A Medical Data Secure Sharing Method Based on Lattice-Based Updatable Proxy Re-encryption

Abstract

The present invention provides a medical data secure sharing method based on lattice-based updatable proxy re-encryption. The present invention involves a delegator, a trustee, and a cloud server. The delegator updates the public key of the trustee, generates a re-encryption key using the updated public key of the trustee and the private key of the delegator, and sends it to the cloud server to re-encrypt the ciphertext. The cloud server sends the re-encrypted re-encrypted ciphertext to the trustee. After receiving the re-encrypted ciphertext, the trustee first updates its own private key, and then decrypts the re-encrypted ciphertext using the updated private key. The present invention realizes updatable proxy re-encryption through key exchange technology, bit decomposition technology, preimage sampling algorithm on lattice, and trapdoor generation algorithm on lattice, thereby achieving HRA security and being able to effectively resist quantum computing attacks. Each time proxy re-encryption is performed, the delegator updates the public key of the trustee, thus avoiding the problem of key leakage and achieving forward security.

Description

Technical Field

[0001] The present invention relates to the technical field of cyberspace security, and in particular to a method for secure sharing of medical data based on lattice-based updatable proxy re-encryption. Background Art

[0002] With the rapid increase in the amount of medical data, the traditional medical data storage method has become no longer applicable, which has promoted the innovation of cloud storage. Users can store medical data on cloud servers. Although cloud storage services provide convenience, they also pose major challenges in terms of data security and privacy. The leakage of medical data will expose the personal privacy of patients. Therefore, it is necessary to encrypt the data before uploading to ensure security. Since files need to be downloaded and decrypted, this encryption makes the sharing of medical data complicated, and proxy re-encryption provides a simplified solution to this problem.

[0003] Proxy Re-encryption (PRE) allows the cloud server to convert the ciphertext of the delegator into a form that the delegatee can decrypt. This process does not disclose the plaintext corresponding to the ciphertext, but is achieved by using the re-encryption key generated by the delegator. The application of proxy re-encryption in fields such as electronic medical systems, data sharing, and email systems is becoming more and more extensive, and its application in fields such as cloud computing and the Internet of Things is also attracting more and more attention.

[0004] Currently, all proxy re-encryption PRE schemes involve three entities, namely the delegator, the proxy, and the delegatee. Each of these entities has its own key that needs to be protected. For example, the private key of the delegator, the re-encryption key held by the proxy, and the private key of the delegatee. If any of these keys is leaked, it will lead to serious data leakage.

[0005] Based on this, Derler et al. formally introduced the forward security of PRE in PKC'18. Forward security means that even if the long-term communication key is leaked, since the attacker cannot obtain the keys used in past communications from the known keys, the past ciphertext messages will not be affected. However, their work only involves the first two dimensions of key leakage, and the forward security in the third dimension remains an unsolved challenge.

[0006] Traditional proxy re-encryption schemes are mainly based on classical number theory problems in cryptography. Their advantages are simple structure, easy implementation, convenience and speed, but their functions are easily limited. The most important shortcoming is that they cannot resist the attack of quantum computing. The attack of quantum computing on traditional proxy re-encryption schemes will cause sensitive data to be leaked and illegally accessed, resulting in serious economic losses and privacy leakage crises. Therefore, anti-quantum cryptography technology also needs to be considered. Summary of the Invention

[0007] In view of the deficiencies of the prior art, the present invention provides a secure medical data sharing method based on lattice-based updatable proxy re-encryption. The present invention achieves forward security in the third dimension, that is, it solves the security problem caused by the leakage of the trustee's private key. The present invention realizes re-encryption simulation and achieves security under honest re-encryption attack (HRA) through lattice cryptography techniques such as key exchange technology, bit decomposition technology, Gaussian sampling, and trapdoor generation on the lattice. Under the honest re-encryption attack, the adversary has stronger capabilities, and he can query the re-encryption from an honest delegator to a dishonest trustee. The invention can effectively resist quantum computing attacks while enhancing security by promoting the security under chosen-plaintext attacks (CPA) in general cases to HRA.

