A controlled ciphertext retrieval method supporting dynamic data and key updates

Abstract

The present invention discloses a controlled ciphertext retrieval method that supports dynamic data and key updates, and belongs to the field of computer application technology. The method of the present invention includes three entities: a trusted authorization agency, a user, and a cloud server. The specific implementation steps are: system initialization; legal users update data; legal users search for data; key updates and corresponding data updates. The present invention takes symmetric searchable encryption technology as the core, and provides a multi-keyword symmetric searchable encryption method that supports dynamic hierarchical role access control, dynamic data updates, and key updates. It breaks through the limitations of existing symmetric searchable encryption technology in access control, can efficiently implement role-based dynamic hierarchical access control, support flexible and efficient data and key updates, and ensure the confidentiality of newly generated ciphertexts during key updates from key leaks, thereby meeting higher security requirements in complex application scenarios.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer applications, and in particular relates to a controlled ciphertext retrieval method supporting dynamic data and key updates. Background Art

[0002] Symmetric Searchable Encryption (SSE) is a cryptographic technique whose core concept is to protect data through symmetric key encryption while allowing users to search encrypted data without decrypting it, making the data "available but invisible." Currently, SSE is widely used in cloud storage, data sharing, healthcare, and finance. Compared to public-key searchable encryption, SSE offers higher computational efficiency and lower processing overhead, making it particularly suitable for performance-critical scenarios.

[0003] However, symmetric searchable encryption requires both communicating parties to hold the same key, which is unrealistic in some application scenarios. For example, within an enterprise's internal file management system, employees in different departments or positions have distinct hierarchical differences in file access rights: the general manager needs to view files from all departments, including sensitive data from finance, R&D, and HR; department managers can only access files within their own departments, such as the finance manager can only view financial statements, and the R&D manager can only view technical documentation; and ordinary employees can only access files related to their specific work, such as only viewing documents for the projects they are responsible for. Therefore, it is necessary to design a searchable encryption method that supports hierarchical role-based access control to meet these requirements.

[0004] In addition, data in actual scenarios is usually dynamically changing rather than static, which requires encryption methods to support dynamic updates of data. However, the dynamism of data will not only affect system efficiency, but may also pose challenges to data security and query security, thereby placing higher demands on secret search methods. At the same time, existing methods are often based on a strong assumption that "client keys are secure." However, in actual environments, client keys may face the risk of leakage. For example, in existing technologies, cloud API keys are stolen, resulting in customer data leakage. This raises an important question: how to ensure that the newly generated ciphertext remains confidential from the time the key is leaked to the time the key is updated in the event of a key leak. This issue is not only related to the reliability of data security, but is also a key challenge that existing encryption technologies need to focus on. Summary of the Invention

[0005] In response to the problems mentioned in the background technology, the present invention proposes a controlled ciphertext retrieval method that supports dynamic data and key updates. With symmetric searchable encryption technology as the core, a multi-keyword symmetric searchable encryption method that supports dynamic hierarchical role access control, dynamic data updates and key updates is set up. It breaks through the limitations of existing symmetric searchable encryption technology in access control, and at the same time realizes flexible updates of data and keys; and ensures the confidentiality of newly generated ciphertexts during key leaks to key updates, thereby meeting higher security requirements in complex application scenarios.

[0006] Technical solution: In order to solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0007] A controlled ciphertext retrieval method that supports dynamic data and key updates includes three entities: a trusted authority, a user, and a cloud server. The specific implementation steps are as follows:

[0008] S1: System initialization: The trusted authority generates the key, label, and public token required for key derivation for each type of user, and discloses the label and public token for each type of user. At the same time, the system is initialized and an empty encryption database is generated.

[0009] S2: Legitimate users update data: Legitimate users update their own user class data and submit update requests to the cloud server. They can also update the data of their own user class sub-nodes and submit sub-node data update requests to the cloud server.

[0010] S3: Legitimate users search for data: Legitimate users query their own user class data by submitting a query request to the cloud server. They can also query the data of their own user class subnodes by submitting a subnode data query request to the cloud server.

[0011] S4: Key update and corresponding data update: The user submits a key update request and sends the updated key to the trusted authority. The trusted authority updates the public token associated with the user class, and the cloud server updates the corresponding ciphertext.

