A cloud computing service platform based on lattice-based proxy re-encryption

Abstract

This invention relates to a cloud computing service platform based on lattice-based proxy re-encryption, belonging to the fields of cloud computing and network security. The invention performs fine-grained classification of plaintext data using conditional vectors and controls the re-encryption of ciphertext using the same conditional vectors. The conditional key is generated from the conditional vectors. Only when the data receiver's conditional key matches the re-encrypted ciphertext content can the proxy server correctly convert the corresponding ciphertext data, while irrelevant data is not re-encrypted, preventing the leakage of other data. Furthermore, the platform designs a proxy re-encryption scheme based on the lattice error learning problem (LWE), employing lattice cryptography algorithms to encrypt data and generate public-private key pairs, effectively resisting quantum attacks.

Description

Technical Field

[0001] This invention belongs to the field of cloud computing and network security, and specifically relates to a cloud computing service platform based on lattice-based proxy re-encryption. Background Technology

[0002] Cloud computing service platforms can quickly and conveniently provide complex program calculations and massive data storage services to numerous companies and individuals, reducing the cost of terminal equipment and changing the way people share data, information, and knowledge, thus achieving the goal of efficient and rational use of network resources. Leveraging the massive storage space and rapid computing capabilities of cloud computing platforms, users can perform relevant data calculations and data storage services anytime, anywhere using their terminal devices.

[0003] Due to the open nature of the internet, cloud service providers are not entirely trustworthy. Driven by economic interests or other factors, they may privately acquire or sell user information, or cause data leaks due to mismanagement. Investigations by Tencent Security Threat Intelligence Center show that in recent years, network attack risks targeting public clouds, such as malicious Trojans, cloud ransomware, and abnormal logins, have been on the rise. The cloud computing era is facing increasingly severe security challenges. Therefore, it is necessary to consider introducing proxy re-encryption technology to achieve secure sharing of encrypted data in the cloud.

[0004] Proxy re-encryption technology primarily operates on ciphertext, transforming ciphertext encrypted with the data owner's public key into information encrypted with the same plaintext using the data receiver's public key. The data receiver can then decrypt the plaintext message without knowing the data owner's private key, thus enabling secure data sharing in a cloud computing environment.

[0005] Existing proxy re-encryption schemes have a large granularity in transforming and sharing data, which does not offer advantages in data security and efficient sharing in scenarios with a large number of users and diverse needs. On the other hand, existing proxy re-encryption schemes use the traditional public key system for data sharing, which cannot guarantee the secure sharing of data on cloud computing service platforms, as detailed below:

[0006] (1) Files that cannot be re-encrypted with fine-grained control. Existing proxy re-encryption schemes do not use conditional keys to control the information being re-encrypted with fine-grained control, resulting in the conversion of irrelevant information.

[0007] (2) They cannot effectively resist quantum attacks. Existing proxy re-encryption schemes are based on classical mathematical problems (such as large prime factorization and discrete logarithms), which can be solved in polynomial time with a certain advantage by Shor's quantum algorithm. Therefore, they cannot resist quantum attacks. Summary of the Invention

[0008] (a) Technical problems to be solved

[0009] The technical problem this invention aims to solve is how to provide a cloud computing service platform based on lattice-based proxy re-encryption, in order to address the issues in existing technologies where fine-grained control over re-encrypted files is not possible and where effective resistance to quantum attacks is lacking.

[0010] (II) Technical Solution

[0011] To address the aforementioned technical problems, this invention proposes a cloud computing service platform based on lattice-based proxy re-encryption. This platform includes: a data owner, cloud storage space, and a data receiver. The cloud storage space includes a cloud server and a proxy server. The cloud server stores the data owner's encrypted data, while the proxy server stores the public-private key pair and condition key of both the data owner and the data receiver. When the data owner needs to share data, the cloud server first matches the encrypted data with the condition vector in the condition key. If a match is found, the cloud server transmits the encrypted data to the proxy server for data conversion. The proxy server then re-encrypts the data using a re-encryption key based on the lattice-based proxy re-encryption method. The data receiver decrypts the data using their own private key.

[0012] (III) Beneficial Effects

[0013] This invention proposes a cloud computing service platform based on lattice-based proxy re-encryption. This invention introduces lattice-based proxy re-encryption to achieve secure data sharing on the cloud computing platform and ensure the security of plaintext data during data exchange.

