Cloud computing service platform based on lattice-based proxy re-encryption

Abstract

The invention relates to a cloud computing service platform based on lattice-based proxy re-encryption, and belongs to the field of cloud computing and network security. According to the method, the plaintext data is subjected to fine-grained classification through the condition vector, the re-encrypted ciphertext is controlled through the condition vector, the condition key is generated by the condition vector, and when the condition key of the data receiver is matched with the re-encrypted ciphertext content, the proxy server can correctly convert the corresponding ciphertext data, so that the re-encrypted ciphertext can be accurately converted. And irrelevant data cannot be re-encrypted, so that leakage of other data is avoided. And on the other hand, the platform designs a proxy re-encryption scheme based on a lattice error learning problem (LWE), encrypts data by adopting a lattice cryptographic algorithm, generates a public and private key pair, and effectively resists quantum attacks.

Description

Technical Field

[0001] The present invention belongs to the field of cloud computing and network security, and in particular relates to a cloud computing service platform based on lattice proxy re-encryption. Background Art

[0002] The cloud computing service platform can quickly and conveniently provide complex program calculations and massive data storage services for a large number of companies and individuals, reducing the cost of terminal equipment, changing the way people share data, information and knowledge, and achieving the goal of efficient and reasonable use of network resources. With the help of the large storage space and fast computing power of the cloud computing platform, users can use the user-side equipment to perform relevant data calculations and data storage services at any time and any place.

[0003] Due to the openness of the Internet, cloud service providers are not completely trustworthy. They may obtain and sell user information privately for economic interests or other reasons, or cause data leakage due to improper management. According to a survey by Tencent Security Threat Intelligence Center, the risk of network attacks against public clouds, such as malicious Trojans, cloud ransomware, and abnormal logins, has been increasing in recent years. The cloud computing era is facing increasingly severe security challenges. Therefore, it is necessary to consider introducing proxy re-encryption technology to achieve secure sharing of ciphertext data on the cloud.

[0004] Proxy re-encryption technology mainly operates on ciphertext, which can convert ciphertext information encrypted by the data owner's public key into information encrypted by the data receiver's public key for the same plaintext. The data receiver can decrypt the relevant plaintext message without knowing the data owner's private key, thus realizing secure data sharing in the cloud computing environment.

[0005] The existing proxy re-encryption scheme has a large granularity in converting and sharing data, and does not have the advantages of data security and efficient sharing in scenarios with a large number of users and diverse needs. On the other hand, the existing proxy re-encryption scheme uses the traditional public key system when sharing data, which cannot guarantee the secure sharing of data on the cloud computing service platform, as follows:

[0006] (1) Unable to fine-grainedly control the re-encrypted files. Existing proxy re-encryption schemes do not use conditional keys to fine-grainedly control the re-encrypted information, resulting in the conversion of irrelevant information.

[0007] (2) Unable to effectively resist quantum attacks. Existing proxy re-encryption schemes are constructed based on classical mathematical problems (such as large prime number factorization and discrete logarithms). These difficult problems can be solved in polynomial time with a certain advantage using the Shor quantum algorithm, so they cannot resist quantum attacks. Summary of the invention

[0008] 1. Technical issues to be resolved

[0009] The technical problem to be solved by the present invention is how to provide a cloud computing service platform based on lattice proxy re-encryption to solve the problem that the prior art cannot control the re-encrypted files in a fine-grained manner and cannot effectively resist quantum attacks.

[0010] (II) Technical solution

[0011] In order to solve the above technical problems, the present invention proposes a cloud computing service platform based on lattice proxy re-encryption, which includes: a data owner, a cloud storage space and a data recipient; wherein the cloud storage space includes a cloud server and a proxy server, the cloud server stores the encrypted data of the data owner, and the proxy server stores the public-private key pair and conditional key of the data owner and the data recipient. When the data owner needs to share data, the cloud server first uses the conditional vector in the conditional key to match the encrypted data. If the match is successful, the cloud server transmits the encrypted data to the proxy server for data conversion; the proxy server re-encrypts the data using the re-encryption key based on the lattice proxy re-encryption method; the data recipient decrypts the data using his own private key.

[0012] (III) Beneficial effects

[0013] The present invention proposes a cloud computing service platform based on lattice proxy re-encryption. The present invention introduces lattice proxy re-encryption to realize secure data sharing on the cloud computing platform and ensure the security of plaintext data during data exchange.

