Multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control

Abstract

The invention discloses a multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control. A system applied to the method comprises a cloud server, an authority, at least one data owner and at least one data user. The authority center is in communication connection with the data owner, the cloud server and the data user, and the cloud server is in communication connection with the data owner and the data user; according to the method, an access control technology and a multi-keyword encryption technology are deeply fused, and it is ensured that returned data is only limited to the content which a user has access to, so that the privacy of an encrypted file is protected. According to the method, access permission and keyword encryption can be processed at the same time so as to ensure that the cloud server accurately locates the content which the user has access to in the ciphertext retrieval process, and verification of correctness and integrity of the returned search result can be supported.

Description

Technical Field

[0001] The present invention relates to data security fields such as data ciphertext retrieval and access control, and in particular to a multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control. Background Art

[0002] With the development of the Internet of Things (IoT) and big data technologies, data volumes are exploding. Traditional local storage and computing models are increasingly facing performance bottlenecks and scalability issues when processing large amounts of data. Cloud computing, with its powerful computing capabilities and elastic resources, has become a key infrastructure supporting data outsourcing. To prevent privacy leaks, users often encrypt sensitive data before uploading it to cloud servers.

[0003] Early research often employed single-keyword indexing. While computationally efficient, this approach is prone to index duplication when dealing with large amounts of data, resulting in a large number of irrelevant results. This significantly reduces retrieval efficiency and accuracy while also exacerbating the risks of keyword guessing attacks and privacy leaks. Attribute-based searchable encryption (ABSE), an innovative solution that combines searchable encryption (SE) with attribute-based encryption (ABE), holds great promise for enabling access control and searchability for encrypted data. However, keyword search and attribute-based access control are handled as two separate processes, increasing server storage and computational pressure while also reducing overall processing efficiency. Furthermore, cloud service providers (CSPs), motivated by their own interests, such as conserving computational or storage resources, may intentionally return incomplete or fabricated search results, compromising data integrity and weakening the overall credibility of the system.

[0004] Most existing attribute-based encryption (ABE) schemes suffer from high computational overhead during encryption and decryption, making them difficult to adapt to resource-constrained scenarios like the Industrial Internet of Things. Furthermore, when users store encrypted data on cloud servers and delegate search queries to them, the reliability of these searches is questionable, as cloud servers are generally untrustworthy, exposing data security to risks such as leakage and tampering. Summary of the Invention

[0005] Aiming at the problems existing in existing encryption retrieval schemes, such as low keyword matching accuracy, unverifiable results, and separation of access control and retrieval process, the present invention proposes a multi-keyword verifiable ciphertext retrieval method that supports fine-grained access control.

[0006] The system used by the method includes a cloud server, an authority, at least one data owner, and at least one data user; the authority center is in communication with the data owner, the cloud server, and the data user, and the cloud server is in communication with the data owner and the data user; the method includes the following steps:

[0007] Step 1: The authoritative center uses the predetermined security parameters and global attribute set to generate the system's global public parameters and system master key, and generates user keys for each data user; each data user has user attributes;

[0008] Step 2: The data owner extracts a predetermined number of keywords for each document they own, sets an access policy, and selects a secret value. These keywords form a keyword set. The data owner executes an index encryption algorithm and outputs the index ciphertext corresponding to the keyword set. The data owner executes a ciphertext encryption algorithm and outputs the document ciphertext, document identifier ciphertext, index document list ciphertext, and message verification tag. The data owner executes a key encryption algorithm and outputs the key ciphertext. Finally, the data owner sends the output results to the cloud server.

[0009] Step 3: The data user generates a query trapdoor, a pre-decryption key, and a decryption key for subsequent decryption, and sends the query trapdoor and pre-decryption key to the cloud server;

[0010] Step 4: The cloud server matches the query trapdoor with the index ciphertext. If the match is successful, the pre-decryption key is used to pre-decrypt the key ciphertext; otherwise, the pre-decryption operation is not performed. During the pre-decryption operation, the cloud server determines whether the user attributes contained in the pre-decryption key can match the access policy. If the match is successful, the pre-decryption result is calculated; otherwise, the pre-decryption is terminated. Finally, the cloud server sends the successfully matched document ciphertext and the pre-decryption result to the data user.

