A ciphertext retrieval method and system supporting hierarchical access control and user revocation

Abstract

The application discloses a ciphertext retrieval method and system supporting hierarchical access control and user revocation, relates to the technical field of information security, and solves the problems that data retrieval is carried out at the same level, data cost is large, and flexible management of user attributes is difficult to realize in the prior art; the method comprises the following steps: an inverted index related to a file set is established by using a keyword, a KEK tree is determined by using a user set and an attribute set, and a hierarchical access tree is constructed by using the attribute set; the file set, the inverted index, a symmetric encryption key and a re-encryption key are respectively encrypted, and corresponding encrypted data is obtained; a conversion key and a decryption key are generated by using a user attribute set and a master key; the encrypted data, the hierarchical access tree and the KEK tree are sent to a cloud server end, and the conversion key and the decryption key are sent to a user end; the method realizes hierarchical access according to user attributes, and uses an outsourcing decryption method, so that the cost of a user computer is reduced, and the query speed is improved.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and system for encrypted retrieval that supports hierarchical access control and user revocation. Background Technology

[0002] With the increasing number of terminal devices and the development of new technologies, more and more data is being generated. Due to the economic and flexible advantages of cloud servers, data storage is often outsourced to cloud service providers. However, since cloud service providers are not necessarily secure and trustworthy, storing data in plaintext poses a significant security risk. Therefore, how to achieve direct retrieval of encrypted data is a crucial issue. Furthermore, different files may have varying levels of importance; highly confidential files cannot be accessed by ordinary users, making tiered access control based on file importance paramount. Since data is valuable, when a user leaves the data owner entity, access permissions must be revoked to protect the entity's rights. Simultaneously, considering the computational overhead of encrypted retrieval, how to enable efficient retrieval even on devices with limited computing power is another problem that needs to be addressed. Faced with the current complex file data usage scenarios, how to securely and efficiently accomplish these tasks has become paramount, and currently, no solution exists that can simultaneously solve all these problems.

[0003] There are two main schemes that are closest to this invention. Xiao et al. designed an expandable hierarchical access tree to achieve hierarchical file access. However, this scheme lacks text keyword retrieval and user revocation functionality, thus having certain limitations. Miao et al. implemented single-keyword and multi-keyword retrieval of text based on file hierarchy, mainly using an inverted index data structure. Simultaneously, their scheme designed a version number for each user, using this version number to enable user revocation. However, this scheme does not fully consider the computational overhead required for users to decrypt ciphertext.

[0004] The main drawbacks of existing technologies are as follows: They cannot achieve efficient keyword retrieval in file-layered scenarios: most previous encrypted keyword retrieval schemes were performed at the same level, which is ineffective in complex file-layered scenarios; They are difficult to manage user attributes flexibly in layered scenarios: current attribute revocation schemes are mainly designed for single-level scenarios, while user attribute management is more complex in layered scenarios, and current schemes cannot achieve good results; They have high local computational overhead: current schemes require a large amount of local computation during decryption, making them unsuitable for most devices with low computing power. Summary of the Invention

[0005] This invention provides a encrypted retrieval method and system that supports hierarchical access control and user revocation. It solves the problems of high data overhead and difficulty in flexibly managing user attributes when retrieving data at the same level in the prior art. It realizes hierarchical access based on user attributes and uses an outsourced decryption method, which reduces the overhead of the user's computer and improves the query speed.

[0006] In a first aspect, the present invention provides a encrypted retrieval method supporting hierarchical access control and user revocation, applicable to data owners, the method comprising:

[0007] An inverted index related to the file set is built using keywords, a KEK tree is determined using user set and attribute set, and a hierarchical access tree is constructed using the attribute set;

[0008] The file set, the inverted index, the symmetric key, and the re-encryption key K are respectively... i Encryption is performed, resulting in file ciphertext CT1, index ciphertext CT2, symmetric key ciphertext CT3, and a re-encryption key; wherein, the symmetric key is the key used to encrypt the file set, and the re-encryption key K... i The key used to encrypt the leaf nodes of the hierarchical access tree;

[0009] Using the user attribute set and master key, generate conversion key and decryption key;

[0010] The file ciphertext CT1, the index ciphertext CT2, the symmetric key ciphertext CT3, the encrypted re-encryption key, the hierarchical access tree, and the KEK tree are sent to the cloud server, and the conversion key and the decryption key are sent to the user.