[0014] The scheme of the present invention introduces identity vectors to achieve fine-grained conversion and sharing of data. In a multi-user, multi-scenario application environment, it ensures accurate data sharing, ensures the conversion of irrelevant data, and fully realizes the security and accurate sharing requirements of user data. At the same time, the lattice proxy re-encryption technology uses the lattice cryptographic algorithm to generate encrypted ciphertexts and public and private key pairs of data owners and data recipients. Compared with the classical mathematical difficulties such as large prime number decomposition and discrete logarithms of traditional proxy re-encryption schemes, the lattice proxy re-encryption technology designs encryption schemes based on the LWE problem, which can safely and efficiently resist quantum computing attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is the overall architecture diagram of the cloud computing service platform of the present invention;

[0016] Figure 2 It is a schematic diagram of the proxy re-encryption scheme of the present invention;

[0017] Figure 3 This is a flowchart of the lattice proxy re-encryption of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0019] In order to solve the threats brought by the above problems, the present invention provides a cloud computing service platform based on lattice-based proxy re-encryption. The solution of the present invention performs fine-grained classification of plaintext data through conditional vectors, and controls the re-encrypted ciphertext through conditional vectors. The conditional key is generated by the conditional vector. When the conditional key of the data recipient matches the re-encrypted ciphertext content, the proxy server can correctly convert the corresponding ciphertext data, and irrelevant data will not be re-encrypted, avoiding the leakage of other data. On the other hand, the platform designs a proxy re-encryption scheme based on the lattice learning error problem (LWE), adopts a lattice cryptographic algorithm to encrypt data and generate public-private key pairs, and effectively resists quantum attacks.

[0020] like Figure 1 As shown in the figure, the cloud computing service platform proposed in this scheme includes: data owner, cloud storage space and data receiver. The cloud storage space includes cloud server and proxy server. The cloud server stores the encrypted data of the data owner, and the proxy server stores the public-private key pair and conditional key of the data owner and the data receiver. When the data owner needs to share data, the cloud server first uses the conditional vector in the conditional key to match the encrypted data. If the match is successful, the cloud server transmits the encrypted data to the proxy server for data conversion; the proxy server re-encrypts the data using the re-encryption key based on the lattice proxy re-encryption method; the data receiver decrypts the data using his own private key.

[0021] The specific process is as follows:

[0022] S11. The data owner sets m keywords b according to the fine-grained characteristics of the data. 1 ,b 2 ,…b m , and generate the conditional vector c=(b 1 ,b 2 ,…b m ) X , realize the fine-grained classification of data by conditional vectors;

[0023] S12, the data owner encrypts the conditional vector based on the lattice cryptographic algorithm, generates a conditional key, and stores it in the proxy server;

[0024] S13, the data owner and the data receiver respectively generate a public and private key pair based on the Lattice cryptographic algorithm and store them in the proxy server;

[0025] S14. The data owner uses his own public key and condition vector to encrypt the data based on the lattice cryptographic algorithm and stores it in the cloud server;

[0026] S15. When the data owner needs to share data, the cloud server first obtains the condition key from the proxy server, decrypts the condition key using the lattice cryptographic algorithm to obtain the condition vector, and uses the condition vector to match the encrypted data. If the match is successful, the cloud server transmits the encrypted data to the proxy server for data conversion and executes S16. Otherwise, the cloud server outputs an invalid signal.

[0027] S16, the proxy server re-encrypts the data using the re-encryption key;

[0028] S17. The data recipient uses his or her own private key to decrypt the data.

[0029] Proxy re-encryption is an extension of public key encryption. In a proxy re-encryption scheme, there are three types of participants: data owner, data recipient, and cloud storage space. After obtaining a proxy re-encryption key from the data owner to the data recipient and a ciphertext of the data owner, the proxy server in the cloud storage space can convert the data owner's ciphertext into the data recipient's ciphertext without decrypting the data owner's ciphertext, and the proxy server cannot obtain any plaintext information. The proxy re-encryption scheme consists of five algorithms: key generation algorithm (KeyGen), re-key generation algorithm (ReKeyGen), encryption algorithm (Enc), re-encryption algorithm (ReEnc) and decryption algorithm (Dec). Lattice proxy re-encryption is a proxy re-encryption based on the lattice cryptographic algorithm. It introduces the lattice error learning problem to generate the public-private key pair of the data owner and the data recipient, and performs encryption and decryption operations on the data, which can effectively resist quantum attacks. The details are as follows:

[0030] (1) Key generation algorithm: input security parameter n, and output the user's public and private key pair (pk, sk);