[0008] The technical solution of the present invention is as follows: A secure medical data sharing method based on lattice-based updatable proxy re-encryption, the method involving a delegator, a trustee, and a cloud server; the delegator sends a medical data storage and encryption request to the trustee according to an emergency; specifically:

[0009] The delegator updates the public key of the trustee, generates a re-encryption key using the updated public key of the trustee and the private key of the delegator, and sends it to the cloud server to re-encrypt the ciphertext; the cloud server sends the re-encrypted re-encryption ciphertext to the trustee, and after receiving the re-encrypted ciphertext, the trustee first updates its own private key, and then decrypts the re-encrypted ciphertext using the updated private key.

[0010] Preferably, before the delegator updates the public key of the trustee, the following steps are further included:

[0011] S1), the cloud server runs the UPRE.Setup algorithm to generate public parameters pp and publishes the public parameters pp;

[0012] S2), the delegator and the trustee respectively run the UPRE.KeyGen algorithm to generate their respective public and private key pairs;

[0013] S3), the delegator encrypts its medical data plaintext information using the UPRE.Enc algorithm to obtain a ciphertext; and sends the ciphertext to the cloud server.

[0014] Preferably, the delegator generates an updated public key and an updated ciphertext for the trustee by running the UPRE.Up-pk algorithm, and sends the updated ciphertext to the trustee;

[0015] The client uses the UPRE.ReKeyGen algorithm to generate a re-encryption key by using its own private key and the updated public key of the trustee; and sends the generated re-encryption key to the cloud server.

[0016] Preferably, the cloud server uses the UPRE.ReEnc algorithm to re-encrypt the ciphertext with the re-encryption key to obtain a re-encrypted ciphertext; and sends it to the trustee.

[0017] Preferably, after receiving the re-encrypted ciphertext sent by the cloud server, the trustee runs the UPRE.Up-sk algorithm to generate an updated private key by using the updated ciphertext.

[0018] Preferably, the trustee decrypts the re-encrypted ciphertext by inputting the re-encrypted ciphertext with the updated private key into the UPRE.Dec algorithm, so as to obtain the medical plaintext data encrypted by the client.

[0019] Preferably, in step S1), the public parameters pp generated by the cloud server running the UPRE.Setup algorithm are:

[0020] pp = (n, m, q, χ, χ m );

[0021] where (n, m, q, χ) are lattice parameters; where n, m, q, χ represent the dimension of the lattice, the rank of the lattice, the modulus, and the error distribution respectively; χ m represents a set of m-dimensional vectors where each element belongs to the χ distribution.

[0022] Preferably, in step S2), the client and the trustee respectively run the UPRE.KeyGen algorithm to generate their respective public-private key pairs, which specifically include the following steps:

[0023] S21), input the public parameters pp, and randomly select a matrix where U i represents an n×m-dimensional random matrix, and each element of the random matrix U i belongs to the group of integers modulo q;

[0024] S22), calculate where represents an n×m-dimensional random matrix, and each element of the random matrix A i belongs to the group of integers modulo q; represents the trapdoor of the random matrix A i ; 1 n represents the security parameter; m represents the dimension of the lattice, and q represents the modulus;

[0025] S23), sample through the preimage sampling algorithm on the lattice where; E i ∈ χ m×m represents an n×m dimensional random matrix, and each element constituting the matrix belongs to the χ distribution, and the matrix E generated by the SamplePre algorithm i satisfies the equation U i = A i E i ; τ is the parameter of the discrete Gaussian distribution;

[0026] S24), output the public key pk i = {U i , A i}, and the private key sk i = E i .

