Post-quantum authentication searchable encryption method and system with forward security

Abstract

The invention provides a post-quantum authentication searchable encryption method and system with forward security, discloses effective multi-user authentication searchable encryption, and has forward security of a cloud storage system. The scheme is based on character hardness, is high in efficiency, and supports a multi-user scheme in a quantum environment. The security problems such as secret key leakage and IKGA attack are solved, and complete CI security and complete TI security are met at the same time.

Description

Technical Field

[0001] The present application belongs to the field of data security technology, and in particular relates to a post-quantum authenticated searchable encryption method and system with forward security. Background Art

[0002] Abstract Public Key Authenticated Encryption with Keyword Search (PAEKS) has been widely studied in cloud storage systems, allowing cloud servers to search encrypted data while protecting against Internal Keyword Guessing Attacks (IKGA). Most PAEKS schemes are based on discrete logarithm (DL) hardness.

[0003] However, this assumption becomes unsafe when it comes to quantum attacks. To address this issue, lattice-based post-quantum PAEKs have been studied. However, to our knowledge, current lattice-based PAEKs exhibit limited applicability and security, such as supporting only single-user scenarios or encountering key leakage issues.

[0004] The above statements are only used to provide background technical information related to this application. Unless otherwise indicated herein, the contents described in this section are not prior art for the contents of other parts of this application. Summary of the Invention

[0005] This invention proposes an efficient multi-user authenticated searchable encryption scheme with forward security for cloud storage systems. This scheme is based on lattice hardness, high efficiency, and support for multi-user operations in quantum environments. It addresses security issues such as secret key leakage and IKGA attacks, while also achieving both full CI security and full TI security.

[0006] Furthermore, we formally determine the security model of FS-MUAEKS and prove its security in the randomized oracIe model (ROM). Finally, a comprehensive performance evaluation shows that our scheme is computationally efficient and outperforms other PAEKS schemes.

[0007] According to a first aspect of an embodiment of the present application, a forward-secure post-quantum authenticated searchable encryption method is provided, comprising:

[0008] The trusted organization calculates the public parameters params and sends them to the cloud server, the data sender, and multiple data receivers for initialization;

[0009] The data sender extracts the keyword from the data in the cloud, calculates the keyword ciphertext ct using the data sender's public key and secret key (pks, sks) and the receiver's public key pkR, and sends the data ciphertext and keyword ciphertext to the cloud server;

[0010] When the data receiver retrieves the data stored on the cloud server, it first selects the trapdoor keyword TK, then calculates the trapdoor Trap based on the public key (pkR, skR(t)) at time period t and the public key pks of the data sender, and sends the trapdoor to the cloud server;

[0011] The cloud server matches the trap door with the cipher text keyword to search for the target data cipher text; if the match is successful, it means that the data cipher text contains the same keyword as the trap door, and the cloud server returns the successfully matched data cipher text to the data recipient, who can decrypt the data cipher text to obtain the data locally.

[0012] In some embodiments of the present application, the trusted institution calculates the public parameter params and sends it to the cloud server, the data sender, and multiple data receivers for initialization, including:

[0013] Given a security parameter λ and the depth d of the binary tree, the public parameter params is output through the Setup algorithm;

[0014] Via KeyGen S The algorithm takes public parameters params as input and generates a public key and a secret key (pks, sks) for the sender;

[0015] After entering the public parameters params, through KeyGen R The algorithm outputs the initial public key and secret key (pkR, skR) for the data receiver.

[0016] In some embodiments of the present application, the data sender extracts keywords from the data of the cloud server, calculates the keyword ciphertext ct using the public key and secret key (pks, sks) of the data sender and the public key pkR of the receiver, and sends the data ciphertext and the keyword ciphertext to the cloud server, including:

[0017] Based on the public parameters params, the receiver's public key pkR, and the receiver's secret key skr(t), the receiver's secret key skr(t+1) is output through the KeyUpdate algorithm at time period t+1, and then the previous secret key skr(t) is discarded;

[0018] With the given public parameters params, receiver public key pkR, sender public key pks, sender secret key sks and ciphertext keyword ck, the sender executes the FS-MUAEKS algorithm within time period t to generate a ciphertext ct embedded with ck.

[0019] In some embodiments of the present application, when a data receiver retrieves data stored on a cloud server, it first selects a trapdoor keyword TK, then calculates a trapdoor Trap based on the public key (pkR, skR(t)) in time period t and the public key pks of the data sender, and sends the trapdoor to the cloud server, including:

[0020] The receiver inputs the public parameters params, the receiver's public key pkR, the sender's public key pks, the receiver's secret key skR(t), the period t, and the trapdoor keyword TK. The receiver obtains the trapdoor Trap embedded in tk through the Trapdoor algorithm.

[0021] In some embodiments of the present application, the cloud server matches the trapdoor with the ciphertext keyword to search for the target data ciphertext, including:

[0022] The server executes the deterministic Test algorithm to verify whether the ciphertext keyword ct and the trapdoor Trap correspond to the same keyword. If they match, it returns TRUE; otherwise, it returns FALSE.

[0023] In some embodiments of the present application, given a security parameter λ and the depth d of the binary tree, the public parameter params is output through the Setup algorithm, including:

[0024] Enter the security parameter λ and the binary tree depth d and execute the Setup algorithm, initially selecting the hash function H1: And set the parameters n,m,q,α,σ; select several matrices Finally get the public parameters

[0025] In some embodiments of the present application, through KeyGen S The algorithm takes public parameters params as input and generates a public key and a secret key (pks, sks) for the sender, including:

[0026] The trusted institution takes the public parameter params as input and generates the sender's public key and private key by running the KeyGenS algorithm; by calling the TrapGen(n,m,q) algorithm, the trusted institution can obtain (A, Then, a matrix is ​​uniformly randomly selected And two matrices K A , Finally, we get pks=(A,U S , K A , A w ), sks=T Aand publish the public key pair (pks, sks) to the sender.

