A forward-secure policy-hiding attribute-based keyword search method

Abstract

The present application relates to the technical field of information security, in particular to a forward security policy hidden attribute-based keyword search method for access control and search of sensitive information, comprising: obtaining public parameters and a master key; processing an attribute set submitted by a data user to construct a user private key and output a puncture key; randomly selecting a symmetric key, symmetrically encrypting plaintext through the symmetric key to obtain initial ciphertext, and sequentially performing policy hidden encryption, keyword encryption and label binding on the plaintext to obtain corresponding output representations, and integrating the initial ciphertext and the output representations to obtain complete ciphertext; updating the puncture key when a constraint condition is met; establishing a keyword set according to the content required by the data user, generating a trapdoor, and initiating a search request; matching the trapdoor and the complete ciphertext according to the search request to obtain a matching result, and comprehensively updating the puncture key and the user private key to decrypt the initial ciphertext to obtain corresponding plaintext; and effectively improving forward security.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a forward-safe policy-hidden attribute-based keyword search method. Background Art

[0002] With the rapid development of cloud computing technology, users often use encryption to protect their data before uploading it to the cloud to avoid privacy risks and ensure data confidentiality. Searchable Encryption (SE), a cryptographic mechanism that supports keyword searches on ciphertext, enables users to perform keyword queries without decrypting the data, thus achieving a good balance between data confidentiality and availability. Furthermore, to meet the needs of multi-user sharing and access control, researchers have further proposed an Attribute-Based Searchable Encryption (ABSE) scheme that combines Attribute-Based Encryption (ABE) technology, effectively integrating ciphertext access control with search capabilities.

[0003] However, its practical application still faces many challenges: First, it lacks forward security mechanisms, making it difficult to defend against privacy attacks after key leakage. Currently, cloud platforms have long operating cycles, and user private keys may be leaked due to reasons such as device loss and system intrusion. Once an attacker obtains the key at a certain point in time, it may be possible to decrypt historical ciphertext, causing serious privacy leaks. To address this technical shortcoming, key revocation and re-encryption, time-segmented keys, and puncturable encryption are currently commonly used. These provide key update mechanisms to a certain extent, but key revocation and re-encryption have high overhead and are difficult to apply to large-scale systems. The time segmentation mechanism is limited to time tags and does not support flexible attribute tags. Although puncturable encryption can achieve lightweight updates, it has not yet been effectively integrated into the ABSE framework.

[0004] Secondly, multi-keyword search is inefficient and difficult to support complex queries. Currently, linear scans, Bloom filters, and composite indexes are commonly used to solve this problem. However, linear scans are computationally intensive and cannot adapt to large-scale ciphertext libraries. Bloom filters have the risk of false positives. Composite indexes have high maintenance costs and are difficult to integrate with attribute access control mechanisms.

[0005] Third, access policies lack the ability to hide information, posing a risk of privacy leakage. Access policies in ABSE solutions often contain sensitive information such as organizational structure and user roles. If exposed during encryption or search, they may reveal user intent or system logic. Existing technologies such as inner product encryption (IPE) have high computational overhead and poor attribute space scalability. Fuzzy identity encryption has weak expressiveness and cannot support complex policy logic. Attempts to hide policy information, such as zero-knowledge proofs, introduce high communication and computational overhead, making them unsuitable for practical deployment.

[0006] Fourth, the overall computing and communication overhead of the system is still relatively high, making it difficult to meet high-performance requirements; the encryption, search, and decryption operations in the ABSE system involve a large number of exponential operations and bilinear pairing calculations, which pose a challenge to resource-constrained devices, and existing ciphertext aggregation technologies usually rely on simplified policy logic, which has a limited scope of application; outsourced decryption relies on semi-trusted servers, and security relies on additional assumptions; lightweight algorithms may reduce security boundaries and affect system robustness. Summary of the Invention

[0007] In order to solve the technical problems of attribute-based searchable encryption methods lacking forward security mechanisms in practice, insufficient forward security, inability of multi-keyword searches to support complex searches, low search efficiency, lack of access policy hiding capabilities, and high computational and communication overhead, the present invention aims to provide a forward-secure, policy-hidden attribute-based keyword search method for access control and search of sensitive information, including key generation centers, data owners, cloud servers, and data users. The technical solutions adopted are as follows:

[0008] Set parameters through the key generation center and obtain public parameters and master keys;

[0009] The key generation center attributes the attribute set submitted by the data user, constructs the user's private key based on the public parameters and the master key, and outputs the puncture key;

[0010] The data owner randomly selects a symmetric key and symmetrically encrypts the plaintext with the symmetric key to obtain the initial ciphertext. The plaintext is then encrypted using policy hiding, keyword encryption, and label binding to obtain the corresponding output representation. The initial ciphertext and output representation are combined to obtain the complete ciphertext and uploaded to the cloud server.

[0011] Set constraints and update the puncture key when the constraints are met;

[0012] Establish a keyword set based on the data user's needs, generate a trapdoor based on the keyword set and the user's private key, and initiate a search request;

[0013] The cloud server matches the trapdoor with the complete ciphertext according to the search request, obtains the matching result, and decrypts the initial ciphertext with the updated puncture key and the user's private key to obtain the corresponding plaintext.

