User revocable attribute keyword search-based encryption method and system with integrity verification

Abstract

The invention discloses a user revocable attribute keyword search-based encryption method and system with integrity verification, in the encryption system, a system parameter setting module generates a public parameter, a main private key, a binary tree, a revocation list and a message authentication key; the key generation module generates a public and private key pair of a user and updates binary tree state information; the ciphertext generation module generates a ciphertext and a message authentication code; the trap door generation module generates a search trap door; the updating module generates an updated timestamp ciphertext and a conversion key; the verification module generates an intermediate ciphertext after judging that the search result is complete, the revocation module updates a revocation list according to the revoked user, and the decryption module decrypts to obtain plaintext information according to the private key of the user. According to the invention, fine-grained data access control and result integrity verification in the cloud environment can be realized, and the identity of the user can be revoked at the same time.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing security technology, and in particular to a user-revocable attribute keyword search-based encryption method and system with integrity verification. Background Art

[0002] Attribute-based encryption (ABE) is mainly divided into two categories, namely ciphertext policy attribute-based encryption (CP-ABE) and key policy attribute-based encryption (KP-ABE). In CP-ABE, data owners can define access policies according to their own needs, and only users allowed by them can decrypt, which is more suitable for constructing a one-to-many data security sharing solution in a cloud environment.

[0003] Furthermore, in order to achieve one-to-many fine-grained access control and keyword search functions, Zheng et al. proposed a ciphertext policy-based attribute keyword search (CP-ABKS) scheme in 2014. In the CP-ABKS scheme, the access policy is attached to the ciphertext, and the key is associated with the user attribute set. When the user attribute set embedded in the key satisfies the access policy associated with the ciphertext and the trapdoor matches the index successfully, the user can decrypt the ciphertext. In 2019, Sun et al. proposed a CP-ABKS scheme with policy hiding, which can realize lightweight computing for users with cloud assistance, but failed to realize user revocation and integrity verification of search results. Summary of the invention

[0004] Purpose of the invention: The purpose of the present invention is to provide a user-revocable attribute keyword search encryption method and system with integrity verification, revoke malicious users through a revocation mechanism, and implement search result integrity verification through a message authentication code.

[0005] Technical solution: The user-revocable attribute keyword search encryption method with integrity verification of the present invention comprises:

[0006] (1) Configure the security parameter λ, and the trusted institution TA outputs the revocation list RL, the binary tree BT with state st, and the message authentication key K Mac , public parameters pp and master private key msk;

[0007] (2) Based on each user’s attribute set S, public parameter pp, master private key msk, and user id, the trusted institution TA calculates the user’s public-private key pair (sk id ,pkid ), update the state st of the binary tree BT and output the user's private key sk;

[0008] (3) Based on the public parameters pp, timestamp t, and message authentication key K Mac And access policy A, the data owner DO outputs the ciphertext CT and the message authentication code σ;

[0009] (4) Based on the public parameter pp, the revocation list RL, the state st of the binary tree BT, the user id, and the new timestamp t′, the edge server ES outputs the transformation key UTK id,t And the updated timestamp ciphertext TC;

[0010] (5) Based on the public parameter pp and the user private key sk, the data user DU outputs the trapdoor td;

[0011] (6) Based on the public parameter pp, the ciphertext CT and the trapdoor td, the cloud server CS performs verification. If the verification is successful, the message authentication code σ is sent to the data user DU, and the converted ciphertext ct is generated and sent to the edge server ES; otherwise, the output is ⊥;

[0012] (7) According to the conversion ciphertext ct and conversion key UTK id,t , the data user DU first verifies the message authentication code σ. If the verification is successful, the edge server ES generates an intermediate ciphertext K and sends the ciphertext C and the intermediate ciphertext K to the data user DU; otherwise, it returns ⊥;

[0013] (8) Based on the ciphertext C, the intermediate ciphertext K and your own private key sk id , the data user DU recovers the plaintext information M;

[0014] (9) The revocation list RL is updated according to the ID of the user to be revoked, the timestamp t, and the state st of the binary tree BT, and the trusted institution TA outputs the updated revocation list RL.