[0027] Preferably, in step S3), the entrusting party encrypts its medical data plaintext information using the UPRE.Enc algorithm to obtain the ciphertext, which specifically includes the following steps:

[0028] S31), input the public key pk i = {U i , A i} and the medical data plaintext information plaintext μ ∈ {0, 1} m ;

[0029] S32), select the vector randomly select the vector x0 ← χ m and x1 ← χ m ;

[0030] S33), set

[0031] S34), output the ciphertext c i = (c i0 , C i1 );

[0032] where the ciphertext consists of two parts, c i0 is the first component of the ciphertext, and c i1 is the second component of the ciphertext; x0 and x1 represent two m-dimensional random vectors, and each element constituting the two vectors belongs to the χ distribution; q represents the modulus; s represents an n-dimensional random vector, and each element of the random vector s belongs to the group of integers modulo q; s T represents the transpose of the random vector s.

[0033] Preferably, the entrusting party generates an updated public key for the trustee by running the UPRE.Up-pk algorithm, specifically:

[0034] S41), Input the public parameters pp and the public key pk j ={U j , A j};

[0035] S42), Sample E j '←χ m×m , Calculate U j ' = U j + A j E j '; Wherein, E j ' represents an m×m dimensional random matrix, and each element of the random matrix E j ' belongs to the χ distribution, χ is a B-bounded distribution, and m is the rank of the lattice;

[0036] S43), Use the public key pk j to encrypt the random matrix E j ' to obtain the updated ciphertext up, that is:

[0037] up = UPRE.Enc(pk j , E j ');

[0038] S44), Output up = UPRE.Enc(pk j , E j ') and the updated public key pk' j ={U j ', A j}.

[0039] Preferably, the entrusting party uses its own private key and the updated public key pk' j of the trustee to generate a re-encryption key through the UPRE.ReKeyGen algorithm, specifically:

[0040] S51), Input the public parameters pp, and the private key sk i = E i of the entrusting party and the updated public key pk' j of the trustee;

[0041] S52), Randomly select matrices Sample and In the formula, the matrix R1 represents an dimensional random matrix, and each element of the random matrix R1 belongs to the group of integers modulo q, and R2 and R3 both represent dimensional random matrices, and each element of the random matrices R2 and R3 belongs to the χ distribution;

[0042] S53), Calculate the following formula:

[0043]

[0044] Among them, Z represents the first part of the re-encryption key, and P2(E i ) represents the expansion function of the random matrix E i ; P2(E i ) outputs

[0045] S54), randomly select a vector In the formula, r1 represents an n-dimensional vector set in which each element belongs to the integer group modulo q, and represent an m-dimensional random vector in which each element belongs to the χ distribution; represents an n-dimensional vector set in which each element belongs to the integer group modulo q; χ m represents an m-dimensional vector set in which each element belongs to the χ distribution;

[0046] S55), calculate

[0047] where g T represents the second part of the re-encryption key;

[0048] S56), output the re-encryption key rk i→j ={g T , Z}.

[0049] Preferably, the cloud server uses the UPRE.ReEnc algorithm to re-encrypt the ciphertext with the re-encryption key to obtain a re-encrypted ciphertext, specifically:

[0050] S61), input the public parameters pp, the re-encryption key rk i→j ={g T , Z} and the ciphertext c i ;

[0051] S62), select a random number a ∈ χ, and calculate:

[0052]

[0053] Let in the formula || represents the row-wise concatenation of two vectors or matrices; then

[0054]

[0055] S63), calculate (BD(c i0 )||c i1 )·Z = (c′ j0 , c′ j1 );

[0056] Among them, the BD(v) function decomposes v and outputs satisfying:

[0057]

[0058] S64), calculate the re-encrypted ciphertext c j , specifically as follows:

[0059]

[0060] In the formula, c j0 , c j1 respectively represent the first component of the re-encrypted ciphertext and the second component of the re-encrypted ciphertext;

[0061] S65), output the re-encrypted ciphertext c j =(c j0 , c j1 ).

