invention and the literature

[90] were compared. From Figure 4 As can be seen, although the offline encryption runtime of both the scheme in reference

[90] and the present invention increases linearly with the number of global attributes, the growth rate of reference

[90] is significantly higher than that of the present invention. When the number of attributes reaches 100, from Figure 5 It can be seen that the offline encryption storage overhead of both reference

[90] and this scheme increases linearly with the number of attributes. The linear growth rate of reference

[90] is significantly higher than that of this scheme. This is because the storage overhead in reference

[90] that increases linearly with the number of attributes is the result of modular exponentiation on the multiplicative cyclic group G, which is relatively long. In contrast, the number of modular exponentiation results that increase linearly with the number of attributes in this scheme is much lower than that in reference

[90] . This is because the offline scheme of this invention combines outsourced encryption technology, and some modular exponentiation results are calculated by the cloud server. As a result, the offline encryption part stores more random elements on the shorter group p, which greatly reduces the storage overhead of the offline part of the scheme, which is consistent with the theoretical analysis results. When the number of attributes reaches 100, the storage overhead of reference

[90] is 1.8 times that of this invention, which is 45.3% higher than that of this invention.

[0241] Figure 6The running time of the two public batch verification algorithms designed in this invention and the ciphertext correctness verification algorithm proposed in reference

[60] were compared and analyzed. The verification algorithm proposed in reference

[60] requires the data owner and the cloud server to conduct a challenge-response to fully verify the correctness of the ciphertext. It does not support public verification. The verification process depends on the cloud computing results, and this interactive verification mode brings additional communication burden to the data owner. The two verification schemes proposed in this invention can achieve public verification of ciphertext without any trusted third party, and they are both non-interactive with a lower communication burden. Let the attribute size be N. Compared with the fast batch verification algorithm of this invention, the verifier in reference

[60] has an additional (O)N exponential operation in the verification process, which is less efficient. Compared with the verification algorithm in reference

[60] , the strict verification algorithm proposed in this invention, although increasing the computational burden of the verifier, greatly improves the verification accuracy. Figure 5 It can be seen that when the number of attributes reaches 100, the running time of the verification algorithm in reference

[60] is about 5 times the running time of the fast batch verification algorithm in the present invention, while the running time of the strict verification algorithm in the present invention is 3.28 times the running time of the verification algorithm in reference

[60] , which is consistent with the above analysis.

[0242] In summary, this invention provides a highly efficient and publicly verifiable searchable attribute-based encryption method. It utilizes online / offline technology to divide computationally complex encryption algorithms into online and offline stages for computation. Furthermore, it employs outsourced encryption technology to enable cloud servers to collaboratively compute the ciphertext in the offline stage, reducing the storage pressure on fog nodes and enabling efficient and secure data sharing on resource-constrained devices. The combination of outsourced encryption and offline stage encryption ensures that the data owner's secret information is not included in the outsourced encryption computation process. Any honest public verifier can verify the correctness of the outsourced ciphertext using public parameters and the offline stage computation results, without the need for any trusted third party.

[0243] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A highly efficient, publicly verifiable, searchable attribute-based encryption method, characterized in that, Includes the following steps: S1. Generate global public parameters and system master key through an authorized agency; S2. Generate an attribute authority public key and an attribute authority private key based on the global public parameters and the attribute set managed by attribute authority, and publish the attribute authority public key; S3. Generate an attribute private key as a unique identifier based on the intersection of the system master key, user attributes, and attribute authority management attributes. S4. Data encryption is completed jointly by the data owner and an outsourced encrypted cloud server, and the ciphertext is stored in the fog node. S5. Generate a keyword index based on the access control policy size and upload it to the storage cloud server for storage; S6. Generate a keyword trapdoor based on the keyword to be queried and the attribute private key; S7. Determine if the keyword index and the trapdoor match. If they do not match, the search fails and the ciphertext is not the result the data user wants to search for. Otherwise, proceed to step S8; S8. Data decryption is completed jointly by outsourced decryption cloud servers and data users; S9. Execute the ciphertext public verification algorithm through the public verifier and output the verification result.

