Searchable encryption methods, devices, equipment, storage media, and software products.

Abstract

This invention provides a searchable encryption method, apparatus, device, storage medium, and program product. The method includes: responding to a search trapdoor submitted by a data access tenant, determining a keyword in the search trapdoor; determining whether a matching ciphertext exists based on system public parameters, the keyword, and the trapdoor component of the search trapdoor; determining that a matching ciphertext exists, and sending the intermediate ciphertext corresponding to the ciphertext to the data access tenant, so that the data access tenant can access the data corresponding to the ciphertext according to the data access tenant's tenant key; the search trapdoor is obtained based on the keyword of the data to be accessed by the data access tenant, system public parameters, the data access tenant's tenant key, and the data access tenant's attribute vector; the ciphertext is obtained based on the keyword of the data to be shared by the data sharing tenant, the access vector of the access policy, system public parameters, and offline ciphertext.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to a searchable encryption method, apparatus, device, storage medium, and program product. Background Technology

[0002] Data flow is central to cloud computing services. Some tenants store their local data in the cloud or entrust it to the cloud computing platform for analysis and processing. Correspondingly, tenants can also access cloud computing platform service data based on their qualifications and payments, or obtain data uploaded by other tenants for their use. Whether considering the commercial revenue of the cloud computing platform or the privacy and fairness of tenant data, the cloud computing platform needs to implement an access control mechanism to ensure that unpaid (including overdue) tenants or those without authorization for specific functions cannot access the corresponding data. Specifically, cloud computing tenant data access control faces the following challenges:

[0003] Fine-grained and diverse access control: It is necessary to ensure that only authorized tenants or systems can decrypt and access encrypted data. At the same time, fine-grained and diverse data services should be provided according to the characteristics and functional requirements of tenants.

[0004] Anonymity and tenant privacy: Traditional access control requires cloud computing platforms to confirm and verify the identity of tenants, which may further leak private information, including personal identification information, financial data, and medical records, thereby causing trouble and harm to tenants.

[0005] Secure Search: Access control is typically implemented using cryptographic algorithms, but because data is encrypted, traditional data search methods cannot perform search operations on encrypted data. Downloading all encrypted data from the cloud, decrypting it one by one, and then searching would impose an unbearable amount of communication, computing, and storage overhead on tenants.

[0006] Efficiency: Cloud computing platforms are typically powerful hardware infrastructures consisting of multiple distributed server clusters, which enable them to handle various computing needs. However, tenant devices are usually lightweight devices such as personal computers, mobile terminals, or vehicle terminals. The computational and storage overhead brought about by the complex algebraic structure of cryptographic algorithms poses a challenge to the lightweight terminal devices of tenants.

[0007] Therefore, an efficient and secure search technology is needed that allows searching directly on ciphertext without decryption. Summary of the Invention

[0008] This invention provides a searchable encryption method, apparatus, device, storage medium, and program product to address the deficiencies in the prior art and achieve an attribute-based searchable encryption method for privacy protection.

[0009] This invention provides a searchable encryption method, comprising:

[0010] In response to a search trap submitted by a data access tenant, determine the keywords in the search trap;

[0011] Based on system common parameters, the keyword and the trapdoor component of the search trapdoor search the stored ciphertext to determine whether there is a matching ciphertext.

[0012] Once a matching ciphertext is found, the intermediate ciphertext corresponding to the ciphertext is sent to the data access tenant so that the data access tenant can access the data corresponding to the ciphertext based on the tenant's tenant key.

[0013] The search trapdoor is obtained based on the keywords of the data to be accessed by the data access tenant, system public parameters, the tenant key of the data access tenant, and the attribute vector of the data access tenant.

[0014] The ciphertext is obtained based on the keywords of the data to be shared by the data sharing tenant, the access vector of the access policy, system public parameters, and offline ciphertext.

[0015] According to a searchable encryption method provided by the present invention, the method further includes:

[0016] Construct a first set of positions and a second set of positions corresponding to the access policy, and a third set of positions corresponding to the user attributes. The first set of positions includes the first positive value attribute positions of the access policy, the second set of positions includes the wildcard attribute positions of the access policy, and the third set of positions includes the second positive value attribute positions of the user attributes.

[0017] Based on the first positive attribute position in the first position set and the wildcard attribute position in the second position set, a Lagrange polynomial is constructed using the Lagrange interpolation theorem, and a set of factors is extracted from the Lagrange polynomial.

[0018] The aggregate value is determined based on the first positive attribute position in the first position set and the wildcard attribute position in the second position set;

[0019] Based on a set of factors, aggregate values, and preset zero values, an access vector corresponding to the access strategy is constructed.

[0020] Based on all the first positive attribute positions in the first position set and the second positive attribute positions in the third position set, the access vector elements are determined;

[0021] An attribute vector corresponding to the user attribute is constructed based on the access vector elements and the preset tag vector; wherein, the attribute vector and the access vector are two vectors of equal length.

[0022] According to a searchable encryption method provided by the present invention, the tenant key is obtained in the following manner:

[0023] Obtain the tenant's attribute vector and identity ID;

[0024] Based on the identity ID, system public parameters, system master key, and the first random element, a tenant key component is generated;

[0025] The tenant key is generated based on the tenant key component and the attribute vector.