[0015] Further, step (1) comprises:

[0016] Input security parameter λ, the trusted institution TA generates a tuple <G,G T ,g,e>, where G and G T are two p-order multiplicative cyclic groups, p is a prime number, g is a generator of the group G, and the bilinear map e:G×G→G T ;

[0017] The trusted institution TA randomly selects a collision-resistant hash function H:{0,1} * →Z p , where {0,1} * Represents a bit string of arbitrary length, Zp represents the remainder class ring Z / pZ modulo p, where Z represents the set of all integers;

[0018] The trusted institution TA randomly selects τ1,…,τ n ,α,β∈Z p ,calculate U=e(g,g) α and V = e(g,g) αβ , where 1≤i≤n, n represents the number of attributes in the attribute set S;

[0019] The trusted authority TA defines an empty revocation list It is used to store the identities of all revoked data users and initialize a binary tree BT with q leaf nodes and a state of st;

[0020] The trusted institution TA initializes a l-bit timestamp t and randomly selects Then for each bit in timestamp t, randomly choose

[0021] Generate the message authentication key K according to the key generation algorithm in the message authentication code algorithm Mac ;

[0022] Output common parameters The binary tree BT in state st, the revocation list RL and the master private key msk={α,{τ i} i∈[1,n]}.

[0023] Further, step (2) comprises:

[0024] The trusted institution TA randomly selects μ id ∈Z p ,calculate Generate the user's public and private key pair

[0025] The trusted institution TA generates a corresponding attribute vector for each user's attribute set S according to the attribute and access vector generation algorithm.

[0026] Store the user id in the undefined leaf node θ of the binary tree BT id For each node x∈Path(θ id ), get g from node x x , Path(θ) is the set of all nodes on the path from the root to the leaf node θ in the binary tree BT, g xis the value selected when defining node x; otherwise, if node x is not defined, that is, the node does not store any content related to user information, the trusted institution TA randomly selects g x ∈G, then g x Store it in node x and update the state st←st∪{x,g x};

[0027] The trusted institution TA randomly selects s x ,s′ x ∈Z p ,calculate

[0028] Finally, the trusted institution TA outputs the user's private key And send it to the data user DU and the edge server ES.

[0029] Further, step (3) comprises:

[0030] The data owner DO randomly selects δ,θ,{η i} i∈[1,n] ∈Z p ,calculate

[0031] For each bit j∈[1,l] of timestamp t, the edge server ES calculates

[0032] The data owner DO generates offline ciphertext The offline ciphertext off.ct is a necessary component of the ciphertext CT;

[0033] According to the access policy A, the trusted institution TA generates the corresponding access vector according to the attributes and the access vector generation algorithm. Then the data owner DO calculates C = M·U δ , C′=V H(w)δ , γ i =η i +v i θ, where i∈[1,n], M is the plaintext information, and w is the keyword; then the data owner DO generates the corresponding message authentication code σ=Mac.GenMac(K Mac ,w||t);

[0034] For timestamp t, the data owner DO calculates the timestamp ciphertext Where I is the set of all zero bits t[j]=0 in timestamp t;

[0035] Data owner DO outputs ciphertext And the message authentication code σ, and send the ciphertext CT and the message authentication code σ to the cloud server CS.

[0036] Further, step (4) comprises:

[0037] According to the new timestamp t′, the cloud server CS updates the timestamp ciphertext Then the cloud server CS sends TC to the edge server ES;

[0038] For each x∈KUNodes(RL,st,t), the edge server ES randomly selects π x ,π′ x ∈Z p ,calculate Output update key UK t =(t,{uk1,uk2} x∈KUNodes(RL,st,t )); KUNodes represents the key update node algorithm;

[0039] For each node x∈Path(θ id )∩KUNodes(RL,st,t), edge server ES calculation Finally, the edge server ES outputs the updated user's conversion key And the updated timestamp ciphertext TC.

[0040] Further, step (5) includes: the data user DU calculates her / his trapdoor in

[0041] Further, step (6) comprises:

[0042] The cloud server CS first calculates e1 = (c′0, d2), e2 = e(C0, d1), where Then check the equation Is it true? If so, the cloud server CS sends the message authentication code σ to the data user DU, and then sends the converted ciphertext ct = (c′0, TC, C0) to the edge server ES; otherwise, it returns ⊥.

[0043] Step (7) comprises:

[0044] The data user DU first determines the equation Mac.GenMac(K Mac,w||t")=σ, where t" represents the time when the user makes the query. If so, the data user DU outputs "yes" and sends it to the edge server ES. After receiving the instruction from the data user DU, the edge server ES continues to generate the intermediate ciphertext K=e(c′0,usk2)·e(TC,usk3) / e(C0,usk1) and sends the ciphertext C and the intermediate ciphertext K to the data user DU; otherwise, it returns ⊥.