[0027] In some embodiments of the present application, through KeyGen R The algorithm outputs the initial public key and secret key ((pkR, skR)) for the data receiver, including:

[0028] The trusted authority takes the public parameters params as input and runs KeyGen R The algorithm generates the receiver's output initial public key and secret key ((pkR, skR); by calling the TrapGen(n,m,q) algorithm, the trusted institution can obtain Then, a matrix is ​​uniformly randomly selected And two matrices K B , Finally, we get (pkR=(C0,U R , K B , B w ), skR=T C0 and publish the public key pair (pkR, skR) to the recipient.

[0029] According to a second aspect of an embodiment of the present application, a forward-secure post-quantum authenticated searchable encryption system is provided, comprising:

[0030] Initialization and user registration module: used by trusted organizations to calculate public parameters params and send them to the cloud server, data sender, and multiple data receivers for initialization;

[0031] Ciphertext generation module: used by the data sender to extract keywords from the data of the cloud server, calculate the keyword ciphertext ct using the public key and secret key (pks, sks) of the data sender and the public key pkR of the receiver, and send the data ciphertext and keyword ciphertext to the cloud server;

[0032] Key update and trapdoor generation module: When the data receiver retrieves data stored on the cloud server, it first selects the trapdoor keyword TK, then calculates the trapdoor Trap based on the public key (pkR, skR(t)) in time period t and the public key pks of the data sender, and sends the trapdoor to the cloud server;

[0033] Matching and data acquisition module: used by the cloud server to match the trap door with the cipher text keyword to search for the target data cipher text; if the match is successful, it means that the data cipher text contains the same keyword as the trap door, and the cloud server returns the successfully matched data cipher text to the data recipient, who can decrypt the data cipher text to obtain the data locally.

[0034] According to a third aspect of an embodiment of the present application, a post-quantum authenticated searchable encryption device with forward security is provided, comprising: a storage unit for storing executable instructions; and a processing unit for connecting to the memory to execute the executable instructions to complete a post-quantum authenticated searchable encryption method with forward security.

[0035] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored; the computer program is executed by a processor to implement a post-quantum authenticated searchable encryption method with forward security.

[0036] The forward-secure post-quantum authenticated searchable encryption method, system and device of the present application involve four entities: a trusted institution, a data sender, a data receiver and a cloud server. It includes the trusted institution calculating the public parameter params and sending it to the cloud server, the data sender and multiple data receivers for initialization; user registration of the data sender and multiple data receivers, as well as the public key and secret key generation, key update, ciphertext generation, trap door generation and matching data acquisition stages. The present application scheme discloses an effective multi-user authenticated searchable encryption with forward security of cloud storage systems. The present application scheme is based on a multi-user scheme with lattice hardness, high efficiency and support for quantum environments. The present application solves security issues such as secret key leakage and IKGA attacks. And it meets both complete CI security and complete TI security.

[0037] In summary, the forward-secure post-quantum authenticated searchable encryption method, system, and device disclosed in this application provide a secure and efficient deployment of FS-MUAEKS for cloud storage systems, with the following technical effects:

[0038] Multi-user friendliness,This application supports multi-user scenarios making it very practical in cloud storage systems.

[0039] Quantum resistance. The PAEKS scheme proposed in this application can resist quantum computing attacks, thereby achieving a higher level of security.

[0040] Forward security: This application scheme can ensure that even if the current key has been leaked, the previously generated ciphertext is still secure.

[0041] Efficiency and security: This application scheme provides higher efficiency than other schemes in ROM and achieves high-end verifiable security. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0043] Figure 1 For the traditional cloud-assisted PAEKS framework;

[0044] Figure 2 : A schematic diagram of the steps of a forward-secure post-quantum authenticated searchable encryption method according to an embodiment of the present application is shown;

[0045] Figure 3 : shows a schematic diagram of the steps of system initialization according to an embodiment of the present application;

[0046] Figure 4 : shows a schematic diagram of the steps of sending ciphertext data by a data sender according to an embodiment of the present application;

[0047] Figure 5 : A schematic diagram of the system model principle of the FS-MUAEKS solution according to an embodiment of the present application is shown;

[0048] Figure 6 : A schematic diagram of the structure of a forward-secure post-quantum authenticated searchable encryption system according to an embodiment of the present application is shown in FIG.

[0049] Figure 7 Schematic diagram of the structure of a post-quantum authenticated searchable encryption device with forward security according to an embodiment of the present application is shown in FIG. DETAILED DESCRIPTION

[0050] Regarding this application, current lattice-based PAEKS schemes provide partial resistance to quantum computing attacks, IKGA, and key leakage problems. Furthermore, these schemes do not support multi-user scenarios and cannot achieve both full CI and TI security simultaneously, making them insecure and impractical for real-world applications such as cloud computing, electronic medical records (EMR), and the Internet of Things (ToT).

[0051] Forward security, also known as perfect forward secrecy (PFS), means that even if the long-term key is cracked or leaked in the future, past communications will not be compromised, thus protecting past communications from being cracked. Specifically, if a cryptographic system is forward secure, a key leaked after a certain point in time will not be able to decrypt data encrypted before that point.

