A hybrid proxy re-encryption method supporting keyword retrieval

Abstract

The present invention discloses a hybrid proxy re-encryption method supporting keyword retrieval, comprising: a key generation center generates an identification key for a data owner and generates an attribute key for a user with specific attributes; the data owner uses his own identification ID to encrypt original data to obtain original ciphertext; the data owner generates a re-encryption key based on his own identification key and an access control policy corresponding to the authorized user's attributes; a cloud server uses the re-encryption key to re-encrypt the original ciphertext to obtain a re-encrypted ciphertext; the cloud server distributes the re-encrypted ciphertext to the corresponding authorized users, and the authorized users use their respective attribute keys to decrypt the re-encrypted ciphertext to obtain the original data; the data owner uses his own identification key to generate an identification threshold and performs ciphertext data retrieval; each authorized user uses his own attribute key to generate a corresponding attribute threshold and performs re-encrypted ciphertext retrieval.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security and data encryption, and specifically relates to a hybrid proxy re-encryption method and system supporting keyword retrieval. Background Art

[0002] One-to-many encrypted data sharing refers to converting ciphertext decryptable by a single user into ciphertext decryptable by multiple users using an authorized key, without decrypting the plaintext. Current schemes supporting one-to-many encrypted data sharing include identity-based broadcast proxy re-encryption (IB-BPRE) (G. Chunpeng, Z. Liu, J. Xia, and F. Liming, “Revocable identity-based broadcast proxy re-encryption for data sharing in clouds,” IEEE Transactions on Dependable and Secure Computing, 2019) and hybrid proxy re-encryption (HyPRE) based on identity encryption and attribute encryption (X. Feng et al., “HyPRE: Hybrid Proxy Re-Encryption for Secure Multimedia Data Sharing on Mobile Devices,” 2024 IEEE International Conference on Multimedia and Expo (ICME), Niagara Falls, ON, Canada, 2024, pp. 1-6). The idea of ​​the former is to transform the data encryption scheme based on a single identifier into a data encryption scheme based on a set of multiple identifiers, while the idea of ​​the latter is to transform the data encryption scheme based on a single identifier into a data encryption scheme based on attributes and policies composed of attributes.

[0003] The disadvantage of the IB-BPRE scheme is that it requires enumerating all identifiers during the re-encryption phase, which introduces exponential performance overhead during re-encryption key generation and decryption of re-encrypted ciphertext. The HyPRE scheme offers more flexible access control capabilities and is generally considered more suitable for one-to-many data encryption scenarios. However, to date, existing one-to-many encrypted data sharing schemes do not support keyword search against ciphertext. For cloud-based data sharing scenarios, keyword search is a crucial technology for efficient data access when the data scale is large, and is therefore of great value for cloud-assisted encrypted data sharing. Summary of the Invention

[0004] Purpose of the invention: In order to solve the problems of certain redundancy in public parameters in existing one-to-many encrypted data sharing methods, which will introduce certain storage and computing overheads and lack of ciphertext keyword retrieval, the present invention proposes a hybrid proxy re-encryption method and system that supports keyword retrieval. By adding four keyword retrieval related algorithms, namely identification threshold generation, attribute threshold generation, identification threshold test, and attribute threshold test, the secret keyword retrieval function based on one-to-many encrypted data sharing is realized.

[0005] Technical solution: A hybrid proxy re-encryption method supporting keyword retrieval, including the following steps:

[0006] The key generation center generates an identification key for the data owner and sends the identification key to the data owner through a secure channel. The key generation center generates an attribute key for a user with a specific attribute and distributes the attribute key to the user through a secure channel. The specific attribute is attribute information abstracted from user characteristics.

[0007] The data owner uses his or her own ID to encrypt the original data, obtain the original ciphertext, and upload the original ciphertext to the cloud server for storage;

[0008] The data owner generates a re-encryption key based on his or her identification key and the access control policy corresponding to the authorized user attributes;

[0009] The data owner uploads the re-encryption key to the cloud server, which then uses the re-encryption key to re-encrypt the original ciphertext to obtain the re-encrypted ciphertext.

[0010] When data is shared, the cloud server distributes the re-encrypted ciphertext to the corresponding authorized users. The authorized users use their own attribute keys to decrypt the re-encrypted ciphertext and obtain the original data.