[0045] Further, step (8) comprises:

[0046] Data user DU uses ciphertext C, intermediate ciphertext K and his own private key sk id , recover the plaintext information

[0047] Further, step (9) comprises:

[0048] Input the ID of the revoked user, timestamp t and the state st of the binary tree BT. For all nodes x∈Path(θ id ), the trusted authority TA updates the revocation list RL by operating RL←RL∪(x,t).

[0049] The user-revocable attribute keyword-based search encryption system with integrity verification of the present invention comprises:

[0050] System parameter setting module, used to configure security parameter λ, the trusted institution TA outputs the revocation list RL, the binary tree BT with state st, and the message authentication key K Mac , public parameter pp and master private key msk; send the public parameter pp to the ciphertext generation module, the key generation module, the update module, the verification module, the trapdoor generation module and the revocation module, and send the binary tree BT to the trapdoor generation module;

[0051] The key generation module is used to calculate the public-private key pair (sk) of each user according to the attribute set S, public parameter pp, master private key msk and user id of each user. id ,pk id ), update the state st of the binary tree BT and output the user private key sk; send the user private key sk to the update module and the decryption module;

[0052] The ciphertext generation module is used to generate the ciphertext based on the public parameters pp, timestamp t, and message authentication key K. Mac And access strategy A, the data owner DO outputs the ciphertext CT and the message authentication code σ; the ciphertext CT is sent to the search module and the update module;

[0053] Update module, used for outputting the transformation key UTK by the edge server ES according to the public parameter pp, the revocation list RL, the state st of the binary tree BT, the user id and the new timestamp t′ id,t and the updated timestamp ciphertext TC; send the updated timestamp ciphertext TC to the ciphertext generation module, and convert the key UTK id,t Send to the verification module;

[0054] The trapdoor generation module is used to output the trapdoor td according to the public parameter pp and the user private key sk and the data user DU; and send the trapdoor td to the search module;

[0055] The search module is used to verify the cloud server CS based on the public parameter pp, the ciphertext CT and the trapdoor td. If the verification is successful, the corresponding conversion ciphertext ct and the message authentication code σ are returned to the verification module; otherwise, ⊥ is output;

[0056] Verification module, used to convert ciphertext ct and key UTK id,t , the data user DU first verifies the message authentication code σ. If the verification is successful, the edge server ES generates an intermediate ciphertext K and sends the ciphertext C and the intermediate ciphertext K to the decryption module; otherwise, it returns ⊥;

[0057] Decryption module, used to decrypt the ciphertext C, the intermediate ciphertext K and its own private key sk id , the data user DU recovers the plaintext information M;

[0058] And, a revocation module is used to update the revocation list RL according to the ID of the user to be revoked, the timestamp t and the state st of the binary tree BT, and the trusted institution TA outputs the updated revocation list RL and sends it to the update module.

[0059] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages: Compared with the general attribute-based encryption method, the present invention can achieve efficient revocation of malicious users and search result integrity verification, and can also achieve lightweight computing on the user side. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a schematic diagram of the structure of a user-revocable attribute keyword-based search encryption system with integrity verification provided by an embodiment of the present invention;

[0061] Figure 2 It is a schematic diagram of user usage status of a user-revocable attribute keyword-based search encryption system with integrity verification in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The present invention will be further described below in conjunction with the accompanying drawings.

[0063] An embodiment of the present invention provides a user-revocable attribute keyword search encryption method with integrity verification, which specifically includes the following steps:

[0064] (1) Configure the security parameter λ, and the trusted authority TA (trusted authority) outputs the revocation list RL, the binary tree BT with state st, and the message authentication key K Mac , public parameters pp and master private key msk;

[0065] Step (1) comprises:

[0066] (1.1) Input security parameter λ, the trusted institution TA generates a tuple <G,G T ,g,e>, where G and G T are two p-order multiplicative cyclic groups, p is a prime number, g is a generator of the group G, and the bilinear map e:G×G→G T ;

[0067] The trusted institution TA randomly selects a collision-resistant hash function H:{0,1} * →Z p , where {0,1} * Represents a bit string of arbitrary length, Z p represents the remainder class ring Z / pZ modulo p, where Z represents the set of all integers;

[0068] (1.2) The trusted institution TA randomly selects τ1,...,τ n ,α,β∈Z p ,calculate U=e(g,g) α and V = e(g,g) αβ , where 1≤i≤n, n represents the number of attributes in the attribute set S (when a user joins the system, the trusted institution TA distributes an identity and attribute set to the user);

[0069] (1.3) The trusted authority TA defines an empty revocation list It is used to store the identities of all revoked data users and initialize a binary tree BT with q leaf nodes and a state of st;

[0070] (1.4) The trusted institution TA initializes a l-bit timestamp t and randomly selects Then for each bit in timestamp t, randomly choose

[0071] (1.5) Generate the message authentication key K according to the key generation algorithm in the message authentication code algorithm (which is the existing technology) Mac ;

[0072] (1.6) Output common parameters The binary tree BT in state st, the revocation list RL and the master private key msk={α,{τ i} i∈[1,n]}.

