Secure sharing multi-user management system and method with secret index
By utilizing the multi-user management system for secure sharing of encrypted indexes, and through the collaborative work of the multi-user module, key management module, and cloud storage module, the problems of multi-user management and secure sharing of encrypted indexes in encrypted search systems are solved, thereby improving user retrieval security and storage efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- UNIV OF ELECTRONICS SCI & TECH OF CHINA
- Filing Date
- 2025-05-20
- Publication Date
- 2026-05-12
AI Technical Summary
In existing technologies, encrypted search systems suffer from problems such as difficulty in ensuring user retrieval security, complex key management, and high storage overhead for encrypted indexes in terms of multi-user management and secure sharing of encrypted indexes.
A secure, shared, multi-user management system for encrypted indexes is adopted. Through the collaborative work of the multi-user module, key management module, and cloud storage module, different search keys are used to process document keywords, enabling the uploading and retrieval of heterogeneous encrypted indexes. Search keys are generated using bilinear mapping and hash functions, supporting differentiated permission management and unified index storage.
It enables different users to use different retrieval keys, simplifies key management, reduces the storage overhead of encrypted indexes, improves the scalability and security of multi-user management, and adapts to encrypted big data application scenarios.
Smart Images
Figure CN120498779B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data security sharing technology, and in particular to a secure multi-user management system and method for sharing encrypted indexes. Background Technology
[0002] Currently, practical encrypted search systems need to support multiple users accessing the encrypted search service. The trusted center needs to provide search keys during user registration, with different users using different index keys to generate encrypted indexes, protecting their search keywords from being leaked. However, different users processing the same keywords will output different encrypted indexes, and the storage overhead of encrypted indexes increases exponentially with the number of users.
[0003] Meanwhile, multiple users have a need for secure data sharing when using encrypted storage. Downloading encrypted data to the user's end and then decrypting and sharing it leads to low sharing efficiency. Decrypting and sharing encrypted data on the server side reduces security. Sharing user retrieval keys directly with the receiving user through a secure channel increases the key management burden, and the cross-sharing of user retrieval keys increases the risk of key loss of control.
[0004] Existing technical solutions still have the following problems regarding multi-user management and secure sharing of encrypted indexes in encrypted search systems:
[0005] (1) The management of multiple users in the secret state search system is difficult. In order to ensure the security of user retrieval, different retrieval keys need to be configured for users, and user key management is complicated.
[0006] (2) It is difficult to share the encrypted index stored by users. While different index keys ensure data security, they also create a barrier to data sharing, resulting in low sharing efficiency.
[0007] (3) The index storage overhead is large. The same keywords will output different encrypted indexes due to different users having different search keys, resulting in large encrypted index storage overhead. Summary of the Invention
[0008] To address the aforementioned technical problems, this invention provides a secure shared multi-user management system and method for encrypted indexes.
[0009] This invention is achieved using the following technical solution:
[0010] Firstly, the secure shared multi-user management system for encrypted indexes includes the following interactive entity modules:
[0011] Multi-user module: Processes document keywords and their unique identifiers using different search keys for different users;
[0012] Key management module: Distributes different search keys to different users in the multi-user module, and provides public key query services for the cloud storage module;
[0013] Cloud storage module: Manages user retrieval behavior and processes heterogeneous dense indexes submitted by multiple user modules;
[0014] Specifically, the cloud storage module and the multi-user module perform interactive encrypted index uploading and encrypted retrieval. The cloud storage module also provides public key query services and supervises encrypted retrieval of the multi-user shared index with the key management module. In addition, the multi-user module extracts and inputs plaintext files through keywords and document identifiers, and the key management module distributes and manages the search keys.
[0015] Specifically, the cloud storage module also includes: duplicate ciphertext detection and deletion, and maintenance of a unified multi-user shared index.
[0016] On the other hand, the secure sharing multi-user management method for encrypted indexes, implemented based on the aforementioned secure sharing multi-user management system for encrypted indexes, includes entity initialization, encrypted index uploading, and multi-user shared index search. The entity initialization specifically includes the following steps:
[0017] Step A1: The key management module selects two levels as... group Hequn ,group Hequn Satisfy bilinear mapping Select group generator g and hash function ,in, Map the input values to the group middle;
[0018] Step A2: The key management module in the multiplication group Generate your own random private key For users Generate random private key To search for public keys for cloud terminal computing ;
[0019] Step A3: The key management module will transfer the private key. Send the search public key to user i via a secure channel. Send to the search server;
[0020] The key management module can also be used by a trusted administrator configured in the key management center. Hequn The choice.
[0021] Specifically, the upload of the encrypted index includes the following steps:
[0022] Step B1: When user i uploads a document, an index is simultaneously generated for the keywords. The client synchronously selects a temporary key for this keyword. Calculate the search threshold After searching for the access control signature, it is sent to the cloud storage server;
[0023] Step B2: The cloud storage server retrieves the search public key corresponding to user i. Calculate the index key components , index key component After signing, it is sent to the user, where, Represents a bilinear mapping ;
[0024] Step B3: User calculates the index key Extract the document's unique identifier FileId and calculate the index. A= B= ;
[0025] Step B4: User on the index After signing, the data is returned to the cloud storage module server for storage.