[0011] In conjunction with the first aspect, in one possible implementation, before encrypting the file set, the inverted index, the symmetric key, and the re-encryption key respectively to obtain the file ciphertext CT1, the index ciphertext CT2, the symmetric key ciphertext CT3, and the encrypted re-encryption key, the method further includes:

[0012] Perform initialization to generate the master key and public key;

[0013] Using a random element K in a multiplicative cyclic group x Generate symmetric key K SE ;

[0014] For the random element K x Use a hash function to generate random tags;

[0015] The random label and the encrypted file are used to obtain the verification key using the hash function;

[0016] Using the KEK tree, generate the minimum cover set corresponding to the user attributes.

[0017] In conjunction with the first aspect, in one possible implementation, the encryption of the file set, the inverted index, the symmetric key, and the re-encryption key, respectively, to obtain file ciphertext CT1, index ciphertext CT2, symmetric key ciphertext CT3, and the encrypted re-encryption key, includes:

[0018] Each file in the file set is encrypted using a different symmetric key to obtain the ciphertext CT1 of the file;

[0019] The inverted index is encrypted using the parameters in the public key to obtain the index ciphertext CT2;

[0020] Using the hierarchical access tree and the re-encryption key K i And the parameters in the public key, for the random element K associated with the symmetric key. x The attribute set in the hierarchical access tree is encrypted to obtain the symmetric key ciphertext CT3;

[0021] The re-encryption key K is obtained using the minimum cover set. i Encryption is performed to obtain the re-encryption key.

[0022] In conjunction with the first aspect, one possible implementation also includes:

[0023] Obtain the user's revocation attribute and re-obtain the re-encryption key to obtain the first encryption key;

[0024] The leaf nodes of the hierarchical access tree are encrypted to obtain the re-encrypted symmetric key ciphertext CT3;

[0025] Update the KEK tree and regenerate the first minimum cover set corresponding to the user attributes;

[0026] The first encryption key is encrypted using the first minimum cover set to obtain the re-encrypted encryption key;

[0027] The encrypted symmetric key ciphertext CT3, the encrypted re-encryption key, and the re-encryption key are respectively updated to the re-encrypted symmetric key ciphertext CT3, the re-encryption key, and the first encryption key.

[0028] Secondly, this invention provides a method for encrypted retrieval that supports hierarchical access control and user revocation, applied to a user terminal. The method includes:

[0029] A query request is sent to the cloud server to obtain the path key, multiple attribute group overlay sets, and encrypted re-encryption key corresponding to the query request in the KEK tree; wherein, the query request includes: user identity and user attributes;

[0030] The path key is used to perform an intersection operation with the multiple attribute group coverage sets to obtain multiple corresponding sub-KEK keys;

[0031] The encrypted re-encryption key is decrypted using the multiple sub-KEK keys to obtain the corresponding multiple re-encryption keys;

[0032] The conversion key is updated using the re-encryption key to obtain the updated conversion key;

[0033] A trapdoor is generated using keywords, random numbers, public keys, and the user attributes. The trapdoor and the update conversion key are then sent to the cloud server.

[0034] Obtain the query results returned by the cloud server; wherein, the query results include: partially decrypted ciphertext, symmetric key ciphertext, and file ciphertext;

[0035] The decrypted portion of the ciphertext is decrypted using the decryption key and the symmetric key ciphertext to obtain an unencrypted file.

[0036] In conjunction with the second aspect, in one possible implementation, the step of decrypting the partially decrypted ciphertext using the decryption key and the symmetric key ciphertext to obtain an unencrypted file includes:

[0037] The partial decryption ciphertext is decrypted using the decryption key and the symmetric key ciphertext to obtain the random element K. x ;

[0038] Using a hash function, the random element K is... x Perform a hash operation to obtain a random label;

[0039] The random label and the encrypted file are hashed to obtain the verification key;

[0040] Determine whether the calculated verification key is the same as the verification key. If they are equal, then for the random element K... x Perform calculations to obtain the symmetric key;

[0041] The encrypted file is decrypted using the symmetric key to obtain the unencrypted file.

[0042] Thirdly, this invention provides a method for encrypted retrieval that supports hierarchical access control and user revocation, applied to a cloud server. The method includes:

[0043] Obtain user attributes and keywords, and determine whether the user attributes are in the hierarchical access tree. If yes, perform the following steps; otherwise, return an empty set.

[0044] The trapdoor is used to match the encrypted index; if a match is found, the symmetric key ciphertext is returned.

[0045] The symmetric key ciphertext is partially decrypted using the updated conversion key to obtain partially decrypted ciphertext.

[0046] The partially decrypted ciphertext, symmetric key ciphertext, and file ciphertext are sent to the user terminal.