[0073] (2) Based on each user’s attribute set S, public parameter pp, master private key msk, and user id, the trusted institution TA calculates the user’s public-private key pair (sk id ,pk id ), update the state st of the binary tree BT and output the user's private key sk;

[0074] Step (2) comprises:

[0075] (2.1) The trusted institution TA randomly selects μ id ∈Z p ,calculate Generate the user's public and private key pair

[0076] (2.2) The trusted institution TA generates a corresponding attribute vector for each user's attribute set S according to the attribute and access vector generation algorithm

[0077] Attribute and access vector generation algorithm:

[0078] The input of the algorithm is the user attribute value set S = {A1,...,A m}, where for each i∈[1,m], there is A i ∈{"+","-"}; Given an access policy A containing at most n attributes, each attribute has three possible values: positive value "+", negative value "-" and wildcard "*".

[0079] The output of this algorithm is an attribute vector and access vector

[0080] 1: The plus sign ("+") and wildcard ("*") in the access structure are placed in two position sets J and I;

[0081] 2: while k w ∈I do

[0082] 3: Calculation To derive the index a j ;

[0083] 4: for k w ∈I and i∈J do

[0084] 5: Calculation

[0085] 6: Only positive values ​​in one attribute set are separated into the position set J′;

[0086] 7: for i=1to n and i∈J′do

[0087] 8: Calculate {u j =+Σ i∈J′ i j};

[0088] 9: Return access vector and attribute vector

[0089] (2.3) Store the user id in the undefined leaf node θ of the binary tree BT id For each node x∈Path(θ id ), get g from node x x , Path(θ) is the set of all nodes on the path from the root to the leaf node θ in the binary tree BT, g x is the value selected when defining node x; otherwise, if node x is not defined, that is, the node does not store any content related to user information, the trusted institution TA randomly selects g x ∈G, then g x Store it in node x and update the state st←st∪{x,g x};

[0090] (2.4) The trusted institution TA randomly selects s x ,s′ x ∈Z p ,calculate

[0091] (2.5) Finally, the trusted institution TA outputs the user's private key And send it to the data user DU and the edge server ES.

[0092] (3) Based on the public parameters pp, timestamp t, and message authentication key K Mac And access policy A, the data owner DO (data owner) outputs the ciphertext CT and the message authentication code σ;

[0093] Step (3) includes:

[0094] (3.1) The data owner DO randomly selects δ,θ,{η i} i∈[1,n] ∈Z p , calculate C0 = g δ ,

[0095] (3.2) For each bit j∈[1,l] of timestamp t, the edge server ES calculates

[0096] (3.3) The data owner DO generates offline ciphertext The offline ciphertext off.ct is a necessary component of the ciphertext CT;

[0097] (3.4) According to the access policy A, the trusted institution TA generates the corresponding access vector according to the attributes and the access vector generation algorithm Then the data owner DO calculates C = M·U δ , C′=V H(w)δ , γ i =η i +v i θ, where i∈[1,n], M is the plaintext information, and w is the keyword; then the data owner DO generates the corresponding message authentication code σ=Mac.GenMac(K Mac ,w||t);

[0098] (3.5) For timestamp t, the data owner DO calculates the timestamp ciphertext Where I is the set of all zero bits t[j]=0 in timestamp t;

[0099] (3.6) Data owner DO outputs ciphertext And the message authentication code σ, and send the ciphertext CT and the message authentication code σ to the cloud server CS.

[0100] (4) Based on the public parameter pp, the revocation list RL, the state st of the binary tree BT, the user id, and the new timestamp t′, the edge server ES outputs the conversion key UTK id,t And the updated timestamp ciphertext TC;

[0101] Step (4) comprises:

[0102] (4.1) According to the new timestamp t′, the cloud server CS updates the timestamp ciphertext Then the cloud server CS sends TC to the edge server ES;

[0103] (4.2) For each x∈KUNodes(RL,st,t), the edge server ES randomly selects π x ,π′ x ∈Z p ,calculate Output update key UK t=(t,{uk1,uk2} x∈KUNodes(RL,st,t ));

[0104] (4.3) For each node x∈Path(θ id )∩KUNodes(RL,st,t), edge server ES calculation Finally, the edge server ES outputs the updated user's conversion key And the updated timestamp ciphertext TC.