[0011] When retrieving ciphertext data, the data owner uses his or her own identification key to generate an identification threshold and uploads the identification threshold to the cloud server for ciphertext data retrieval. The cloud server performs an identification threshold test on the original ciphertext based on the data owner's identification threshold and returns the corresponding test result. Each authorized user uses his or her own attribute key to generate a corresponding attribute threshold and uploads the attribute threshold to the cloud server for re-encrypted ciphertext retrieval. The cloud server performs an attribute threshold test on the re-encrypted ciphertext based on the attribute threshold of each authorized user and returns the corresponding test result.

[0012] Furthermore, the key generation center generates an identification key for the data owner, specifically including:

[0013] Pick a random number as well as

[0014] Calculate g a ,g b ,g c ; The system public parameter pp and master key msk are expressed as:

[0015] pp=g,g a ,g b ,g c ,u,h,w,v,f,e(g,g) α

[0016] msk=(α,a,b)

[0017] Where, the bilinear mapping e(·): Indicates that the two The elements in the group are mapped to Elements in the group, The corresponding set of groups is The set consisting of the Cartesian product of the elements in the group, and G T are two different multiplicative cyclic groups defined on elliptic curves;

[0018] Select a random number r and calculate K0=g α w r , K1=(u ID h) -r , K2=g r , V=g (ac-r) / b , Z = f r ;

[0019] The identification key of the data owner corresponding to the identification ID is expressed as: sk ID =(K0,K1,K2,V,Z).

[0020] Furthermore, the key generation center generates attribute keys for users with specific attributes, specifically including:

[0021] Random selection and calculate

[0022] For any i∈[k], k represents the number of attributes, calculate Where A i Represents the value of each attribute;

[0023] Possess specific attributes The attribute key corresponding to the user is expressed as:

[0024]

[0025] Where, Represents a collection of attribute information.

[0026] Furthermore, the data owner uses his / her own identification ID to encrypt the original data to obtain the original ciphertext, which specifically includes:

[0027] The data owner selects a random element And calculate C = m·e(g,g) αs , C0=g s , C1=g t , C2=u ID h) t w -s , C3=f s , m represents the plaintext message;

[0028] Random selection And calculate W = g cd , W0=g a(d+s) g bdH(KW) , W1=g bs , E=f s (u ID h) s , where H(·) represents mapping the keyword KW to The hash function of the group, KW represents the keyword bound during the original encryption;

[0029] The original ciphertext is represented as:

[0030] ct ID =(C,C0,C1,C2,C3,W,W0,W1,E).

[0031] Furthermore, the data owner generates a re-encryption key based on his / her identification key and the access control policy corresponding to the authorized user attributes, specifically including:

[0032] Define the access control policy W = (M, ρ) corresponding to the authorized user attributes, where And ρ: l represents the row number, and a row of the matrix is ​​mapped to a specific attribute value;

[0033] Possess identification key sk ID Data owner selection in, represents a random vector, s′ represents a random number, y n represents a random element, and n represents the number of attributes of the authorized user;

[0034] Pick a random number Then calculate d0=K0·f t′ , d1=K1,d2=K2;

[0035] For j∈[l], calculate Among them, λ′ j represents a random number, ρ(j) represents the attribute value corresponding to the j-th row of matrix M

[0036] Then calculate d6=F(e(g,g) αs′ )·g t′ , d7=g s′ , F(·) means Group elements are mapped to Hash functions in groups;

[0037] Random selection And calculate e0=g cd′ , e1=g a(d′+s′) g bd′H(KW) , e2=g bs′ , for any j∈[l] calculate

[0038] The re-encryption key is represented as:

[0039] rk ID→W =(d0,d1,d2,{d j,3 ,d j,4 ,d j,5} j∈[l] ,d6,d7,e0,e1,e2,{e j,3} j∈[l] ).