[0062] Preferably, the trustee runs the UPRE.Up-sk algorithm to generate the updated private key, specifically:

[0063] S71), input the ciphertext up = UPRE.Enc(pk j , E j ′); and the updated public key pk′ j ={U j ′, A j};

[0064] S72), calculate E j ′ = UPRE.Dec(pk j , up);

[0065] S73), output the updated private key sk′ j =E j +E j ′.

[0066] Preferably, the trustee uses the updated private key sk′ j to decrypt the ciphertext c j , specifically as follows:

[0067] S81), input the updated private key sk′ j of the trustee and the ciphertext c j =(c j0 , c j1 );

[0068] S82), calculate μ′ = c j1 -c j0 sk′j ;

[0069] S83), round each component of μ′ to {0, 1}, that is, for j ∈ 1,..., m, if μ′ j is closer to 0, then set μ j = 0, if μ′ j is closer to then set μ j = 1;

[0070] S84. Output the plaintext μ ∈ {0, 1} m .

[0071] The beneficial effects of the present invention are as follows:

[0072] 1. The present invention realizes updatable proxy re-encryption through key exchange technology, preimage sampling algorithm on lattices, and trapdoor generation algorithm on lattices, thus achieving HRA security and being able to effectively resist quantum computing attacks;

[0073] 2. The present invention realizes IND-CR-sHRA security without relying on the random oracle model; and each time the present invention performs proxy re-encryption, the delegator needs to update the public key of the trustee; thus resisting the key leakage problem of the trustee in the proxy re-encryption scenario; and achieving forward security. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 is the flowchart of the medical data security sharing method in the embodiment of the present invention;

[0075] Figure 2 is the framework diagram of the medical data security sharing method in the embodiment of the present invention;

[0076] Figure 3 is the algorithm running time comparison diagram of the medical data security sharing method in the embodiment of the present invention;

[0077] Figure 4 is the running time diagram of the trapdoor generation algorithm in the embodiment of the present invention;

[0078] Figure 5 is the running time diagram of the preimage sampling algorithm in the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0079] The following further describes the specific embodiments of the present invention in conjunction with the drawings:

[0080] As Figure 1 and 2As shown, this embodiment provides a secure medical data sharing method based on lattice-based updatable proxy re-encryption. The method involves a delegator i, a trustee j, and a cloud server. Among them, the delegator i in this embodiment includes the county people's hospital, the county traditional Chinese medicine hospital, and the county maternal and child health hospital; and the trustee j is the city hospital.

[0081] This embodiment first defines the parameters involved:

[0082] 1 λ : Security parameter;

[0083] T: Discrete Gaussian distribution parameter; In the formula, ω represents the lower bound, and m represents the rank of the lattice;

[0084] (n, m, q, v): Lattice parameters; where χ is a B-bounded distribution; n is the dimension of the lattice; q is the modulus; O is the upper bound;

[0085] pp: Public parameter pp = (n, m, q, χ, χ m ).

[0086] In this embodiment, the secure medical data sharing method specifically includes the following steps:

[0087] S1). The cloud server runs the UPRE.Setup algorithm to generate the public parameter pp and publishes the public parameter pp; among them, the parameter selection in the initialization stage is as follows:

[0088] 1 λ : Security parameter;

[0089] T: Discrete Gaussian distribution parameter;

[0090] (n, m, q, v): Lattice parameters; where χ is a B-bounded distribution;

[0091] S2). The delegator i and the trustee j respectively run the UPRE.KeyGen algorithm to generate their respective public and private key pairs; specifically including the following steps:

[0092] S21). Input the public parameter pp and the delegator number i, and randomly select the matrix Among them, the matrix U i represents an n×m random matrix, and all elements of the random matrix U i belong to the modular q integer group;

[0093] S22). Calculate through the trapdoor generation algorithm on the lattice Among them, represents a random matrix; Denote matrix A i as the trapdoor of; 1 n denote the security parameter; m denotes the rank of the lattice, and q denotes the modulus;