[0014] This invention introduces an identity vector to achieve fine-grained data transformation and sharing. In multi-user, multi-scenario application environments, it ensures accurate data sharing, guarantees the transformation of irrelevant data, and comprehensively meets the needs of secure and accurate sharing of user data. Simultaneously, the lattice-based proxy re-encryption technology utilizes the lattice cryptographic algorithm to generate encrypted ciphertext and public-private key pairs for the data owner and receiver. Compared to classical mathematical difficulties such as large prime factorization and discrete logarithms in traditional proxy re-encryption schemes, the lattice-based proxy re-encryption technology designs an encryption scheme based on the LWE problem, which can securely and efficiently resist quantum computing attacks. Attached Figure Description

[0015] Figure 1 This is a diagram of the overall architecture of the cloud computing service platform of the present invention;

[0016] Figure 2 This is a schematic diagram of the proxy re-encryption scheme of the present invention;

[0017] Figure 3 This is a flowchart of the lattice-based proxy re-encryption process of the present invention. Detailed Implementation

[0018] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0019] To address the threats posed by the aforementioned problems, this invention provides a cloud computing service platform based on lattice-based proxy re-encryption. The solution uses conditional vectors to perform fine-grained classification of plaintext data and controls the re-encryption of ciphertext using these same vectors. The conditional key is generated from the conditional vectors. Only when the data receiver's conditional key matches the re-encrypted ciphertext content can the proxy server correctly convert the corresponding ciphertext data, while irrelevant data is not re-encrypted, preventing the leakage of other data. Furthermore, this platform designs the proxy re-encryption scheme based on the lattice error learning problem (LWE), employing lattice cryptography algorithms to encrypt data and generate public-private key pairs, effectively resisting quantum attacks.

[0020] like Figure 1 As shown, the cloud computing service platform proposed in this solution includes: a data owner, cloud storage space, and a data receiver. The cloud storage space includes a cloud server and a proxy server. The cloud server stores the data owner's encrypted data, while the proxy server stores the public-private key pair and condition key of both the data owner and the data receiver. When the data owner needs to share data, the cloud server first matches the encrypted data with the condition vector in the condition key. If a match is found, the cloud server transmits the encrypted data to the proxy server for data conversion. The proxy server then re-encrypts the data using a re-encryption key based on the lattice-based proxy re-encryption method. Finally, the data receiver decrypts the data using their own private key.

[0021] The specific process is as follows:

[0022] S11. The data owner sets m keywords b1, b2, ... b based on the fine-grained characteristics of the data. m And a condition vector c = (b1, b2, ... b) is generated using a random matrix X. m ) X This enables fine-grained classification of data using conditional vectors.

[0023] S12. The data owner encrypts the condition vector based on the lattice cryptography algorithm, generates a condition key, and stores it on the proxy server;

[0024] S13. The data owner and the data receiver each generate a public-private key pair based on the lattice cryptography algorithm and store it on the proxy server;

[0025] S14. The data owner uses their own public key and condition vector to encrypt the data based on the lattice cryptography algorithm and stores it on a cloud server;

[0026] S15. When the data owner needs to share data, the cloud server first obtains the condition key from the proxy server, uses the lattice cryptography algorithm to decrypt the condition key to obtain the condition vector, and uses the condition vector to match the encrypted data. If the match is successful, the cloud server transmits the encrypted data to the proxy server for data conversion and executes S16. Otherwise, the cloud server outputs an invalid signal.

[0027] S16. The proxy server re-encrypts the data using the re-encryption key;

[0028] S17. The data recipient decrypts the data using their own private key.

[0029] Proxy re-encryption is an extension of public-key cryptography. A proxy re-encryption scheme involves three participants: the data owner, the data receiver, and the cloud storage space. After obtaining a proxy re-encryption key from the data owner to the data receiver, and a ciphertext from the data owner, the proxy server in the cloud storage space can convert the data owner's ciphertext into the data receiver's ciphertext without decrypting the data owner's ciphertext, while the proxy server does not obtain any plaintext information. The proxy re-encryption scheme consists of five algorithms: key generation algorithm (KeyGen), re-key generation algorithm (ReKeyGen), encryption algorithm (Enc), re-encryption algorithm (ReEnc), and decryption algorithm (Dec). Lattice-based proxy re-encryption is a proxy re-encryption based on lattice cryptography algorithms. It introduces a lattice error learning problem to generate public-private key pairs for the data owner and data receiver, performing encryption and decryption operations on the data, effectively resisting quantum attacks. Details are as follows:

[0030] (1) Key generation algorithm: Input security parameter n, output user's public and private key pair (pk, sk);