[0014] Preferably, setting parameters through a key generation center to obtain public parameters and a master key includes:

[0015] A bilinear group structure and group generator are generated through the key generation center, and a master key component is randomly selected. The public parameters corresponding to each master key component are calculated based on the group generator. A multi-order polynomial is defined to satisfy the master key component, and a polynomial commitment set is generated.

[0016] Establish attribute, keyword and tag hash functions in turn;

[0017] The master key components, the public parameters corresponding to each master key component, the polynomial commitment set and the public parameters of the key generation center are generated by the hash function, and the master key is obtained based on the randomly selected master key components.

[0018] Preferably, the key generation center attributes the attribute set submitted by the data user, constructs the user's private key based on the public parameters combined with the master key, and outputs the puncture key, including:

[0019] Based on the attribute set submitted by the data user, the key generation center calculates the attribute hash sum according to the attribute hash function;

[0020] The master key and attribute hash are combined based on the public parameters to generate the basic private key component, and any element is randomly selected and integrated with the basic private key component to form the user's private key;

[0021] Get the initial puncture tag, combine it with the tag hash function through the polynomial commitment set, and integrate the initial puncture tag to output the puncture key.

[0022] Preferably, the data owner randomly selects a symmetric key, symmetrically encrypts the plaintext with the symmetric key to obtain the initial ciphertext, and sequentially performs policy hiding encryption, keyword encryption, and label binding on the plaintext to obtain the corresponding output representation. The initial ciphertext and the output representation are integrated to obtain the complete ciphertext, which is then uploaded to the cloud server, including:

[0023] The data owner randomly selects and generates a random symmetric key, and uses a symmetric encryption algorithm to encrypt the plaintext to obtain the initial ciphertext;

[0024] Obtain the access policy, calculate the policy hash sum based on the attribute hash function combined with the access policy, and generate the ciphertext header;

[0025] Establish a keyword set based on the data owner, and generate keyword components through keyword encryption of the keyword set;

[0026] Combine the label hash function to perform label binding to generate the puncture label component;

[0027] The initial ciphertext, ciphertext header, keyword component and puncture tag component are integrated to obtain the complete ciphertext and uploaded to the cloud server.

[0028] Preferably, the ciphertext header is generated, and the corresponding calculation formula is:

[0029]

[0030] in, Indicates the ciphertext header; 、 、 Both represent random elements in the bilinear group structure; represents the policy hash sum, represents the attribute hash function, Indicates the Access strategies, Indicates the total number of access policies; represents the group generator; Represents the matching operation in the bilinear group structure; represents a random symmetric key;

[0031] Generate keyword components, the corresponding calculation formula is:

[0032]

[0033] in, Represents a keyword component; Represents the master key component; Represents a random element in a bilinear group structure; Represents a keyword hash function; Indicates the first Keywords;

[0034] Generate puncture label components, the corresponding calculation formula is:

[0035]

[0036] in, Indicates a puncture label component; represents a polynomial commitment set, represents a polynomial, represents the order of the polynomial; represents the label hash function; Indicates the tags.

[0037] Preferably, the constraint condition is that the timestamp corresponding to the newly generated puncture key arrives or a security event occurs, and the security event includes any one of key leakage, data tampering, unauthorized access, system vulnerability exploitation and malware attack.

[0038] Preferably, a keyword set is established according to the data user's requirements, a trapdoor is generated based on the keyword set combined with the user's private key, and a search request is initiated, specifically:

[0039] Establish a keyword set based on the data user’s needs, denoted as ;

[0040] Generate a trapdoor based on the keyword set combined with the user's private key and issue a search request. The corresponding calculation formula is:

[0041]

[0042] in, Indicates a trapdoor; represents the group generator; 、 Represents a random element in a bilinear group structure; Represents the basic private key component of the user's private key; Represents a keyword hash function; Indicates the first keyword in the keyword set established based on the data user's demand content. Keywords.

[0043] Preferably, the cloud server matches the trapdoor with the complete ciphertext according to the search request to obtain a matching result, and decrypts the initial ciphertext by combining the updated puncture key and the user's private key to obtain the corresponding plaintext, including:

[0044] Based on the complete ciphertext, segmentation processing is performed. In the cloud server, the trapdoor is matched with the segmented complete ciphertext through the bilinear group structure to obtain the matching result;

[0045] Check whether the ciphertext labels corresponding to the matching results have not been punctured. If so, restore the data based on the updated puncture key and the keyword set formed by the data user's requirements.

[0046] The symmetric key is decrypted according to the recovered puncture key, and the initial ciphertext is decrypted using the symmetric key to obtain the corresponding plaintext.

[0047] Preferably, the keyword set formed based on the updated puncture key and the data user's required content is restored, and the corresponding calculation formula is:

[0048]

[0049] in, Indicates the recovered puncture key; Represents the matching operation in the bilinear group structure; A set of keywords representing the content formed by data user needs The Keywords; Indicates the first segment in the complete ciphertext; Indicates that the 8th segment in the complete ciphertext contains elements; Indicates the User private key, corresponding to represents a random element, 、 Both represent the basic private key components.