[0026] According to a searchable encryption method provided by the present invention, the search threshold is obtained by the data access tenant in the following manner:

[0027] Determine the keywords for the data to be accessed;

[0028] Based on the system's common parameters, the tenant's key for the data access tenant, and the keyword, three trapdoor components are identified;

[0029] The search threshold is generated based on the three trapdoor components and the attribute vector of the data access tenant.

[0030] According to a searchable encryption method provided by the present invention, the ciphertext is obtained through the following means:

[0031] Determine the data to be shared and the access policy for the data to be shared, and convert the access policy into an access vector;

[0032] Based on the access vector, system public parameters, offline ciphertext, and the first keyword of the data to be shared, a first ciphertext component is determined; the offline ciphertext is obtained based on a second random element and the offline ciphertext component, and the offline ciphertext component is obtained based on system public parameters and a third random element.

[0033] Based on the first ciphertext component and the offline ciphertext component, the ciphertext of the data to be shared is obtained.

[0034] According to a searchable encryption method provided by the present invention, the method further includes:

[0035] The tenant key component in the tenant key of the tenant to be tracked is decrypted to obtain a decryption result, which includes an encrypted identity ID and a Lagrange polynomial that matches the encrypted identity ID;

[0036] If the decryption result is found to exist in a set of discrete secret data points, it is determined that the tenant key of the tenant to be tracked has not been leaked.

[0037] According to a searchable encryption method provided by the present invention, the method further includes:

[0038] If the decryption result does not exist in the set of discrete secret data points, it is determined that the tenant key of the tenant to be tracked has been leaked;

[0039] The Lagrange polynomial matching the encrypted identity ID is reconstructed based on the discrete data point set and the Lagrange interpolation theorem to obtain the reconstructed Lagrange polynomial.

[0040] Malicious tenant identification is performed on the tenant to be tracked based on the encrypted identity ID matching Lagrange polynomial and the reconstructed Lagrange polynomial.

[0041] The present invention also provides a searchable encryption device, comprising:

[0042] A first searchable encryption module is used to determine the keywords in the search trapdoor in response to a search trapdoor submitted by a data access tenant.

[0043] The second searchable encryption module is used to search the stored ciphertext based on system public parameters, the keyword and the trapdoor component of the search trapdoor to determine whether there is a matching ciphertext.

[0044] The third searchable encryption module is used to determine that there is a matching ciphertext and send the intermediate ciphertext corresponding to the ciphertext to the data access tenant so that the data access tenant can access the data corresponding to the ciphertext according to the tenant key of the data access tenant.

[0045] The search trapdoor is obtained based on the keywords of the data to be accessed by the data access tenant, system public parameters, the tenant key of the data access tenant, and the attribute vector of the data access tenant.

[0046] The ciphertext is obtained based on the keywords of the data to be shared by the data sharing tenant, the access vector of the access policy, system public parameters, and offline ciphertext.

[0047] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the searchable encryption method as described above.

[0048] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the searchable encryption method as described above.

[0049] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the searchable encryption methods described above.

[0050] The present invention provides a searchable encryption method, apparatus, device, storage medium, and program product, comprising: responding to a search trapdoor submitted by a data access tenant; determining a keyword in the search trapdoor; determining whether a matching ciphertext exists based on system public parameters, the keyword, and the trapdoor component of the search trapdoor; upon determining that a matching ciphertext exists, sending the intermediate ciphertext corresponding to the ciphertext to the data access tenant, so that the data access tenant can access the data corresponding to the ciphertext according to the data access tenant's tenant key; the search trapdoor is obtained based on the keyword of the data to be accessed by the data access tenant, system public parameters, the data access tenant's tenant key, and the data access tenant's attribute vector; the ciphertext is obtained based on the keyword of the data to be shared by the data sharing tenant, the access vector of the access policy, system public parameters, and offline ciphertext. The present invention, by converting tenant attributes and access policies into two equal-length vectors and implementing access control through vector inner product, replaces the complex access control based on secret sharing and recovery in traditional related technologies. This is not only very user-friendly for lightweight tenant terminals, but also hides the tenant's attribute privacy while performing access control and search. Based on this, the present invention further transforms the keyword search trapdoor matching process of ciphertext search into vector inner product operation, thereby realizing fine-grained ciphertext keyword search with less computational overhead. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0052] Figure 1 This is a schematic diagram of a scenario for the searchable encryption method provided by the present invention;

[0053] Figure 2 This is one of the flowcharts of the searchable encryption method provided by the present invention;

[0054] Figure 3 This is the second flowchart of the searchable encryption method provided by the present invention;

[0055] Figure 4 This is a schematic diagram of the structure of the searchable encryption device provided by the present invention;

[0056] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0058] An analysis of the technical challenges and current research and application progress of tenant access control in cloud computing reveals that tenant-oriented data access control in cloud computing primarily involves two technical research areas: how to implement a secure, flexible, and efficient access control mechanism, and how to allow tenants efficient encrypted search capabilities before accessing data. However, regarding access control mechanisms, although some role-based or attribute-based access control methods have been proposed, they still suffer from the following problems and limitations:

[0059] First, it is difficult to effectively protect tenant privacy. For example, although access control based on anonymous encryption technology can hide the tenant's identity, the connection between the anonymous tenant and the data they access is still obvious. Although attribute-based encryption can provide better flexibility, the tenant's sensitive information may still be leaked from the public access policy.