[0031] (2) Key generation algorithm: Input data owner's private key sk i PK with the public key of the data receiver j The re-encryption key rk is generated using the lattice-based re-key generation algorithm. i->j The lattice-based re-key generation algorithm is essentially an application of the lattice-based key generation algorithm, utilizing the preimage sampling technique in the lattice-based key generation algorithm to generate a re-encryption key;

[0032] (3) Encryption Algorithm: Input the data to be encrypted μ, and use the user's public key pk and the encryption algorithm to output a ciphertext c. i ;

[0033] (4) Re-encryption algorithm: Input a ciphertext c from the data owner i and re-encryption key rk i->j Using a re-encryption algorithm, a ciphertext c is output to the data receiver. jThe re-encryption algorithm uses a re-encryption key to convert the data owner's ciphertext into the data receiver's ciphertext. This process does not require the data owner's participation and is therefore non-interactive.

[0034] (5) Decryption algorithm: Input a re-encrypted ciphertext c j and the private key sk of the data recipient j Using a decryption algorithm, the plaintext μ is output.

[0035] Proxy re-encryption schemes such as Figure 2 As shown. The proxy re-encryption process is as follows:

[0036] S21. The data owner and data receiver each invoke the key generation algorithm to generate a public-private key pair (pk). i ,sk i ) and (pk j ,sk j );

[0037] S22. The data owner invokes the encryption algorithm, using their public key to perform a PK (peer-to-peer) operation. i Encrypt data μ to generate ciphertext c i ;

[0038] S23, The data owner obtains the data receiver's public key pk. j ;

[0039] S24. The data owner invokes the key generation algorithm using their private key sk. i PK with the data receiver's public key j Generate a re-encryption key rk i->j ;

[0040] S25, The data owner will re-key rk i->j Upload to cloud storage space;

[0041] S26. The agent in the cloud storage space calls the re-encryption algorithm, using the re-signature key rk. i->j , will encrypt the data owner's c i The output is the ciphertext c of the data receiver. j ;

[0042] S27. The data recipient retrieves the re-encrypted ciphertext c from the cloud storage space. j ;

[0043] S28. The data receiver invokes the decryption algorithm using its private key sk. j Decrypt the re-encrypted ciphertext into plaintext μ.

[0044] Example 1:

[0045] The Geki proxy re-encryption scheme utilizes Gentry's BGN class encryption to construct a reusable one-way proxy re-encryption scheme, as detailed below:

[0046] (1) Key generation algorithm: Input security parameter 1 n Randomly select a prime number q and run the TrapGen(1) algorithm to generate trapdoors. n Generate a random matrix A and a trap basis T of lattice A. The preimage sampling function f A (x) = Axmod q. Therefore, the public key is A and the private key is T.

[0047] (2) Key generation algorithm: Input the public key pk of the data receiver j =A j and the data owner's private key sk i =T i Let A j =(a j1 ,a j2 ,…,a jm ) T For each a jn For n = 1, ..., m, construct a preimage sampling algorithm SamplePre(A) with real number σ (σ > 0) as the parameter. i ,T i ,a jn Extract a vector r (σ). n This makes A i r n =a jn mod q and ||r n ||≤σ*m 1 / 2 Let R pki->pkj =(r1,r2,...,r m ), then A i R pki->pkj =A j mod q and ||R pki->pkj ||≤σ*m 1 / 2 Let the re-encryption key be rk. pki->pkj , then rk pki->pkj That is, R pki->pkj The value;

[0048] (3) Encryption algorithm: Input a message pk i =A i The encryption is as follows:

[0049] 1) Choose a random vector s i An error vector x i ←χ m A vector bi ←{0,1} m ;

[0050] 2) Calculate the ciphertext c i =(A i ) T *s i +2x i +μb i .

[0051] (4) Re-encryption algorithm: Input a public key pk i =A i The ciphertext c below i and re-encryption key rk pki->pkj =R pki->pkj Calculate c j =(R pki->pkj ) T *c i +2x j , where x j ←χ m Output c j ;

[0052] (5) Decryption algorithm: Input private key sk j =T j ciphertext c j Calculate w = (T) j T ) -1 (T j T c j If w = 0, output 0; otherwise, output 1.

[0053] The re-encryption process of the Gridbase proxy is as follows Figure 3 As shown.

[0054] Key points of this invention:

[0055] Proxy re-encryption technology, as a data encryption technology in cloud computing, is secure and efficient. It can effectively solve the inconvenience of data sharing in the cloud environment, greatly reduce the burden of users frequently issuing and accessing passwords, enhance the reliability and confidentiality of cloud data, and protect user privacy.