[0050] Preferably, the symmetric key is decrypted according to the recovered puncture key, and the initial ciphertext is decrypted by the symmetric key to obtain the corresponding plaintext. The corresponding calculation formula is:

[0051]

[0052] in, Represents a symmetric key; Indicates the recovered puncture key; 、 、 Respectively represent the second, third, and fourth segments of the complete ciphertext; Represents the matching operation in the bilinear group structure; Represents the basic private key component of the user's private key; Represents a random element in a bilinear group structure.

[0053] The present invention has the following beneficial effects:

[0054] Encryption is performed in combination with the puncture key to ensure that the key generated by each puncture tag is irreversible in the future state. Even if a version of the key is leaked, it cannot be used to decrypt the ciphertext at other time points to ensure forward security; trapdoors are generated through keyword sets to support multi-keyword joint queries. The cloud server completes the logical matching by matching the trapdoor with the complete ciphertext without linearly traversing all keywords; symmetric encryption, policy hidden encryption, keyword encryption and label binding are performed on the plaintext in sequence, so that the access policy does not appear directly in the ciphertext. It can only be correctly decrypted under the premise of meeting the policy, effectively preventing the leakage of policy information; and the components of the complete ciphertext are independent of each other, and the volume of the complete ciphertext as a whole does not increase with the number of keywords or the complexity of the access policy; at the same time, the parameters of the overall operation and the subsequent matching operations are in a fixed range, with constant computing and communication overhead, which is suitable for edge devices or low-power scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0056] Figure 1 A flowchart of the steps of a forward-secure, policy-hidden attribute-based keyword search method provided by one embodiment of the present invention;

[0057] Figure 2 A schematic diagram of a framework of a forward-secure, policy-hidden attribute-based keyword search method provided by one embodiment of the present invention;

[0058] Figure 3 A flowchart illustrating the implementation of policy-hiding encryption in a forward-secure, policy-hiding attribute-based keyword search method provided by one embodiment of the present invention;

[0059] Figure 4 This is a flowchart of an implementation of updating a puncture key in a forward-secure, policy-hidden attribute-based keyword search method provided by one embodiment of the present invention;

[0060] Figure 5 This is a flowchart of an implementation of matching trapdoors and complete ciphertexts in a forward-secure, policy-hidden attribute-based keyword search method provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0061] To further illustrate the technical means and effectiveness of the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail the specific implementation, structure, features, and effectiveness of a forward-secure, policy-hidden, attribute-based keyword search method proposed by the present invention. In the following description, different references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0062] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0063] The following describes in detail a specific solution of a forward-secure, policy-hidden attribute-based keyword search method provided by the present invention with reference to the accompanying drawings.

[0064] Please combine Figure 1 and Figure 2, which shows a flowchart and framework diagram of a forward-secure, policy-hidden attribute-based keyword search method provided by the first embodiment of the present invention, which is used for access control and search of sensitive information, including a key generation center, a data owner, a cloud server, and a data user. The method includes:

[0065] Step S1: Set parameters through the key generation center to obtain public parameters and master key;

[0066] Step S2: The key generation center attributes the attribute set submitted by the data user, constructs the user's private key based on the public parameters and the master key, and outputs the puncture key;

[0067] Step S3: The data owner randomly selects a symmetric key and symmetrically encrypts the plaintext with the symmetric key to obtain the initial ciphertext. The plaintext is then encrypted with policy hiding, keyword encryption, and label binding to obtain the corresponding output representation. The initial ciphertext and the output representation are combined to obtain the complete ciphertext, which is then uploaded to the cloud server.

[0068] Step S4: setting constraints, and updating the puncture key when the constraints are met;

[0069] Step S5: Create a keyword set based on the data user's requirements, generate a trapdoor based on the keyword set and the user's private key, and initiate a search request;

[0070] Step S6: The cloud server matches the trapdoor with the complete ciphertext according to the search request, obtains a matching result, and decrypts the initial ciphertext with the updated puncture key and the user's private key to obtain the corresponding plaintext.

[0071] For better explanation, attribute-based refers to keyword search based on attributes such as objects or data items.

[0072] Aiming at the key problems of existing attribute-based searchable encryption (ABSE) schemes in terms of security, efficiency and policy privacy, after the user key is leaked, attackers may use it to decrypt historical ciphertexts, resulting in privacy leakage. There is a lack of an effective key evolution mechanism and insufficient forward security. The existing multi-keyword search mechanism usually adopts a linear structure, which causes the search complexity to increase with the number of keywords, making it difficult to meet the efficient search requirements under large-scale ciphertext databases and resulting in low search efficiency. Most attribute-based encryption schemes explicitly include access policies in the ciphertext, which may leak user permission structure and access intentions, and there is a risk of sensitive information being inferred, resulting in access policy exposure. When the complexity of the access policy increases, the ciphertext volume and decryption computational complexity of the traditional scheme expand rapidly, which cannot adapt to resource-constrained devices or response time-sensitive application scenarios, resulting in excessive computational and communication overhead. Therefore, a forward-secure policy-hidden attribute-based keyword search method is proposed in this application, that is, an improved encryption method with forward security, support for multi-keyword search, policy hiding and controllable system overhead.