[0012] As a preferred embodiment, in S1, the system is initialized: the trusted authority generates the key, label and public token required for key derivation for each type of user, and discloses the label and public token of each type of user; at the same time, the system is initialized and generates an empty encrypted database with the specific content as follows:

[0013] The trusted authority runs the HKAS method to establish the algorithm Setup2 and outputs each user class R i The key K i , Tag l i and the public token Y i,j Specifically:

[0014]

[0015] Among them, H is a cryptographic hash function; K j Represents user class R j The key of Represents the exclusive OR operation.

[0016] As a preference, the client runs the DSSE′ method to establish the algorithm Setup1 and outputs the key K 1i , K 2i And the initial empty encrypted database EDB.

[0017] As a preferred method, in S2, a legitimate user updates data: the legitimate user updates the data of his own user class and submits an update request to the cloud server; at the same time, the legitimate user can also update the data of the child node of his own user class and submit a child node data update request to the cloud server. The specific content is:

[0018] S21: Update user class R i Data, directly use the key K 1i , K 2i Update the message;

[0019] S22: Update user class R j Data, R j It is R i The user calls the key derivation algorithm KeyDerivation2(R i , R j ) Generate user class R j The key K 1j , K 2j , then use the key K 1j , K 2j Update the message.

[0020] As a preference, in S21, update the user class R i Data, directly use the key K 1i , K 2i The specific content of the updated message is:

[0021] First, (tk w ,cnt w )=st[w];Count value updates cnt w =cnt w +1; Search token update tk′ w ←{0, 1} λ ; State quantity update st[w]=(tk′ w ,cnt w ), ciphertext

[0022] Send the ciphertext (X, Y, Z) to the cloud server, and the server performs the update operation EDB[X]←(Y, Z);

[0023] Where EDB represents the encrypted database, EDB[X] represents the location of the corresponding address X in the encrypted database, EDB[X]←(Y, Z) represents storing the ciphertext (Y, Z) in EDB[X], H1, H2, and H3 represent cryptographic hash functions, and tk w Represents the search token, tk′ w represents the updated search token; λ represents the security parameter, op represents the operation, and id represents the corresponding document identifier.

[0024] As a preferred method, in S3, legitimate users search for data: legitimate users query their own user class data and submit a query request to the cloud server; at the same time, they can also query the data of their own user class sub-nodes and submit a sub-node data query request to the cloud server. The specific content is:

[0025] S31: Search for user class R i Data, directly use the key K 1i , K 2i Calculate search tokens;

[0026] S32: Search for user class R j Data, R j It is R i The user calls the key derivation algorithm KeyDerivation2(R i , R j ) Generate user class R j The key K 1j , K 2j , then use the key K 1j , K 2j Computes the search token.

[0027] As a preference, in S31, search for user class R i Data, directly use the key K 1i , K 2i The specific content of calculating the search token is,

[0028] First, (tk w ,cnt w )=st[w], then calculate (K1, X, Msk Y , Msk Z ) is sent to the server via a secure channel;

[0029] The server performs a query operation, initializes an empty list I, and then retrieves the ciphertext from the corresponding position of the encrypted database EDB according to X, specifically: (Y, Z)←EDB[X];

[0030] When (Y, Z) ≠ (NULL, NULL), calculate Insert Z′ into list I and calculate based on the derived tk (Y, Z)←EDB[X], loop until (Y, Z)=(NULL, NULL);

[0031] Send the list, to the user, the user initializes the empty list IdList, and then the user decrypts each Z′ in the list, Z′ i ←I[i], If op i =add, then id i Insert into list IdList, if op i = delete, then id i Delete from the list IdList, and finally the user gets the query result IdList;

[0032] Among them, K1 represents the key, X represents the ciphertext, Msk Y Represents the component of Y, Msk Z Represents the components of Z, H1, H2, and H3 represent cryptographic hash functions, tk represents the search token, and Z′ represents the intermediate value; add represents the add operation, delete represents the delete operation, and NULL represents the null value.