[0026] The entity initialization and encrypted index upload steps assume that each entity has completed identity registration and holds an identity ID and a public / private identity key. Public key It is also used to encrypt the secure channel in step A3.
[0027] Specifically, the multi-user shared index search includes the following steps:
[0028] Step C1: During the search, the user enters keywords, and the client-side backend processes the keywords. Calculate the limit gate ;
[0029] Step C2: The user sends the search threshold signature to the cloud storage module server;
[0030] Step C3: The server receives the search threshold. Retrieve the search public key corresponding to user i Calculate the retrieval key and the search results The signature is returned to the search user;
[0031] Among them, the retrieval key is calculated. The calculation formula is:
[0032] ;
[0033] Use the retrieval key For index Detect each document's unique identifier sequentially. Whether it is true or not, if it is true, then... Add to successful search list .
[0034] The beneficial effects of this invention are as follows: The secure sharing multi-user management system and method for encrypted indexes proposed in this invention allow different users to use different search keys, and the search keys do not need to be shared, minimizing the scope of knowledge of the search keys, ensuring user search security, and supporting differentiated permission control for multiple users; key management only requires distributing the search key to different users once to support users to obtain encrypted index sharing services, simplifying key management costs and improving the scalability of multi-user management; in terms of index storage, it supports different keys from multiple users to generate the same encrypted index for the same document keywords, reducing the encrypted index storage overhead and making it more suitable for encrypted big data application scenarios. Attached Figure Description
[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.
[0036] Figure 1 This is an architecture diagram of a secure shared multi-user management system for encrypted indexes in an embodiment of the present invention;
[0037] Figure 2 This is a schematic diagram illustrating the entity initialization and encrypted index uploading steps in an embodiment of the present invention;
[0038] Figure 3 This is a schematic diagram of the multi-user shared index search steps in an embodiment of the present invention. Detailed Implementation
[0039] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.
[0040] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.
[0041] The following is in conjunction with the appendix Figure 1-3 The following describes some embodiments of the present invention in detail. Unless otherwise specified, the following embodiments and features can be combined with each other.
[0042] This invention proposes a secure shared multi-user management system for encrypted indexes. In a preferred embodiment, the system includes the following interactive entity modules:
[0043] Multi-user module: Processes document keywords and their unique identifiers using different search keys for different users;
[0044] Key management module: Distributes different search keys to different users in the multi-user module, and provides public key query services for the cloud storage module;
[0045] Cloud storage module: Manages user retrieval behavior and processes heterogeneous dense indexes submitted by multiple user modules.
[0046] In one specific embodiment, the secure shared multi-user management system for encrypted indexes is as follows: Figure 1 As shown, the cloud storage module and the multi-user module perform interactive encrypted index uploading and encrypted retrieval. The cloud storage module also provides public key query services and supervises encrypted retrieval of the multi-user shared index with the key management module. In addition, the multi-user module extracts and inputs plaintext files through keywords and document identifiers, and the key management module distributes and manages the search keys.
[0047] The plaintext files include keyword 1, keyword 2, ..., keyword n; the random combination of private keys in the multi-user module is search key 1, search key 2, ..., search key n; different users use different search keys to process document keywords and their unique identifiers; the key management module distributes different search keys to different users, provides public key query services to the cloud storage module, and also holds a global search key that can be used to monitor the stored encrypted index; the cloud storage module manages user search behavior, processes heterogeneous encrypted indexes submitted by multiple users, detects and deletes duplicate ciphertext, and maintains a unified multi-user shared index.
[0048] Based on the secure shared multi-user management system for encrypted indexes proposed in this embodiment, the management of secure shared multi-user encrypted indexes in this scheme mainly includes entity initialization and encrypted index uploading, shared index multi-user search, and other processes. The parameters involved in each part and their corresponding meanings are shown in Table 1 below:
[0049] Table 1
[0050]
[0051] In this embodiment, the search entity initialization and index upload process is as follows: Figure 2 As shown, by default, each entity has completed identity registration and holds an identity ID and a public / private key for that identity. .
[0052] During the search entity initialization phase:
[0053] 1) The trusted administrator (configured by the key management center, i.e., the key management module) selects two levels as... group Hequn Satisfies bilinear mapping Select group generator g and hash function , Map the input values to middle.
[0054] Condensed tubes in multiplication groups Generate your own random private key For users Generate random private key To search for public keys for cloud terminal computing .
[0055] 2) The key management center will via a secure channel (using the recipient's public key) (Encrypted) and sent to user i.
[0056] 3) The key management center will search for the public key. Send it to the search server.