[0040] Furthermore, the cloud server re-encrypts the original ciphertext using the re-encryption key to obtain the re-encrypted ciphertext, specifically including:

[0041] First, calculate B = e(d0, C0)·e(d1, C1)·e(d2, C2);

[0042] Then, calculate C′=C / B;

[0043] The re-encrypted ciphertext is represented as:

[0044] ct′=(C′,C′0,{C′ j,1 ,C′ j,2 ,C′ j,3} j∈[l] ,C′4,C′5,W′0,W′1,W′2,{W′ j,3} j∈[l] )

[0045] in:

[0046] {C′ j,1 =d j,3 ,C′ j,2 =d j,4 ,C′ j,3 =d j,5} j∈[l]

[0047] C′4=C3=f s

[0048] C′5=d7, W′0=e0, W′1=e1

[0049] {W′ j,3 =e j,3} j∈[l] .

[0050] Furthermore, the cloud server distributes the re-encrypted ciphertext to the corresponding authorized users, and the authorized users decrypt the re-encrypted ciphertext with their respective attribute keys to obtain the original data, specifically including:

[0051] For the original ciphertext, calculate B = e(K0, C0)·e(K1, C1)·e(K2, C2), and then calculate the plaintext message m = C / B;

[0052] For the re-encrypted ciphertext, calculate:

[0053]

[0054] Then calculate g t′ =C′0 / F(e(g,g) αs′ ), and finally calculate the plaintext message m=C'·e(g t′ ,C′4).

[0055] Furthermore, the data owner generates an identification threshold using his or her own identification key, specifically including:

[0056] Possess identification key sk ID The data owner selects a random element And calculate:

[0057] τ1=(g a g bH(KW′) ) γ , τ2=g cγ , τ3=V γ , Z′=Z γ ;

[0058] In the formula, KW′ represents the keywords provided during the search;

[0059] sk ID The corresponding identification threshold is expressed as:

[0060] τ ID =(τ1,τ2,τ3,K′1,K′2,Z′)

[0061] The cloud server performs an identification threshold test on the original ciphertext based on the identification threshold of the data owner and returns the corresponding test results, specifically including:

[0062] Calculate the following formula:

[0063]

[0064] If e(W,τ1)·(W1,τ3)·F=e(W0,τ2), it means the retrieval is successful, that is, KW'=KW, and 1 is returned. Otherwise, the retrieval fails, that is, KW'≠KW, and 0 is returned.

[0065] Furthermore, each authorized user generates a corresponding attribute threshold using his or her own attribute key, specifically including:

[0066] Has attribute key The user selects a random number And calculate:

[0067] Y′=Y γ , Z′=Z γ ;

[0068] For any i∈[k], calculate Y i ′=Y i γ ;

[0069] Property Key The corresponding attribute threshold is expressed as:

[0070]

[0071] The cloud server performs an attribute threshold test on the re-encrypted ciphertext based on the attribute threshold of each authorized user and returns the corresponding test results, specifically including:

[0072] Calculate the following formula:

[0073]

[0074] If e(W0′,τ1)·(W2′,τ3)·F=e(W1′,τ2), it means the retrieval is successful, that is, KW'=KW, and 1 is returned. Otherwise, the retrieval fails, that is, KW'≠KW, and 0 is returned.

[0075] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0076] (1) The method of the present invention can realize one-to-many encrypted data sharing based on an untrusted cloud, that is, it can realize data storage, sharing, and keyword retrieval without leaking any private information under the assumption that the third-party cloud server is honest but curious;

[0077] (2) In the method of the present invention, on the one hand, the data owner can encrypt the original data with his own private key and upload the ciphertext to the cloud server for outsourced storage, thereby saving local storage space; on the other hand, when data needs to be shared with multiple people, the data owner only needs to use his own private key to generate an authorization key to authorize the cloud server to convert the stored ciphertext into ciphertext that can be decrypted by the target (shared) user; in addition, both the data owner and the authorized user can use their own private key to generate a threshold to realize keyword retrieval of cloud data, thereby improving data reading efficiency. It should be noted that all the above operations are performed in ciphertext on the cloud without leaking any plaintext data or user-related sensitive information, thereby ensuring the security of the entire link of the data sharing process;

[0078] (3) The method of the present invention solves the problem of parameter redundancy in the existing one-to-many encrypted data sharing scheme. The method of the present invention adds four keyword retrieval related algorithms, namely, identification threshold generation, attribute threshold generation, identification threshold test, and attribute threshold test, thereby realizing the secret keyword retrieval function based on one-to-many encrypted data sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 This is a flowchart of a hybrid proxy re-encryption method supporting keyword retrieval in the data encryption sharing stage;