[0060] Secondly, the efficiency and performance are poor. The current mainstream attribute-based access control protocol algorithms have complex structures, which still imposes a relatively heavy computational and storage burden on tenants.

[0061] Finally, neither anonymous encryption nor attribute-based encryption can effectively regulate or constrain the flow or malicious use of tenant keys, which compromises the security of cloud computing platforms and leads to key abuse and malicious access.

[0062] In cloud-based encrypted search, public-key searchable encryption and symmetric searchable encryption are hot topics in academia and industry, respectively. Public-key searchable encryption offers strong scalability and diverse functionality, meeting various encrypted search needs, but its performance is low, making it difficult to deploy in practice. Symmetric searchable encryption, while offering higher performance, has very limited application models. Therefore, balancing availability and performance in searchable encryption remains a challenging problem that current technologies have not yet solved.

[0063] To address the shortcomings of existing technologies, this invention proposes a searchable encryption method and an attribute-based access control strategy based on inner product operations. The method involves transforming the tenant attribute set and access structure into two equal-length vectors, and then implementing access control through the vector inner product. This replaces the complex secret-sharing and recovery-based access control methods found in traditional related technologies, making it highly user-friendly for lightweight tenant devices. Furthermore, building upon the attribute-based access control strategy inherently avoids the leakage of user identity privacy; in addition, it hides tenant attribute privacy while performing access control and searching.

[0064] Furthermore, based on the aforementioned attribute-based access control strategy using inner product operations, the keyword and index matching process for ciphertext search is also transformed into vector inner product operations, achieving fine-grained ciphertext keyword search with relatively low computational overhead.

[0065] Finally, through careful algorithm design, the tenant key does not expose any information related to the tenant's identity or attribute privacy, thus achieving key anonymity. However, in the event of malicious behavior by the tenant (such as selling the key for profit) or key leakage, the specific tenant identity corresponding to the key can still be traced to hold them accountable.

[0066] It should be noted here that the reference is... Figure 1 The searchable encryption method proposed in this embodiment mainly involves data interaction among three types of entities in the cloud computing system: cloud administrators, tenants, and the cloud computing platform. Tenants can be further divided into tenants who upload encrypted data or data-sharing tenants (referred to as Tenant A) and tenants who access encrypted data or data-accessing tenants (referred to as Tenant B). The specific definitions of these entities are as follows:

[0067] The cloud administrator is a trusted entity responsible for initializing and managing the entire system and holding the system's master key. It neither colludes with any other entity nor is it easily vulnerable to attack. When it receives a registration request from a tenant, it distributes tenant keys based on the tenant's attributes. In the event of tenant key leakage or misuse, the cloud administrator can analyze anonymous tenant keys to trace the owner of that key, i.e., the responsible party.

[0068] A tenant is a user who enjoys cloud computing services. They can encrypt local data and upload it to the cloud platform, and can also use their own keys to search and access encrypted data. It is an untrusted entity, potentially vulnerable to attack, and has an incentive to illegally access cloud computing services through various means.

[0069] Cloud computing platforms provide various services to tenants. They can store encrypted data uploaded by tenants and provide it to other tenants with authorization, or process data and generate their own encrypted data for tenant access. In particular, to provide flexibility in data access, when a tenant initiates a search request, the cloud can search for ciphertext that meets the tenant's requirements without needing to know any information related to the ciphertext.

[0070] It's important to note here that before performing searchable encryption, the cloud administrator must first initialize the cloud computing system, define common system parameters for all tenants and devices, and generate a secretly held system master key. Specifically, this stage involves the following steps:

[0071] The cloud administrator defines the system security parameter λ, which defines the system's security level. For practical purposes, it can be set to 128. Based on this, the national standard SM4 symmetric encryption algorithm is called, and its encryption and decryption algorithms are set to SEnc and SDec, respectively. Two symmetric keys k1 and k2 are set.

[0072] Define the Shamir secret sharing scheme as It is based on Lagrange polynomials It can be made by Discrete secret data points Refactoring;

[0073] Choose three prime-order multiplicative cyclic groups G0, G1, G2, and g and g'. Let G0 and G1 be generators in groups G0 and G1, respectively, and define a bilinear mapping e: G0×G1→G2;

[0074] Define a hash function H: Used to map a bit string of arbitrary length to an element in a p-order integer cyclic group;

[0075] Select random elements Based on this, components for calculating public parameters and the system master key are... h0 = g θ ,

[0076] Based on the above, output and publish the system's common parameter PP:

[0077]

[0078] Meanwhile, the cloud administrator secretly holds the system master key (MSK):

[0079]

[0080] In this embodiment, the cloud administrator defines and creates the system public parameter PP and generates the system master key MSK to prepare for subsequent operations.