[0047] In conjunction with the third aspect, one possible implementation also includes:

[0048] Obtain the user's request to revoke the attribute, and re-obtain the re-encryption key to obtain the first encryption key;

[0049] The leaf nodes of the hierarchical access tree are encrypted to obtain the re-encrypted symmetric key ciphertext CT3;

[0050] Update the KEK tree, and regenerate the first minimum cover set corresponding to the user attributes and the updated KEK tree;

[0051] The first encryption key is encrypted using the first minimum cover set to obtain the re-encrypted encryption key;

[0052] The encrypted symmetric key ciphertext CT3, KEK tree, encrypted re-encryption key, and re-encryption key are respectively updated to the re-encrypted symmetric key ciphertext CT3, the updated KEK tree, the re-encryption key, and the first encryption key.

[0053] Fourthly, the present invention provides a encrypted retrieval system that supports hierarchical access control and user revocation, the system comprising: a data owner, a user terminal, and a cloud server;

[0054] The data owner is responsible for encrypting the data and sending the encrypted data to the cloud server.

[0055] The user terminal is used to send query requests, obtain query results, and obtain decrypted data based on the query results;

[0056] The cloud server is used to obtain the query request from the user, decrypt the query, and obtain the query result.

[0057] Fifthly, the present invention provides a computer-readable storage medium having executable instructions, wherein when a computer executes the executable instructions, it can implement a encrypted retrieval method that supports hierarchical access control and user revocation.

[0058] One or more technical solutions provided in this invention have at least the following technical effects or advantages:

[0059] (1) The present invention designs a verifiable outsourced decryption, which puts the complex decryption operation on the bilinear mapping on the server and sends part of the decryption result to the user. The user only needs to perform a simple exponential operation, which solves the problem of low decryption efficiency of low computing power devices and improves the efficiency of query.

[0060] (2) Constructing a hierarchical access tree allows users to query only the relevant access layer when making a query, without querying the overall data, which improves the computing speed and reduces the computer overhead caused by the query. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments of the present invention or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 A flowchart illustrating the steps of a encrypted retrieval method supporting hierarchical access control and user revocation provided in an embodiment of the present invention;

[0063] Figure 2 A schematic diagram of an inverted index provided in an embodiment of the present invention;

[0064] Figure 3 This is a schematic diagram of a hierarchical access tree provided in an embodiment of the present invention;

[0065] Figure 4 A line graph showing the change in query request generation time with the number of user attributes, provided in an embodiment of the present invention.

[0066] Figure 5 Line graphs showing the changes in outsourced decryption time and local decryption time with the number of users, provided in embodiments of the present invention;

[0067] Figure 6 This is a schematic diagram of a encrypted retrieval system that supports hierarchical access control and user revocation, provided in an embodiment of the present invention. Detailed Implementation

[0068] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0069] This invention provides a encrypted retrieval method that supports hierarchical access control and user revocation, applicable to data owners, such as... Figure 1 As shown, the method includes the following steps S101 to S104.

[0070] S101 uses keywords to build an inverted index related to the file set, uses user set and attribute set to determine key encryption key tree (KEK tree), and uses attribute set to build hierarchical access tree.

[0071] For example, this invention uses an inverted index to construct a mapping relationship between a set of keywords and a set of files. In the inverted index, each keyword maps to a file number containing that keyword. Therefore, the inverted index makes it convenient to retrieve files containing those keywords using that keyword. Figure 2 As shown, this represents the relationship between document ID, document content, and keywords. An inverted index is built based on the document ID and document content, including the document ID and keywords.

[0072] For example, the hierarchical access tree proposed in this invention is for implementing hierarchical control access to files. In a hierarchical access tree, each subtree rooted at a non-leaf node represents an access policy, and the entire access tree is a tree structure aggregating multiple access policies. The non-leaf nodes of the hierarchical access tree represent threshold gates, such as AND-gate, OR-gate, or OUTOF-gate, while the leaf nodes represent attributes. The specific form of the hierarchical access tree is as follows: Figure 3 As shown.

[0073] For each node in the hierarchical access tree, the degree of each node is set as d = k-1, where k represents the threshold. The threshold for leaf nodes is 1. The hierarchical access tree is constructed from top to bottom.

[0074] Assuming the root node of the hierarchical access tree is A, first randomly select a random number s from the prime group. A Then randomly select d A Remaining values Then, together they generate the polynomial of the root node A, specifically represented as:

[0075]

[0076] For all other non-leaf nodes, let X be the set of non-leaf nodes. For each x∈X, compute the secret value based on the polynomial of the parent node:

[0077] s x =q x (0)=q parent (index(x))

[0078] Here, index(x) represents the position of node x among all child nodes of its parent node, and parent(x) represents the parent node of x.

[0079] Then randomly select d x Remaining values Then together they generate a polynomial for x.

[0080]

[0081] The polynomial of each node in the hierarchical access tree is actually the access strategy for each node.