[0073] It can be explained that the proposed search method is based on the system operation formed by the key generation center, data owner, cloud server and data user. Among them, the key generation center (KGC) is responsible for system initialization, generation and issuance of user keys with evolutionary capabilities and policy management; the data owner (DO) is responsible for encrypting data, setting access policies and key puncture operations, and uploading them to the cloud; the cloud server (CS) stores encrypted data and responds to users' keyword search requests, performs policy-hidden search, verifies user revocation status, and returns matching results; the data user (DU) generates a search trap based on a set of personal attributes to initiate keyword searches.

[0074] Furthermore, step S1 includes:

[0075] Step S11: Generate a bilinear group structure and group generator through the key generation center, randomly select a master key component, calculate the public parameters corresponding to each master key component based on the group generator, define a multi-order polynomial to satisfy the master key component, and generate a polynomial commitment set.

[0076] Preferably, before implementing this step, security parameters and a maximum penetration depth are set to define the initialization parameters of the key generation center. Fixed time slices are not preset throughout the initialization process, but rather key updates are triggered by subsequent events. This allows the frequency and timing of key updates to be flexibly adjusted based on actual operational needs to improve system security and responsiveness. The security parameters are used to mitigate potential security vulnerabilities and ensure the randomness and unpredictability of the key generation process. The maximum penetration depth is used to prevent excessive physical or logical penetration during the key generation process. This penetration depth restriction effectively prevents malicious attackers from obtaining key information through physical means or software vulnerabilities, ensuring the key generation center maintains high security at both the physical and logical levels.

[0077] Specifically, the key generation center randomly selects parameters to generate the bilinear group structure and group generator, where the bilinear group structure is recorded as , the group generator is recorded as , 、 Represents two groups, It means that the two groups satisfy the bilinear pairing relationship, that is, ; Complex encryption and decryption operations can be implemented through the bilinear group structure to ensure the security of data transmission; the group generator is a key element in the bilinear group structure, used to generate other elements in the group to build the entire encryption system.

[0078] Randomly select the master key component, denoted as , express The common parameters are calculated by group generators, and the corresponding calculation formula is:

[0079]

[0080] Then construct a multi-order polynomial to satisfy the master key component, that is, in this embodiment, construct Order polynomial satisfy , generating a polynomial commitment set, denoted as ; Among them, the polynomial commitment set refers to a set of polynomial commitments, and the polynomial commitments are used to ensure the security and reliability of the subsequent encryption and decryption process to avoid the deduction of sensitive information.

[0081] Step S12: Establish attribute, keyword and tag hash functions in sequence.

[0082] To clarify, a hash function refers to a collision-resistant hash function, which can convert input data of any length into an output value of a fixed length. The collision-resistant hash function is one-way, which means that the original data cannot be deduced from the hash value; and it is collision-resistant, which means that even if two different input data are found to have the same hash value, it is extremely difficult, that is, no corresponding collision pair can be found.

[0083] Specifically, the attribute hash function is used for policy hiding, denoted as ; The keyword hash function is used for searching, denoted as ; The label hash function is used for puncture, denoted as .

[0084] Step S13: The master key components, the public parameters corresponding to each master key component, the polynomial commitment set and the hash function are combined to generate the public parameters of the key generation center, and the master key is obtained based on the randomly selected master key components; that is, the public parameters are recorded as , 、 、 Represents a bilinear group structure The random element of the group; the master key is recorded as .

[0085] Furthermore, step S2 includes:

[0086] Step S21: Based on the attribute set submitted by the data user, the key generation center calculates the attribute hash sum according to the attribute hash function.

[0087] To clarify, an attribute set refers to an attribute collection, that is, a collection of multiple attributes, where an attribute refers to a user's basic information, behavioral characteristics, or other related data used to describe or identify an entity; in this embodiment, the attribute set is recorded as , Represents an element in an attribute set, Represents the number of elements in the attribute set; the attribute hash sum is calculated by the key generation center according to the attribute hash function, which is recorded as ; That is, attribute processing is completed for the attribute set.

[0088] Step S22: Generate a basic private key component based on the public parameters, the master key, and the attribute hash, and randomly select any element to be integrated with the basic private key component to form the user private key.

[0089] Specifically, the basic private key component is generated, and the corresponding calculation formula is:

[0090]

[0091]

[0092] in, 、 Both represent the basic private key components; 、 All represent random elements, that is, select the bilinear group structure The random element of the group is then integrated with the basic private key component to form the user's private key, which is recorded as .

[0093] Step S23: Obtain the initial puncture tag, combine the tag hash function through the polynomial commitment set, and integrate the initial puncture tag to output the puncture key.