[0052] Figure 1This paper describes a traditional cloud-assisted PAEKS framework, which includes four entities: the cloud, the data sender, the data receiver, and the authority. However, the ongoing advancement of quantum communication poses a significant threat to traditional PAEKS schemes based on DL hardness. Many researchers have proposed post-quantum PAEKS prototypes based on lattice hardness, which are known for their resistance to quantum attacks. Unfortunately, these schemes do not protect against key leakage, making them still insecure. Specifically, if keys are improperly stored, they can be exploited by an adversary who can generate a valid trapdoor and submit it to the cloud server. As a result, the cloud server will successfully pass the test and return the previously encrypted data to the attacker, who can then decrypt the previously encrypted data using the compromised secret key, presenting a significant security threat.

[0053] In this regard, the present application discloses a system model scheme of FS-MUAEKS and proposes forward-secure multi-user authenticated searchable encryption, which alleviates the problem of secret key exposure and further supports multi-user scenarios in quantum settings. In addition, the security model of FS-MUAEKS disclosed in this application proves its security in the random oracIe model (ROM). Finally, the comprehensive performance evaluation shows that the scheme of this application is computationally efficient and surpasses other advanced PAEKS schemes. In the best case, the ciphertext generation overhead of the scheme of this application is only 0.27 times that of other schemes. Under different security parameter settings, the communication overhead of the FS-MUAEKS algorithm of this application is constant at 175MB.

[0054] The present invention is motivated by the goal of building a PAEKS-based cloud storage solution that not only supports multi-user functionality but also provides advanced forward security. This application aims to improve and achieve breakthroughs in the following four key aspects.

[0055] 1. In order to meet the practical application needs of cloud storage, it is essential to build an efficient multi-user PAEKS primitive in a quantum environment.

[0056] 2. In order to solve the key leakage problem, this application solution must ensure that the proposed solution achieves forward security.

[0057] 3. Achieving full CI and full TI security simultaneously is the key to improving high-end security levels.

[0058] Finally, for user convenience, it is necessary to minimize the computational overhead of each algorithm.

[0059] To achieve the above objectives, the present invention provides a forward-secure post-quantum authenticated searchable encryption method that mainly consists of the following steps:

[0060] It mainly involves four entities: trusted institutions, data senders, data receivers, and cloud servers. Its specific workflow includes:

[0061] First, the trusted entity calculates the public parameters params and sends them to other entities for initialization. The data sender then extracts the keyword from the data in the cloud and calculates the ciphertext of the keyword ct using its own public key (pks, sks) and the recipient's public key (pkn). The sender then sends the ciphertext and keyword to the cloud server.

[0062] Second, when the data receiver wishes to retrieve data stored on the cloud, it must select a trapdoor keyword TK. Then, it calculates the trapdoor Trap based on the public key (pkr, skR(t)) at time period t and the sender’s public key pkg. Finally, it sends the trapdoor to the cloud server for further use.

[0063] After receiving the data, the cloud server matches the trapdoor with the ciphertext keyword to search for the target data ciphertext. A successful match indicates that the data ciphertext contains the same keyword as the trapdoor. The cloud server then returns the successfully matched data ciphertext to the recipient, who can decrypt it to retrieve the data locally.

[0064] The proposed scheme not only supports multi-user functionality but also provides advanced forward security. The FS-MUAEKS primitive has been proven to be secure against attacks by fully chosen keys on cryptographic keys and attacks by fully chosen keys on target keys. At the same time, security analysis shows that our scheme provides full CI security and full TI security in ROM.

[0065] In order to make the technical solutions and advantages of the embodiments of the present application more clearly understood, the exemplary embodiments of the present application are further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, and are not an exhaustive list of all the embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other unless they conflict.

[0066] Example 1

[0067] Figure 2 FIG. 5 shows a schematic diagram of the steps of a forward-secure post-quantum authenticated searchable encryption method according to an embodiment of the present application.

[0068] like Figure 2 As shown, according to a first aspect of an embodiment of the present application, a forward-secure post-quantum authenticated searchable encryption method is provided, comprising:

[0069] S1: The trusted organization calculates the public parameters params and sends them to the cloud server, the data sender, and multiple data receivers for initialization;

[0070] S2: The data sender extracts keywords from the data in the cloud, calculates the keyword ciphertext ct using the data sender's public and secret keys (pks, sks) and the receiver's public key pkR, and sends the data ciphertext and keyword ciphertext to the cloud server;

[0071] S3: When the data receiver retrieves the data stored on the cloud server, it first selects the trapdoor keyword TK, then calculates the trapdoor Trap based on the public key (pkR, skR(t)) at time period t and the public key pks of the data sender, and sends the trapdoor to the cloud server;

[0072] S4: The cloud server matches the trap door with the cipher text keyword to search for the target data cipher text; if the match is successful, it means that the data cipher text contains the same keyword as the trap door, and the cloud server returns the successfully matched data cipher text to the data recipient, who can decrypt the data cipher text to obtain the data locally.

[0073] Figure 3 Schematic diagram of the steps of system initialization according to an embodiment of the present application is shown in FIG.

[0074] like Figure 3 As shown, the trusted institution in S1 calculates the public parameter params and sends it to the cloud server, the data sender, and multiple data receivers for initialization, including:

[0075] S11: Given a security parameter λ and the depth d of the binary tree, output the public parameter params through the Setup algorithm;

[0076] S12: Via KeyGen S The algorithm takes public parameters params as input and generates a public key and a secret key (pks, sks) for the sender;

[0077] S13: After entering the public parameters params, through KeyGen R The algorithm outputs the initial public key and secret key (pkR, skR) for the data receiver.