[0105] Key Updating Nodes (KUNodes) algorithm:

[0106] First, define a binary tree BT, which has n leaf nodes and the state is st. For each non-leaf node x, x0 and x1 represent its left child node and right child node respectively. Each user is assigned a separate leaf node θ, and Path(θ) is defined as the set of all nodes on the path from the root to the leaf node θ in BT. The KUNodes algorithm takes the revocation list RL and the time period t as input, and puts all nodes x∈Path(θ) into the set X of each node θ related to the revoked user. Then collect the sets of left and right child nodes of all nodes x∈X except the nodes already stored in X to generate the set Y. The KUNodes algorithm finally outputs Y=KUNodes(RL,st,t), which represents the minimum set for updating keys. For users who have not been revoked, it updates its key for each node x∈Path(θ)∩KUNodes(RL,st,t). For revoked users, there is

[0107] (5) Based on the public parameter pp and the user private key sk, the data user DU (data user) outputs the trapdoor td;

[0108] Step (5) comprises:

[0109] The data user DU calculates her / his trapdoor in

[0110] (6) Based on the public parameter pp, the ciphertext CT and the trapdoor td, the cloud server CS performs verification. If the verification is successful, the message authentication code σ is sent to the data user DU, and the converted ciphertext ct is generated and sent to the edge server ES; otherwise, the output is ⊥;

[0111] Step (6) comprises:

[0112] The cloud server CS first calculates e1 = (c′0, d2), e2 = e(C0, d1), where Then check the equation Is it true? If so, the cloud server CS sends the message authentication code σ to the data user DU, and then sends the converted ciphertext ct = (c′0, TC, C0) to the edge server ES; otherwise, it returns ⊥.

[0113] (7) According to the conversion ciphertext ct and conversion key UTK id,t , the data user DU first verifies the message authentication code σ. If the verification is successful, the edge server ES generates an intermediate ciphertext K and sends the ciphertext C and the intermediate ciphertext K to the data user DU; otherwise, it returns ⊥;

[0114] Step (7) comprises:

[0115] The data user DU first determines the equation Mac.GenMac(K Mac ,w||t″)=σ, where t″ represents the time when the user makes the query. If so, the data user DU outputs “yes” and sends it to the edge server ES. After receiving the instruction from the data user DU, the edge server ES continues to generate the intermediate ciphertext K=e(c′0,usk2)·e(TC,usk3) / e(C0,usk10), and sends the ciphertext C and the intermediate ciphertext K to the data user DU; otherwise, it returns ⊥.

[0116] (8) Based on the ciphertext C, the intermediate ciphertext K and your own private key sk id , the data user DU recovers the plaintext information M;

[0117] Step (8) comprises:

[0118] Data user DU uses ciphertext C, intermediate ciphertext K and his own private key sk id , recover the plaintext information

[0119] (9) The revocation list RL is updated according to the ID of the user to be revoked, the timestamp t, and the state st of the binary tree BT, and the trusted institution TA outputs the updated revocation list RL.

[0120] Step (9) comprises:

[0121] Input the ID of the revoked user, timestamp t and the state st of the binary tree BT. For all nodes x∈Path(θ id ), the trusted authority TA updates the revocation list RL by operating RL←RL∪(x,t).

[0122] like Figure 1 As shown, an embodiment of the present invention also provides a user-revocable attribute keyword-based search encryption system with integrity verification, comprising:

[0123] System parameter setting module, used to configure security parameter λ, the trusted institution TA outputs the revocation list RL, the binary tree BT with state st, and the message authentication key K Mac , public parameter pp and master private key msk; send the public parameter pp to the ciphertext generation module, the key generation module, the update module, the verification module, the trapdoor generation module and the revocation module, and send the binary tree BT to the trapdoor generation module;

[0124] The key generation module is used to calculate the public-private key pair (sk) of each user according to the attribute set S, public parameter pp, master private key msk and user id of each user. id ,pk id ), update the state st of the binary tree BT and output the user private key sk; send the user private key sk to the update module and the decryption module;

[0125] The ciphertext generation module is used to generate the ciphertext based on the public parameters pp, timestamp t, and message authentication key K. Mac And access strategy A, the data owner DO outputs the ciphertext CT and the message authentication code σ; the ciphertext CT is sent to the search module and the update module;