[0094] To clarify, the initial puncture tag refers to a puncture tag, a special tag used to identify and verify data integrity in the field of information security, that is, a unique identifier used to identify specific data or information; the output puncture key, the corresponding calculation formula is:

[0095]

[0096] in, represents the puncture key, i.e. the initial puncture key, which represents the encryption key used for the first time; Represents a random element; Represents polynomial representations in polynomial commitment sets; represents the label hash function; Indicates the initial puncture tag.

[0097] It can be understood that encryption of plain text ensures that only legitimate users with the key can access and process the corresponding information data, so that the data owner can effectively protect the confidentiality and integrity of the data and prevent unauthorized access and tampering.

[0098] See also Figure 3 , further, step S3 includes:

[0099] Step S31: The data owner randomly selects and generates a random symmetric key, and uses a symmetric encryption algorithm to encrypt the plaintext to obtain the initial ciphertext.

[0100] To illustrate, the random symmetric key is recorded as , which is used to encrypt and decrypt data; then the plaintext is encrypted using a symmetric encryption algorithm, where a symmetric encryption algorithm refers to using the same key to encrypt and decrypt data. According to this encryption method, the sender and receiver must share the same key to correctly encrypt and decrypt the information; the plaintext is recorded as , the initial ciphertext is recorded as .

[0101] Step S32: Obtain the access policy, calculate the policy hash sum based on the attribute hash function combined with the access policy, and generate the ciphertext header.

[0102] To explain, access policy refers to the rules and conditions such as user authentication, permission level, time limit, etc. that are defined in advance to determine whether the corresponding user or device can access specific resources or data; in this embodiment, the access policy is recorded as , the policy hash sum is recorded as .

[0103] Furthermore, in step S32, a ciphertext header is generated, and the corresponding calculation formula is:

[0104]

[0105] in, Indicates the ciphertext header; 、 、 Both represent random elements in the bilinear group structure; represents the policy hash sum, represents the attribute hash function, Indicates the Access strategies, Indicates the total number of access policies; represents the group generator; Represents the matching operation in the bilinear group structure; Represents a random symmetric key.

[0106] As an optional implementation method, based on the set access policy, it is converted into a linear combination of attribute hash functions, hidden in the ciphertext, and a ciphertext header is generated and sent to the cloud server. Then, a match is made between the attribute hash value and the access policy hash value. If the match is successful, decryption can be performed to obtain the information corresponding to the ciphertext header; if the match fails, decryption fails, and the ciphertext cannot be decrypted, thereby ensuring the security and privacy of the data.

[0107] Step S33: Create a keyword set based on the data owner, and generate keyword components by encrypting the keywords in the keyword set.

[0108] To explain, a keyword set is established based on the data owner, which means the keyword set encrypted by the data owner itself, including various keywords related to the data content; and the keyword set is recorded as .

[0109] Furthermore, in step S33, a keyword component is generated, and the corresponding calculation formula is:

[0110]

[0111] in, Represents a keyword component; Represents the master key component; Represents a random element in a bilinear group structure; Represents a keyword hash function; Indicates the first Keywords.

[0112] Step S34: performing tag binding in combination with the tag hash function to generate a puncture tag component.

[0113] Furthermore, in step S34, a puncture label component is generated, and the corresponding calculation formula is:

[0114]

[0115] in, Indicates a puncture label component; represents a polynomial commitment set, represents a polynomial, represents the order of the polynomial; represents the label hash function; Indicates the tags.

[0116] Step S35: Integrate the initial ciphertext, ciphertext header, keyword component and puncture tag component to obtain the complete ciphertext and upload it to the cloud server; the complete ciphertext is recorded as .

[0117] It can be explained that, based on the acquisition of the complete ciphertext, the access policy is completely hidden in the ciphertext component, so that even if the attacker obtains the ciphertext, he cannot infer the permission structure.

[0118] See also Figure 4 ,Further, in step S4, the constraint condition is that the timestamp corresponding to the newly generated puncture key arrives or a security event occurs, and the security event includes any event of key leakage, data tampering, unauthorized access, system vulnerability exploitation and malware attack.

[0119] It can be explained that the timestamp refers to the timestamp corresponding to the puncture key that is regularly updated based on the time label, that is, regular updates are performed to ensure the stability of forward security. Among them, the update of the puncture key driven by the label can block the decryption of historical ciphertexts, and the time complexity of the overall update is relatively small, which is more efficient than the traditional scheme through the replacement of the global key. When the constraints are met, the puncture key is updated, that is, a new puncture key is regularly generated based on the timestamp or secure time, and updated, so that the updated puncture key cannot be deduced using the historical puncture key, avoiding the subsequent puncture key from being deduced by the previous version of the puncture key, thereby achieving and improving forward security.

[0120] Specifically, random elements are obtained based on the bilinear group structure, denoted as , to update the puncture key, the corresponding calculation formula is:

[0121]

[0122]

[0123] in, Indicates the updated puncture key; Indicates the corresponding updated user private key; Indicates the current user's private key, corresponding to represents a random element, 、 Both represent the basic private key components; Indicates the User private key; Represents the master key component; represents the group generator; represents a polynomial commitment set; represents the label hash function; Indicates the initial puncture tag; Indicates the updated puncture tag.