[0094] S23), sample through the preimage sampling algorithm on the lattice where; E i ∈χ m×m denotes an n×m-dimensional random matrix, and each element of the random matrix E i belongs to the χ distribution, and the matrix E generated by the SamplePre algorithm i satisfies the equation U i =A i E i ; τ is the parameter of the discrete Gaussian distribution;

[0095] S24), respectively output the public key pk of the delegator i i ={U i , A i}, and the private key sk i =E i ; and the public key pk of the trustee j j ={U j , A j}, and the private key sk j =E j .

[0096] S3), the delegator i uses the UPRE.Enc algorithm to encrypt its medical data plaintext information μ to obtain the ciphertext c i ; and send the ciphertext c i to the cloud server; specifically including the following steps:

[0097] S31), input the public key pk i ={U i , A i} and the medical data plaintext information plaintext μ∈{0, 1} m ;

[0098] S32), select the vector randomly select vectors x0←χ m and x1←χ m ;

[0099] S33), set

[0100] S34), output the ciphertext c i =(c i0 , c i1 );

[0101] where, c i0is the first ciphertext component; c i1 is the second ciphertext component; x0 represents an m-dimensional random vector where each element belongs to the χ distribution, and x1 represents an m-dimensional random vector where each element belongs to the χ distribution; q represents the modulus; T represents matrix transpose; s represents a set of n×1-dimensional vectors where each element belongs to the group of integers modulo q.

[0102] S4), the delegator i generates an updated public key pk′ for the trustee j by running the UPRE.Up-pk algorithm j ; specifically:

[0103] S41), input the public parameters pp and the public key pk of the trustee j j ={U j , A j};

[0104] S42), randomly select a matrix E j ′←χ m×m , calculate U j ′ = U j + A j E j ′; where E j ′ is a set of m×m-dimensional matrices where each element belongs to the group of integers modulo q, χ is the B-bounded distribution, and m is the rank of the lattice;

[0105] S43), encrypt E j ′ using the public key pk j to obtain the updated ciphertext up, that is:

[0106] up = UPRE.Enc(pk j , E j ′);

[0107] S44), output the updated ciphertext up = UPRE.Enc(pk j , E j ′) and the updated public key pk′ j ={U j , A j}.

[0108] S5), the delegator i generates a re-encryption key rk i = E i using its own private key sk j ={U j , A j} of the trustee j and the updated public key pk′ i→j ; and sends the generated re-encryption key rk i→j to the cloud server; specifically:

[0109] S51), Input the public parameter pp and the private key sk of the principal i = E i and the updated public key pk' of the trustee j ;

[0110] S52), Randomly select matrices sampling and

[0111] where the matrix R1 represents an -dimensional random matrix in which each element belongs to the integer group modulo q, and both R2 and R3 represent an -dimensional random matrix in which each element belongs to the integer group modulo q;

[0112] S53), Calculate the second part matrix Z of the re-encryption key; that is:

[0113]

[0114] where P2(E i ) represents the vector expansion function; P2(E i ) outputs

[0115] S54), Randomly select vectors

[0116] where r1 represents an n×1-dimensional random vector in which each element belongs to the integer group modulo q, and represents an m-dimensional random vector in which each element belongs to the χ distribution; represents the set of n-dimensional vectors in which each element belongs to the integer group modulo q; χ m represents the set of m-dimensional vectors in which each element belongs to the χ distribution;

[0117] S55), Calculate

[0118] where g T represents the first part of the re-encryption key;

[0119] S56), Output the re-encryption key rk i→j = {g T , Z}.