[0080] Figure 2 This is a flowchart of a hybrid proxy re-encryption method that supports keyword retrieval during the ciphertext data retrieval phase;

[0081] Figure 3 A schematic diagram of a hybrid proxy re-encryption method supporting keyword retrieval proposed by the present invention and applied in a medical scenario;

[0082] Figure 4 This is a performance test diagram of each algorithm proposed in the present invention, where: Figure 4 (a) is a schematic diagram of the key generation algorithm performance test. Figure 4 (b) is a schematic diagram of encryption algorithm performance test. Figure 4 (c) is a schematic diagram of the performance test of the threshold generation algorithm. Figure 4 (d) is a schematic diagram of the performance test of the re-encryption related algorithm. Figure 4 (e) is a schematic diagram of the threshold test algorithm performance test. Figure 4 (f) in the figure is a schematic diagram of the decryption algorithm performance test. DETAILED DESCRIPTION

[0083] In order to make the purpose, technical solutions and advantages of the present invention clearer, the hybrid proxy re-encryption method and system supporting keyword retrieval proposed by the present invention will be further explained in conjunction with the accompanying drawings in the present invention.

[0084] Example 1:

[0085] This embodiment proposes a hybrid proxy re-encryption method that supports keyword retrieval to achieve data encryption sharing. The specific execution steps are as follows: Figure 1 As shown, including:

[0086] Step 101: The key generation center KGC generates an identification key for the data owner and sends the corresponding key to the data owner via a secure channel (such as HTTPS). The specific implementation steps include:

[0087] System Initialization Setup(1 λ )→(pp,msk), λ is a security parameter, 1 λ Identifies the bit length corresponding to the security parameter λ: The key generation center KGC first selects a random number as well as Then calculate g a ,g b ,g c , the system public parameter pp and the master key msk can be expressed as:

[0088] pp=g,g a ,g b ,g c ,u,h,w,v,f,e(g,g) α

[0089] msk=(α,a,b)

[0090] Where, the bilinear mapping e(·): Indicates that the two The elements in the group are mapped to Elements in the group, that is, e(g,g) α for An element of the group, The corresponding set of groups is The set consisting of the Cartesian product of the elements in the group, and G T are two different multiplicative cyclic groups defined on elliptic curves;

[0091] Identification key generation KeyGen(pp,msk,ID)→sk ID :The key generation center KGC selects a random number r and calculates K0=g α w r , K1=(u ID h) -r , K2=g r , V=g (ac-r) / b , Z = f r , the identification key corresponding to the identification ID can be expressed as: sk ID =(K0,K1,K2,V,Z).

[0092] Step 102: The key generation center (KGC) generates attribute keys for users with specific attributes and distributes the corresponding attribute keys to different users through a secure channel (such as HTTPS). The specific attributes are attribute information abstracted from user characteristics and are generally identified by strings. For example, in a medical scenario, the attributes may be "doctor," "patient," "hypertension," "heart disease," "general surgery," "neurology," etc. In an educational scenario, they may be "student," "teacher," "Peking University," "Tsinghua University," "advanced mathematics," "abstract algebra," etc. The specific implementation steps include:

[0093] Attribute key generation The key generation center KGC is randomly selected and calculate For any i∈[k], k represents the number of attributes, calculate Where A i Represents the value of an attribute;

[0094] The user key with a specific attribute can be expressed as:

[0095]

[0096] Where, Represents an attribute information set, which refers to the set of specific attributes mentioned above and is used to describe a specific entity. For example, in a medical scenario, to describe a doctor, the attribute information set may be {"doctor", "general surgery"}; to describe a patient, the attribute information set may be {"patient", "heart disease", "neurology"}.