[0082] For example, to enable dynamic user revocation, this scheme uses a key encryption key (KEK) tree. The key encryption key tree is a user-based binary tree, where each leaf node represents a user, and all nodes store a different key (KEK).

[0083] Let U={u1,u2,…u n} is the set of all users in the system, G i Let G represent the set of users who possess attribute i. Attribute group G i Minimal cover set cover(G) i ) indicates that it can cover G i The minimum KEK set of all users in G, i.e. i All users are descendant nodes of a certain element in the overlay set. Path key PK i Let G represent the set of all KEK nodes from the root node to a certain leaf node. Therefore, for G... i Each user in the system has one and only one KEK=PK. i ∩cover(G i ), for those not in G i Users in this context do not have such a KEK, and this property can be used to achieve flexible user revocation.

[0084] Before step S102, the method further includes: (1) performing initialization to generate a master key and a public key. Specifically, the master key MSK and the public key PK are represented as follows:

[0085] PK = {g,g a ,gb ,g c ,g β ,e(g,g) α}

[0086] MSK = {a, b, c, α, β}

[0087] Where e(g,g) denotes the bilinear mapping: G×G→G T , g represents the generator of the multiplicative cyclic group G, and a, b, c, α, β represent random elements over a finite field.

[0088] (2) Using the random element K on group G x Generate symmetric key K SE Specifically, for each file pair, a random element K is used. x Each random element K x Corresponding to a symmetric key K SE .

[0089] (3) For random element K x Use a hash function to generate a random tag Tag0.

[0090] (4) The random tag Tag0 and the file ciphertext CT1 are hashed to obtain the verification key VK. The obtained verification key VK is used for verification during the decryption of the outsourced package.

[0091] (5) Use the KEK tree to generate the minimum cover set corresponding to the user attributes.

[0092] S102, respectively, the file set, inverted index, symmetric key, and re-encryption key K are processed. i Encryption yields the file ciphertext CT1, index ciphertext CT2, symmetric key ciphertext CT3, and the re-encryption key; where the symmetric key is the key used to encrypt the file set, and the re-encryption key K... i The key used to encrypt the leaf nodes of the hierarchical access tree.

[0093] Specifically, in step S102, the file set, inverted index, symmetric key and re-encryption key are encrypted respectively to obtain file ciphertext CT1, index ciphertext CT2, symmetric key ciphertext CT3 and encrypted re-encryption key, including the following steps S1021 to S1024.

[0094] S1021, each file in the file set is encrypted using a different symmetric key to obtain the ciphertext CT1. The ciphertext CT1 is specifically represented as: CT1 = Enc(K SE M x ).

[0095] S1022, using the parameters in the public key, encrypt the inverted index to obtain the index ciphertext CT2. Specifically, given the parameters a, b, c and the previously constructed inverted index, for a given keyword w, randomly select μ, where μ is a random number from group G. Calculate... Meanwhile, if w belongs to file M x ,calculate:

[0096] Where H0 is a pre-defined hash function H0: s x This is the secret value corresponding to the hierarchical access tree defined earlier. If w does not belong to M x Set z x =1,z' x If = 1, then the final index ciphertext is:

[0097] CT2={z x ,z' x},x∈X

[0098] S1023, utilizing a hierarchical access tree and a re-encryption key K i And the parameters in the public key, for the random element K associated with the symmetric key. x The attribute set in the hierarchical access tree is then encrypted to obtain the symmetric key ciphertext CT3. Specifically, for efficiency reasons, only the random element K related to the symmetric key used when encrypting the file is encrypted using the hierarchical access tree. x It does not directly encrypt the files in the file set. The specific process is as follows: First, input the hierarchical access tree, and the K selected when generating the key. x Calculate separately:

[0099]

[0100] For all leaf nodes, calculate:

[0101]

[0102] Where att(y) represents the correspondence between leaf nodes and attributes in the hierarchical access tree, H1:{0,1} * →G can map elements to group G, then the final ciphertext is:

[0103]

[0104] S1024, using the minimum cover set to re-encrypt the key K iEncryption is performed to obtain the re-encryption key. Specifically, to achieve dynamic revocation of user attributes, the ciphertext needs to be re-encrypted using the key generated by the key encryption key tree. For each attribute group G... i Choose a re-encryption key K i Re-encryption key K i It is a random number, and then the ciphertext associated with the leaf node is re-encrypted:

[0105]

[0106]

[0107] After re-encrypting the ciphertext associated with the leaf nodes, the KEK pair in the attribute group overlay set is used to overwrite K. i Perform symmetric encryption, save the re-encrypted ciphertext, and simultaneously send the symmetrically encrypted ciphertext to the user.