[0078] To further illustrate, given a security parameter λ and the depth d of the binary tree in S11, the Setup algorithm outputs the public parameters params, including:

[0079] Input security parameter λ and binary tree depth d and execute the Setup algorithm, initially selecting the hash function And set the parameters n,m,q,α,σ; select several matrices Finally get the public parameters

[0080] Further explanation, S12 through KeyGen S The algorithm takes public parameters params as input and generates a public key and a secret key (pks, sks) for the sender, including:

[0081] The trusted institution takes the public parameters params as input and generates the sender's public key and private key by running the KeyGenS algorithm; by calling the TrapGen(n,m,q) algorithm, the trusted institution can obtain Then, a matrix is ​​uniformly randomly selected And two matrices K A , Finally, we get pks=(A,U S , K A , A w ), sks=T A and publish the public key pair (pks, sks) to the sender.

[0082] Further explanation, in S13, through KeyGen R The algorithm outputs the initial public key and secret key ((pkR, skR)) for the data receiver, including:

[0083] The trusted authority takes the public parameters params as input and runs KeyGen R The algorithm generates the receiver's output initial public key and secret key ((pkR, skR); by calling the TrapGen(n,m,q) algorithm, the trusted institution can obtain Then, a matrix is ​​uniformly randomly selected And two matrices K B , Finally, we get (pkR=(C0,U R , K B , B w ), skR=T C0 and publish the public key pair (pkR, skR) to the recipient.

[0084] Figure 4 Detailed description is given of the steps for a data sender to send encrypted data according to an embodiment of the present application.

[0085] like Figure 4As shown, in S2, the data sender extracts keywords from the data of the cloud server, calculates the keyword ciphertext ct by the public key and secret key (pks, sks) of the data sender and the public key pkR of the receiver, and sends the data ciphertext and keyword ciphertext to the cloud server, including:

[0086] S21: Based on the public parameters params, the receiver's public key pkR and the receiver's secret key skr(t), the receiver's secret key skr(t+1) is output by the KeyUpdate algorithm at time period t+1, and the previous secret key skr(t) is discarded.

[0087] S22: Using the given public parameters params, the receiver's public key pkR, the sender's public key pks, the sender's secret key sks, and the ciphertext keyword ck, the sender executes the FS-MUAEKS algorithm within time period t to generate a ciphertext ct embedded with ck.

[0088] Figure 5 ] A schematic diagram of the system model principle of the FS-MUAEKS solution according to an embodiment of the present application is shown in FIG.

[0089] Combine Figure 5 In the specific implementation, when the data receiver in S3 retrieves the data stored on the cloud server, it first selects the trapdoor keyword TK, then calculates the trapdoor Trap based on the public key (pkR, skR(t)) in time period t and the public key pks of the data sender, and sends the trapdoor to the cloud server, including:

[0090] The receiver inputs the public parameters params, the receiver's public key pkR, the sender's public key pks, the receiver's secret key skR(t), the period t, and the trapdoor keyword TK. The receiver obtains the trapdoor Trap embedded in tk through the Trapdoor algorithm.

[0091] In specific implementation, in S4, the cloud server matches the trap door with the cipher text keyword to search for the target data cipher text, including:

[0092] The server executes the deterministic Test algorithm to verify whether the ciphertext keyword ct and the trapdoor Trap correspond to the same keyword. If they match, it returns TRUE; otherwise, it returns FALSE.

[0093] The forward-secure post-quantum authenticated searchable encryption method of the embodiment of the present application not only supports multi-user functions, but also provides high-level forward security. The FS-MUAEKS primitive has been proven to be secure and can resist attacks on cryptographic keys by fully chosen keys and attacks on target keys by fully chosen keys. At the same time, security analysis shows that our scheme provides full CI security and full TI security in ROM.

[0094] To better illustrate the solution of this application, we first explain the prerequisites, including a brief summary of symbols, lattices, LWE difficulty, and lattice-based algorithms. Table 1 explains the abbreviations and descriptions used in this application.

[0095] Definition 1: Given a matrix It consists of n linearly independent vectors, and the m-dimensional lattice Λ is defined below.

[0096]

[0097] Definition 2: For three integers n, m, g and the matrix Define a q-ary directed integer lattice and its "shifted" mitochondrial number set as follows:

[0098]

[0099] Definition 3: For σ∈R + , a real number, with vector t∈Z m Centered on, defined for And define the discrete Gaussian distribution on Λ as: D Λ,t,σ =ρ t ,σ(s) / ρ t ,σ(Λ),for in

[0100] Definition 4: Given a positive integer n and a prime number q, define a hash function as a full rank difference (FRD) mapping H: Then, H(a)-H(b) is a full-rank matrix where

[0101] Definition 5: For a positive integer n, a parameter α∈(0,1), a prime number q, and The definitions are as follows:

[0102] LWE distribution: Randomly select a matrix AA Zn×mq, and a vector ←Vm. Then, return (A, ATs+e)nxTxZq.

[0103] Uniform distribution: randomly select the matrix and vector Then, return

[0104] Lemma 1: Given an m-dimensional lattice Λ and its basis T, and a parameter get:

[0105]

[0106] Lemma 2: Given two integers n, m>0, and a prime number For a real number and a matrix It is proved that u=A·e mod q The distribution on is statistically close to uniform, where e←D Zm ,σ.

[0107] In addition, the distribution of A·e=u mod q is expressed as Indicates that for a fixed With overwhelming probability.

[0108] Lemma 3: Given several integers n, m, q, the TrapGen(n, m, q) algorithm outputs a matrix and its trapdoor for is full rank and statistically close to uniform.