[0031] (2) Re-key generation algorithm: Input the data owner's private key sk i , and the public key pk of the data receiver j , using the lattice-based re-key generation algorithm to generate the re-encryption key rk i->j The lattice-based re-key generation algorithm is essentially an application of the lattice-based key generation algorithm, which uses the original image sampling technology in the lattice-based key generation algorithm to generate a re-encryption key;

[0032] (3) Encryption algorithm: Input the encrypted data μ, use the user's public key pk and encryption algorithm to output a ciphertext c i ;

[0033] (4) Re-encryption algorithm: Input a ciphertext c of the data owner i and the re-encryption key rk i->j, using the re-encryption algorithm, output a ciphertext c of the data receiver j The re-encryption algorithm uses the re-encryption key to convert the data owner's ciphertext into the data receiver's ciphertext. The process does not require the participation of the data owner and is therefore non-interactive.

[0034] (5) Decryption algorithm: Input a re-encrypted ciphertext c j and the data recipient's private key sk j , using the decryption algorithm, output the plaintext μ.

[0035] Proxy re-encryption schemes such as Figure 2 The proxy re-encryption process is as follows:

[0036] S21, the data owner and the data receiver respectively call the key generation algorithm to generate a public-private key pair (pk i ,sk i ) and (pk j ,sk j );

[0037] S22, the data owner calls the encryption algorithm and uses his own public key pk i Encrypt data μ to generate ciphertext c i ;

[0038] S23. The data owner obtains the public key pk of the data receiver j ;

[0039] S24, the data owner calls the re-key generation algorithm and uses his own private key sk i and the public key pk of the data recipient j , generate the re-encryption key rk i->j ;

[0040] S25, the data owner will re-key the key rk i->j Upload to cloud storage space;

[0041] S26, the agent in the cloud storage space calls the re-encryption algorithm and uses the re-signature key rk i->j , the ciphertext c of the data owner i The output is the ciphertext c of the data receiver j ;

[0042] S27. The data recipient obtains the re-encrypted ciphertext c from the cloud storage space j ;

[0043] S28, the data receiver calls the decryption algorithm and uses his own private key sk j Decrypt the re-encrypted ciphertext into plaintext μ.

[0044] Embodiment 1:

[0045] The lattice proxy re-encryption scheme uses Gentry's BGN-like encryption to construct a multi-use one-way proxy re-encryption scheme, as follows:

[0046] (1) Key generation algorithm: Input security parameter 1 n , randomly select a prime number q, and run the trapdoor generation algorithm TrapGen(1 n ) generates a random matrix A and a notch basis T of the lattice A. The original image sampling function f A (x) = Ax mod q. Then the public key is A and the private key is T;

[0047] (2) Re-key generation algorithm: Input the public key pk of the data receiver j =A j , and the data owner's private key sk i =T i Let A j =(a j1 ,a j2 ,…,a jm ) T For each a jn ,n=1,…,m,construct the original image sampling algorithm SamplePre(A i ,T i ,a jn ,σ), extract a vector r n , so that A i r n =a jn mod q and || r n ||≤σ*m 1 / 2 Let R pki->pkj =(r 1 ,r 2 ,...,r m ), then A i R pki->pkj =A j mod q and || R pki->pkj ||≤σ*m 1 / 2 . Let the re-encryption key be rk pki->pkj , then rk pki->pkj That is R pki->pkj The value of

[0048] (3) Encryption algorithm: Enter a message pk i =A i , encrypted as follows:

[0049] 1) Select a random vector s i, an error vector x i ←χ m , a vector b i ←{0,1} m ;

[0050] 2) Calculate the ciphertext c i =(A i ) T *s i +2x i +μb i .

[0051] (4) Re-encryption algorithm: Enter a public key pk i =A i The ciphertext c i and the re-encryption key rk pki->pkj =R pki->pkj , calculate c j =(R pki->pkj ) T *c i +2x j , where x j ←χ m , output c j ;

[0052] (5) Decryption algorithm: Input private key sk j =T j , ciphertext c j . Calculate w = (T j T ) -1 (T j T c j )mod 2, if w=0, then output 0, otherwise output 1.

[0053] The Geki proxy re-encryption process is as follows Figure 3 shown.

[0054] The key points of the present invention are:

[0055] As a data ciphertext conversion technology in cloud computing, proxy re-encryption technology is safe and efficient. It can effectively solve the inconvenience of data sharing for users in cloud environments, greatly reduce the burden of users frequently publishing and accessing passwords, enhance the reliability and confidentiality of cloud data, and protect users' privacy well.