[0108] S103, using the user attribute set and master key, generate a conversion key TK and a decryption key DK. Specifically, to achieve outsourced decryption, it is necessary to generate a conversion key TK and a decryption key DK. Using the user attribute set and master key, calculate the conversion key TK, then send the keys (TK and DK) to the user, and send the attribute group relationship G of each attribute to the cloud server.

[0109] The conversion key is represented as:

[0110]

[0111] Where r represents a randomly selected random number, and the decryption key is represented as DK = α′.

[0112] S104, send the file ciphertext CT1, index ciphertext CT2, symmetric key ciphertext CT3, encrypted re-encryption key, hierarchical access tree, and KEK tree to the cloud server, and send the conversion key TK and decryption key DK to the user.

[0113] On the data owner's side, user attributes can also be revoked, specifically including the following steps.

[0114] (1) Obtain the user's revocation attribute and re-obtain the re-encryption key to obtain the first encryption key.

[0115] (2) Encrypt the leaf nodes of the hierarchical access tree to obtain the re-encrypted symmetric key ciphertext CT3.

[0116] (3) Update the KEK tree and regenerate the first minimum cover set corresponding to the user attributes.

[0117] (4) Encrypt the first encryption key using the first minimum covering set to obtain the re-encrypted key.

[0118] (5) Update the encrypted symmetric key ciphertext CT3, the encrypted re-encryption key and the re-encryption key to the re-encrypted symmetric key ciphertext CT3, the re-encryption key and the first encryption key respectively.

[0119] For example, when a user leaves the data owner entity, their original access permissions need to be revoked. This method achieves this by changing the attribute group membership. Assuming attribute i is revoked for the user, the data owner needs to randomly select a new K′. i Then, for the ciphertext C y ,C' y The ciphertext for attribute i is modified as follows:

[0120] The ciphertext for other attributes remains unchanged. Finally, the attribute group is redefined, the minimum cover set of the new attribute group is selected, and the KEK pair K′ is reselected. i Encryption is used. This allows you to revoke a specific attribute for a designated user without affecting other users.

[0121] This invention provides a method for encrypted retrieval that supports hierarchical access control and user revocation, applied to the user end. The method includes the following steps S201 to S207.

[0122] S201, using user attributes, obtain the path key corresponding to the user attributes in the KEK tree and multiple attribute group coverage sets.

[0123] S202, use the path key to perform an intersection operation with multiple attribute group overlay sets to obtain multiple corresponding sub-KEK keys.

[0124] S203, use multiple sub-KEK keys to decrypt the encrypted re-encryption key to obtain the corresponding multiple re-encryption keys.

[0125] S204, Obtain the conversion key sent by the data owner, and update the conversion key using the re-encryption key to obtain the updated conversion key TK'. Specifically, for example, when a user wants to perform a retrieval, it is necessary to find the intersection of the user's path key in the KEK tree and the attribute group cover set based on the user's attributes, obtaining multiple corresponding KEKs. Then, the KEKs are used to decrypt and obtain the key K used for re-encryption. i Then update the conversion key:

[0126]

[0127] S205 generates a trapdoor using keywords, random numbers, a public key, and user attributes, and sends the trapdoor and update / transformation key TK' to the cloud server. Specifically, if a user wants to search for files containing the keyword w′, a search trapdoor must first be generated based on the keyword and the user's own attribute set.

[0128] Calculate the trapdoor using the user's randomly selected random number s, the user's query keywords, and the user's attribute set:

[0129]

[0130] in, T2 = g cs ,T3=(D w ) s Finally, the generated trapdoor and the update conversion key TK' are sent to the cloud server.

[0131] S206, retrieve the query results returned by the cloud server; the query results include: partially decrypted ciphertext CT′, file ciphertext CT1, and symmetric key ciphertext CT3.

[0132] S207. Using the decryption key DK and the symmetric key ciphertext CT3, the partial decryption ciphertext CT′ is decrypted to obtain the unencrypted file.

[0133] Specifically, in step S207, the decryption key DK and the symmetric key ciphertext CT3 are used to decrypt part of the decryption ciphertext CT′ to obtain an unencrypted file, including the following steps S2071 to S2075.

[0134] S2071, using the decryption key DK and the symmetric key ciphertext CT3, decrypt part of the decrypted ciphertext CT′ to obtain the random element K. x Specifically, use the decryption key DK to decrypt and obtain K. x :

[0135]

[0136] S2072, using a hash function, for random element K x Perform a hash operation to obtain a random label.

[0137] S2073, perform a hash operation on the random tag and the encrypted file to obtain the verification key VK′.

[0138] S2074, determine whether the calculated verification key VK′ is the same as the verification key VK. If they are equal, then for the random element K... x The symmetric key K is obtained through calculation. SE .