2. The efficient, publicly verifiable, searchable attribute-based encryption method according to claim 1, characterized in that, The specific implementation method of step S1 is as follows: S1-1, Input security parameter κ; Generate multiplicative cyclic groups G and G1 of prime order p through the central authority, let g and g1 be the generators of groups G and G1 respectively, satisfying the bilinear mapping e: G×G→G T and e:G×G1→G T Define a hash function H:{0,1} * →G, maps the global identity (GID) to elements in group G; defines a hash function. The extracted keyword bitstream and global identity are used for mapping and grouping. Elements on; define hash function H bls :{0,1} * →G, used for outsourced ciphertext components and public verification components for random hash generation; CA is randomly selected. f∈G, according to the formula: GP={G,G T ,p,g,g λ ,f,H,H1,H bls } Obtain the global common parameter GP; S1-2, Output global public parameters and system master key msk={λ}.

3. The efficient, publicly verifiable, searchable attribute-based encryption method according to claim 1, characterized in that, The specific implementation method of step S2 is as follows: S2-1. Input the global common parameter GP; for any attribute under attribute authority management, randomly select two random numbers α. i ,β i ∈Z p As the authoritative private key for attributes, according to the formula: Obtain the authoritative public key for the APK. i,j And it is publicly disclosed, where e is a bilinear mapping, g is a generator of the group G, and S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management; S2-2, According to the formula: Obtain the attribute authority private key ASK i,j And retain, where S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set of management, α i ,β i ∈Z p .

4. The efficient, publicly verifiable, searchable attribute-based encryption method according to claim 1, characterized in that, The specific implementation method of step S3 is as follows: According to the formula: Obtain Attribute Authority A j The set of private keys SK corresponding to all attributes of the managed attributes GID Where GID is a globally unique identifier, α i ,β i ∈Z p Two random numbers randomly selected for the attribute authority are used here as the attribute authority's private key. g is a generator of group G, H and H1 are hash functions, and S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management, K 1,i and K 2,i It is attribute authority A j The specific attribute private key generated by the managed attribute i.