[0126] Update module, used for outputting the transformation key UTK by the edge server ES according to the public parameter pp, the revocation list RL, the state st of the binary tree BT, the user id and the new timestamp t′ id,t and the updated timestamp ciphertext TC; send the updated timestamp ciphertext TC to the ciphertext generation module, and convert the key UTK id,t Send to the verification module;

[0127] The trapdoor generation module is used to output the trapdoor td according to the public parameter pp and the user private key sk and the data user DU; and send the trapdoor td to the search module;

[0128] The search module is used to verify the cloud server CS based on the public parameter pp, the ciphertext CT and the trapdoor td. If the verification is successful, the corresponding conversion ciphertext ct and the message authentication code σ are returned to the verification module; otherwise, ⊥ is output;

[0129] Verification module, used to convert ciphertext ct and key UTK id,t , the data user DU first verifies the message authentication code σ. If the verification is successful, the edge server ES generates an intermediate ciphertext K and sends the ciphertext C and the intermediate ciphertext K to the decryption module; otherwise, it returns ⊥;

[0130] Decryption module, used to decrypt the ciphertext C, the intermediate ciphertext K and its own private key sk id , the data user DU recovers the plaintext information M;

[0131] And, a revocation module is used to update the revocation list RL according to the ID of the user to be revoked, the timestamp t and the state st of the binary tree BT, and the trusted institution TA outputs the updated revocation list RL and sends it to the update module.

[0132] like Figure 2 As shown, the user-revocable attribute keyword search-based encryption system with integrity verification provided by an embodiment of the present invention includes the following four entities:

[0133] Trusted institution: As the administrator of the system, it generates the system's master key, public parameters, binary tree and revocation list. In addition, it is also responsible for distributing, updating and revoking user private keys.

[0134] Data owner: encrypts the document, generates the corresponding index, and uploads it to the cloud server.

[0135] User: Generates a corresponding trapdoor for the keyword you want to search for and then sends it to the cloud server. Before the edge server further decrypts it, it also needs to verify the integrity of the search results. After receiving the ciphertext sent from the edge server, it is decrypted using its own private key.

[0136] Cloud server: A malicious entity that may return incomplete search results and is responsible for storing encrypted ciphertexts and indexes outsourced by the data owner. When receiving a trapdoor from a data user, the cloud server matches it with the search index and sends the message authentication code to the data user and the corresponding ciphertext to the edge server after a successful match.

[0137] Edge server: An honest and curious device that is primarily used to perform heavy computational operations such as key updates and decryption.

[0138] The following will describe an example scenario in which the user-revocable attribute keyword search-based encryption method and system with integrity verification described in an embodiment of the present invention is applied to cloud computing.

[0139] In the scenario of data collection and sharing for the Internet of Things, data owners usually want to implement access control on shared data to prevent unauthorized users from accessing it. Data owners outsource encrypted data and indexes to cloud servers for data users to search. When a user wants to search for a file corresponding to a keyword, a trapdoor corresponding to the keyword must be generated first and sent to the cloud server. The encrypted keyword and plaintext information can only be searched and accessed when the user's key attribute meets the access policy of the ciphertext. At the same time, the integrity of the search results also needs to be verified. If the search results are tampered with or incomplete, the subsequent decryption operation will not be performed. In order to reduce the computing burden of resource-constrained devices on the user side, some decryption operations are delegated to the edge server. Since the edge server does not know the user's private key, it will not decrypt the plaintext information, but only the intermediate ciphertext. After the edge server sends the intermediate ciphertext to the user, the user can decrypt it according to his own private key to obtain the plaintext information. In addition, there may be a situation where the user is updated, and the access rights of illegal users need to be revoked through the user revocation mechanism.