[0097] Step 103: The data owner encrypts the original data with his / her own identification ID to obtain the original ciphertext. The specific implementation steps include:

[0098] Data encryption Encrypt(pp,m,ID,KW)→ct ID : The data owner selects a random element And calculate C = m·e(g,g) αs , C0=g s , C1=g t , C2=(u ID h) t w -s , C3=f s , m represents the plaintext message, and then randomly selected And calculate W = g cd , W0=g a(d+s) g bdH(KW) , W1=g bs , E=f s (u ID h) s , where H(·) represents mapping the keyword KW to The hash function of the group), KW represents the keyword bound during the original encryption;

[0099] The original ciphertext can be expressed as:

[0100] ct ID =(C,C0,C1,C2,C3,W,W0,W1,E)

[0101] Step 104: The data owner uploads the original ciphertext to the cloud server for storage;

[0102] Step 105: When data sharing is required, the data owner generates a re-encryption key based on his or her identification key and the access control policy corresponding to the user attributes of the shared key (here, it is assumed that the user has obtained the key from the KGC in step 102). The specific implementation steps include:

[0103] Re-encryption key generation RKGen(pp,sk ID ,W,KW)→rk ID→W : Owns the identification key sk IDThe data owner of is based on the strategy W = (M, ρ) encoded in LSSS, where And ρ: l represents the row number, and a row of the matrix is ​​mapped to a specific attribute value. First, select in, represents a random vector, s′ represents a random number, y n represents a random element, and n represents the number of attributes of the authorized user;

[0104] Pick a random number Then calculate d0=K0·f t′ , d1=K1, d2=K2.

[0105] For j∈[l], calculate Among them, λ′ j represents a random number, ρ(j) represents the attribute value corresponding to the j-th row of the matrix M;

[0106] Then calculate d6=F(e(g,g) αs′ )·g t′ , d7=g s′ , F(·) represents the hash function, F(e(g,g) αs′ ) means to put Group elements are mapped to The hash function of the group, the content of which is the result of bilinear mapping.

[0107] In order to realize the characteristics of ciphertext retrieval, randomly select And calculate e0=g cd′ , e1=g a(d'+s′) g bd'H(KW) , e2=g bs' , for any j∈[l] calculate The re-encryption key can be expressed as:

[0108] rk ID→W =(d0,d1,d2,{d j,3 ,d j,4 ,d j,5} j∈[l] ,d6,d7,e0,e1,e2,}e j,3} j∈[l] )

[0109] Step 106: The data owner uploads the re-encryption key to the cloud server;

[0110] Step 107: The cloud server re-encrypts the original ciphertext uploaded in step 104 using the re-encryption key uploaded in step 106 to obtain re-encrypted ciphertext. The specific implementation steps include:

[0111] Re-encryption Enter the re-encryption key rk ID→W and the original ciphertext ct ID , the re-encryption algorithm first calculates B = e(d0, C0)·e(d1, C1)·e(d2, C2), and then calculates C' = C / B.

[0112] Other components of the re-encrypted ciphertext include:

[0113] {C′ j,1 =d j,3 ,C′ j,2 =d j,4 ,C′ j,3 =d j,5} j∈[l]

[0114] C′4=C3=f s

[0115] C′5=d7, W0′=e0, W1′=e1,

[0116] {W′ j,3 =e j,3} j∈[l]

[0117] The re-encrypted ciphertext can be expressed as:

[0118] ct′=(C′,C′0,{C′ j,1 ,C′ j,2 ,C′ j,3} j∈[l] ,C′4,C′5,W0′,W1′,W2′,{W′ j,3} j∈[l] )

[0119] Step 108: The cloud server distributes the re-encrypted ciphertext to the corresponding authorized user (assuming it is the user in step 102).

[0120] Step 109: The authorized users use their respective keys to decrypt the re-encrypted ciphertext distributed in step 108 and obtain the original data. The specific implementation steps include:

[0121] Data decryption Decrypt(ct,sk)→m: For the original ciphertext, calculate B=e(K0,C0)·e(K1,C1)·e(K2,C2), and then calculate the plaintext message m=C / B;

[0122] For re-encrypted ciphertext, the decryption algorithm calculates:

[0123]

[0124] Then calculate g t′=C′0 / F(e(g,g) αs′ ), and finally calculate the plaintext message m=C'·e(g t′ ,C′4).