[0081] The searchable encryption method provided in this invention is applied to a cloud computing platform. Figure 1 This is one of the flowcharts illustrating the searchable encryption method provided in this embodiment of the invention; such as Figure 1 As shown, the method includes:

[0082] Step 110: In response to a search trap submitted by a data access tenant, determine the keywords in the search trap;

[0083] In this embodiment, the search trapdoor is obtained based on the keywords of the data access tenant to access, system public parameters, the tenant key of the data access tenant, and the attribute vector of the data access tenant.

[0084] It should be noted that tenants or cloud computing platforms can use system public parameters to encrypt their own data and select keywords to assign to the encrypted index structure, and then upload it to the cloud computing platform for searching and retrieval. On this basis, when other tenants need to access the data, they can use their own tenant keys to generate search trapdoors related to the keywords they are interested in and submit them to the cloud computing platform for searching.

[0085] Here, keywords are the specific content that the tenant wants to search for (or that the tenant wants to share). Keywords can be text, numbers, or other types of data, representing information that the tenant is interested in.

[0086] A tenant key is unique to a tenant and is used to encrypt and decrypt that tenant's data. Using a tenant key when constructing a search trapdoor ensures that only that tenant can perform a valid search operation, thus increasing system security.

[0087] It should be noted that the attribute vector in this embodiment is obtained by vectorizing user attributes. The attribute vector can transform the originally complex modular exponentiation operation into a lightweight dot product operation. By combining the attribute vector with the search trapdoor, more granular access control can be achieved.

[0088] Specifically, the search threshold is obtained by the data access tenant in the following way:

[0089] Determine the keywords for the data to be accessed;

[0090] Based on the system's common parameters, the tenant's key for the data access tenant, and the keyword, three trapdoor components are identified;

[0091] The search threshold is generated based on the three trapdoor components and the attribute vector of the data access tenant.

[0092] In this step, the data access tenant calculates three trapdoor components using the system public parameter PP, the tenant key SK, and the keyword KW of the data to be accessed. Finally, combine the attribute vectors of the data access tenant. Integrate and output search thresholds

[0093] Step 120: Based on system common parameters, the keyword and the trapdoor component of the search trapdoor search the stored ciphertext to determine whether there is a matching ciphertext.

[0094] In this embodiment, the ciphertext is obtained based on the keywords of the data to be shared by the data sharing tenant, the access vector of the access policy, system public parameters, and offline ciphertext.

[0095] As above, the access vector in this embodiment is obtained by vectorizing the access strategy. The access vector can transform the originally complex modular exponentiation operation into a lightweight dot product operation. By combining the access vector with the ciphertext, more granular access control can be achieved.

[0096] Offline ciphertext is a pre-generated ciphertext format used for sharing and accessing data under specific conditions (such as offline status).

[0097] In one example, when a trapdoor is received from a tenant... Afterwards, the cloud computing platform inputs the system's common parameter PP, trapdoor. The ciphertext CT = (c0,c′0,c1,c) 1,i ,c2,τ i Then, the stored ciphertext is matched and calculated. Specifically, this stage consists of the following steps:

[0098] Computational search component:

[0099] Q1=e(c′1,d2),Q2=e(c1,d1),Q3=e(c2,d3)

[0100] Among them, the search component

[0101] Based on the search components described above, determine whether the following equation holds true:

[0102] c′0=Q2·(Q1Q3) -1

[0103] If the condition is met, it is determined that a matching ciphertext exists; otherwise, the cloud computing platform returns the symbol ⊥ to indicate that the ciphertext sought by the search trap does not exist.

[0104] Step 130: Determine that a matching ciphertext exists, and send the intermediate ciphertext corresponding to the ciphertext to the data access tenant so that the data access tenant can access the data corresponding to the ciphertext according to the tenant key of the data access tenant;

[0105] In this embodiment, if a matching ciphertext exists, the intermediate ciphertext CT′=(c0,c′0,c1,c′1) is sent to the data access tenant.

[0106] Upon receiving the intermediate ciphertext CT′=(c0,c′0,c1,c′1), the data access tenant uses its tenant key SK to calculate the following equation to recover the data:

[0107]

[0108] The method provided in this embodiment determines the keyword in the search trapdoor in response to a search trapdoor submitted by a data access tenant; determines whether a matching ciphertext exists based on system public parameters, the keyword, and the trapdoor component of the search trapdoor; if a matching ciphertext exists, the intermediate ciphertext corresponding to the ciphertext is sent to the data access tenant, allowing the data access tenant to access the data corresponding to the ciphertext based on the data access tenant's tenant key; the search trapdoor is obtained based on the keyword of the data to be accessed by the data access tenant, system public parameters, the data access tenant's tenant key, and the data access tenant's attribute vector; the ciphertext is obtained based on the keyword of the data to be shared by the data sharing tenant, the access vector of the access policy, system public parameters, and the offline ciphertext. This invention transforms tenant attributes and access policies into two equal-length vectors and implements access control through vector inner product, replacing the complex access control based on secret sharing and recovery in traditional related technologies. This is not only very user-friendly for lightweight tenant terminals but also hides the tenant's attribute privacy while performing access control and search. Based on this, this invention further transforms the search trapdoor matching process for keywords in ciphertext search into vector inner product operations, achieving fine-grained ciphertext keyword search with minimal computational overhead.