Claims

1. User-revocable attribute-based keyword search encryption method with integrity verification, characterized in that include: (1) Configure the security parameter λ, and the trusted institution TA outputs the revocation list RL, the binary tree BT with state st, and the message authentication key K Mac , public parameters pp and master private key msk; (2) Based on each user’s attribute set S, public parameter pp, master private key msk, and user id, the trusted institution TA calculates the user’s public-private key pair (sk id ,pk id ), update the state st of the binary tree BT and output the user's private key sk; (3) Based on the public parameters pp, timestamp t, and message authentication key K Mac And access policy A, the data owner DO outputs the ciphertext CT and the message authentication code σ; (4) Based on the public parameter pp, the revocation list RL, the state st of the binary tree BT, the user id, and the new timestamp t′, the edge server ES outputs the transformation key UTK id,t And the updated timestamp ciphertext TC; (5) Based on the public parameter pp and the user private key sk, the data user DU outputs the trapdoor td; (6) Based on the public parameter pp, the ciphertext CT, and the trapdoor td, the cloud server CS performs verification. If the verification is successful, the message authentication code σ is sent to the data user DU, and the converted ciphertext ct is generated and sent to the edge server ES; Otherwise output ⊥; (7) According to the conversion ciphertext ct and conversion key UTK id,t , the data user DU first verifies the message authentication code σ. If the verification is successful, the edge server ES generates an intermediate ciphertext K and sends the ciphertext C and the intermediate ciphertext K to the data user DU; otherwise, it returns ⊥; (8) Based on the ciphertext C, the intermediate ciphertext K and your own private key sk id , the data user DU recovers the plaintext information M; (9) The revocation list RL is updated according to the ID of the user to be revoked, the timestamp t, and the state st of the binary tree BT, and the trusted institution TA outputs the updated revocation list RL.

2. The user-revocable attribute keyword search-based encryption method with integrity verification according to claim 1, characterized in that: Step (1) comprises: Input security parameter λ, the trusted institution TA generates a tuple <G,G T ,g,e>, where G and G T are two p-order multiplicative cyclic groups, p is a prime number, g is a generator of the group G, and the bilinear map e:G×G→G T ; The trusted institution TA randomly selects a collision-resistant hash function H:{0,1} * →Z p , where {0,1} * Represents a bit string of arbitrary length, Z p represents the remainder class ring Z / pZ modulo p, where Z represents the set of all integers; Trusted institution TA randomly selects calculate U=e(g,g) α and V = e(g,g) αβ , where 1≤i≤n, n represents the number of attributes in the attribute set S; The trusted authority TA defines an empty revocation list It is used to store the identities of all revoked data users and initialize a binary tree BT with q leaf nodes and a state of st; The trusted institution TA initializes a l-bit timestamp t and randomly selects Then for each bit in timestamp t, randomly choose Generate the message authentication key K according to the key generation algorithm in the message authentication code algorithm Mac ; Output common parameters The binary tree BT in state st, the revocation list RL and the master private key msk={α,{τ i { i∈[1,n ]}.

3. The user-revocable attribute keyword search-based encryption method with integrity verification according to claim 2, characterized in that: Step (2) comprises: The trusted institution TA randomly selects μ id ∈Z p ,calculate Generate the user's public and private key pair The trusted institution TA generates a corresponding attribute vector for each user's attribute set S according to the attribute and access vector generation algorithm. Store the user id in the undefined leaf node θ of the binary tree BT id For each node x∈Path(θ id ), get g from node x x , Path(θ) is the set of all nodes on the path from the root to the leaf node θ in the binary tree BT, g x is the value selected when defining node x; otherwise, if node x is not defined, that is, the node does not store any content related to user information, the trusted institution TA randomly selects g x ∈G, then g x Store it in node x and update the state st←st∪{x,g x }; The trusted institution TA randomly selects s x ,s′ x ∈Z p ,calculate Finally, the trusted institution TA outputs the user's private key And send it to the data user DU and the edge server ES.

4. The user-revocable attribute keyword search-based encryption method with integrity verification according to claim 3, characterized in that: Step (3) includes: The data owner DO randomly selects δ,θ,{η i } i∈[1,n] ∈Z p ,calculate For each bit j∈[1,l] of timestamp t, the edge server ES calculates The data owner DO generates offline ciphertext The offline ciphertext off.ct is a necessary component of the ciphertext CT; According to the access policy A, the trusted institution TA generates the corresponding access vector according to the attributes and the access vector generation algorithm. Then the data owner DO calculates C = M·U δ , C′=V H(w)δ , γ i =η i +v i θ, where i∈[1,n], M is the plaintext information, and w is the keyword; then the data owner DO generates the corresponding message authentication code σ=Mac.GenMac(K Mac ,w||t); For timestamp t, the data owner DO calculates the timestamp ciphertext Where I is the set of all zero bits t[j]=0 in timestamp t; Data owner DO outputs ciphertext And the message authentication code σ, and send the ciphertext CT and the message authentication code σ to the cloud server CS.