5. The efficient, publicly verifiable, searchable attribute-based encryption method according to claim 4, characterized in that, The specific implementation method of step S4 is as follows: S4-1. According to the formula: Obtain the conversion key TK GID Where GID is a globally unique identifier and H is a hash function. S GID K is the complete set of attributes owned by the user. 2,i K',K3 is the user's private key used for outsourced encrypted computation, K 2,i For attribute authority A j The specific attribute private key generated by the managed attribute i; S4-2, Randomly select via fog nodes Calculate and generate the portion of offline ciphertext in the offline ciphertext resource pool that does not change with attribute authority: I0=g b ,I1=g λb , Obtain the outsourced encrypted component: According to the formula: PVC component obtained through public verification j ,in g is a generator of a group G, f∈G, e is a bilinear mapping, and OCC j.i For outsourced encrypted components, S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management, CTC 1,i CTC 2,i CTC 3,i CTC 4,i CTC 5,i CTC 6,i For encrypted components; S4-3. Before uploading the outsourced encrypted component and the public verification component to the storage cloud server, sign the outsourced encrypted component and the public verification component using a fog node, and calculate the signature public key pk. sig and signing private key sk sig : en sig =v,pk sig =g1 v According to the formula: We obtain the signatures performed by the fog node on the outgoing ciphertext component and the public verification component using the BLS signature private key, where g1 is the generator of the multiplicative cyclic group G1 of order p. H serves as the private key for signing. bls For hash functions, OCC j.i For outsourced encrypted components, S A A is the authority for all attributes in a distributed system. j Attribute Authority AA j The corresponding attribute set for management, PVC j For publicly verified components, the symbol || indicates concatenation; Upload the outsourced encrypted component and the public verification component to the storage cloud server; S4-4. Calculate the outsourced ciphertext using the outsourced encrypted cloud server for all attribute-authoritative outsourced ciphertext components: According to the formula: The final offline ciphertext resource pool contains the complete intermediate ciphertext, where IT c For the part that does not change with attribute authority, IT j,i For attribute-related parts of attribute authority management, α i ,β i ∈Z p For attribute authority private key, CTC 1,i CTC 2,i CTC 3,i CTC 4,i CTC 5,i CTC 6,i For encrypted components, C 1,i ′,C 2,i ′,C 3,i ′ represents the outsourced ciphertext in the outsourced computation, and I0, I1, I2, and E1 are the offline ciphertext portions in the offline ciphertext resource pool that do not change with attribute authority. S4-5, Randomly select γ∈G by the data owner. T The symmetric key k is derived from this. se =h(γ), using the secure symmetric encryption algorithm Enc to calculate the ciphertext of plaintext M: The secret value γ is encrypted according to the access control policy A==(M,ρ), where M is an l×n matrix and ρ is a function that maps each row of matrix M to a corresponding attribute; the secret value is then randomly selected. Calculate the ciphertext: C = γ·e(g,g) s The data owner randomly constructs a vector starting with the secret value s. Calculate the secret share: Then randomly construct a vector starting with 0. Calculate the zero secret share: Where M i Represents the i-th row of matrix M, where i∈{1,2,…,l}; Get the encrypted message online: According to the formula: CT′=(C,CT m ,{CT on } i∈[1,l] ) The final generated online partial ciphertext CT′ is obtained, where CT on For online encrypted text, CT m To compute the ciphertext of plaintext M using the secure symmetric encryption algorithm Enc, C is the ciphertext encrypted with the secret value γ; S4-6. After the fog node receives the online ciphertext CT′ from the data owner, it calculates the following based on the required offline ciphertext pool resources: CTF 2,i =C 2,ρ(i) ′ Obtain instantaneous synthesized encrypted CT final Where i∈{1,2,...,l}, e is a bilinear mapping, g is a generator of group G, and λ i For a secret share, w i For zero secret share, C 1,ρ(i) ′,C 2,ρ(i) ′,C 3,ρ(i) ' is the outsourced encrypted text for the temporarily pending outsourced computation, C 1,i and C 3,i For outsourced computation of ciphertext, ρ(i) is a function that maps the i-th row of the matrix to the corresponding attribute, α ρ(i) ,β ρ(i) ,r ρ(i) ∈Z p ; According to the formula: CT=(C,CT m ,{CT final } i∈[1,l] ) The final fog node is obtained to generate the complete encrypted CT, where CT final C is the ciphertext synthesized in real time, and CT is the ciphertext used to encrypt the secret value γ. m This is to obtain the ciphertext of the message after encrypting the plaintext M using a secure symmetric encryption algorithm.

6. The efficient, publicly verifiable, searchable attribute-based encryption method according to claim 5, characterized in that, The specific implementation method of step S5 is as follows: S5-1, The data owner extracts the encrypted CT scan. m Keyword information W = {kw1,kw2,...,kw} m }, randomly selected Construct the polynomial: g(x)=d(x-H1(kw1))…(x-H1(kw1)) m ))+1=η m x m +η m-1 x m-1 +…+η0; where H1 is a hash function, η0,η1,…,η m For coefficients; S5-2. The data owner, based on the secret information σ1 obtained from the fog node, blinds the coefficients of each term of the polynomial g(x) and calculates: Obtain the keyword index, where I 3,x For offline encrypted text and indexes or parts related to keywords, η x where are the coefficients of each term in the polynomial g(x); S5-3: The data owner sends the keyword index to the aggregation node, which then uploads it to the storage cloud server for storage.

7. The efficient, publicly verifiable, searchable attribute-based encryption method according to claim 6, characterized in that, The specific implementation method of step S6 is as follows: S6-1. Data users search for data containing W'={kw1',kw2',...,kw n The encrypted text contains keywords such as '}, where n ≤ m; the data user generates a keyword trapdoor using the attribute private key and the set of keywords to be searched, and randomly selects μ, For all attributes i∈S of the data user GID calculate: Get the trapdoor T related to the attribute 1,i Where H1 is the hash function, GID is the globally unique identifier, g is the generator of group G, and α i ∈Z p , S6-2, According to the formula: Get the trapdoor T related to the keyword 2,x Where x∈{0,1,...,m}, H is a hash function, ∑ is the summation symbol, and kw′ i Keywords to be searched S6-3, According to the formula: Obtain the complete keyword trapdoor form T KW T 1,i For trapdoors related to attributes, T 2,x H1 is a trapdoor related to keywords, and H1 is a hash function. f∈G, GID is a globally unique identifier, S GID All attributes for the data user.