[0033] As a preferred method, in S4, the key is updated and the corresponding data is updated: the user submits a key update request, sends the updated key to the trusted authority, the trusted authority updates the public token related to the user class, and the cloud server updates the corresponding ciphertext, the specific content is,

[0034] First, select Update key K′ 1i ←K 1i Δ, K′ 2i ←K 2i Δ;

[0035] In the public token update protocol PTokenUpdate2, the user class R i The updated key K′ 1i and K′ 2i Sent to the trusted authority, and then the trusted authority updates the user class R i The relevant public tokens are:

[0036] In the key update protocol KeyUpdate1, the client sends Δ to the cloud server through a secure channel, and the cloud server performs the corresponding ciphertext update, specifically:

[0037] X′←X Δ , Y′←Y Δ , Z′←Z Δ ,EDB[X′]←(Y′,Z′),

[0038] Then remove the ciphertext X, Y, Z from the encrypted database EDB;

[0039] Where Δ represents the key update token, represents the multiplication group of module q, X′ represents the updated ciphertext; Y′ represents the updated ciphertext; Z′ represents the updated ciphertext; EDB[X′] represents the new ciphertext storage location, X Δ The new ciphertext X′, Y is obtained by performing an exponential operation on the previous ciphertext X and the key update token Δ. Δ The new ciphertext Y′, Z is obtained by performing an exponential operation on the previous ciphertext Y and the key update token Δ. Δ It represents the new ciphertext Z′ obtained by performing an exponential operation on the previous ciphertext Z and the key update token Δ.

[0040] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0041] (1) The present invention supports dynamic updates of data and keys, achieving sublinear multi-key search efficiency, and enabling efficient data retrieval while ensuring data confidentiality. By introducing a dual-layer encryption mechanism, even if a key is leaked, the present invention can still ensure the confidentiality of the newly generated ciphertext during the key update period, thereby improving the security and reliability of the system.

[0042] (2) Based on the traditional symmetric searchable encryption method, the present invention introduces a role-based dynamic hierarchical access control mechanism, which can flexibly configure multi-level, role-based refined access strategies according to the access requirements of different users, allowing legitimate users to access their own data and the data of users below their authority level. On the basis of protecting the privacy of sensitive data, it effectively realizes reliable and efficient dynamic hierarchical role access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a system model diagram of the present invention;

[0044] Figure 2 A schematic diagram of the hierarchical access control relationship of the present invention;

[0045] Figure 3 It is a data update schematic diagram of the present invention;

[0046] Figure 4 It is a data search schematic diagram of the present invention;

[0047] Figure 5 Schematic diagram of key update of the present invention. DETAILED DESCRIPTION

[0048] The present invention will be further illustrated below with reference to specific examples. The examples are implemented based on the technical solutions of the present invention. It should be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0049] The controlled ciphertext retrieval method supporting dynamic data and key update provided in this embodiment mainly includes three main participating entities (such as Figure 1 Figure 2 shows the trusted authority, user, and cloud server. Different entities have different functions and responsibilities.

[0050] Trusted Authority (TA): Develops and maintains access control policies for user data; assigns keys and labels to each user class, and maintains the public tokens required for key derivation.

[0051] User: A user who has been issued a key by a trusted authority and is the creator and owner of private data. In this system, legitimate users can request data updates and queries from the cloud server. Depending on the user class's position in the access structure, they can access the data of its child nodes. Otherwise, access is prohibited. Furthermore, users can request key updates from the cloud server and request updates to the cloud server's public token.

[0052] Cloud server: Provides remote data storage services to store user-uploaded data; provides users with secure remote updates, data queries, and key update requests.

[0053] The method in this embodiment is designed to defend against two potential attackers: the first is an "honest but curious" cloud server, which, while honestly executing user requests, may attempt to spy on the user's private data; the second is a "key stealer," which can steal the client's key, eavesdrop on communications between the client and the server, and obtain a copy of the encrypted database. Furthermore, this embodiment's method assumes no collusion or collusion between the server and the key stealer.

[0054] The method provided in this embodiment supports dynamic data update and key update, aims to achieve efficient retrieval and secure update of data, and builds a secure and efficient dynamic hierarchical access control mechanism and dynamic update system.

[0055] Specific features include:

[0056] 1. Dynamic hierarchical role access control:

[0057] The present invention generates and maintains dynamic hierarchical access control strategies through a trusted authorization agency, assigns keys to each hierarchical node, and users can access their own data and their sub-node data based on their role permissions, thereby achieving refined permission management and ensuring that the access permissions of users with different roles are isolated from each other.

[0058] 2. Dynamic data update:

[0059] This invention allows users to securely update stored data on cloud servers as needed, achieving both forward and backward security. This solution effectively protects against various attacks, including file injection, while ensuring data privacy while optimizing system efficiency and meeting practical application needs in dynamically changing environments.