[0109] In some embodiments, the method further includes:

[0110] Construct a first set of positions and a second set of positions corresponding to the access policy, and a third set of positions corresponding to the user attributes. The first set of positions includes the first positive value attribute positions of the access policy, the second set of positions includes the wildcard attribute positions of the access policy, and the third set of positions includes the second positive value attribute positions of the user attributes.

[0111] Based on the first positive attribute position in the first position set and the wildcard attribute position in the second position set, a Lagrange polynomial is constructed using the Lagrange interpolation theorem, and a set of factors is extracted from the Lagrange polynomial.

[0112] The aggregate value is determined based on the first positive attribute position in the first position set and the wildcard attribute position in the second position set;

[0113] Based on a set of factors, aggregate values, and preset zero values, an access vector corresponding to the access strategy is constructed.

[0114] Based on all the first positive attribute positions in the first position set and the second positive attribute positions in the third position set, the access vector elements are determined;

[0115] An attribute vector corresponding to the user attribute is constructed based on the access vector elements and the preset tag vector; wherein, the attribute vector and the access vector are two vectors of equal length.

[0116] It should be noted that the vectorization in this embodiment can be performed not only by the cloud computing platform, but also by the tenant itself. Here, the cloud computing platform will be used as an example for explanation.

[0117] First, define the attribute set S as a set containing m attributes, each of which can be a positive value (+) or a negative value (-).

[0118] For access strategies, the attribute positions of the access strategy are divided into two categories: the set of positive attribute positions P (i.e., the first position set) and the set of wildcard attribute positions W (i.e., the second position set).

[0119] Next, using the Lagrange interpolation theorem, based on the wildcard position k in the wildcard attribute position set W... i Given the positive attribute positions j∈P in the set of positive attribute positions P ∈W, construct a Lagrange polynomial. This Lagrange polynomial reflects the relationship between the wildcard positions in the wildcard attribute position set W and the positive attribute positions in the positive attribute position set P, and extracts a set of factors u0,...,u from it. l Based on this, the aggregate value is determined.

[0120] Based on the above set of factors u0,...,u l Aggregate value and the preset zero value (i.e., 0) l+1 ,...,0 n (used to extend the vector length to a preset fixed length) to construct an access vector.

[0121] Similarly, store all positive attribute positions in the user attributes into set P′ (i.e., the third position set). For all elements x∈[1,n], positive attribute positions x∈P′ in set P′, and positive attribute positions j∈P in the positive attribute position set P, calculate the access vector element {v j =+∑ x∈P′ x j Finally, an attribute vector is constructed by combining it with a preset marker vector. (Where, -1 is the last element of the attribute vector, which can be regarded as a specific marker or placeholder).

[0122] The method provided in this embodiment transforms the tenant attribute set and access structure into two vectors of equal length, enabling subsequent access control to be implemented through vector inner product, thereby replacing the complex access control based on secret sharing and recovery in traditional related technologies.

[0123] In some embodiments, the tenant key is obtained in the following manner:

[0124] Obtain the tenant's attribute vector and identity ID;

[0125] Based on the identity ID, system public parameters, system master key, and the first random element, a tenant key component is generated;

[0126] The tenant key is generated based on the tenant key component and the attribute vector.

[0127] In this embodiment, the tenant can convert the tenant's attribute set into an attribute vector based on the above method. And send it along with your own identity ID to the cloud computing platform (or cloud administrator).

[0128] Upon receiving the tenant's attribute vector After obtaining the identity ID, the tenant key component is calculated based on the system public parameter PP and the system master key MSK:

[0129]

[0130] Next, select random elements. And calculate the tenant key component

[0131]

[0132]

[0133] Based on the above steps, the tenant key is finally generated. And send it to the tenant via a secure channel.

[0134] In this embodiment, the tenant key does not expose any information related to the tenant's identity and attribute privacy through the above methods, thus achieving the anonymity of the tenant key.

[0135] In some embodiments, the ciphertext is obtained in the following manner:

[0136] Determine the data to be shared and the access policy for the data to be shared, and convert the access policy into an access vector;

[0137] Based on the access vector, system public parameters, offline ciphertext, and the first keyword of the data to be shared, a first ciphertext component is determined; the offline ciphertext is obtained based on a second random element and the offline ciphertext component, and the offline ciphertext component is obtained based on system public parameters and a third random element.

[0138] Based on the first ciphertext component and the offline ciphertext component, the ciphertext of the data to be shared is obtained.

[0139] This step can be performed by the data sharing tenant or the cloud computing platform, allowing the data sharing tenant to share its own data or the cloud computing platform to provide its collected and processed data. This embodiment uses the cloud computing platform as an example for explanation.