[0120] S6), The cloud server uses the UPRE.ReEnc algorithm to perform re-encryption processing on the ciphertext c i→j using the re-encryption key rk i to obtain the re-encrypted ciphertext c j; and send the re-encrypted ciphertext c j to the trustee j, specifically:

[0121] S61). Input the public parameters pp and the re-encryption key rk i→j ={g T , Z} and the ciphertext c i ;

[0122] S62). Select a random number a ∈ χ and calculate:

[0123]

[0124] where;

[0125] S63). Calculate (BD(c i0 ||c i1 )·Z = (c′ j0 , c′ j1 ); that is:

[0126]

[0127] where BD is the vector decomposition function, and the vector decomposition function BD(v) represents decomposing v and outputting satisfying

[0128] S64). Calculate the re-encrypted ciphertext c j , specifically as follows:

[0129]

[0130] In the formula, c j0 , c j1 respectively represent the first component of the re-encrypted ciphertext and the second component of the re-encrypted ciphertext;

[0131] S65). Output the re-encrypted ciphertext c j =(c j0 , c j1 ).

[0132] S7). After the trustee j receives the re-encrypted ciphertext c j sent by the cloud server, run the UPRE.Up-sk algorithm to generate the updated private key sk′ j ; specifically:

[0133] S71). Input the update ciphertext up = UPRE.Enc(pk j , E j ′); and the updated public key pk′ j ={U j ′, Aj};

[0134] S72), Calculate E j ′ = UPRE.Dec(pk j , up);

[0135] S73), Output the updated private key sk′ of the trustee j j = E j + E j ′.

[0136] S8), Use the updated private key sk′ of the trustee j j to decrypt the re - encrypted ciphertext c j to obtain the medical plaintext data encrypted by the principal i, specifically:

[0137] S81), Input the updated private key sk′ of the trustee j and the re - encrypted ciphertext c j =(c j0 , c j1 );

[0138] S82), Calculate μ′ = c j1 - c j0 sk′ j ;

[0139] S83), Round each component of μ′ to {0, 1}, that is, for j ∈ 1,..., m, if μ′ j is closer to 0, then set μ j = 0, if μ′ j is closer to then set μj = 1;

[0140] S84, Output the medical plaintext data μ ∈ {0, 1} m .

[0141] In this embodiment, for the lattice - based trapdoor generation algorithm, given q ≥ 2, n ≥ 1, m = [6nlogq], there exists a trapdoor generation algorithm TrapGen(m, n, q) that outputs a random matrix and a trapdoor (which is also the lattice basis of the vertical lattice ), and the distance after performing Schmidt orthogonalization on T A For the lattice - based pre - image sampling algorithm SamplePre in this embodiment, input the matrix

[0142] trapdoor vector vector and the Gaussian parameter Sample a vector from a discrete Gaussian distribution that is approximated such that Ae = u.

[0143] In this embodiment, assume that BD(v) and P2(x) respectively represent deterministic functions that map a vector to a higher dimension. Let v i ∈ {0, 1} n . The vector is the input of the BD(v) function, and the output is a vector in a higher dimension . Similarly, the input of the P2(x) function is the vector , and the output is a vector in a higher dimension . The relationship between BD(v) and P2(x) satisfies

[0144] Figure 3 is the running time of each algorithm when n takes different values in this embodiment; Figure 4 is the running time graph of the trapdoor generation algorithm when n takes different values in this embodiment; Figure 5 is the running time of the preimage sampling algorithm when n takes different values in this embodiment; It can be seen from Figures 3 - 5 that the main time consumption of this method is concentrated in the two algorithms of UPRE.KeyGen and UPRE.ReKeyGen. For the same delegator or trustee, the algorithm UPRE.KeyGen is only executed once; and for each re-encryption operation, only UPRE.ReKeyGen needs to be run once. It is not difficult to find that the UPRE.KeyGen algorithm calls the trapdoor generation algorithm and the preimage sampling algorithm on the lattice. Therefore, the present invention also tests the running time of the above two algorithms under different parameters. It can be seen from Figure 4 that as n increases, the running time of the trapdoor generation algorithm on the lattice increases; it can be seen from Figure 5 that as n increases, the running time of the preimage sampling algorithm on the lattice increases exponentially.