[0057] During the document upload index building phase:
[0058] 4) When user i uploads a document, an index is simultaneously generated for the keywords. The client synchronously selects a temporary key for this keyword. Calculate the search threshold .
[0059] 5) After searching for the gate signature, send it to the cloud storage server.
[0060] 6) The cloud storage server retrieves the search public key corresponding to user i. ,calculate
[0061] 7) The cloud storage server will index the key components. After signing, send it to the user.
[0062] 8) User calculates index key Extract the document's unique identifier FileId and calculate the index. .
[0063] 9) User's index After signing, the data is returned to the cloud storage server for storage.
[0064] In this embodiment, the shared index multi-user search and the dense state retrieval process are as follows: Figure 3 As shown:
[0065] 1) When searching, the user enters keywords, and the client-side backend processes the keywords. Calculate the limit gate .
[0066] 2) The user sends the search limit signature to the cloud storage service client.
[0067] 3) Server receives search threshold Retrieve the search public key corresponding to user i Calculate the retrieval key Use the retrieval key For index Detect and judge sequentially Whether it is true or not, if it is true, then... Add to successful search list .
[0068] 4) Cloud storage will store search results The signature is returned to the search user.
[0069] Compared with the prior art, the present invention has the following advantages:
[0070] 1) Different users use different search keys, and the search keys do not need to be shared, minimizing the scope of knowledge of the search keys, ensuring user search security, and supporting differentiated permission control for multiple users.
[0071] 2) Key management only requires distributing the search key to different users once to support users in obtaining the encrypted index sharing service, simplifying key management costs and improving the scalability of multi-user management.
[0072] 3) In terms of index storage, it supports multiple users generating the same encrypted index for the same document keywords using different keys, which reduces the storage overhead of encrypted indexes and is more suitable for encrypted big data application scenarios.
[0073] For the foregoing embodiments, in order to simplify the description, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to this application.
[0074] The above embodiments describe the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Modifications and variations made by those skilled in the art without departing from the spirit and scope of the invention should be within the protection scope of the appended claims.
Claims
1. A method for secure sharing and multi-user management of encrypted indexes, characterized in that: This includes entity initialization, encrypted index uploading, and multi-user shared index search. Entity initialization specifically includes the following steps: Step A1: The key management module selects two levels as... group Hequn ,group Hequn Satisfy bilinear mapping Select group generator g and hash function ,in, Map the input values to the group middle; Step A2: The key management module in the multiplication group Generate your own random private key Generate a random private key for user i To search for public keys for cloud terminal computing ; Step A3: The key management module will transfer the private key. Send the search public key to user i via a secure channel. Send to the search server; The upload of the encrypted index specifically includes the following steps: Step B1: When user i uploads a document, an index is simultaneously generated for the keywords. The client synchronously selects a temporary key for this keyword. Calculate the search threshold After searching for the access control signature, it is sent to the cloud storage server; Step B2: The cloud storage server retrieves the search public key corresponding to user i. Calculate the index key components , index key component After signing, it is sent to the user, where, Represents a bilinear mapping ; Step B3: User calculates the index key Extract the document's unique identifier FileId and calculate the index. , = ; = This indicates that an index is used to generate the key. The encrypted document's unique identifier is FileId; Step B4: User on the index After signing, the data is returned to the cloud storage module server for storage. The multi-user shared index search specifically includes the following steps: Step C1: During the search, the user enters keywords, and the client-side backend processes the keywords. Calculate the limit gate ; Step C2: The user sends the search threshold signature to the cloud storage module server; Step C3: The server receives the search threshold. Retrieve the search public key corresponding to user i Calculate the retrieval key and the search results The signature is returned to the search user; specifically including: Calculate the retrieval key The calculation formula is: ； Use the retrieval key For index Detect each document's unique identifier sequentially. Whether it is true or not, if it is true, then... Add to successful search list ;in, Indicates the use of a retrieval key After encrypting the unique identifier FileId of the document, the retrieval key is then used. Decrypt the encrypted result.
2. The method for secure sharing of encrypted indexes by multiple users as described in claim 1, characterized in that, The entity initialization and encrypted index upload steps assume that each entity has completed identity registration and holds an identity ID and public / private identity key. .
3. The method for secure sharing of encrypted indexes by multiple users as described in claim 2, characterized in that, The public key It is also used to encrypt the secure channel in step A3.
4. A secure shared multi-user management system for encrypted indexes, used to implement the secure shared multi-user management method for encrypted indexes as described in any one of claims 1 to 3, characterized in that, Includes the following interactive entity modules: Multi-user module: Processes document keywords and their unique identifiers using different search keys for different users; Key management module: Distributes different search keys to different users in the multi-user module, and provides public key query services for the cloud storage module; Cloud storage module: Manages user retrieval behavior and processes heterogeneous dense indexes submitted by multiple user modules.
5. The secure shared multi-user management system for encrypted indexes as described in claim 4, characterized in that, The cloud storage module also includes: duplicate ciphertext detection and deletion, and maintenance of a unified multi-user shared index.