[0140] Specifically, when the data to be shared M and the access policy ψ of the data sharing tenant are clearly defined, the access policy ψ is first transformed into an access vector based on the above method. Then input the system public parameter PP, offline ciphertext FCT, specify the keyword KW related to the data to be shared, and calculate the ciphertext component:

[0141] τ i =η i +u i t,

[0142] The offline encrypted FCT is obtained in the following way:

[0143] Random elements are selected based on the system's common parameter PP. And calculate the offline ciphertext component c1 = g t , Next, calculate the offline ciphertext FCT = (c1, c 1,i ,c2,t,η1,...,η n ).

[0144] Finally, based on the above steps, the ciphertext CT = (c0, c′0, c1, c) is generated. 1,i ,c2,τi (and store it on a cloud computing platform.)

[0145] In some embodiments, the method further includes:

[0146] The tenant key component in the tenant key of the tenant to be tracked is decrypted to obtain a decryption result, which includes an encrypted identity ID and a Lagrange polynomial that matches the encrypted identity ID;

[0147] If the decryption result is found to exist in a set of discrete secret data points, it is determined that the tenant key of the tenant to be tracked has not been leaked.

[0148] In this embodiment, due to the need for tenant privacy protection and flexible access control, the tenant key itself does not disclose any information about the tenant's identity or attribute set. However, since the tenant's identity information is covertly embedded in their tenant key, it makes it possible to track tenants who sell keys or intentionally leak their tenant keys. Therefore, this embodiment tracks and assigns responsibility to tenants who leak their tenant keys.

[0149] Specifically, the tenant key component sk0 in the tenant key SK of the tenant to be tracked is first decrypted using the symmetric key k2. get if in, If the data points are discrete secret points, it is determined that the tenant's key has not been leaked, and thus the tenant's identity can be obtained by decrypting with the symmetric key k1.

[0150] Furthermore, it also includes:

[0151] If the decryption result does not exist in the set of discrete secret data points, it is determined that the tenant key of the tenant to be tracked has been leaked;

[0152] The Lagrange polynomial matching the encrypted identity ID is reconstructed based on the discrete data point set and the Lagrange interpolation theorem to obtain the reconstructed Lagrange polynomial.

[0153] Malicious tenant identification is performed on the tenant to be tracked based on the Lagrange polynomial matching the encrypted identity ID and the reconstructed Lagrange polynomial.

[0154] like Then utilize discrete data points Using the Lagrange interpolation theorem to encrypt the identity ID (i.e.) Matching Lagrange polynomials (i.e.) Reconstruct the Lagrange polynomial based on the reconstructed Lagrange polynomial. And solve for f′(0). If f′(0) = f(0), then decrypt the calculation. The system tracks tenant identity IDs and determines if a tenant is malicious. Otherwise, it can be determined that the tenant identified by the ID has not engaged in malicious behavior.

[0155] In this embodiment, the above method enables the identification of the specific tenant corresponding to the key to pursue accountability when the tenant engages in malicious behavior (such as selling the tenant key for profit) or the tenant key is leaked.

[0156] For ease of understanding, please refer to Figure 3 This embodiment also provides a searchable encryption method, which consists of seven steps: cloud computing system establishment, access policy and attribute vectorization, tenant key distribution, encrypted data upload, tenant search trap creation, ciphertext keyword search, tenant data access, and key leakage tracking.

[0157] First, in the cloud computing system setup step, the cloud administrator defines and creates system public parameters and generates a master key to prepare for subsequent operations. In the access policy and attribute vectorization step, user attribute sets and access policies are vectorized. In the tenant key distribution step, the cloud administrator generates tenant keys for tenants using the system public parameters and the master key. After key distribution, tenants or the cloud computing platform can use the system public parameters to encrypt their data and select keywords to assign to the ciphertext index structure, then upload it to the cloud computing platform for searching and retrieval. Based on this, when other tenants need to access data, they generate a search trapdoor related to their keywords of interest using their own tenant key during the tenant search trapdoor creation stage and submit it to the cloud computing platform. Subsequently, after receiving the search trapdoor, the cloud computing platform enters the ciphertext keyword search stage, using it to perform a search operation from the stored ciphertext. If a matching ciphertext exists, it is returned to the tenant; otherwise, the process terminates. After obtaining the ciphertext, the tenant enters the tenant data access stage, using their own tenant key to decrypt the ciphertext to obtain the data, thus achieving their goal. In addition, if tenant key misuse or leakage is detected during any of the above processes, the cloud administrator will perform a key leakage tracing phase to trace the corresponding tenant information from the anonymous key.

[0158] The searchable encryption device provided by the present invention is described below. The searchable encryption device described below and the searchable encryption method described above can be referred to in correspondence.

[0159] Figure 4 This is a schematic diagram of the structure of the searchable encryption device provided by the present invention; as shown. Figure 4 As shown, the device includes:

[0160] The first searchable encryption module 410 is used to determine the keyword in the search trapdoor in response to a search trapdoor submitted by a data access tenant.

[0161] The second searchable encryption module 420 is used to search the stored ciphertext based on system public parameters, the keyword and the trapdoor component of the search trapdoor to determine whether there is a matching ciphertext.