5. The user-revocable attribute keyword search-based encryption method with integrity verification according to claim 4, characterized in that: Step (4) comprises: According to the new timestamp t′, the cloud server CS updates the timestamp ciphertext Then the cloud server CS sends TC to the edge server ES; For each x∈KUNodes(RL,st,t), the edge server ES randomly selects π x ,π′ x ∈Z p ,calculate Output update key UK t =(t,{uk1,uk2} x∈KUNodes(RL,st,t) ); KUNodes represents the key update node algorithm; For each node x∈Path(θ id )∩KUNodes(RL,st,t), edge server ES calculation Finally, the edge server ES outputs the updated user's conversion key And the updated timestamp ciphertext TC.

6. The user-revocable attribute keyword search-based encryption method with integrity verification according to claim 5, characterized in that: Step (5) includes: the data user DU calculates her / his trapdoor in 7. The user-revocable attribute keyword search-based encryption method with integrity verification according to claim 6, characterized in that: Step (6) comprises: The cloud server CS first calculates e1 = (c′0, d2), e2 = e(C0, d1), where Then check the equation Is it true? If so, the cloud server CS sends the message authentication code σ to the data user DU, and then sends the converted ciphertext ct = (c′0, TC, C0) to the edge server ES; otherwise, it returns ⊥. Step (7) comprises: The data user DU first determines the equation Mac.GenMac(K Mac ,w||t″)=σ, where t″ represents the time when the user makes the query. If so, the data user DU outputs "yes" and sends it to the edge server ES. After receiving the instruction from the data user DU, the edge server ES continues to generate the intermediate ciphertext K=e(c′0,usk2)·e(TC,usk3) / e(C0,usk1) and sends the ciphertext C and the intermediate ciphertext K to the data user DU; otherwise, it returns ⊥.

8. The user-revocable attribute keyword search-based encryption method with integrity verification according to claim 7, characterized in that: Step (8) comprises: Data user DU uses ciphertext C, intermediate ciphertext K and his own private key sk id , recover the plaintext information 9. The user-revocable attribute keyword search-based encryption method with integrity verification according to claim 8, characterized in that: Step (9) comprises: Input the ID of the revoked user, timestamp t and the state st of the binary tree BT. For all nodes x∈Path(θ id ), the trusted authority TA updates the revocation list RL by operating RL←RL∪(x,t).

10. A user-revocable attribute-based keyword search encryption system with integrity verification, characterized in that: include: System parameter setting module, used to configure security parameter λ, the trusted institution TA outputs the revocation list RL, the binary tree BT with state st, and the message authentication key K Mac , public parameter pp and master private key msk; send the public parameter pp to the ciphertext generation module, the key generation module, the update module, the verification module, the trapdoor generation module and the revocation module, and send the binary tree BT to the trapdoor generation module; The key generation module is used to calculate the public-private key pair (sk) of each user according to the attribute set S, public parameter pp, master private key msk and user id of each user. id ,pk id ), update the state st of the binary tree BT and output the user private key sk; send the user private key sk to the update module and the decryption module; The ciphertext generation module is used to generate the ciphertext based on the public parameters pp, timestamp t, and message authentication key K. Mac And access strategy A, the data owner DO outputs the ciphertext CT and the message authentication code σ; the ciphertext CT is sent to the search module and the update module; Update module, used for outputting the transformation key UTK by the edge server ES according to the public parameter pp, the revocation list RL, the state st of the binary tree BT, the user id and the new timestamp t′ id,t And the updated timestamp ciphertext TC; Send the updated timestamp ciphertext TC to the ciphertext generation module and convert the key UTK id,t Send to the verification module; The trapdoor generation module is used to output the trapdoor td according to the public parameter pp and the user private key sk and the data user DU; and send the trapdoor td to the search module; The search module is used to verify the cloud server CS based on the public parameter pp, the ciphertext CT and the trapdoor td. If the verification is successful, the corresponding conversion ciphertext ct and the message authentication code σ are returned to the verification module; otherwise, ⊥ is output; Verification module, used to convert ciphertext ct and key UTK id,t , the data user DU first verifies the message authentication code σ. If the verification is successful, the edge server ES generates an intermediate ciphertext K and sends the ciphertext C and the intermediate ciphertext K to the decryption module; otherwise, it returns ⊥; Decryption module, used to decrypt the ciphertext C, the intermediate ciphertext K and its own private key sk id , the data user DU recovers the plaintext information M; And, a revocation module is used to update the revocation list RL according to the ID of the user to be revoked, the timestamp t and the state st of the binary tree BT, and the trusted institution TA outputs the updated revocation list RL and sends it to the update module.

Images