[0145] The above embodiments and the descriptions in the specification only illustrate the principles and the best embodiments of the present invention. Without departing from the spirit and scope of the present invention, the present invention will have various changes and improvements, and these changes and improvements all fall within the scope of the present invention claimed.

Claims

1. A medical data security sharing method based on lattice-based updatable proxy re-encryption, the method involving a delegator, a trustee, and a cloud server; the delegator sends a medical data storage and encryption request to the trustee according to an emergency; characterized in that, The method described above specifically includes the following steps: S1). The cloud server generates public parameters pp and discloses the public parameters pp. S2). The delegator and the trustee generate their respective public-private key pairs. S3). The delegator encrypts the plaintext information of the medical data to obtain a ciphertext, and sends the ciphertext to the cloud server. S4). The delegator generates an updated public key for the trustee. The delegator generates an updated public key for the trustee by running the UPRE.Up-pk algorithm, which specifically includes the following steps: S41), input the public parameter pp and the public key pk j ={U j , A j}; S42), Sampling E j ′ ← χ m×m , Calculate U j ′ = U j + A j E j ′; Among them, E j ′ represents an m×m dimensional random matrix, and each element of the random matrix E j ′ belongs to the χ distribution, χ is the B-bounded distribution, and m is the rank of the lattice; S43), use the public key pk j to encrypt the random matrix E j ' to obtain the updated ciphertext up, i.e.: up = UPRE.Enc(pk j , E j ′); S44), output up = UPRE.Enc(pk j , E j ′) and the updated public key pk′ j = {U j ′, A j}; S5). The delegator uses the updated public key of the trustee and the delegator's private key to generate a re-encryption key. S6). The cloud server uses the re-encryption key to perform re-encryption processing on the ciphertext to obtain a re-encrypted ciphertext, and sends it to the trustee. S7). After receiving the re-encrypted ciphertext sent by the cloud server, the trustee uses the updated ciphertext to generate an updated private key. The trustee runs the UPRE.Up-sk algorithm to generate an updated private key, which specifically includes the following steps: S71), input the ciphertext up = UPRE.Enc(pk j , E j ′); and the updated public key pk′ j = {U j ′, A j}; S72), calculate E j ′ = UPRE.Dec(pk j , up); S73), output the updated private key sk′ j = E j + E j ′; S8). The trustee decrypts the re-encrypted ciphertext using the updated private key to obtain the medical plaintext data encrypted by the delegator. Specifically: S81), input the updated private key sk′ of the trustee j and the ciphertext c j =(c j0 , c j1 ); S82), calculate μ′ = c j1 -c j0 sk′ j ; S83), round each component of μ′ to {0, 1}, that is, for j ∈ 1, …, m, if μ′ j is closer to 0, then set μ j = 0, if μ′ j is closer to then set μ j = 1; Output the plaintext μ ∈ {0, 1} m .

2. The medical data security sharing method based on lattice-based updatable proxy re-encryption according to claim 1, wherein: The cloud server runs the UPRE.Setup algorithm to generate public parameters pp as: pp = (n, m, q, χ, χ m ); Among them, (n, m, q, χ) are lattice parameters; among them, n, m, q, and χ respectively represent the dimension of the lattice, the rank of the lattice, the modulus, and the error distribution; χ m represents a set of m-dimensional vectors in which each element belongs to the χ distribution.