[0162] The third searchable encryption module 430 is used to determine that there is a matching ciphertext and send the intermediate ciphertext corresponding to the ciphertext to the data access tenant so that the data access tenant can access the data corresponding to the ciphertext according to the tenant key of the data access tenant.

[0163] The search trapdoor is obtained based on the keywords of the data to be accessed by the data access tenant, system public parameters, the tenant key of the data access tenant, and the attribute vector of the data access tenant.

[0164] The ciphertext is obtained based on the keywords of the data to be shared by the data sharing tenant, the access vector of the access policy, system public parameters, and offline ciphertext.

[0165] The apparatus provided by this invention, in response to a search trapdoor submitted by a data access tenant, determines the keyword in the search trapdoor; based on system public parameters, the keyword, and the trapdoor component of the search trapdoor, it determines whether a matching ciphertext exists; upon determining that a matching ciphertext exists, it sends the intermediate ciphertext corresponding to the ciphertext to the data access tenant, so that the data access tenant can access the data corresponding to the ciphertext according to the data access tenant's tenant key; the search trapdoor is obtained based on the keyword of the data to be accessed by the data access tenant, system public parameters, the data access tenant's tenant key, and the data access tenant's attribute vector; the ciphertext is obtained based on the keyword of the data to be shared by the data sharing tenant, the access vector of the access policy, system public parameters, and the offline ciphertext. This invention transforms tenant attributes and access policies into two equal-length vectors respectively, and implements access control through vector inner product, replacing the complex access control based on secret sharing and recovery in traditional related technologies. This is not only very user-friendly for lightweight tenant terminal devices, but also hides the tenant's attribute privacy while performing access control and search. Based on this, this invention further transforms the search trapdoor matching process of the keyword in the ciphertext search into vector inner product operation, achieving fine-grained ciphertext keyword search with less computational overhead.

[0166] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540. Processor 510 can invoke logical instructions in memory 530 to execute a searchable encryption method, the method comprising: in response to a search trapdoor submitted by a data access tenant, determining a keyword in the search trapdoor; based on system common parameters, searching the keyword and the trapdoor component of the search trapdoor from stored ciphertext to determine whether a matching ciphertext exists; determining that a matching ciphertext exists, and sending the intermediate ciphertext corresponding to the ciphertext to the data access tenant, so that the data access tenant can access the data corresponding to the ciphertext according to the tenant's tenant key; wherein, the search trapdoor is obtained based on the keyword of the data to be accessed by the data access tenant, system common parameters, the tenant key of the data access tenant, and the attribute vector of the data access tenant; the ciphertext is obtained based on the keyword of the data to be shared by the data sharing tenant, the access vector of the access policy, system common parameters, and offline ciphertext.

[0167] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0168] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the searchable encryption method provided by the above methods. The method includes: in response to a search trapdoor submitted by a data access tenant, determining a keyword in the search trapdoor; based on system public parameters, searching the keyword and the trapdoor component of the search trapdoor from stored ciphertext to determine whether a matching ciphertext exists; determining that a matching ciphertext exists, sending the intermediate ciphertext corresponding to the ciphertext to the data access tenant, so that the data access tenant can access the data corresponding to the ciphertext according to the tenant key of the data access tenant; wherein, the search trapdoor is obtained based on the keyword of the data to be accessed by the data access tenant, the system public parameters, the tenant key of the data access tenant, and the attribute vector of the data access tenant; the ciphertext is obtained based on the keyword of the data to be shared by the data sharing tenant, the access vector of the access policy, the system public parameters, and the offline ciphertext.

[0169] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform the searchable encryption method provided by the methods described above. The method includes: in response to a search trapdoor submitted by a data access tenant, determining a keyword in the search trapdoor; searching from stored ciphertext based on system common parameters, using the keyword and a trapdoor component of the search trapdoor, to determine whether a matching ciphertext exists; upon determining that a matching ciphertext exists, sending an intermediate ciphertext corresponding to the ciphertext to the data access tenant, so that the data access tenant can access the data corresponding to the ciphertext according to the tenant's tenant key; wherein the search trapdoor is obtained based on the keyword of the data to be accessed by the data access tenant, system common parameters, the tenant key of the data access tenant, and the attribute vector of the data access tenant; the ciphertext is obtained based on the keyword of the data to be shared by the data sharing tenant, the access vector of the access policy, system common parameters, and offline ciphertext.