[0109] Lemma 4: For the matrix and its trap door vector matrix and This SampleLeft(B,N,T B ,r,σ) algorithm publishes a vector s∈Z m+k Statistically close σ, but the condition is [B|N]·s=r mod q.

[0110] Lemma 5: Given two matrices and a base A matrix A vector and Gaussian parameters SampleRight(A,D,N,T D ,u,σ) algorithm will output sample t∈Z 2m , the distribution is statistically close to σ.

[0111] Lemma 6: Given a full-rank matrix At the same time, Gaussian parameters The SampleRwithBasis(A,σ) algorithm will output a Zq invertible matrix R∈Z m×m and a base T A·R-1 ∈Z m×m , where R is statistically distributed close to D m×m , and T A·R-1 The distribution is statistically close to

[0112] Lemma 7: For two integers A matrix and its traps one and a Gaussian parameter By SamplePre(M,T M ,v,σ) algorithm outputs a vector The statistical distribution of σ.

[0113] Lemma 8: Given two matrices and a base of The ExtBasis(A,S1) algorithm returns a matrix S, which is where m = m1 + m2, A = A1UA2, and

[0114] Lemma 9 (Remainder of the Hash Lemma): Define a family of universal hashes Assume function f:X→Z and uniform random variable U y Belong to Y, let T1, T2, ..., T k It is based on X and independent random variables, and thus:

[0115] △((h,h(T1),f(T1),…,h(T k ),f(T k )) Formula (5);

[0116] and

[0117] Then, let the three matrices A, B, and R be {-1,1} m×k , mod q is uniformly selected. Given a matrix (A,AR,RT The statistical distribution of (A, B, R) is close to T The statistical distribution of W).

[0118] Lemma 10: Given a vector h∈Z m ,and Then h T y seems to be an integer with almost negligible probability.

[0119] Lemma 11: From {-1,1} m×k We can find a constant by randomly selecting an m×k matrix R in Where s1(R):=sup ||u||＝1 ||Ru||.

[0120] The security models of the FS-MUAEKS scheme proposed in this application target both external and internal adversaries. The first model targets the ciphertext indistinguishability risk, which is protected against fully chosen keyword to cipherkeyword attacks (also known as fully CI security); the other model targets the trapdoor indistinguishability risk, which is protected against fully chosen keyword to targetkeyword attacks (also known as fully TI security).

[0121] This application has complete CI security and complete TI security, and can prevent the above two types of leakage attack risks at the same time.

[0122] The specific solution for the first model to achieve complete CI security is as follows:

[0123] 1) Setup: After entering the security parameter λ, execute the Setup algorithm and KeyGen S Algorithm; to obtain public parameters params and public and secret keys (pks, sks); then, return data A including public parameters params, receiver public key pkR and sender public key pks, while maintaining the confidentiality of the initial key skR;

[0124] 2) Phase 1: In polynomial time, data A executes the following three rules in an adaptive manner.

[0125] Key update rule O KU : Update the current key skR(t) period t to the next period skR(t+1), unless the current period is the last period; otherwise, publish sk Ro Empty.

[0126] Ciphertext Rule O Ct :Time period t must be greater than the challenge time period t* required by data A. Given the ciphertext keyword ck and the recipient's public key (not specifically designated for the challenge public key pkR) execute FS- algorithm, calculates and returns ct as ciphertext,

[0127] Trap Door Rule Tr : In order to meet the requirements of data A, the challenge deadline t* must be earlier than the current deadline t. For a target keyword tk and the sender's public key pks (not specifically limited to the challenge public key pks), execute The algorithm calculates and returns Trap as a trap door to data A in cycle t.

[0128] 3) Challenge stage: before being O Tr During the query period t*, A selects two challenge ciphertext keywords And send it to the executor. This stage is limited to 0 Tr No visits or Then, the executor randomly selects a bit b∈{0,1} and calls The algorithm obtains the challenge ciphertext ct* and returns ct* to data A.

[0129] 4) Phase 2: Allow data A to perform the same query as in Phase 1, but challenge the keyword Unable to query.

[0130] 5) Estimation: Data A generates an estimated bit b′∈{0,1}. If b′=b, we consider A to have won the game. Data A wins the full CI advantage in the above implementation, and A(λ) is defined as follows:

[0131]

[0132] Definition 6: The FS-MUAEKS primitive fully satisfies the ciphertext indistinguishability if any PPT algorithm satisfies the above A(λ) implementation definition with negligible advantage over the above definition.

[0133] The specific solution for the second model to achieve complete TI security is as follows:

[0134] 1) Setup: The process is the same as that for a full CI security implementation setup.

[0135] 2) Phase 1: The process is the same as the full CI security implementation setup.

[0136] 3) Challenge phase: A selects two target challenge keywords (tk*, tk*) within a time period t* that has not been previously queried by OTr and sends them to C. The restrictions imposed in this phase are:

[0137] In theTr During the query period t*, A selects two challenge ciphertext keywords And send it to the executor. This stage is limited to 0 Tr No visits or The executor randomly selects a bit b∈{0,1} and calls Algorithm to obtain challenge ciphertext Finally, Return to data A.

[0138] 4) Phase 2: Allow data A to perform the same query as in Phase 1, but challenge the keyword Unable to query.

[0139] 5) Estimation: Data A generates an estimated bit b′∈{0,1}. If b′=b, we consider A to have won the game. Data A wins the full CI advantage in the above implementation, and A(λ) is defined as follows:

[0140]

[0141] Definition 7: If any user using the PPT algorithm satisfies the above definition of implementation A(λ) by a small margin, then the FS-MUAEKS prototype is considered to fully satisfy the trapdoor indistinguishability.