3. A medical data security sharing method based on lattice-based updatable proxy re-encryption according to claim 2, characterized in that: In step S2), the delegator and the trustee respectively run the UPRE.KeyGen algorithm to generate their respective public-private key pairs, which specifically includes the following steps: S21), input the public parameter pp, and randomly select a matrix wherein, U i represents an n×m dimensional random matrix, and each element of the random matrix U i belongs to the integer group modulo q; S22), calculate through the trapdoor generation algorithm on the lattice wherein represents an n×m-dimensional random matrix, and each element of the random matrix A i belongs to the integer group modulo q; represents the trapdoor of the random matrix A i ; 1 n represents the security parameter; m represents the dimension of the lattice, and q represents the modulus; S23), sampling through the preimage sampling algorithm on the lattice where; E i ∈χ n×m represents an n×m dimensional random matrix, and each element constituting the matrix belongs to the χ distribution, and the matrix E generated by the SamplePre algorithm i satisfies the equation U i = A i E i ; τ is the parameter of the discrete Gaussian distribution; S24), output the public key pk i ={U i , A i}, the private key sk i = E i .

4. A medical data security sharing method based on lattice-based updatable proxy re-encryption according to claim 3, characterized in that: In step S3), the delegator uses the UPRE.Enc algorithm to encrypt the plaintext information of its medical data to obtain a ciphertext, which specifically includes the following steps: S31), input the public key pk i ={U i , A i} and the plaintext μ of the medical data plaintext information ∈ {0, 1} m ; S32), Selection vector Randomly select vectors x0 ← χ m and x1 ← χ m ; S33), set S34), output the ciphertext c i =(c i0 , c i1 ); Among them, the ciphertext consists of two parts, c i0 is the first component of the ciphertext, c i1 is the second component of the ciphertext; x0 and x1 represent two m-dimensional random vectors, and each element constituting the two vectors belongs to the χ distribution; q represents the modulus; s represents an n-dimensional random vector, and each element of the random vector s belongs to the group of integers modulo q; s T represents the transpose of the random vector s.

5. A medical data security sharing method based on lattice-based updatable proxy re-encryption according to claim 4, characterized in that: In step S5), the principal uses its own private key and the updated public key pk' of the trustee through the UPRE.ReKeyGen algorithm j to generate a re-encryption key, which specifically includes the following steps: S51), input the public parameter pp and the private key sk of the principal i = E i and the updated public key pk' of the trustee j ; S52), Random selection matrix Sampling And In the formula, matrix R1 represents a -dimensional random matrix, and each element of the random matrix R1 belongs to the group of integers modulo q, and both R2 and R3 represent -dimensional random matrices, and each element of the random matrices R2 and R3 belongs to the χ distribution; S53). Calculate the following formula: where Z represents the first part of the re-encryption key, and P2(E i ) represents the expansion function of the random matrix E i ; P2(E i ) outputs S54), randomly select a vector where r1 represents an n-dimensional vector set in which each element belongs to the integer group modulo q and represents an m-dimensional random vector in which each element belongs to the χ distribution; represents an m-dimensional vector set in which each element belongs to the integer group modulo q; χ m represents an m-dimensional vector set in which each element belongs to the χ distribution; S55), calculation where g T represents the second part of the re-encryption key; S56), output the re-encryption key rk i→j = {g T , Z} 6. The method for secure sharing of medical data based on lattice-based updatable proxy re-encryption according to claim 5, wherein: In step S6), the cloud server uses the UPRE.ReEnc algorithm to perform re-encryption processing on the ciphertext using the re-encryption key to obtain a re-encrypted ciphertext, specifically: S61), input the public parameter pp and the re-encryption key rk i→j ={g T , Z} and the ciphertext c i ; S62). Select a random number a ∈ χ and calculate: wherein, || represents the row-wise concatenation of two vectors or matrices; S63), calculate (BD(c i0 )||c i1 )·Z = (c′ j0 , c′ j1 ); Among them, the BD(v) function decomposes v and outputs Satisfying: S64), calculate the re-encrypted ciphertext c j , specifically as follows: where c j0 and c j1 represent the first component of the re-encrypted ciphertext and the second component of the re-encrypted ciphertext, respectively; S65), output the re-encrypted ciphertext c j =(c j0 , c j1 ).

Images