[0056] With the increasing number of users and their increasingly diverse needs, this solution proposes fine-grained control over re-encrypted files to meet users' application requirements in complex scenarios. It introduces conditional vectors to perform fine-grained control over encrypted data, ensuring that data recipients can accurately obtain the data they need, avoiding the conversion and sharing of irrelevant data, and protecting data security.

[0057] Lattice-based cryptography algorithms are effectively resistant to quantum attacks. Lattice-based cryptography algorithms designed based on the LWE problem are characterized by simplicity and high security. By reducing the difficulty of breaking a cryptographic scheme to the difficulty of solving the LWE problem, the security of the cryptographic scheme can be guaranteed based on the difficulty assumption of lattice problems.

[0058] Effects of the invention:

[0059] This invention introduces lattice-based proxy re-encryption to achieve secure data sharing on cloud computing platforms, ensuring the security of plaintext data during data exchange.

[0060] This solution introduces identity vectors to achieve fine-grained data transformation and sharing. In multi-user, multi-scenario application environments, it ensures accurate data sharing and guarantees the transformation of irrelevant data, comprehensively meeting the needs for secure and accurate sharing of user data. Simultaneously, the lattice-based proxy re-encryption technology utilizes the lattice cryptographic algorithm to generate encrypted ciphertext, as well as public-private key pairs for the data owner and receiver. Compared to traditional proxy re-encryption schemes that address classic mathematical difficulties such as large prime factorization and discrete logarithms, the lattice-based proxy re-encryption technology designs its encryption scheme based on the LWE problem, which can securely and efficiently resist quantum computing attacks.

[0061] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A cloud computing service platform based on lattice-based proxy re-encryption, characterized in that, The platform comprises: a data owner, cloud storage space, and a data receiver. The cloud storage space includes a cloud server and a proxy server. The cloud server stores the data owner's encrypted data, while the proxy server stores the public / private key pair and condition key of both the data owner and the data receiver. When a data owner needs to share data, the cloud server first matches the encrypted data with the condition vector in the condition key. If a match is found, the cloud server transmits the encrypted data to the proxy server for data conversion. The proxy server then re-encrypts the data using a re-encryption key based on the lattice-based proxy re-encryption method. Finally, the data receiver decrypts the data using their own private key. in, The specific processes of this platform include: S11. The data owner sets m keywords b1, b2, ... b based on the fine-grained characteristics of the data. m And a condition vector c = (b1, b2, ... b) is generated using a random matrix X. m ) X This enables fine-grained classification of data using conditional vectors. S12. The data owner encrypts the condition vector based on the lattice cryptography algorithm, generates a condition key, and stores it on the proxy server; S13. The data owner and the data receiver each generate a public-private key pair based on the lattice cryptography algorithm and store it on the proxy server; S14. The data owner uses their own public key and condition vector to encrypt the data based on the lattice cryptography algorithm and stores it on a cloud server; S15. When the data owner needs to share data, the cloud server first obtains the condition key from the proxy server, uses the lattice cryptography algorithm to decrypt the condition key to obtain the condition vector, and uses the condition vector to match the encrypted data. If the match is successful, the cloud server transmits the encrypted data to the proxy server for data conversion and executes S16. Otherwise, the cloud server outputs an invalid signal. S16. The proxy server re-encrypts the data using the re-encryption key; S17. The data recipient decrypts the data using their own private key.

2. The cloud computing service platform based on lattice-based proxy re-encryption as described in claim 1, characterized in that, The proxy re-encryption scheme includes three types of participants: data owner, data receiver, and cloud storage space. After obtaining a proxy re-encryption key from the data owner to the data receiver and a ciphertext of the data owner, the proxy server in the cloud storage space can convert the data owner's ciphertext into the data receiver's ciphertext without decrypting the data owner's ciphertext, while the proxy server cannot obtain any plaintext information.