[0139] Decrypt to obtain K x Afterwards, integrity verification is required, using the previously obtained hash function to check K. x Hash the key to Tag0, then hash Tag0 together with the ciphertext CT1 to generate the verification key VK′, and verify whether it is equal to the previous VK.

[0140] S2075, using symmetric key K SE Decrypt the encrypted file to obtain the unencrypted file. If they are equal, then check K. x Perform calculations to obtain the key K for encrypting the file. x Finally, use this key K. x Decrypt to obtain the original file.

[0141] This invention provides a method for encrypted retrieval that supports hierarchical access control and user revocation, applied to a cloud server. The method includes the following steps S301 to S304.

[0142] S301: Obtain user attributes and keywords, and determine whether the user attributes are in the hierarchical access tree. If yes, execute the following steps; otherwise, return an empty set. Specifically, after receiving the query request, the cloud server first checks whether the user's attributes satisfy a certain level in the hierarchical access structure. If so, it performs a match on the encrypted index based on the trapdoor.

[0143] Specifically, when performing attribute determination, for leaf nodes, if the user's attribute is in the defined attribute set, the calculation is performed according to the following formula, where θ = e(g, g):

[0144]

[0145] For all non-leaf nodes, calculate using Lagrange interpolation based on all their child nodes:

[0146]

[0147] Among them, S x Let S' represent the set of child nodes of node x, where j = index(x′) and S' x ={index(x′):x′∈S x}

[0148] S302 uses a trapdoor to match the encrypted index. If a match is found, the symmetric key ciphertext is returned. Specifically, the index ciphertext CT2 is compared with the generated trapdoor T. w′ The following formula is used to verify whether a match exists:

[0149]

[0150] If a match is found, the corresponding ciphertext is returned; otherwise, an empty string is returned.

[0151] S303, use the updated conversion key to partially decrypt the symmetric key ciphertext, obtaining partially decrypted ciphertext. Specifically, first, the conversion key TK' needs to be used to partially decrypt the ciphertext, generating partially decrypted ciphertext:

[0152]

[0153] S304, send the partially decrypted ciphertext, symmetric key ciphertext, and file ciphertext to the user terminal, that is, send the partially decrypted ciphertext CT′, file ciphertext CT1, and symmetric key ciphertext CT3. Send to the user's client.

[0154] By outsourcing the complex query part to a cloud server, the problem of low decryption efficiency on devices with low computing power is solved.

[0155] On the cloud server side, it also includes the ability to undo user attributes, specifically including:

[0156] (1) Obtain the user's request to revoke the attribute and re-obtain the re-encryption key to obtain the first encryption key.

[0157] (2) Encrypt the leaf nodes of the hierarchical access tree to obtain the re-encrypted symmetric key ciphertext CT3.

[0158] (3) Update the KEK tree and regenerate the first minimum cover set corresponding to the user attributes and the updated KEK tree.

[0159] (4) Encrypt the first encryption key using the first minimum covering set to obtain the re-encrypted key.

[0160] (5) Update the encrypted symmetric key ciphertext CT3, KEK tree, encrypted re-encryption key and re-encryption key respectively to the re-encrypted symmetric key ciphertext CT3, updated KEK tree, re-encryption key and first encryption key.

[0161] For example, when a user leaves the data owner entity, their original access permissions need to be revoked. This method achieves this by changing the attribute group membership. Assuming attribute i is revoked for the user, the cloud server needs to randomly select a new attribute and K′. i Then, for the ciphertext C y ,C' y The ciphertext for attribute i is modified as follows:

[0162] The ciphertext for other attributes remains unchanged. Finally, the attribute group is redefined, the minimum cover set of the new attribute group is selected, and the KEK pair K′ is reselected. i Encryption is used. This allows you to revoke a specific attribute for a designated user without affecting other users.

[0163] This invention provides a encrypted retrieval system that supports hierarchical access control and user revocation. The system, as follows: Figure 6 The data includes: the data owner, the user terminal, and the cloud server.

[0164] The data owner encrypts the data and sends the encrypted data to the cloud server. Specifically, the data includes: a file set, an inverted index, a symmetric key, and a re-encryption key K. i The data owner processes the file set, extracts keywords, builds an inverted index, encrypts the data, and sends the file ciphertext CT1, index ciphertext CT2, symmetric key ciphertext CT3, the encrypted re-encryption key, hierarchical access tree, and KEK tree to the cloud server. The conversion key TK and decryption key DK are sent to the user.

[0165] The client-side is used to send query requests, obtain query results, and retrieve decrypted data based on the query results. Specifically, a query request is first sent to the cloud server, which includes the user attribute set and user identity. The server then obtains the path key corresponding to the requested data in the KEK tree, multiple attribute group overlay sets, and the encrypted re-encryption key.