[0011] The beneficial effects of the present invention are:

[0012] 1. It can simultaneously process access rights and keyword encryption, ensuring that the cloud server accurately locates the content that users are authorized to access during ciphertext retrieval. It also supports the correctness and integrity verification of returned search results. This also reduces computing overhead, improves retrieval efficiency, and ensures the privacy of ciphertext data and the security of access control.

[0013] 2. We designed an index structure that integrates access control strategies and multiple keywords, and constructed a trapdoor structure that combines user attributes and multiple keywords, so that the cloud server can simultaneously verify keywords and access rights, thereby accurately locating the encrypted data accessible to users.

[0014] 3. A search result verification mechanism is introduced to support search result verification. A message authentication code (MAC)-based structure is designed to calculate the MAC and perform an XOR operation on the relevant data, effectively preventing the cloud server from returning incomplete or forged results and improving the system credibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1This is a schematic diagram of the system model used in the present invention and the interaction between its parts. DETAILED DESCRIPTION

[0016] The design concept of this invention is to deeply integrate access control technology with multi-keyword encryption technology to ensure that the returned data is limited to content that the user is authorized to access, thereby protecting the privacy of encrypted files. In addition, a message authentication code (MAC)-based structure is designed to verify the integrity and correctness of the returned results. A detailed explanation is provided below.

[0017] First, the system structure to which this method is applied is described.

[0018] like Figure 1 The figure shows the system model used in the method described in this invention. The system primarily consists of four entities: data owners (DOs), cloud servers (CSs), data users (DUs), and data authorities (TAs). The authority communicates with data owners, cloud servers, and data users. The cloud servers communicate with data owners and data users.

[0019] The authority is responsible for generating global system parameters and user attribute keys. This authority is typically a trusted third party. In practice, the trusted third party can be selected based on the application scenario, such as a government security service center or a medical institution's own security department.

[0020] The data owner is responsible for constructing the index, encrypting the data, generating the message authentication tag, etc., and uploading the relevant ciphertext data to the cloud server.

[0021] The cloud server is responsible for storing data, performing search and matching operations, and helping data users perform pre-decryption operations.

[0022] The data user is responsible for generating query trapdoors and transformation keys, performing verification operations, and decrypting the final data.

[0023] The specific steps of the multi-keyword verifiable ciphertext retrieval method run by the above system are as follows:

[0024] Step 1: The authoritative center uses the predetermined security parameters and global attribute set to generate the system global public parameters and system master key, and generates the user attribute key for each data user; each data user has user attributes.

[0025] Methods for system global public parameters and system master key: . () is the system setting algorithm function. The setting algorithm is executed by TA. Input security parameter λ and global attribute set , , output system global public parameters and the system master key . N is the total number of attributes in the attribute set.

[0026] The security parameter λ is selected after measuring the difficulty of cracking the encryption system in practice. TA selects a prime order of The multiplicative cyclic group of and , and order for The generator of . Given a bilinear map , and define a set of hash functions . Where P is a prime number, is a set of reversible elements modulo p. For each attribute (i is the attribute number here, ), TA randomly selects , and calculate Then, TA randomly selects , and set the master key Finally, calculate , and set the system global public parameters .

[0027] The method to generate the corresponding user attribute key for DU is: . () is the key generation function, whose input is the system global public parameter , System Master Key , attribute set of data users , the output is the user attribute key .

[0028] Specifically: Assume that the attribute set of the data user is , TA selects the corresponding attribute according to the attribute number i in the attribute set . Then, TA selects a random number , , and generate four sub-keys to form the key, the four sub-keys are , are calculated as follows: .

[0029] After the calculation is completed, TA will use the user attribute key Sent to data users.

[0030] Step 2: DO extracts k keywords for each document it owns, with the value of k defined by DO. When encrypting a document, DO generates a symmetric key for the document and encrypts each document in the same document collection as its index; this symmetric key is then encrypted under the access policy. DO also generates an encryption list and a message authentication tag for the document collection list, which data users can subsequently verify for integrity and correctness. DO outsources the index ciphertext, document ciphertext, document identification ciphertext, index document list ciphertext, and message authentication tag to CS for storage.

[0031] The access policy is represented as an access structure , where M is The access matrix of ×n defines the linear relationship between attributes, and ρ is the mapping function used to associate each row of the matrix with the attribute defined in the system. The access policy structure is used to describe the set of attributes that must be satisfied for access to ciphertext data.