[0060] 3. Dynamic key update:

[0061] This invention provides a dual-layer encryption mechanism and a key update mechanism, achieving post-compromise security. This dual-layer encryption mechanism ensures that even if a key is compromised, newly generated ciphertext remains secure between the time the key is leaked and the time it takes to update the key. The key update mechanism enables rapid ciphertext updates without the need to download, decrypt, and re-encrypt the ciphertext, significantly improving system security and usability.

[0062] 4. Efficient and dense search:

[0063] The present invention supports efficient retrieval of multi-keyword encrypted data, enabling users to quickly obtain required data without having to decrypt all encrypted content, thereby balancing data availability and security.

[0064] This embodiment requires the application of a dynamic searchable encryption method that supports key updates and a hierarchical key distribution method. The relevant algorithms are described as follows:

[0065] Table 1 Symmetric searchable encryption schemes supporting key updates

[0066]

[0067] Table 2 Hierarchical key distribution scheme

[0068]

[0069] Based on the above components, participating entities, and related technical methods, a controlled ciphertext retrieval method that supports dynamic data and key updates mainly includes:

[0070] S1: System initialization: TA generates the key, label, and public token required for key derivation for each type of user, and discloses the label and public token of each type of user. At the same time, the system is initialized and an empty encryption database is generated.

[0071] like Figure 2 As shown, TA runs the HKAS method system to establish algorithm Setup2, and outputs each user class R i The key K i , Tag l i and the public token Y required for key derivation i，j . Specifically,

[0072] Among them, H is a cryptographic hash function; K j Represents user class R j The key of Represents the exclusive OR operation.

[0073] The client runs the DSSE′ scheme system establishment algorithm Setup1 and outputs the key K 1i , K 2i And the initial empty encrypted database EDB.

[0074] S2: Legitimate users update data: Legitimate users can update their own user class data by submitting an update request to the cloud server. They can also update the data of their own user class subnodes by submitting a subnode data update request to the cloud server.

[0075] like Figure 3 As shown, it belongs to user class R i User:

[0076] S21: If you want to update the user class R i Data, directly use the key K 1i , K 2i Update the message document identifier-keyword pair (id, w).

[0077] During updates, messages are encrypted using a two-layer encryption mechanism (ENC2(K, ENC1(R, op, id, w))), where K is the client's key and R is a random number; op is the operation, and (id, w) is the message. The inner layer, ENC1, uses a traditional encryption scheme, while the outer layer, ENC2, is an encryption method specifically designed for key updates. This two-layer encryption mechanism ensures that even if an attacker obtains the client's key and all historical random numbers, they cannot decrypt any information from a newly generated ciphertext because new random numbers are used in the new ciphertext. Although an attacker can decrypt the outer layer of the ciphertext using the leaked key, the inner layer cannot be decrypted due to the lack of the random number R. In subsequent implementations, K is K1 and K2, and the random number R is the search token tk.

[0078] First, (tk w ,cntt w )=st[w], the count value is updated cntt w =cntt w +1, search token update tk′ w ←{0, 1} λ , state quantity update st[w]=(tk′ w ,cnt w ), ciphertext The ciphertext (X, Y, Z) is sent to the cloud server, and the server performs the update operation, EDB[X]←(Y, Z).

[0079] Where EDB represents the encrypted database, EDB[X] represents the location of the corresponding address X in the encrypted database, EDB[X]←(Y, Z) represents storing the ciphertext Y, Z in EDB[X], (Y, Z) represents the ciphertext, H1, H2, H3 represent cryptographic hash functions, tk w Represents the search token, tk′ w Represents the updated search token (each state corresponds to a search token, and each update will regenerate a corresponding search token); λ represents the security parameter, op represents the operation, and id represents the corresponding document identifier.

[0080] S22: If you want to update the user class R j (R j In the access control policy graph, R i The user needs to call the key derivation algorithm KeyDerivation2 (R i , R j ) Generate user class R j The key K 1j , K 2j , then use the key K1j , K 2j Update the message (id, w).

[0081] First, (tk w ,cnt w )=st[w], the count value updates cnt w =cnt w +1, search token update tk′ w ←{0, 1} λ , state quantity update st[w]=(tk′ w ,cnt w ), ciphertext The ciphertext (X, Y, Z) is sent to the cloud server, and the server performs the update operation, EDB[X]←(Y, Z).