[0142] As further described, the construction of the grid-based FS-MUAEKS scheme specifically includes six phases, including system initialization, key generation, key update, ciphertext generation, trapdoor generation, and matching phase.

[0143] Phase 1: System initialization, input security parameter λ and binary tree depth d and execute Setup algorithm, initially select hash function And set the parameters n,m,q,α,σ; select several matrices Finally get the public parameters

[0144] Phase 2: Key generation for the data sender and receiver, including:

[0145] Generate public key and private key (pks, sks) for the sender: The trusted institution takes the public parameter params as input and generates the sender's public key and private key by running the KeyGenS algorithm; By calling the TrapGen(n,m,q) algorithm, the trusted institution can obtain Then, a matrix is ​​uniformly randomly selected And two matrices K A , Finally, we get pks=(A,U S , K A , A w ), sks=T A and publish the public key pair (pks, sks) to the sender.

[0146] Via KeyGen R The algorithm outputs the initial public key and secret key ((pkR, skR)) for the data receiver, including: the trusted institution takes the public parameters params as input, and runs KeyGen R The algorithm generates the receiver's output initial public key and secret key ((pkR, skR); by calling the TrapGen(n,m,q) algorithm, the trusted institution can obtain Then, a matrix is ​​uniformly randomly selected And two matrices K B , Finally, we get (pkR=(C0,U R , K B , B w ), skR=T C0 and publish the public key pair (pkR, skR) to the recipient.

[0147] Phase 3: Key Update. In this application, the receiver's key is updated regularly to prevent key leakage and achieve forward security. The receiver first inputs the public parameters params, its public key pkR and secret key skp(t), and time t into the KeyUpdate algorithm.

[0148] Phase 4: Ciphertext generation. The data sender receives a public parameter params, a receiver's public key pkr, a sender's public key (pks, sks), a ciphertext keyword ck, and the current time period t as input, and then runs the FS-MUAEKS algorithm to encrypt the data.

[0149] First, the sender randomly selects the following four matrices:

[0150]

[0151]

[0152] Therefore, let P w =F w +[A w H1(pkS,pkR,ck) -1 ] -1 X S , and then calculate two matrices:

[0153] P a= A T X S + Q A F w Formula (7);

[0154] P c = K T AX S + Q C F w Formula (8);

[0155] Next, the sender sets the following in time period t:

[0156] Then calculate two matrices:

[0157]

[0158] P u = U S X S + F U Formula (10);

[0159] in,

[0160] Finally, the sender calls the SampleLeft algorithm to perform sampling, and the ciphertext obtained by the sender is ct = (P w , P a , P b , P c , F S ) and upload it to the cloud server.

[0161] Phase 5: Trapdoor Generation. The authorized receiver can calculate the search trapdoor by running the trapdoor algorithm. In particular, the receiver inputs a public parameter params, the receiver's public key skR(t) in time period t, the sender's public key pks and a trapdoor keyword tk into the algorithm.

[0162] The receiver then uniformly randomly selects the following two matrices:

[0163]

[0164] Therefore, let Then two matrices are calculated:

[0165]

[0166] Next, the receiver checks whether skR(t) contains the basis X Γ(t) If it does, the algorithm continues; otherwise, it calls ExtBasis(F Γ(t),X Γ(i) ) algorithm to calculate X Γ(t) , and then continue execution.

[0167] Finally, the receiver calls the SampleLeft algorithm to perform sampling, and the receiver obtains the trap door Trap = (T w ,Y a ,Y b ,Y c ,F R ) and upload it to the cloud server through a secret channel.

[0168] Phase 6: Matching phase, based on the sender's encrypted ciphertext and the receiver's security trapdoor, the cloud server performs a matching procedure to find the result.

[0169] After inputting the ciphertext ct and trap Trap into the test algorithm, the cloud server first performs the following calculations:

[0170]

[0171] Therefore, for i=1,2,···,lR, and j=1,…lS, the server determines whether If there is a match, the algorithm outputs TRUE; otherwise, the algorithm outputs FALSE.

[0172] In specific practical implementation, this application also proves that the solution has complete CI security and complete TI security.

[0173] The FS-MUAEKS scheme of this application was compared and analyzed with other advanced PAEKS primitives, and its superiority in terms of computational overhead was demonstrated under the background of keeping computational and communication overheads as fair as possible.

[0174] In summary, the embodiments of this application disclose an efficient multi-user authenticated searchable encryption solution with forward security for cloud storage systems. This solution is based on a lattice-hardened, highly efficient, and quantum-capable multi-user solution. This solution addresses security issues such as secret key leakage and IKGA attacks, while also achieving both full CI security and full TI security.

[0175] The proposed scheme not only supports multi-user functionality but also provides advanced forward security. The FS-MUAEKS primitive has been proven to be secure against attacks by fully chosen keys on cryptographic keys and attacks by fully chosen keys on target keys. At the same time, security analysis shows that our scheme provides full CI security and full TI security in ROM.

[0176] In summary, the forward-secure post-quantum authenticated searchable encryption method, system, and device disclosed in this application provide a secure and efficient deployment of FS-MUAEKS for cloud storage systems, with the following technical effects:

[0177] Multi-user friendliness,This application supports multi-user scenarios making it very practical in cloud storage systems.

[0178] Quantum resistance. The PAEKS scheme proposed in this application can resist quantum computing attacks, thereby achieving a higher level of security.

[0179] Forward security: This application scheme can ensure that even if the current key has been leaked, the previously generated ciphertext is still secure.

[0180] Efficiency and security: This application scheme provides higher efficiency than other schemes in ROM and achieves high-end verifiable security.