[0124] Furthermore, in step S5, specifically:

[0125] Establish a keyword set based on the data user’s needs, denoted as ;

[0126] Generate a trapdoor based on the keyword set combined with the user's private key and issue a search request. The corresponding calculation formula is:

[0127]

[0128] in, Indicates a trapdoor; represents the group generator; 、 Represents a random element in a bilinear group structure; Represents the basic private key component of the user's private key; Represents a keyword hash function; Indicates the first keyword in the keyword set established based on the data user's demand content. Keywords.

[0129] It is explained that a trapdoor is a cryptographic tool used to implement specific functions in an encryption system. In this embodiment, the generated trapdoor can ensure that only users with the corresponding public key can access or decrypt specific information, thereby improving data security and protecting user privacy. In this embodiment, trapdoors are generated based on keyword aggregation, so that when searching, Keyword searches require only one index operation and The efficiency of the multiplication is greatly improved compared with the corresponding multiple exponential operations of the traditional solution.

[0130] See also Figure 5 , further, step S6 includes:

[0131] Step S61: Segment processing is performed based on the complete ciphertext. In the cloud server, the trapdoor is matched with the segmented complete ciphertext through a bilinear group structure to obtain a matching result.

[0132] Preferably, in this embodiment, the complete ciphertext is divided into 8 parts, It refers to the process of segmenting the ciphertext to enhance its security. In the subsequent decryption process, each segment of the ciphertext needs to be obtained to correctly interpret the entire ciphertext, thereby improving security and reliability.

[0133] Specifically, the trapdoor is matched with the complete ciphertext after segmentation through the bilinear group structure, that is, the cloud server is used to verify whether the two are true. The corresponding calculation formula is:

[0134]

[0135] in, Represents the matching operation in the bilinear group structure; 、 、 They represent the 5th, 6th, and 7th segments of the complete ciphertext respectively; 、 、 They all represent trapdoor components, corresponding to the three components in the trapdoor component, namely for ; for ; for .

[0136] When the equations hold, the match is successful, indicating that the keyword set corresponding to the trapdoor can find the corresponding content in the ciphertext, and then return the matching result to obtain the corresponding ciphertext; conversely, when the equations do not hold, it means that the search has failed.

[0137] Step S62: Check whether the ciphertext tags corresponding to the matching results have not been punctured. If so, restore the data based on the updated puncture key and the keyword set formed by the data user's required content.

[0138] To explain, in this embodiment, the ciphertext tag is not equivalent to the puncture tag. The ciphertext tag usually contains the identifier of the encrypted information; the puncture tag is used to mark whether the data has been accessed or modified. First, the puncture verification is performed, that is, verifying whether the ciphertext tag has not been punctured and whether the ciphertext tag does not belong to the puncture key, that is, ; and ensure that the ciphertext tags are in an unpunctured state to ensure the integrity and security of the data.

[0139] Furthermore, in step S62, the corresponding calculation formula is:

[0140]

[0141] in, Indicates the recovered puncture key; Represents the matching operation in the bilinear group structure; A set of keywords representing the content formed by data user needs The Keywords; Indicates the first segment in the complete ciphertext; Indicates that the 8th segment in the complete ciphertext contains elements; Indicates the User private key, corresponding to represents a random element, 、 Both represent the basic private key components.

[0142] Step S63: Decrypt the symmetric key according to the recovered puncture key, and decrypt the initial ciphertext using the symmetric key to obtain the corresponding plaintext.

[0143] Furthermore, in step S63, the corresponding calculation formula is:

[0144]

[0145] in, Represents a symmetric key; Indicates the recovered puncture key; 、 、 Respectively represent the second, third, and fourth segments of the complete ciphertext; Represents the matching operation in the bilinear group structure; Represents the basic private key component of the user's private key; Represents a random element in a bilinear group structure.

[0146] Specifically, by decrypting the symmetric key, and then using the decrypted symmetric key to decrypt the initial ciphertext , that is, through the decryption recovery process, the originally chaotic and disordered data is restored into original, readable information, ensuring efficiency and speed while ensuring the integrity and confidentiality of the data.

[0147] Understandably, encryption is performed in combination with the puncture key to ensure that the key generated by each puncture tag cannot be reversibly deduced to the future state. Even if a version of the key is leaked, it cannot be used to decrypt the ciphertext at other time points to ensure forward security; trapdoors are generated through keyword sets to support multi-keyword joint queries. The cloud server completes the logical matching by matching the trapdoor with the complete ciphertext without linearly traversing all keywords; symmetric encryption, policy hidden encryption, keyword encryption and label binding are performed on the plaintext in sequence, so that the access policy does not appear directly in the ciphertext, and can only be correctly decrypted under the premise of meeting the policy, effectively preventing the leakage of policy information; and the components of the complete ciphertext are independent of each other, and the volume of the complete ciphertext as a whole does not increase with the number of keywords or the complexity of the access policy; at the same time, the parameters of the overall operation and the subsequent matching operations are in a fixed range, with constant computing and communication overhead, which is suitable for edge devices or low-power scenarios.