3. The cloud computing service platform based on lattice-based proxy re-encryption as described in claim 2, characterized in that, The proxy re-encryption scheme consists of five algorithms: key generation algorithm (KeyGen), re-key generation algorithm (ReKeyGen), encryption algorithm (Enc), re-encryption algorithm (ReEnc), and decryption algorithm (Dec). Key generation algorithm: Input security parameter n, output user's public and private key pair (pk, sk); Key generation algorithm: Input data owner's private key sk i PK with the public key of the data receiver j The re-encryption key rk is generated using the lattice-based re-key generation algorithm. i->j ; Encryption Algorithm: Input the data to be encrypted μ, use the user's public key pk and the encryption algorithm, and output a ciphertext c. i ; Re-encryption algorithm: Input data owner's ciphertext c i and re-encryption key rk i->j Using a re-encryption algorithm, a ciphertext c is output to the data receiver. j The re-encryption algorithm uses a re-encryption key to convert the data owner's ciphertext into the data receiver's ciphertext. This process does not require the data owner's participation and is therefore non-interactive. Decryption algorithm: Input a re-encrypted ciphertext c j and the private key sk of the data recipient j Using a decryption algorithm, the plaintext μ is output.

4. The cloud computing service platform based on lattice-based proxy re-encryption as described in claim 3, characterized in that, The proxy re-encryption process includes: S21. The data owner and data receiver each invoke the key generation algorithm to generate a public-private key pair (pk). i ,sk i ) and (pk j ,sk j ); S22. The data owner invokes the encryption algorithm, using their public key to perform a PK (peer-to-peer) operation. i Encrypt data μ to generate ciphertext c i ; S23, The data owner obtains the data receiver's public key pk. j ; S24. The data owner invokes the key generation algorithm using their private key sk. i PK with the data receiver's public key j Generate a re-encryption key rk i->j ; S25, The data owner will re-key rk i->j Upload to cloud storage space; S26. The agent in the cloud storage space calls the re-encryption algorithm, using the re-signature key rk. i->j , will encrypt the data owner's c i The output is the ciphertext c of the data receiver. j ; S27. The data recipient retrieves the re-encrypted ciphertext c from the cloud storage space. j ; S28. The data receiver invokes the decryption algorithm using its private key sk. j Decrypt the re-encrypted ciphertext into plaintext μ.

5. The cloud computing service platform based on lattice-based proxy re-encryption as described in any one of claims 1-4, characterized in that, The Geki proxy re-encryption scheme utilizes Gentry's BGN class encryption to construct a reusable one-way proxy re-encryption scheme, which includes: a key generation algorithm, a re-key generation algorithm, an encryption algorithm, a re-encryption algorithm, and a decryption algorithm.

6. The cloud computing service platform based on lattice-based proxy re-encryption as described in claim 5, characterized in that, The key generation algorithm of the lattice-based proxy re-encryption scheme includes: input security parameter 1 n Randomly select a prime number q and run the TrapGen(1) algorithm to generate trapdoors. n Generate a random matrix A and a trap basis T of matrix A; the preimage sampling function f A (x) = Axmod q; then the public key is A and the private key is T.

7. The cloud computing service platform based on lattice-based proxy re-encryption as described in claim 6, characterized in that, The re-key generation algorithm of the lattice-based proxy re-encryption scheme includes: inputting the public key pk of the data receiver. j =A j and the data owner's private key sk i =T i Let A j =(a j1 ,a j2 ,…,a jm ) T For each a jn For n = 1, ..., m, construct a preimage sampling algorithm SamplePre(A) with real number σ as the parameter. i ,T i ,a jn ,σ), σ>0, extract a vector r n This makes A i r n =a jn mod q and ||r n ||≤σ*m 1 / 2 Let R pki->pkj =(r1,r2,...,r m ), then A i R pki->pkj =A j mod q and ||R pki->pkj ||≤σ*m 1 / 2 Let the re-encryption key be rk pki->pkj , then rk pki->pkj That is, R pki->pkj The value of .

8. The cloud computing service platform based on lattice-based proxy re-encryption as described in claim 7, characterized in that, The encryption algorithm of the lattice-based proxy re-encryption scheme includes: inputting a message μ∈{0,1}, pk i =A i The encryption is as follows: 1) Choose a random vector s i An error vector x i ←χ m A vector b i ←{0,1} m ; 2) Calculate the ciphertext c i =(A i ) T *s i +2x i +μb i .

9. The cloud computing service platform based on lattice-based proxy re-encryption as described in claim 8, characterized in that, The re-encryption and decryption algorithms of the lattice-based proxy re-encryption scheme include: Re-encryption algorithm: Input a public key pk i =A i The ciphertext c below i and re-encryption key rk pki->pkj =R pki->pkj Calculate c j =(R pki->pkj ) T *c i +2x j , where x j ←χ m Output c j ; Decryption algorithm: Input private key sk j =T j ciphertext c j ; Calculate w = (T) j T ) -1 (T j T c j If w = 0, output 0; otherwise, output 1.

Images