[0082] S3: Legitimate users search for data: Legitimate users can query their own user class data by submitting query requests to the cloud server. They can also query the data of their own user class subnodes by submitting subnode data query requests to the cloud server.

[0083] like Figure 4 As shown, it belongs to user class R i User:

[0084] S31: If you want to search for user class R i Data, directly use the key K 1i , K 2i Computes the search token.

[0085] First, (tk w ,cnt w )=st[w], then calculate (K1, X, Msk Y , Msk Z ) is sent to the server via a secure channel.

[0086] The server performs a query operation, initializes an empty list I, and then retrieves the ciphertext from the corresponding position of the encryption database EDB according to X, specifically: (Y, Z)←EDB[X].

[0087] When (Y, Z) ≠ (NULL, NULL), calculate Insert Z′ into list I and calculate based on the derived tk (Y, Z)←EDB[X], and the calculation is repeated until (Y, Z)=(NULL, NULL).

[0088] Send the list, to the user, the user initializes the empty list IdList, and then the user decrypts each Z′ in the list, Z′ i ←I[i], If op i =add, then id i Insert into list IdList, if op i = delete, then id i Delete from the list IdList, and finally the user gets the query result IdList.

[0089] Among them, K1 represents the key, X represents the ciphertext, and is used to represent the position of the ciphertext Y and Z in the encrypted database EDB. Y Represents the component of Y, Msk Z Represents the components of Z, H1, H2, H3 represent cryptographic hash functions, tk represents the search token, and Z′ represents the intermediate value, which is obtained by Z and Msk Z The specific form is calculated as Used to subsequently decrypt the op and id. add indicates an add operation, delete indicates a delete operation, and NULL indicates a null value.

[0090] S32: If you want to search for user class R j (R j In the access control policy graph, R i The user needs to call the key derivation algorithm KeyDerivation2 (R i , R j ) Generate user class R j The key K 1j , K 2j , then use the key K 1j , K 2j Computes the search token.

[0091] First, (tk w ,cnt w )=st[w], then calculate (K1, X, Msk Y , Msk Z ) is sent to the server via a secure channel.

[0092] The server performs a query operation, initializes an empty list I, and then retrieves the ciphertext from the corresponding position of the encryption database EDB according to X. Specifically, (Y, Z)←EDB[X].

[0093] When (Y, Z) ≠ (NULL, NULL), calculate Insert Z′ into list I and calculate based on the derived tk (Y, Z)←EDB[X], and the calculation is repeated until (Y, Z)=(NULL, NULL).

[0094] Send the list, to the user, the user initializes the empty list IdList, and then the user decrypts each Z′ in the list, Z′ i ←I[i], If op i =add, then id i Insert into list IdList, if op i = delete, then id i Delete from the list IdList, and finally the user gets the query result IdList.

[0095] S4: Key update and corresponding data update: The user can submit a key update request and send the updated key to the TA. The TA updates the public token related to the user class, and the cloud server updates the corresponding ciphertext.

[0096] like Figure 5 As shown, user class R i Update the key regularly.

[0097] First, select Update key K′ 1i ←K 1i Δ, K′ 2i ←K 2i ·Δ.

[0098] Where Δ represents the key update token, Usually represents the multiplicative group modulo q.

[0099] In the public token update protocol PTokenUpdate2, the user class R i The updated key K′ 1i and K′ 2i Send it to TA, and then TA updates the user class R i Related public tokens, e.g. In the key update protocol KeyUpdate1, the client sends Δ to the cloud server through a secure channel, and the cloud server performs the corresponding ciphertext update, X′←X Δ , Y′←Y Δ , Z′←Z Δ , EDB[X′]←(Y′, Z′), and then remove the ciphertext X, Y, Z from the encrypted database EDB.

[0100] Among them, X′ represents the updated ciphertext, Y′ represents the updated ciphertext, Z′ represents the updated ciphertext, EDB[X′] represents the new ciphertext storage location, X Δ The new ciphertext X′ is obtained by performing an exponential operation on the previous ciphertext X and the key update token Δ; Y Δ The new ciphertext Y′ is obtained by performing an exponential operation on the previous ciphertext Y and the key update token Δ. Δ It means that the new ciphertext Z′ is obtained by performing an exponential operation on the previous ciphertext Z and the key update token Δ.