[0125] Example 2:

[0126] Based on Example 1, this example proposes a hybrid proxy re-encryption method that supports keyword retrieval, which is used to implement ciphertext data retrieval. The specific execution steps are as follows: Figure 2 As shown, including:

[0127] Following the steps disclosed in Example 1, the following are generated:

[0128] Identification key ct'=(C',C'0,{C' j,1 ,C′ j,2 ,C′ j,3} j∈[l] ,C′4,C′5,W0′,W1′,W2′,{W′ j,3} j∈[l] )

[0129] Property Key

[0130] Original ciphertext ct ID =(C,C0,C1,C2,C3,W,W0,W1,E)

[0131] Re-encryption key rk ID→W =(d0,d1,d2,{d j,3 ,d j,4 ,d j,5} j∈[l] ,d6,d7,e0,e1,e2,{e j,3} j∈[l] )

[0132] Re-encrypted ciphertext ct'=(C',C'0,{C' j,1 ,C′ j,2 ,C′ j,3} j∈[l] ,C′4,C′5,W0′,W1′,W2′,{W′ j,3} j∈[l] ).

[0133] Right now Figure 2 Step 201 and step 202 in .

[0134] Step 203: The data owner uses his own identification key sk ID Generate identification thresholds and upload them to the cloud server for ciphertext data retrieval. The specific implementation steps include:

[0135] Identify thresholds to generate trapdoors ID (pp,sk ID ,KW′)→τ ID : Owns the identification key sk ID The data owner selects a random element And calculate τ1=(g a g bH(KW′) ) γ , τ2=g cγ , τ3=V γ , Z′=Z γ ,sk ID The corresponding identification threshold can be expressed as: τ ID =(τ1,τ2,τ3,K′1,K′2,Z′). KW′ represents the keyword used for retrieval.

[0136] Step 204: Each authorized user (assuming the corresponding user in step 202) generates a corresponding attribute threshold using his or her own attribute key and uploads the attribute threshold to the cloud server for re-encrypted ciphertext retrieval. The specific implementation steps include:

[0137] Attribute threshold generation Has attribute key The user selects a random number and calculate Y′=Y γ , Z′=Z γ , for any i∈[k], calculate Y i ′=Y i γ , attribute key The corresponding attribute threshold can be expressed as:

[0138]

[0139] Step 205: The cloud server performs an identification threshold test on the original ciphertext based on the identification threshold of the data owner and returns the corresponding test result. The specific implementation steps include:

[0140] Marking threshold test Test ID (ct ID ,τ ID )→{0,1}: Calculate:

[0141]

[0142] If e(W,τ1)·(W1,τ3)·F=e(W0,τ2), it means the retrieval is successful, that is, KW'=KW, and 1 is returned. Otherwise, the retrieval fails, that is, KW'≠KW, and 0 is returned.

[0143] Step 206: The cloud server performs an attribute threshold test on the re-encrypted ciphertext based on the attribute threshold of each authorized user and returns the corresponding test result. The specific implementation steps include:

[0144] Attribute threshold testing First calculate:

[0145]

[0146] If e(W0′,τ1)·(W2′,τ3)·F=e(W1′,τ2), it means the retrieval is successful, that is, KW'=KW, and 1 is returned. Otherwise, the retrieval fails, that is, KW'≠KW, and 0 is returned.

[0147] Example 3:

[0148] The hybrid proxy re-encryption method supporting keyword retrieval proposed in Example 1 or Example 2 is applied in a medical scenario, such as Figure 3 As shown, after obtaining the physical examination report, the patient can encrypt the report with his or her own identification key and store the ciphertext in the cloud server. When the patient needs multiple doctors for a joint consultation, he or she can authorize the corresponding doctor to access the physical examination report by uploading the authorization key. In this process, multiple doctors can correspond to the same re-encrypted ciphertext without the need for complex ciphertext and key management.