[0166] Using the obtained information, calculations are performed to obtain the updated conversion key;

[0167] By using the query keywords, the trapdoor is obtained. Finally, by using the trapdoor and the updated conversion key, the partially decrypted ciphertext, the symmetric key ciphertext, and the file ciphertext are obtained.

[0168] The decryption key DK and the symmetric key ciphertext CT′ are used to decrypt part of the ciphertext to obtain the unencrypted file.

[0169] The cloud server is used to obtain query requests from users, decrypt the queries, and obtain query results. Specifically, the cloud server saves encrypted data sent by the data owner, queries the encrypted data using the user's query request, and returns the query results to the user.

[0170] This invention not only enables encrypted keyword retrieval based on document hierarchy, but also has the following advantages:

[0171] Functionality: It enables dynamic cancellation of user attributes, which is more in line with real-world scenarios and more practical compared to the original hierarchical attribute-based encryption scheme.

[0172] Efficiency: Compared with existing technologies, this solution significantly reduces the computational overhead on the user end. This invention designs a verifiable outsourced decryption method, performing complex decryption operations on bilinear mappings on the server and sending part of the decryption results to the user end. The user end only needs to perform a simple exponential operation, solving the problem of low decryption efficiency on devices with low computing power. Figure 4 To generate a line graph showing how query request time changes with the number of user attributes. Figure 5 Line graphs showing the changes in outsourced decryption time and local decryption time as a function of the number of users.

[0173] Depend on Figure 4 It can be seen that the trapdoor generation time of this invention varies sublinearly with user attributes; when the number of user attributes is 50, the trapdoor generation time is only 0.596 seconds. From Figure 5 It can be seen that outsourced decryption takes significantly longer than local decryption. When the number of user attributes is between 10 and 50, local decryption requires only 10 milliseconds. Therefore, compared with existing solutions, this invention can greatly reduce the computational overhead on the user end and can be widely applied in practical scenarios.

[0174] The methods, systems, or modules described in this invention can be implemented in a computer-readable program code manner. The controller can be implemented in any suitable manner, for example, as a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of a memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code manner, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included within it for implementing various functions can also be considered as structures within the hardware component. Alternatively, the device used to implement various functions can be viewed as either a software module that implements the method or a structure within a hardware component.

[0175] The various endpoints in the system described in this invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, classes, etc., that perform a specific task or implement a specific abstract data type. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0176] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software and necessary hardware. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, or it can be embodied in the process of data migration.

[0177] This invention provides a computer-readable storage medium having executable instructions. When a computer executes the executable instructions, it can implement a encrypted retrieval method that supports hierarchical access control and user revocation. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, mobile terminal, server, or network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of this invention.

[0178] The various embodiments described in this specification are presented in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. All or part of this invention can be used in numerous general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, mobile communication terminals, multiprocessor systems, microprocessor-based systems, programmable electronic devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices, etc.

[0179] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the present invention.

Claims

1. A encrypted retrieval method supporting hierarchical access control and user revocation, applied to data owners, characterized in that, include: An inverted index related to the file set is built using keywords, a KEK tree is determined using user set and attribute set, and a hierarchical access tree is constructed using the attribute set; Perform initialization, generate master and public keys, and utilize random elements from the multiplicative cyclic group. Generate a symmetric key For the random element A random label is generated using a hash function. The random label and the encrypted file are used together with the hash function to obtain a verification key. The KEK tree is then used to generate a minimum cover set corresponding to the user attributes. The file set, the inverted index, the symmetric key, and the re-encryption key are respectively... Encryption is performed to obtain the ciphertext of the file. Index ciphertext Symmetric key ciphertext and the re-encryption key; wherein, the symmetric key is the key used to encrypt the file set, and the re-encryption key The key used to encrypt the leaf nodes of the hierarchical access tree; Using the user attribute set and master key, generate conversion key and decryption key; The encrypted file The index ciphertext The symmetric key ciphertext The encrypted re-encryption key, the hierarchical access tree, and the KEK tree are sent to the cloud server, and the conversion key and the decryption key are sent to the user terminal. Obtain the user's revocation attribute and re-obtain the re-encryption key to obtain the first encryption key; encrypt the leaf nodes of the hierarchical access tree to obtain the re-encrypted symmetric key ciphertext. Update the KEK tree and regenerate the first minimum cover set corresponding to the user attributes; encrypt the first encryption key using the first minimum cover set to obtain the re-encrypted encryption key; update the encrypted symmetric key ciphertext accordingly. The encrypted re-encryption key and the re-encryption key are the re-encrypted symmetric key ciphertext. The re-encryption key and the first encryption key.