[0170] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0171] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0172] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A searchable encryption method, characterized in that, The method includes: In response to a search trap submitted by a data access tenant, the system searches the stored ciphertext based on common system parameters and the trapdoor component of the search trap to determine whether a matching ciphertext exists. Once a matching ciphertext is determined, the intermediate ciphertext corresponding to the matching ciphertext is sent to the data access tenant, so that the data access tenant can access the data corresponding to the matching ciphertext based on the data access tenant's tenant key. The search trapdoor is obtained based on the keywords of the data to be accessed by the data access tenant, system public parameters, the tenant key of the data access tenant, and the attribute vector of the data access tenant; the matching ciphertext is obtained based on the keywords of the data to be shared by the data sharing tenant, the access vector of the access policy, system public parameters, and offline ciphertext. The attribute vector is obtained in the following way: Construct a first set of positions and a second set of positions corresponding to the access policy, and a third set of positions corresponding to the user attributes. The first set of positions includes the first positive value attribute positions of the access policy, the second set of positions includes the wildcard attribute positions of the access policy, and the third set of positions includes the second positive value attribute positions of the user attributes. Based on the first positive attribute position in the first position set and the wildcard attribute position in the second position set, a Lagrange polynomial is constructed using the Lagrange interpolation theorem, and a set of factors is extracted from the Lagrange polynomial. The aggregate value is determined based on the first positive attribute position in the first position set and the wildcard attribute position in the second position set; Based on a set of factors, aggregate values, and preset zero values, an access vector corresponding to the access strategy is constructed. Based on all the first positive attribute positions in the first position set and the second positive attribute positions in the third position set, the access vector elements are determined; An attribute vector corresponding to the user attribute is constructed based on the access vector elements and the preset tag vector; wherein, the attribute vector and the access vector are two vectors of equal length.

2. The searchable encryption method according to claim 1, characterized in that, The tenant key was obtained in the following way: Obtain the tenant's attribute vector and identity ID; Based on the identity ID, system public parameters, system master key, and the first random element, a tenant key component is generated; The tenant key is generated based on the tenant key component and the attribute vector.

3. The searchable encryption method according to claim 1, characterized in that, The search threshold is obtained by the data access tenant in the following way: Determine the keywords for the data to be accessed; Based on the system's common parameters, the tenant's key for the data access tenant, and the keyword, three trapdoor components are identified; The search threshold is generated based on the three trapdoor components and the attribute vector of the data access tenant.

4. The searchable encryption method according to claim 1, characterized in that, The stored ciphertext was obtained in the following way: Determine the data to be shared and the access policy for the data to be shared, and convert the access policy into an access vector; Based on the access vector, system public parameters, offline ciphertext, and keywords of the data to be shared, the first ciphertext component is determined; The offline ciphertext is obtained based on the second random element and the offline ciphertext component, and the offline ciphertext component is obtained based on the system common parameters and the third random element; Based on the first ciphertext component and the offline ciphertext component, the ciphertext of the data to be shared is obtained and stored.

5. The searchable encryption method according to any one of claims 1 to 4, characterized in that, The method further includes: The tenant key component in the tenant key of the tenant to be tracked is decrypted to obtain a decryption result, which includes an encrypted identity ID and a Lagrange polynomial that matches the encrypted identity ID; If the decryption result is found to exist in a set of discrete secret data points, it is determined that the tenant key of the tenant to be tracked has not been leaked.

6. The searchable encryption method according to claim 5, characterized in that, The method further includes: If the decryption result does not exist in the set of discrete secret data points, it is determined that the tenant key of the tenant to be tracked has been leaked; The Lagrange polynomial matching the encrypted identity ID is reconstructed based on the discrete data point set and the Lagrange interpolation theorem to obtain the reconstructed Lagrange polynomial. Malicious tenant identification is performed on the tenant to be tracked based on the encrypted identity ID matching Lagrange polynomial and the reconstructed Lagrange polynomial.

7. A searchable encryption device, characterized in that, The device includes: The first searchable encryption module is used to respond to a search trapdoor submitted by a data access tenant, and search the stored ciphertext based on system public parameters and the trapdoor component of the search trapdoor to determine whether there is a matching ciphertext. The third searchable encryption module is used to determine that a matching ciphertext exists and send the intermediate ciphertext corresponding to the matching ciphertext to the data access tenant, so that the data access tenant can access the data corresponding to the matching ciphertext according to the tenant key of the data access tenant. The search trapdoor is obtained based on the keywords of the data to be accessed by the data access tenant, system public parameters, the tenant key of the data access tenant, and the attribute vector of the data access tenant. The ciphertext is obtained based on the keywords of the data to be shared by the data sharing tenant, the access vector of the access policy, system public parameters, and offline ciphertext; The attribute vector is obtained in the following way: Construct a first set of positions and a second set of positions corresponding to the access policy, and a third set of positions corresponding to the user attributes. The first set of positions includes the first positive value attribute positions of the access policy, the second set of positions includes the wildcard attribute positions of the access policy, and the third set of positions includes the second positive value attribute positions of the user attributes. Based on the first positive attribute position in the first position set and the wildcard attribute position in the second position set, a Lagrange polynomial is constructed using the Lagrange interpolation theorem, and a set of factors is extracted from the Lagrange polynomial. The aggregate value is determined based on the first positive attribute position in the first position set and the wildcard attribute position in the second position set; Based on a set of factors, aggregate values, and preset zero values, an access vector corresponding to the access strategy is constructed. Based on all the first positive attribute positions in the first position set and the second positive attribute positions in the third position set, the access vector elements are determined; An attribute vector corresponding to the user attribute is constructed based on the access vector elements and the preset tag vector; wherein, the attribute vector and the access vector are two vectors of equal length.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the searchable encryption method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the searchable encryption method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the searchable encryption method as described in any one of claims 1 to 6.

Images