[0032] The encryption algorithm is: . () is the encryption function. The encryption algorithm is executed by DO. Encryption is divided into three steps: index encryption, ciphertext encryption, and key encryption. The output is the index ciphertext, document ciphertext, document identifier ciphertext, and key ciphertext. The following describes each algorithm separately.

[0033] a) Index encryption algorithm: Input is the system global public parameter ,document Keyword collection , access policy ,DO output document index Assume that the document is a document owned by the data owner, where Indicates the users, Indicates the The user's files, , the data owner has for each document Select Keywords DO set access policy for this document and choose a secret value ,Then, the data owner executes the index encryption algorithm , for the Multi-keyword set of keywords Generate encrypted index, calculate . Is a set of global properties defined from the system A subset selected from . To encrypt the index and embed whether the user meets the access policy of certain encrypted data. Finally, the data owner generates a multi-keyword index ciphertext . is a mapping function that maps each row of the access matrix M to a global attribute set The corresponding attributes. Indicates the attribute corresponding to the i-th row, that is, the specific attribute bound to the row in the access policy.

[0034] b) Ciphertext encryption algorithm: In this algorithm, DO uses a symmetric key Encrypt the document list with the same document index, input document and its document identification , output ciphertext document and ciphertext document identification and symmetric keys At the same time, DO also generates the index document list ciphertext and message authentication code for subsequent integrity and correctness verification.

[0035] To prevent the adversary from learning the size of the document lists, we fill the short lists with zeros so that all document lists correspond to the same number of document identifiers, which can be written as . Among them, Lw is the document list, The document identifier for a document list with the same DO index. Padding is the list padding symbol, which can prevent the adversary from guessing the document index and keywords based on the list length through guessing or attack. The data owner uses the pseudo-random function PRF to generate a verification key. , which is bound to the symmetric key of the encrypted document and keyword sets The data owner uses the verification key to encrypt the index document list and generate the index document list ciphertext , and generates a message authentication tag to ensure the integrity and correctness of the returned result. The message authentication tag generation algorithm is as follows: HMAC is a hash-based message authentication code.

[0036] c) Key encryption algorithm: :Key encryption algorithm input system global public parameters ( ), symmetric key ( ), access policy , DO outputs key ciphertext .

[0037] Data owners are randomly selected , and set the vector Shared secret value Next, for Each number is The data owner randomly selects , and the document key Execute encryption algorithm ,calculate , , , DO generates the key ciphertext of the document .

[0038] Finally, the data owner will index the ciphertext ,document , Document identification ciphertext 、Key ciphertext , index document list ciphertext and message authentication tags Send to the cloud server.

[0039] Step 3: The data user generates a query trapdoor (TD), a pre-decryption key, and a decryption key for subsequent decryption, and sends the query trapdoor and pre-decryption key to the cloud server.

[0040] The query algorithm formula is: . The query algorithm is mainly divided into two processes: the query trap generation process and the user attribute key conversion process.

[0041] a) Query trapdoor generation process: The formula used is: Input is the system global public parameter ( ), user attribute key ( ), the query keyword set ( ), output query trapdoor ( ).

[0042] Data users enter the keywords they want to query and randomly select DU executes the trapdoor generation algorithm and calculates .

[0043] 、 、 、 Four elements make up a TD.

[0044] b) User attribute key conversion process: The key conversion formula used is: Input the user attribute key, DU converts it to generate a pre-decryption key for CS to perform partial decryption ( ), and a decryption key for subsequent decryption by DU ( ).

[0045] DU random selection DU will use the user attribute key ( ) into a pre-decrypted key ( ), and As the subsequent decryption key of DO. DU calculates the pre-decryption key : , ,

[0046] Finally, data users will and the pre-decryption key Send to the cloud server.

[0047] Step 4: The cloud server matches the query trapdoor with the index ciphertext. If the match is successful, the pre-decryption key is used to pre-decrypt the key ciphertext (partial decryption). Otherwise, the pre-decryption operation is not performed. During the pre-decryption operation, the cloud server determines whether the user attributes contained in the pre-decryption key can match the access policy. If the match is successful, the pre-decryption result is calculated; otherwise, the pre-decryption is terminated. Finally, the cloud server sends the successfully matched document ciphertext and the pre-decryption result to the data user.