8. The efficient, publicly verifiable, searchable attribute-based encryption method according to claim 7, characterized in that, The specific implementation method of step S7 is as follows: S7-1, The storage cloud server first determines the attribute set S of the data user. GID If the access control policy for the encrypted CT authorization is not satisfied, it means that there is no permission to access the data, and the algorithm outputs 0; if it is satisfied, the storage cloud server determines whether the encrypted text is the encrypted text that the data user is searching for by judging whether the keyword index and the trapdoor match. S7-2. Verify the success of keyword indexing and trapdoor matching. If the following conditions are met: This indicates that the data user has successfully found the ciphertext containing their search keywords. The algorithm outputs 1 if the ciphertext is not the result the user wants to search for, and outputs 0 otherwise; where T 1,ρ(i) For trapdoors related to attributes, T 2,x For trapdoors related to keywords, ∏ represents multiplication, ∑ is the summation symbol, and I 3,x I0, I1, and E1 are the parts of the offline ciphertext that are indexed or related to keywords, and are offline ciphertext that do not change with attribute authority in the offline ciphertext resource pool.

9. The efficient, publicly verifiable, searchable attribute-based encryption method according to claim 8, characterized in that, The specific implementation method of step S8 is as follows: S8-1, According to the formula: The outsourced decryption cloud server will partially decrypt the ciphertext CT. part ,in, The two parts returned by the outsourced decryption Satisfy ∑ i∈I ω i ·M i ={1,0,...,0}, M i Let C represent the i-th row of matrix M, and let C be the ciphertext used to encrypt the secret value γ. K 2,i K3 is the user's private key, CT m To obtain the ciphertext after encrypting plaintext M using a secure symmetric encryption algorithm; S8-2, Partially decrypted ciphertext CT part Returned to data users as search results; S8-3. After receiving the partially decrypted outsourced ciphertext, the user uses the secret information z of the generated outsourced conversion key to calculate the secret information of the derived symmetric key: The symmetric key k is then derived using the calculation result γ. se =h(γ), according to the formula: The decrypted plaintext M is obtained, where Dec is the decryption algorithm, and CT is the decryption algorithm. m This is the ciphertext obtained after encrypting the plaintext.

10. The efficient, publicly verifiable, searchable attribute-based encryption method according to claim 9, characterized in that, The specific implementation method of step S9 is as follows: S9-1, Based on the signature Sig j,i PK with the signature public key of the fog node sig Perform integrity verification on both outsourced encrypted and public verification components. If the following conditions are met: This indicates that the outsourced ciphertext and public verification components were indeed calculated by fog nodes and have not been maliciously tampered with, allowing verifiers to perform batch verification of the algorithm; conversely, it indicates that the integrity of the outsourced ciphertext and public verification components has been compromised, the algorithm outputs 0, and the storage cloud server is instructed to restore the correct outsourced ciphertext and public verification components, as well as recalculate the outsourced ciphertext. S9-2. Obtain the size P of the offline resource pool and perform rapid batch verification. If the following conditions are met: The algorithm outputs 1 if the verification passes, and 0 otherwise; where C 1,i ′,C 2,i ′,C 3,i ' is the encrypted outsourcing calculation for the temporarily pending outsourcing, PVC 4,i For public verification components, α ρ(i) ,β ρ(i) For randomly selected members of Z p Two random numbers; S9-3, Public validators randomly select {a i ,b i ,c i For the verifier ∈ [1,k]|i=1,2,...P}, to reduce the computational cost of modular exponentiation during verification, k is chosen as a small random integer; P is the size of the offline resource pool, calculated by the verifier based on the publicly available parameters of the authority for each attribute. Obtain authoritative verification parameters Where α ρ(i) ,β ρ(i) For randomly selected members of Z p Two random numbers; S9-4. According to the formula: Get offline encrypted PC out,j Where PVC1, PVC2, and PVC3 are publicly verified components, g is a generator of group G, and CTC 4,i CTC 5,i CTC 6,i An outsourced encrypted component for attribute authority. S9-5. The verifier performs rigorous batch verification of the outsourced encrypted text. If the following conditions are met: If the verification passes, the algorithm outputs 1; otherwise, it outputs 0.

Images