2. The encrypted retrieval method supporting hierarchical access control and user revocation as described in claim 1, applied to data owners, is characterized in that... The file set, the inverted index, the symmetric key, and the re-encryption key are encrypted respectively to obtain the corresponding file ciphertext. Index ciphertext Symmetric key ciphertext And the re-encryption key, including: Using different symmetric keys respectively Each file in the file set is encrypted to obtain the ciphertext of the file. ; The inverted index is encrypted using the parameters in the public key to obtain the index ciphertext. ; Using the hierarchical access tree and the re-encryption key And the parameters in the public key, for the random elements associated with the symmetric key. The attribute set in the hierarchical access tree is encrypted to obtain the symmetric key ciphertext. ; The re-encryption key is obtained using the minimum cover set. Encryption is performed to obtain the re-encryption key.

3. A method for encrypted retrieval supporting hierarchical access control and user revocation, applied to the user terminal as described in claim 1, characterized in that, include: A query request is sent to the cloud server to obtain the path key, multiple attribute group overlay sets, and encrypted re-encryption key corresponding to the query request in the KEK tree; wherein, the query request includes: user identity and user attributes; The path key is used to perform an intersection operation with the multiple attribute group coverage sets to obtain multiple corresponding sub-KEK keys; The encrypted re-encryption key is decrypted using the multiple sub-KEK keys to obtain the corresponding multiple re-encryption keys; The conversion key is updated using the re-encryption key to obtain the updated conversion key; A trapdoor is generated using keywords, random numbers, public keys, and the user attributes. The trapdoor and the update conversion key are then sent to the cloud server. Obtain the query results returned by the cloud server; wherein, the query results include: partially decrypted ciphertext, symmetric key ciphertext, and file ciphertext; The decrypted portion of the ciphertext is decrypted using the decryption key and the symmetric key ciphertext to obtain an unencrypted file.

4. The encrypted retrieval method supporting hierarchical access control and user revocation as described in claim 3, applied to the user terminal as described in claim 1, is characterized in that... The step of decrypting the partial ciphertext using the decryption key and the symmetric key ciphertext to obtain an unencrypted file includes: The partial decryption ciphertext is decrypted using the decryption key and the symmetric key ciphertext to obtain random elements. ; Using a hash function, the random element Perform a hash operation to obtain a random label; The random label and the encrypted file are hashed to obtain the verification key; Determine whether the calculated verification key is the same as the verification key. If they are equal, then apply the random element... Perform calculations to obtain the symmetric key; The encrypted file is decrypted using the symmetric key to obtain the unencrypted file.

5. A method for encrypted retrieval supporting hierarchical access control and user revocation, applied to the cloud server as described in claim 3, characterized in that, include: Obtain user attributes and keywords, and determine whether the user attributes are in the hierarchical access tree. If yes, perform the following steps; otherwise, return an empty set. The trapdoor is used to match the encrypted index; if a match is found, the symmetric key ciphertext is returned. The symmetric key ciphertext is partially decrypted using the updated conversion key to obtain partially decrypted ciphertext. The partially decrypted ciphertext, symmetric key ciphertext, and file ciphertext are sent to the user terminal.

6. The encrypted retrieval method supporting hierarchical access control and user revocation as described in claim 5, applied to the cloud server as described in claim 3, is characterized in that... Also includes: Obtain the user's request to revoke the attribute, and re-obtain the re-encryption key to obtain the first encryption key; The leaf nodes of the hierarchical access tree are encrypted to obtain the re-encrypted symmetric key ciphertext. ; Update the KEK tree, and regenerate the first minimum cover set corresponding to the user attributes and the updated KEK tree; The first encryption key is encrypted using the first minimum cover set to obtain the re-encrypted encryption key; Update the encrypted symmetric key ciphertext respectively The KEK tree, the encrypted re-encryption key, and the re-encryption key are the ciphertext of the re-encrypted symmetric key. The updated KEK tree, the re-encrypted key, and the first encryption key.

7. A ciphertext retrieval system supporting hierarchical access control and user revocation, used to implement the ciphertext retrieval method as described in any one of claims 1 to 6, characterized in that, include: Data owner, client, and cloud server; The data owner is responsible for encrypting the data and sending the encrypted data to the cloud server. The user terminal is used to send query requests, obtain query results, and obtain decrypted data based on the query results; The cloud server is used to obtain the query request from the user, decrypt the query, and obtain the query result.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium has executable instructions, and when a computer executes the executable instructions, it can implement the encrypted retrieval method supporting hierarchical access control and user revocation as described in any one of claims 1-6.

Images