[0048] The search operation formula is Input document index and query trap, CS determines whether it meets the search conditions, if so, it performs subsequent pre-decryption operations; if not, the algorithm terminates and outputs Success means the match is successful, and the next step is to proceed to the pre-decryption operation. Indicates that the match failed.

[0049] When the cloud server receives a query trapdoor from a data user, CS matches it with the document index previously stored by the data owner. CS computes If this formula is true, the match is successful, and CS uses the pre-decrypted key to perform partial decryption. If this formula is not true, the match fails, and CS returns To data users.

[0050] The pre-decryption algorithm formula is . Input is key ciphertext , the pre-decrypted key .

[0051] The cloud server uses the pre-decrypted key right Perform partial decryption. CS needs to determine the pre-decryption key Included user attributes Whether the access policy can be matched If there is no match, the pre-decryption is aborted and the To the data user. If it matches, then for , we can find a set of constants , making ,calculate To recover the shared secret value. Then, CS calculates the pre-decryption result: , ,

[0052] Finally, CS will match the successful document ciphertext And the result of pre-decryption Sent to data users.

[0053] Preferably, step five is also included.

[0054] Step 5: The DU decrypts the result returned in step 4 and verifies the integrity and correctness of the returned result.

[0055] The decryption algorithm is: . Enter the decryption key and partial key ciphertext , output symmetric key DU uses symmetric keys Can decrypt the document .

[0056] After receiving the pre-decryption result sent by CS, the data user uses its decryption key Decrypt the document key .

[0057] ;

[0058] DU can use document key Decrypt document ciphertext using symmetric encryption algorithm , get the plaintext document to be queried , completing the retrieval process.

[0059] The correctness verification algorithm is The verification algorithm is executed by DU. Input the symmetric key And the query keyword set , generate verification key , decrypt the encrypted document list And return results Verify the correctness of the comparison. At the same time, DU generates With CS returned Perform comparative integrity verification.

[0060] The correctness verification is achieved by binding the symmetric key to the query keyword set. The verification key generated by the DU is associated with the target keyword. If the CS does not perform the search according to the DU's request, the document list cannot be correctly decrypted; if the CS performs the search according to the DU's request, the document list can be correctly decrypted. Subsequently, the DU compares the returned results. And the decrypted document list , verify whether the returned results actually match the search criteria. If there are mismatches, it means that the server returned invalid or incorrect data.

[0061] The verification formula for the correctness of the search result list returned by subsequent verification is: , , Where F is a pseudo-random function and dec is a decryption function.

[0062] List of document identities , calculate its overall message authentication code ; For each document identity Independently generate a local message authentication code: Aggregate all message authentication codes through XOR (⊕) operation to generate a global integrity tag. Then add the message authentication tag generated by DU to With CS returned Compare them. If they are equal, the integrity verification is passed; if they are not equal, the integrity verification fails.

[0063] Message authentication tags The calculation formula is:

[0064] Message authentication tags With CS returned The comparison formula is: .

Claims

1. A multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control, characterized in that: The system used by the method includes a cloud server, an authority, at least one data owner, and at least one data user; the authority center is in communication with the data owner, the cloud server, and the data user, and the cloud server is in communication with the data owner and the data user; the method includes the following steps: Step 1: The authoritative center uses the predetermined security parameters and global attribute set to generate the system's global public parameters and system master key, and generates user keys for each data user; each data user has user attributes; Step 2: The data owner extracts a predetermined number of keywords for each document they own, sets an access policy, and selects a secret value. These keywords form a keyword set. The data owner executes an index encryption algorithm and outputs the index ciphertext corresponding to the keyword set. The data owner executes a ciphertext encryption algorithm and outputs the document ciphertext, document identifier ciphertext, index document list ciphertext, and message verification tag. The data owner executes a key encryption algorithm and outputs the key ciphertext. Finally, the data owner sends the output results to the cloud server. Step 3: The data user generates a query trapdoor, a pre-decryption key, and a decryption key for subsequent decryption, and sends the query trapdoor and pre-decryption key to the cloud server; Step 4: The cloud server matches the query trapdoor with the index ciphertext. If a match is successful, the pre-decryption key is used to pre-decrypt the key ciphertext. Otherwise, the pre-decryption operation is not performed. During the pre-decryption operation, the cloud server determines whether the user attributes contained in the pre-decryption key can match the access policy. If the match is successful, the pre-decryption result is calculated; otherwise, the pre-decryption is terminated. Finally, the cloud server sends the successfully matched document ciphertext and the pre-decryption result to the data user.