[0181] Example 2

[0182] This embodiment provides a forward-secure post-quantum authenticated searchable encryption system. For details not disclosed in the forward-secure post-quantum authenticated searchable encryption system of this embodiment, please refer to the specific implementation content of the forward-secure post-quantum authenticated searchable encryption method in other embodiments.

[0183] Figure 6 Schematic diagram of the structure of a forward-secure post-quantum authenticated searchable encryption system according to an embodiment of the present application is shown in FIG.

[0184] like Figure 6 As shown, the forward-secure post-quantum authenticated searchable encryption system includes an initialization and user registration module 10, a ciphertext generation module 20, a key update and trapdoor generation module 30, and a matching and data acquisition module 40.

[0185] Specifically described,

[0186] Initialization and user registration module 10: used by the trusted organization to calculate the public parameter params and send it to the cloud server, the data sender and multiple data receivers for initialization;

[0187] Ciphertext generation module 20: used by the data sender to extract keywords from the data of the cloud server, calculate the keyword ciphertext ct using the public key and secret key (pks, sks) of the data sender and the public key pkR of the receiver, and send the data ciphertext and keyword ciphertext to the cloud server;

[0188] Key update and trapdoor generation module 30: used by the data receiver to retrieve data stored on the cloud server, first select the trapdoor keyword TK, then calculate the trapdoor Trap based on the public key (pkR, skR(t)) in time period t and the public key pks of the data sender, and send the trapdoor to the cloud server;

[0189] Matching and data acquisition module 40: used by the cloud server to match the trap door with the cipher text keyword to search for the target data cipher text; if the match is successful, it means that the data cipher text contains the same keyword as the trap door, and the cloud server returns the successfully matched data cipher text to the data recipient, and the data recipient can decrypt the data cipher text to obtain the data locally.

[0190] This application presents an efficient multi-user authenticated searchable encryption system with forward security for cloud storage systems. This solution is based on lattice hardness, high efficiency, and support for multi-user operations in quantum environments. It addresses security issues such as secret key leakage and IKGA attacks, while also achieving both full CI security and full TI security.

[0191] Example 3

[0192] This embodiment provides a forward-secure post-quantum authenticated searchable encryption device. For details not disclosed in the forward-secure post-quantum authenticated searchable encryption device of this embodiment, please refer to the specific implementation content of the forward-secure post-quantum authenticated searchable encryption method or system in other embodiments.

[0193] Figure 7 ] A schematic diagram of the structure of a forward-secure post-quantum authenticated searchable encryption device 400 according to an embodiment of the present application is shown in FIG.

[0194] like Figure 7 As shown, the post-quantum authenticated searchable encryption device 400 with forward security includes: a storage unit 402: used to store executable instructions; and a processing unit 401: used to connect with the storage unit 402 to execute the executable instructions to complete the post-quantum authenticated searchable encryption method with forward security.

[0195] Those skilled in the art will understand that Figure 7 This is merely an example of a forward-secure post-quantum authenticated searchable encryption device 400 and does not constitute a limitation of the forward-secure post-quantum authenticated searchable encryption device 400. The device may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the forward-secure post-quantum authenticated searchable encryption device 400 may also include input and output devices, network access devices, buses, etc.

[0196] The so-called processing unit 401 (Central Processing Unit, CPU) can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), field-programmable gate arrays (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor, or the processing unit 401 can also be any conventional processor, etc. The processing unit 401 is the control center of the forward-secure post-quantum authenticated searchable encryption device 400, and uses various interfaces and lines to connect the various parts of the entire forward-secure post-quantum authenticated searchable encryption device 400.

[0197] The storage unit 402 can be used to store computer-readable instructions. The processing unit 401 implements the various functions of the forward-secure post-quantum authenticated searchable encryption device 400 by running or executing the computer-readable instructions or modules stored in the storage unit 402 and accessing the data stored in the storage unit 402. The storage unit 402 may primarily include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as a sound playback function or an image playback function); the data storage area may store data created based on the use of the forward-secure post-quantum authenticated searchable encryption device 400. Furthermore, the storage unit 402 may include a hard disk, memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, a read-only memory (ROM), a random access memory (RAM), or other non-volatile / volatile storage devices.

[0198] If the modules integrated into the forward-secure post-quantum authenticated searchable encryption device 400 are implemented as software functional modules and sold or used as independent products, they can be stored on a computer-readable storage medium. Based on this understanding, the present invention can also implement all or part of the processes in the above-mentioned method embodiments by instructing the relevant hardware through computer-readable instructions. The computer-readable instructions can be stored on a computer-readable storage medium. When executed by a processor, the computer-readable instructions can implement the steps of each of the above-mentioned method embodiments.

[0199] Example 4

[0200] This embodiment provides a computer-readable storage medium having a computer program stored thereon; the computer program is executed by a processor to implement the forward-secure post-quantum authenticated searchable encryption method in other embodiments.

[0201] Those skilled in the art will appreciate that the terms used in the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. As used in the present invention and the appended claims, the singular forms "a," "the," and "the" are intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any or all possible combinations of one or more of the associated listed items.