[0148] For better explanation, the forward-secure policy-hidden attribute-based keyword search method proposed in this application is suitable for medical data sharing systems and enterprise document management systems; that is, the overall solution uses complete ciphertext and label management of constant size to adapt to resource-constrained IoT devices and meet enterprise-level large-scale key revocation requirements. The high-throughput retrieval achieved in the medical data sharing prototype test provides an encrypted retrieval solution for enterprise sensitive data that is both highly secure and practical.

[0149] Specifically, in the medical data sharing system, the attribute set corresponds to research institutes, oncology disciplines, etc.; the access strategy corresponds to having "tumor research permissions" and "third-level certification qualifications", etc.; and the keyword set corresponds to "breast cancer", "imaging data", etc.; based on the initial data, the hidden attribute-based keyword search method proposed in this application is used to encrypt and decrypt medical data to ensure the privacy and security of patients. At the same time, medical personnel can also obtain the corresponding plaintext medical data to improve research and treatment effects.

[0150] Furthermore, in the enterprise document management system, employees from different departments need to access or retrieve various documents stored in the cloud, such as contracts, design plans, personnel files, etc. In order to ensure the secure access and efficient management of sensitive data, a policy-hidden attribute-based keyword search method is used to process them; the difference is that in the enterprise document management system, a centrally managed tag pool mechanism is used to drive the update of the puncture key. It can be understood that multiple random tags are pre-generated and recorded as , It represents the number of random tags and is stored in the master key. Each random tag corresponds to a possible future puncture key update event, such as employee resignation. In particular, all tags in the tag pool are verified by the tag hash function to ensure global uniqueness.

[0151] Specifically, in the enterprise document management system, the attribute set submitted by the data user is the employee's department and position information, such as the finance department, audit specialist, etc., and the puncture key is generated using unused tags in the tag pool, and then the puncture key is transmitted to the employee terminal through a secure channel; when each business department uploads a document, the corresponding access policy is set to the finance department manager, audit specialist, etc., and the access policy is always embedded in the ciphertext in the form of attribute hash sum, and the keyword set is determined to be budget, salary, and year-end bonus, and then the data is encrypted and uploaded; when an employee wants to search, multiple keywords such as audit report and annual budget are set, integrated into a keyword set, and trapdoor information is generated to issue a search request for index matching; if a security incident such as employee resignation occurs, another unused tag is allocated from the tag pool to update the puncture key, and the current tag is marked as used, so that all old ciphertext data containing the tag is automatically invalidated, that is, the update of the puncture key satisfies irreversibility; when the match is successful, the qualified ciphertext set is obtained after verification, and decrypted and restored to obtain the corresponding plaintext data; it can be understood that the policy-hidden attribute-based keyword search method is used in the enterprise data management system, which can effectively realize the encryption retrieval access mechanism with clear permissions and controllable policies, and enhance the system's anti-attack capability through forward security attributes, thereby improving the security and compliance of enterprise data operation and maintenance.

[0152] It should be noted that the order in which the embodiments of the present invention are described above is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0153] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

Claims

1. A forward-secure, policy-hidden attribute-based keyword search method for access control and search of sensitive information, characterized by: Including a key generation center, a data owner, a cloud server and a data user, the method includes: Set parameters through the key generation center and obtain public parameters and master keys; The key generation center attributes the attribute set submitted by the data user, constructs the user's private key based on the public parameters and the master key, and outputs the puncture key; The data owner randomly selects a symmetric key and symmetrically encrypts the plaintext with the symmetric key to obtain the initial ciphertext. The plaintext is then encrypted using policy hiding, keyword encryption, and label binding to obtain the corresponding output representation. The initial ciphertext and output representation are combined to obtain the complete ciphertext and uploaded to the cloud server. Set constraints and update the puncture key when the constraints are met; Establish a keyword set based on the data user's needs, generate a trapdoor based on the keyword set and the user's private key, and initiate a search request; The cloud server matches the trapdoor with the complete ciphertext according to the search request, obtains the matching result, and decrypts the initial ciphertext with the updated puncture key and the user's private key to obtain the corresponding plaintext.

2. A forward-secure, policy-hidden attribute-based keyword search method according to claim 1, characterized in that: Set parameters through the key generation center and obtain public parameters and master keys, including: A bilinear group structure and group generator are generated through the key generation center, and a master key component is randomly selected. The public parameters corresponding to each master key component are calculated based on the group generator. A multi-order polynomial is defined to satisfy the master key component, and a polynomial commitment set is generated. Establish attribute, keyword and tag hash functions in turn; The master key components, the public parameters corresponding to each master key component, the polynomial commitment set and the public parameters of the key generation center are generated by the hash function, and the master key is obtained based on the randomly selected master key components.