2. A multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control as claimed in claim 1, characterized in that: In step 1, the method for the system global public parameters and system master key is: ; () is the setting algorithm function, λ is the security parameter, is a set of global attributes, ; Choose the prime order to be The multiplicative cyclic group of and , and order for Generator of; given a bilinear map , and define a set of hash functions ; Where P is a prime number, is a set of reversible elements modulo p; for each attribute , random selection by the authority center , and calculate , ); Random selection by the authoritative center , and set the master key ; Finally, calculate , computing system global public parameters ; The method of generating corresponding user keys for data users is as follows: Assume that the attribute set of the data user is The authority center selects the corresponding attribute according to the attribute number i in the attribute set. , then the authority center selects a random number , , and generate four subkeys of the user key , are calculated as follows: ； The authority center will send the user key Send to the corresponding data user.

3. A multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control as claimed in claim 2, characterized in that: In step 2, assume that the data owner has a document , here Indicates the number of the data owner. Indicates the The data owner's files, s is the document The secret value corresponding to the access policy, which is an access structure , the M is ×n access matrix, ρ is the mapping function, represents the number of attributes involved in the access policy structure, and n represents the dimension of the vector space.

4. A multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control as claimed in claim 3, characterized in that: In step 2, the document is The corresponding k keyword set W= Generate index ciphertext specifically as follows: Calculate ; Index ciphertext From the global property set A subset selected from Encrypt the index and embed the data to determine whether the user meets the access policy for certain encrypted data. Indicates accessing the attribute corresponding to the i-th row of the matrix M.

5. A multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control as claimed in claim 4, characterized in that: In step 2, in the key encryption algorithm, the data owner uses the symmetric key generated when encrypting the document Document and its document identification Encrypt and output document ciphertext and document identification ciphertext ; The method for generating the ciphertext of the index document list is as follows: the data owner DO uses a pseudo-random function to generate a verification key: , and use the verification key to encrypt the index document list to generate the index document list ciphertext ;The message authentication tag generation algorithm is as follows: Lw is a document list, and HMAC is a hash-based message authentication code.

6. A multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control as claimed in claim 5, characterized in that: In step 2, the key ciphertext is generated by: the data owner randomly selects , and set the vector Shared secret value , for each number in the global attribute set The data owner randomly selects , and the symmetric key for the document Execute encryption algorithm ,calculate , , , , key ciphertext .

7. A multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control as claimed in claim 6, characterized in that: Step 3 includes querying the trapdoor generation process and the user key conversion process; The query trap generation process is as follows: the data user enters the keyword to be queried, and randomly selects , the data user executes the trapdoor generation algorithm and calculates ； 、 、 、 Construct query trapdoor TD; The user key conversion process is as follows: Data users randomly select , the user key Convert to pre-decrypted key , and As the subsequent decryption key, calculate the pre-decryption key The specific method is: ， ， ， Constitutes the pre-decryption key ; Data users will be trapped and the pre-decryption key Send to the cloud server.

8. A multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control as claimed in claim 7, characterized in that: In step 4, the cloud server performs the search operation as follows: When the cloud server receives the query trap When the cloud server compares it with the data previously stored by the data owner Matching, cloud server computing If this formula is true, it proves that the match is successful, and the cloud server uses the pre-decrypted key to perform partial decryption operations. If this formula is not true, it proves that the match fails, and the cloud server returns To data users.

9. A multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control as claimed in claim 8, characterized in that: In step 4, the cloud server performs pre-decryption in the following way: the cloud server receives the pre-decryption key sent by the data user Afterwards, use the pre-decrypted key right Perform partial decryption, and the cloud server determines the pre-decryption key Included user attributes Whether the access policy can be matched If there is no match, the pre-decryption is aborted and the to the data user; if a match is found, , find a set of constants , making ,calculate To recover the shared secret value, the cloud server calculates the pre-decryption result: ， ， 。 10. A multi-keyword verifiable ciphertext retrieval method supporting fine-grained access control according to any one of claims 1 to 9, characterized in that: The process also includes step five: the data user performs a decryption operation based on the result returned in step four to obtain the plaintext document to be queried, and verifies its integrity and correctness.

Images