[0149] For this scenario, based on Ubuntu 20.04LTSDesktop system and 3.0GHz AMD Ryzen54600H CPU and 16GB RAM environment, such as Figure 4 As shown, the performance test is as follows: for the key generation algorithm, the time overhead of the identification key generation remains basically unchanged at 6.80 milliseconds, while the time overhead of the attribute key generation algorithm increases linearly with the increase in the number of attributes; the time overhead of the original ciphertext encryption algorithm is also stable at around 9.5 milliseconds; for the threshold generation algorithm, the time overhead of the identification threshold generation algorithm is approximately constant at 6 milliseconds, while the time overhead of the attribute threshold generation algorithm increases linearly with the increase in the number of attributes; the time overhead of the re-encryption key generation algorithm increases linearly with the increase in the number of authorized user attributes, while the time overhead of the re-encryption process is fixed at around 2 milliseconds; for the threshold test algorithm, the time overhead of the identification threshold test remains constant at approximately 3.5 milliseconds, while the time overhead of the attribute threshold test increases linearly with the increase in the number of attributes; for the decryption algorithm, the time overhead of the original ciphertext decryption algorithm remains unchanged at approximately 1.7 milliseconds, while the time overhead of the re-encrypted ciphertext decryption increases linearly with the increase in the number of attributes.

[0150] All of the above operations are performed in encrypted form on the cloud, and no plaintext data or user-related sensitive information will be leaked, thus ensuring the security of the entire data sharing process.

Claims

1. A hybrid proxy re-encryption method supporting keyword retrieval, characterized by: The following steps are involved: The key generation center generates an identification key for the data owner and sends the identification key to the data owner through a secure channel. The key generation center generates an attribute key for a user with a specific attribute and distributes the attribute key to the user through a secure channel. The specific attribute is attribute information abstracted from user characteristics. The data owner uses his or her own ID to encrypt the original data, obtain the original ciphertext, and upload the original ciphertext to the cloud server for storage; The data owner generates a re-encryption key based on his or her identification key and the access control policy corresponding to the authorized user attributes; The data owner uploads the re-encryption key to the cloud server, which then uses the re-encryption key to re-encrypt the original ciphertext to obtain the re-encrypted ciphertext. When data is shared, the cloud server distributes the re-encrypted ciphertext to the corresponding authorized users. The authorized users use their own attribute keys to decrypt the re-encrypted ciphertext and obtain the original data. When searching for encrypted data, the data owner uses his or her own identification key to generate an identification threshold and uploads the identification threshold to the cloud server for retrieval. The cloud server performs an identification threshold test on the original ciphertext based on the data owner's identification threshold and returns the corresponding test result. Each authorized user generates a corresponding attribute threshold using their own attribute key and uploads the attribute threshold to the cloud server for re-encrypted ciphertext retrieval. The cloud server performs an attribute threshold test on the re-encrypted ciphertext based on the attribute threshold of each authorized user and returns the corresponding test result. The key generation center generates an identification key for the data owner, specifically including: Pick a random number as well as Calculate g a ,g b ,g c ; The system public parameter pp and master key msk are expressed as: pp=g,g a ,g b ,g c ,u,h,w,v,f,e(g,g) α msk=(α,a,b) Where, the bilinear mapping e(·): Indicates that the two The elements in the group are mapped to Elements in the group, The corresponding set of groups is The set consisting of the Cartesian product of the elements in the group, and G T are two different multiplicative cyclic groups defined on elliptic curves; Select a random number r and calculate K0=g α w r , K1=(u ID h) -r , K2=g r , V = g (ac-r) / b , Z = f r ; The identification key of the data owner corresponding to the identification ID is expressed as: sk ID =(K0,K1,K2,V,Z); The key generation center generates attribute keys for users with specific attributes, specifically including: Random selection and calculate For any i∈[k], k represents the number of attributes, calculate Where A i Represents the value of each attribute; Possess specific attributes The attribute key corresponding to the user is expressed as: Where, Represents a collection of attribute information; The data owner uses his / her own identification ID to encrypt the original data to obtain the original ciphertext, which specifically includes: The data owner selects a random element And calculate C = m·e(g,g) αs , C0=g s , C1=g t , C2=(u ID h) t w -s , C3=f s , m represents the plaintext message; Random selection And calculate W = g cd , W0=g a(d+s) g bdH(KW) , W1=g bs , E=f s (u ID h) s , where H(·) represents mapping the keyword KW to The hash function of the group, KW represents the keyword bound during the original encryption; The original ciphertext is represented as: ct ID =(C,C0,C1,C2,C3,W,W0,W1,E) The data owner generates a re-encryption key based on his or her identification key and the access control policy corresponding to the authorized user attributes, specifically including: Define the access control policy W = (M, ρ) corresponding to the authorized user attributes, where and l represents the row number, and a row of the matrix is ​​mapped to a specific attribute value; Possess identification key sk ID Data owner selection in, represents a random vector, s′ represents a random number, y n represents a random element, and n represents the number of attributes of the authorized user; Pick a random number Then calculate d0=K0·f t′ , d1=K1,d2=K2; For j∈[l], calculate Among them, λ′ j represents a random number, ρ(j) represents the attribute value corresponding to the j-th row of matrix M Then calculate d6=F(e(g,g) αs' )·g t′ , d7=g s′ , F(·) means Group elements are mapped to Hash functions in groups; Random selection And calculate e0=g cd' , e1=g a(d'＋s′) g bd'H(KW) , e2=g bs′ , for any j∈[l] calculate The re-encryption key is represented as: rk ID→W =(d0,d1,d2,{d j,3 ,d j,4 ,d j,5 } j∈[l] ,d6,d7,e0,e1,e2,{e j,3 } j∈[l] )。 2. The hybrid proxy re-encryption method supporting keyword retrieval according to claim 1, characterized in that: The cloud server re-encrypts the original ciphertext using the re-encryption key to obtain the re-encrypted ciphertext, specifically including: First, calculate B = e(d0, C0)·e(d1, C1)·e(d2, C2); Then, calculate C'=C / B; The re-encrypted ciphertext is represented as: ct′=(C′,C′0,{C' j,1 ,C' j,2 ,C' j,3 } j∈[l] ,C′4,C5′,W0′,W1′,W2′,{W j ′ ,3 } j∈[l] ) in: {C′ j,1 =d j,3 ,C′ j,2 =d j,4 ,C′ j,3 =d j,5 } j∈[l] C′4=C3=f s C5′=d7, W0′=e0, W1′=e1 {W′ j,3 =e j,3 } j∈[l] .