3. A forward-secure, policy-hidden attribute-based keyword search method according to claim 2, characterized in that: The key generation center attributes the attribute set submitted by the data user, constructs the user's private key based on the public parameters and the master key, and outputs the puncture key, including: Based on the attribute set submitted by the data user, the key generation center calculates the attribute hash sum according to the attribute hash function; The master key and attribute hash are combined based on the public parameters to generate the basic private key component, and any element is randomly selected and integrated with the basic private key component to form the user's private key; Get the initial puncture tag, combine it with the tag hash function through the polynomial commitment set, and integrate the initial puncture tag to output the puncture key.

4. A forward-secure, policy-hidden attribute-based keyword search method according to claim 2, characterized in that: The data owner randomly selects a symmetric key and symmetrically encrypts the plaintext with the symmetric key to obtain the initial ciphertext. The plaintext is then subjected to policy-hidden encryption, keyword encryption, and label binding to obtain the corresponding output representation. The initial ciphertext and output representation are combined to obtain the complete ciphertext, which is then uploaded to the cloud server, including: The data owner randomly selects and generates a random symmetric key, and uses a symmetric encryption algorithm to encrypt the plaintext to obtain the initial ciphertext; Obtain the access policy, calculate the policy hash sum based on the attribute hash function combined with the access policy, and generate the ciphertext header; Establish a keyword set based on the data owner, and generate keyword components through keyword encryption of the keyword set; Combine the label hash function to perform label binding to generate the puncture label component; The initial ciphertext, ciphertext header, keyword component and puncture tag component are integrated to obtain the complete ciphertext and uploaded to the cloud server.

5. A forward-secure, policy-hidden attribute-based keyword search method according to claim 4, characterized in that: Generate the ciphertext header, the corresponding calculation formula is: ； in, Indicates the ciphertext header; 、 、 Both represent random elements in the bilinear group structure; represents the policy hash sum, represents the attribute hash function, Indicates the Access strategies, Indicates the total number of access policies; represents the group generator; Represents the matching operation in the bilinear group structure; represents a random symmetric key; Generate keyword components, the corresponding calculation formula is: ； in, Represents a keyword component; Represents the master key component; Represents a random element in a bilinear group structure; Represents a keyword hash function; Indicates the first Keywords; Generate puncture label components, the corresponding calculation formula is: ； in, Indicates a puncture label component; represents a polynomial commitment set, represents a polynomial, represents the order of the polynomial; represents the label hash function; Indicates the tags.

6. A forward-secure, policy-hidden attribute-based keyword search method according to claim 2, characterized in that: The constraint condition is that the timestamp corresponding to the newly generated puncture key arrives or a security event occurs, and the security event includes any one of key leakage, data tampering, unauthorized access, system vulnerability exploitation and malware attack.

7. A forward-secure, policy-hidden attribute-based keyword search method according to claim 2, characterized in that: A keyword set is established based on the data user's needs. A trapdoor is generated based on the keyword set and the user's private key, and a search request is initiated. Specifically: Establish a keyword set based on the data user’s needs, denoted as ; Generate a trapdoor based on the keyword set combined with the user's private key and issue a search request. The corresponding calculation formula is: ； in, Indicates a trapdoor; represents the group generator; 、 Represents a random element in a bilinear group structure; Represents the basic private key component of the user's private key; Represents a keyword hash function; Indicates the first keyword in the keyword set established based on the data user's demand content. Keywords.

8. A forward-secure, policy-hidden attribute-based keyword search method according to claim 3, characterized in that: The cloud server matches the trapdoor with the complete ciphertext based on the search request, obtains the matching result, and decrypts the initial ciphertext with the updated puncture key and the user's private key to obtain the corresponding plaintext, including: Based on the complete ciphertext, segmentation processing is performed. In the cloud server, the trapdoor is matched with the segmented complete ciphertext through the bilinear group structure to obtain the matching result; Check whether the ciphertext labels corresponding to the matching results have not been punctured. If so, restore the data based on the updated puncture key and the keyword set formed by the data user's requirements. The symmetric key is decrypted according to the recovered puncture key, and the initial ciphertext is decrypted using the symmetric key to obtain the corresponding plaintext.

9. A forward-secure, policy-hidden attribute-based keyword search method according to claim 8, characterized in that: Based on the updated puncture key, the keyword set formed by combining the data user demand content is restored. The corresponding calculation formula is: ； in, Indicates the recovered puncture key; Represents the matching operation in the bilinear group structure; A set of keywords representing the content formed by data user needs The Keywords; Indicates the first segment in the complete ciphertext; Indicates that the 8th segment in the complete ciphertext contains elements; Indicates the User private key, corresponding to represents a random element, 、 Both represent the basic private key components.

10. A forward-secure, policy-hidden attribute-based keyword search method according to claim 8, characterized in that: Decrypt the symmetric key using the recovered puncture key, and decrypt the initial ciphertext using the symmetric key to obtain the corresponding plaintext. The corresponding calculation formula is: ； in, Represents a symmetric key; Indicates the recovered puncture key; 、 、 Respectively represent the second, third, and fourth segments of the complete ciphertext; Represents the matching operation in the bilinear group structure; Represents the basic private key component of the user's private key; Represents a random element in a bilinear group structure.

Images