[0101] In this embodiment, taking a single keyword as an example, to expand to a multi-keyword Boolean query, it is only necessary to add two layers of encryption steps for the cross terms during the update process. Specifically:

[0102] Cross-term Introduce auxiliary value A1←H4(add||id)·(H5(w||cnt w )) -1 ,A2←H4(add||id)·(H5(w||cnt w )) -1 , A1 and A2 also exist in EDB[X]. At the same time, a new storage structure JSet is introduced, which is essentially an element counter that counts the number of each cross item: each time J is updated, JSet[J]←JSet[J]+1.

[0103] Among them, H4, H5, and H6 represent cryptographic hash functions, cnt w represents the count value, w represents the keyword, and .g represents the generator of the group G, where G is a group of prime order p.

[0104] Multi-keyword query q=(w1∧…∧w n ), when querying, we first assume that w1 is the keyword with the lowest keyword frequency. The client calculates the search token and sends it to the server. After the server executes a single keyword query for w1, it determines whether the document containing w1 contains other keywords. Specifically, it calculates the corresponding cross term based on the auxiliary value, and then determines whether for i∈[2,n], (w i , id) Check whether the number of cross-items for the add operation and the delete operation is the same. If they are different, the file has not been deleted and the condition is met. Otherwise, the file is not returned. (In this embodiment, it is assumed that all operations are executed correctly, that is, the delete operation is always executed after the add operation, and the same operation is not repeated continuously.)

[0105] This invention proposes a fully dynamic, secure, and efficient controlled ciphertext retrieval method. While protecting data confidentiality, it enables efficient multi-keyword data retrieval and supports dynamic updates of data and keys. This method allows legitimate users to access their own data, as well as the data of users below their access control level. Furthermore, in the event of a key leak, this method ensures the confidentiality of ciphertext generated from the time of key leakage until key update, thereby enhancing the security and reliability of the system.

[0106] While protecting data confidentiality, the present invention achieves flexible and efficient access control, data update and key update, significantly improving the security, reliability and practicality of the system, and is suitable for various scenarios such as cloud storage and data sharing.

[0107] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A controlled ciphertext retrieval method supporting dynamic data and key updates, characterized by: It includes three entities: trusted authorization agency, user, and cloud server. The specific implementation steps are as follows: S1: System initialization: The trusted authority generates the key, label, and public token required for key derivation for each type of user, and discloses the label and public token for each type of user. At the same time, the system is initialized and an empty encryption database is generated. S2: Legitimate users update data: Legitimate users update their own user class data and submit update requests to the cloud server. They can also update the data of their own user class sub-nodes and submit sub-node data update requests to the cloud server. S3: Legitimate users search for data: Legitimate users query their own user class data by submitting a query request to the cloud server. They can also query the data of their own user class subnodes by submitting a subnode data query request to the cloud server. S4: Key update and corresponding data update: The user submits a key update request and sends the updated key to the trusted authority. The trusted authority updates the public token associated with the user class, and the cloud server updates the corresponding ciphertext.

2. The controlled ciphertext retrieval method supporting dynamic data and key updates according to claim 1, characterized in that: In S1, the system is initialized: the trusted authority generates the key, label, and public token required for key derivation for each type of user, and discloses the label and public token of each type of user; at the same time, the system is initialized and generates an empty encrypted database with the following specific contents: The trusted authority runs the HKAS method to establish the algorithm Setup2 and outputs each user class R i The key K i , Tag l i and the public token Y i,j Specifically: Among them, H is a cryptographic hash function; K j Represents user class R j The key of Represents the exclusive OR operation.

3. The controlled ciphertext retrieval method supporting dynamic data and key updates according to claim 2, characterized in that: The client runs the DSSE′ method to establish the algorithm Setup1 and outputs the key K 1i , K 2i And the initial empty encrypted database EDB.

4. The controlled ciphertext retrieval method supporting dynamic data and key updates according to claim 1, characterized in that: In S2, a legitimate user updates data: the legitimate user updates the data of his own user class and submits an update request to the cloud server. At the same time, the legitimate user can also update the data of the child node of his own user class and submit a child node data update request to the cloud server. The specific content is: S21: Update user class R i Data, directly use the key K 1i , K 2i Update the message; S22: Update user class R j Data, R j It is R i The user calls the key derivation algorithm KeyDerivation2(R i ,R j ) Generate user class R j The key K 1j , K 2j , then use the key K 1j , K 2j Update the message.