[0056] As the number of users increases, their needs are also becoming increasingly diversified. In order to meet users' application requirements for complex scenarios, this solution proposes fine-grained control of re-encrypted files and introduces conditional vectors to perform fine-grained control on encrypted data, ensuring that data recipients can accurately obtain the required data, avoiding the conversion and sharing of irrelevant data, and protecting data security.

[0057] Lattice cryptographic algorithms can effectively resist quantum attacks. Lattice cryptographic algorithms designed based on the LWE problem are simple and highly secure. By reducing the difficulty of breaking the cryptographic scheme to the difficulty of solving the LWE problem, the security of the cryptographic scheme can be guaranteed based on the difficulty assumption of the lattice problem.

[0058] Effects of the present invention:

[0059] The present invention introduces lattice proxy re-encryption to realize secure data sharing on a cloud computing platform and ensure the security of plaintext data during data exchange.

[0060] This solution introduces identity vectors to achieve fine-grained conversion and sharing of data. In a multi-user, multi-scenario application environment, it ensures accurate data sharing, ensures the conversion of irrelevant data, and fully realizes the security and accurate sharing needs of user data. At the same time, the lattice proxy re-encryption technology uses the lattice cryptographic algorithm to generate encrypted ciphertext and the public and private key pairs of the data owner and the data receiver. Compared with the classical mathematical difficulties such as large prime number decomposition and discrete logarithms of traditional proxy re-encryption schemes, the lattice proxy re-encryption technology designs encryption schemes based on the LWE problem, which can safely and efficiently resist quantum computing attacks.

[0061] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A cloud computing service platform based on lattice proxy re-encryption, characterized in that: The platform includes: data owners, cloud storage space and data recipients; the cloud storage space includes cloud servers and proxy servers, the cloud servers store the encrypted data of the data owners, the proxy servers store the public-private key pairs and conditional keys of the data owners and data recipients, when the data owner needs to share data, the cloud server first uses the conditional vector in the conditional key to match the encrypted data, if the match is successful, the cloud server transmits the encrypted data to the proxy server for data conversion; the proxy server re-encrypts the data using the re-encryption key based on the lattice proxy re-encryption method; the data recipient decrypts the data using his own private key.

2. The cloud computing service platform based on lattice proxy re-encryption according to claim 1, characterized in that: The specific process of the platform includes: S11. The data owner sets m keywords b1, b2, ... b according to the fine-grained characteristics of the data. m , and generate the conditional vector c=(b1,b2,…b m ) X , realize the fine-grained classification of data by conditional vectors; S12, the data owner encrypts the conditional vector based on the lattice cryptographic algorithm, generates a conditional key, and stores it in the proxy server; S13, the data owner and the data receiver respectively generate a public and private key pair based on the Lattice cryptographic algorithm and store them in the proxy server; S14. The data owner uses his own public key and condition vector to encrypt the data based on the lattice cryptographic algorithm and stores it in the cloud server; S15. When the data owner needs to share data, the cloud server first obtains the condition key from the proxy server, decrypts the condition key using the lattice cryptographic algorithm to obtain the condition vector, and uses the condition vector to match the encrypted data. If the match is successful, the cloud server transmits the encrypted data to the proxy server for data conversion and executes S16. Otherwise, the cloud server outputs an invalid signal. S16, the proxy server re-encrypts the data using the re-encryption key; S17. The data recipient uses his or her own private key to decrypt the data.

3. The cloud computing service platform based on lattice proxy re-encryption according to claim 1, characterized in that: The proxy re-encryption scheme includes three types of participants: data owners, data recipients, and cloud storage space. After obtaining a proxy re-encryption key from the data owner to the data recipient and a ciphertext of the data owner, the proxy server in the cloud storage space can convert the data owner's ciphertext into the data recipient's ciphertext without decrypting the data owner's ciphertext, and the proxy server cannot obtain any plaintext information.