3. The hybrid proxy re-encryption method supporting keyword retrieval according to claim 2, characterized in that: The cloud server distributes the re-encrypted ciphertext to the corresponding authorized users, and the authorized users use their own attribute keys to decrypt the re-encrypted ciphertext and obtain the original data, specifically including: For the original ciphertext, calculate B = e(K0, C0)·e(K1, C1)·e(K2, C2), and then calculate the plaintext message m = C / B; For the re-encrypted ciphertext, calculate: Then calculate g t′ =C′0 / F(e(g,g) αs′ ), and finally calculate the plaintext message m=C′·e(g t′ ,C′4).

4. The hybrid proxy re-encryption method supporting keyword retrieval according to claim 2, characterized in that: The data owner uses his / her own identification key to generate an identification threshold, which specifically includes: Possess identification key sk ID The data owner selects a random element And calculate: τ1=(g a g bH(KW′) ) γ ,τ2=g cγ ,τ3=V γ , Z′=Z γ ; In the formula, KW′ represents the keywords provided during the search; sk ID The corresponding identification threshold is expressed as: t ID =(t1,t2,t3,K′1,K′2,Z′) The cloud server performs an identification threshold test on the original ciphertext based on the identification threshold of the data owner and returns the corresponding test results, specifically including: Calculate the following formula: If e(W,τ1)·(W1,τ3)·F=e(W0,τ2), it means the retrieval is successful, that is, KW'=KW, and 1 is returned. Otherwise, the retrieval fails, that is, KW'≠KW, and 0 is returned.

5. The hybrid proxy re-encryption method supporting keyword retrieval according to claim 2, characterized in that: Each authorized user generates a corresponding attribute threshold using his or her own attribute key, specifically including: Has attribute key sk S The user selects a random number And calculate: Y′=Y γ ,Z′=Z γ ; For any i∈[k], calculate Y i ′=Y i γ ; Attribute key sk S The corresponding attribute threshold is expressed as: t S =(τ1,τ2,τ3,Y′,{Y i ′} i∈[k] ,Z′) The cloud server performs an attribute threshold test on the re-encrypted ciphertext based on the attribute threshold of each authorized user and returns the corresponding test results, specifically including: Calculate the following formula: If e(W′0,τ1)·(W′2,τ3)·F=e(W′1,τ2), it means the retrieval is successful, that is, KW'=KW, and 1 is returned. Otherwise, the retrieval fails, that is, KW'≠KW, and 0 is returned.

Images