[0202] It should be understood that although the terms "first," "second," "third," etc. may be used in the present invention to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present invention. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0203] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0204] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A forward-secure post-quantum authenticated searchable encryption method, characterized in that: include: The trusted organization calculates the public parameters params and sends them to the cloud server, the data sender, and multiple data receivers for initialization; The data sender extracts keywords from the data of the cloud server, calculates the keyword ciphertext ct using the public key and secret key (pks, sks) of the data sender and the public key pkR of the receiver, and sends the data ciphertext and keyword ciphertext to the cloud server; When the data receiver retrieves the data stored on the cloud server, it first selects the trapdoor keyword TK, then calculates the trapdoor Trap based on the public key (pkR, skR(t)) at time period t and the public key pks of the data sender, and sends the trapdoor to the cloud server; The cloud server matches the trap door with the cipher text keyword to search for the target data cipher text; if the match is successful, it means that the data cipher text contains the same keyword as the trap door, and the cloud server returns the successfully matched data cipher text to the data recipient, who can decrypt the data cipher text to obtain the data locally.

2. The forward-secure post-quantum authenticated searchable encryption method according to claim 1, characterized in that: The trusted institution calculates the public parameter params and sends it to the cloud server, the data sender, and multiple data receivers for initialization, including: Given a security parameter λ and the depth d of the binary tree, the public parameter params is output through the Setup algorithm; Via KeyGen S The algorithm takes public parameters params as input and generates a public key and a secret key (pks, sks) for the sender; After entering the public parameters params, through KeyGen R The algorithm outputs the initial public key and secret key (pkR, skR) for the data receiver.

3. The forward-secure post-quantum authenticated searchable encryption method according to claim 2, wherein: The data sender extracts keywords from the data of the cloud server, calculates the keyword ciphertext ct by using the public key and secret key (pks, sks) of the data sender and the public key pkR of the receiver, and sends the data ciphertext and keyword ciphertext to the cloud server, including: Based on the public parameters params, the receiver's public key pkR, and the receiver's secret key skr(t), the receiver's secret key skr(t+1) is output through the KeyUpdate algorithm at time period t+1, and then the previous secret key skr(t) is discarded; With the given public parameters params, receiver public key pkR, sender public key pks, sender secret key sks and ciphertext keyword ck, the sender executes the FS-MUAEKS algorithm within time period t to generate a ciphertext ct embedded with ck.

4. The forward-secure post-quantum authenticated searchable encryption method according to claim 3, wherein: When the data receiver retrieves data stored on the cloud server, it first selects the trapdoor keyword TK, then calculates the trapdoor Trap based on the public key (pkR, skR(t)) in time period t and the public key pks of the data sender, and sends the trapdoor to the cloud server, including: The receiver inputs the public parameters params, the receiver's public key pkR, the sender's public key pks, the receiver's secret key skR(t), the period t, and the trapdoor keyword TK. The receiver obtains the trapdoor Trap embedded in tk through the Trapdoor algorithm.

5. The forward-secure post-quantum authenticated searchable encryption method according to claim 4, wherein: The cloud server matches the trapdoor with a ciphertext keyword to search for the target data ciphertext, including: The server executes the deterministic Test algorithm to verify whether the ciphertext keyword ct and the trapdoor Trap correspond to the same keyword. If they match, it returns TRUE; otherwise, it returns FALSE.

6. The forward-secure post-quantum authenticated searchable encryption method according to claim 2, wherein: Given a security parameter λ and the depth d of the binary tree, the Setup algorithm outputs the public parameters params, including: Input security parameter λ and binary tree depth d and execute the Setup algorithm, initially selecting the hash function And set the parameters n,m,q,α,σ; select several matrices Finally get the public parameters 7. The forward-secure post-quantum authenticated searchable encryption method according to claim 2, wherein: Said by KeyGen S The algorithm takes public parameters params as input and generates a public key and a secret key (pks, sks) for the sender, including: The trusted institution takes the public parameters params as input and generates the sender's public key and private key by running the KeyGenS algorithm; by calling the TrapGen(n,m,q) algorithm, the trusted institution can obtain Then, a matrix is ​​uniformly randomly selected And two matrices K A , Finally, we get pks=(A,U S , K A , A w ), sks=T A and publish the public key pair (pks, sks) to the sender.

8. The forward-secure post-quantum authenticated searchable encryption method according to claim 2, wherein: Said by KeyGen R The algorithm outputs the initial public key and secret key ((pkR, skR)) for the data receiver, including: The trusted authority takes the public parameters params as input and runs KeyGen R The algorithm generates the receiver's output initial public key and secret key ((pkR, skR); by calling the TrapGen(n,m,q) algorithm, the trusted institution can obtain Then, a matrix is ​​uniformly randomly selected And two matrices K B , Finally, we get (pkR=(C0,U R , K B , B w ), skR=T C0 and publish the public key pair (pkR, skR) to the recipient.

9. A forward-secure post-quantum authenticated searchable encryption system, characterized in that: include: Initialization and user registration module: used by trusted organizations to calculate public parameters params and send them to the cloud server, data sender, and multiple data receivers for initialization; Ciphertext generation module: used by the data sender to extract keywords from the data of the cloud server, calculate the keyword ciphertext ct using the public key and secret key (pks, sks) of the data sender and the public key pkR of the receiver, and send the data ciphertext and keyword ciphertext to the cloud server; Key update and trapdoor generation module: When the data receiver retrieves data stored on the cloud server, it first selects the trapdoor keyword TK, then calculates the trapdoor Trap based on the public key (pkR, skR(t)) in time period t and the public key pks of the data sender, and sends the trapdoor to the cloud server; Matching and data acquisition module: used for the cloud server to match the trap door with the cipher text keyword to search for the target data cipher text; If the match is successful, it means that the data cipher text contains the same keyword as the trap door. The cloud server returns the successfully matched data cipher text to the data receiver, and the data receiver can decrypt the data cipher text to obtain the data locally.

10. A computer-readable storage medium, characterized in that A computer program is stored thereon; the computer program is executed by a processor to implement the method according to any one of claims 1 to 8.

Images