4. The cloud computing service platform based on lattice proxy re-encryption as claimed in claim 3, characterized in that: The proxy re-encryption scheme consists of five algorithms: key generation algorithm (KeyGen), re-key generation algorithm (ReKeyGen), encryption algorithm (Enc), re-encryption algorithm (ReEnc) and decryption algorithm (Dec); Key generation algorithm: input security parameter n, output user's public and private key pair (pk, sk); Re-key generation algorithm: Input data owner's private key sk i , and the public key pk of the data receiver j , using the lattice-based re-key generation algorithm to generate the re-encryption key rk i->j ; Encryption algorithm: Input the encrypted data μ, use the user's public key pk and encryption algorithm, and output a ciphertext c i ; Re-encryption algorithm: Input a ciphertext c of the data owner i and the re-encryption key rk i->j , using the re-encryption algorithm, output a ciphertext c of the data receiver j ; The re-encryption algorithm uses the re-encryption key to convert the data owner's ciphertext into the data receiver's ciphertext. The process does not require the participation of the data owner and is therefore non-interactive; Decryption algorithm: Input a re-encrypted ciphertext c j and the data recipient's private key sk j , using the decryption algorithm, output the plaintext μ.

5. The cloud computing service platform based on lattice proxy re-encryption as claimed in claim 4, characterized in that: The proxy re-encryption process includes: S21, the data owner and the data receiver respectively call the key generation algorithm to generate a public-private key pair (pk i ,sk i ) and (pk j ,sk j ); S22, the data owner calls the encryption algorithm and uses his own public key pk i Encrypt data μ to generate ciphertext c i ; S23. The data owner obtains the public key pk of the data receiver j ; S24, the data owner calls the re-key generation algorithm and uses his own private key sk i and the public key pk of the data recipient j , generate the re-encryption key rk i->j ; S25, the data owner will re-key the key rk i->j Upload to cloud storage space; S26, the agent in the cloud storage space calls the re-encryption algorithm and uses the re-signature key rk i->j , the data owner's ciphertext c i The output is the ciphertext c of the data receiver j ; S27. The data recipient obtains the re-encrypted ciphertext c from the cloud storage space j ; S28, the data receiver calls the decryption algorithm and uses his own private key sk j Decrypt the re-encrypted ciphertext into plaintext μ.

6. The cloud computing service platform based on lattice proxy re-encryption according to any one of claims 1 to 5, characterized in that: The lattice proxy re-encryption scheme uses Gentry's BGN-class encryption to construct a multi-use one-way proxy re-encryption scheme, including: key generation algorithm, re-key generation algorithm, encryption algorithm, re-encryption algorithm and decryption algorithm.

7. The cloud computing service platform based on lattice proxy re-encryption according to claim 6, characterized in that: The key generation algorithm of the lattice proxy re-encryption scheme includes: input security parameter 1 n , randomly select a prime number q, and run the trapdoor generation algorithm TrapGen(1 n ) generates a random matrix A and a notch basis T of the lattice A; the original image sampling function f A (x) = Axmod q; then the public key is A and the private key is T.

8. The cloud computing service platform based on lattice proxy re-encryption according to claim 7, characterized in that: The re-key generation algorithm of the lattice proxy re-encryption scheme includes: inputting the public key pk of the data receiver j =A j , and the data owner's private key sk i =T i ; Let A j =(a j1 ,a j2 ,…,a jm ) T ; For each a jn , n = 1, ..., m, construct the original image sampling algorithm SamplePre (A i ,T i ,a jn ,σ),σ>0, extract a vector r n , so that A i r n =a jn mod q and || r n ||≤σ*m 1 / 2 ; Let R pki->pkj =(r1,r2,...,r m ), then A i R pki->pkj =A j mod q and || R pki->pkj ||≤σ*m 1 / 2 ; Let the re-encryption key be rk pki->pkj , then rk pki->pkj That is R pki->pkj The value of .

9. The cloud computing service platform based on lattice proxy re-encryption according to claim 8, characterized in that: The encryption algorithm of the lattice proxy re-encryption scheme includes: input a message μ∈{0,1}, pk i =A i , encrypted as follows: 1) Select a random vector s i , an error vector x i ←χ m , a vector b i ←{0,1} m ; 2) Calculate the ciphertext c i =(A i ) T *s i +2x i +μb i .

10. The cloud computing service platform based on lattice proxy re-encryption according to claim 9, characterized in that: The re-encryption algorithm and decryption algorithm of the lattice proxy re-encryption scheme include: Re-encryption algorithm: Enter a public key pk i =A i The ciphertext c i and the re-encryption key rk pki->pkj =R pki->pkj , calculate c j =(R pki->pkj ) T *c i +2x j , where x j ←χ m , output c j ; Decryption algorithm: input private key sk j =T j , ciphertext c j ; Calculate w = (T j T ) -1 (T j T c j )mod 2, if w=0, then output 0, otherwise output 1.

Images