5. The controlled ciphertext retrieval method supporting dynamic data and key updates according to claim 4, characterized in that: In S21, update the user class R i Data, directly use the key K 1i , K 2i The specific content of the updated message is: First, (tk w ,cnt w )=st[w];Count value updates cnt w =cnt w +1; Search token update tk′ w ←{0,1} λ ; State quantity update st[w]=(tk′ w ,cnt w ), ciphertext Send the ciphertext (X, Y, Z) to the cloud server, and the server performs the update operation EDB[X]←(Y, Z); Where EDB represents the encrypted database, EDB[X] represents the location of the corresponding address X in the encrypted database, EDB[X]←(Y,Z) represents storing the ciphertext (Y,Z) in EDB[X], H1, H2, and H3 represent cryptographic hash functions, and tk w Represents the search token, tk′ w represents the updated search token; λ represents the security parameter, op represents the operation, and id represents the corresponding document identifier.

6. The controlled ciphertext retrieval method supporting dynamic data and key updates according to claim 1, characterized in that: In S3, legitimate users search for data: Legitimate users query their own user class data and submit query requests to the cloud server. At the same time, they can also query the data of their own user class sub-nodes and submit sub-node data query requests to the cloud server. The specific content is: S31: Search for user class R i Data, directly use the key K 1i , K 2i Calculate search tokens; S32: Search for user class R j Data, R j It is R i The user calls the key derivation algorithm KeyDerivation2(R i ,R j ) Generate user class R j The key K 1j , K 2j , then use the key K 1j , K 2j Computes the search token.

7. The controlled ciphertext retrieval method supporting dynamic data and key updates according to claim 6, characterized in that: In S31, search for user class R i Data, directly use the key K 1i , K 2i The specific content of calculating the search token is, First, (tk w ,cnt w )=st[w], then calculate (K1, X, Msk Y ,Msk Z ) is sent to the server via a secure channel; The server performs a query operation, initializes an empty list I, and then retrieves the ciphertext from the corresponding position of the encrypted database EDB according to X, specifically: (Y, Z)←EDB[X]; When (Y,Z)≠(NULL,NULL), calculate Insert Z′ into list I and calculate based on the derived tk (Y,Z)←EDB[X], loop until (Y,Z)=(NULL,NULL); Send the list I to the user, the user initializes an empty list IdList, and then the user decrypts each Z′ in the list I. i ←O[i], If op i =add, then id i Insert into list IdList, if op i = delete, then id i Delete from the list IdList, and finally the user gets the query result IdList; Among them, K1 represents the key, X represents the ciphertext, Msk Y Represents the component of Y, Msk Z Represents the components of Z, H1, H2, and H3 represent cryptographic hash functions, tk represents the search token, and Z′ represents the intermediate value; add represents the add operation, delete represents the delete operation, and NULL represents the null value.

8. The controlled ciphertext retrieval method supporting dynamic data and key updates according to claim 1, characterized in that: In S4, the key is updated and the corresponding data is updated: the user submits a key update request and sends the updated key to the trusted authority. The trusted authority updates the public token associated with the user class, and the cloud server updates the corresponding ciphertext. The specific content is: First, select Update key K′ 1i ←K 1i Δ, K′ 2i ←K 2i Δ; In the public token update protocol PTokenUpdate2, the user class R i The updated key K′ 1i and K′ 2i Sent to the trusted authority, and then the trusted authority updates the user class R i The relevant public tokens are: In the key update protocol KeyUpdate1, the client sends Δ to the cloud server through a secure channel, and the cloud server performs the corresponding ciphertext update, specifically: X′←X Δ ,Y′←Y Δ ,Z′←Z Δ ,EDB[X ′ ]←(Y′,Z′), Then remove the ciphertext X, Y, Z from the encrypted database EDB; Where Δ represents the key update token, represents the multiplication group of module q, X′ represents the updated ciphertext; Y′ represents the updated ciphertext; Z′ represents the updated ciphertext; EDB[X′] represents the new ciphertext storage location, X Δ The new ciphertext X′, Y is obtained by performing an exponential operation on the previous ciphertext X and the key update token Δ. Δ The new ciphertext Y′, Z is obtained by performing an exponential operation on the previous ciphertext Y and the key update token Δ. Δ It represents the new ciphertext Z′ obtained by performing an exponential operation on the previous ciphertext Z and the key update token Δ.

Images