Multi-user secret state retrieval method supporting mode leakage regulation and dynamic authority management

Abstract

The invention discloses a multi-user secret state retrieval method supporting mode leakage regulation and dynamic authority management, and belongs to the technical field of computer application. Comprising the following steps: S1, initializing a method, and generating an encryption key, private information and auxiliary information of each user by a trusted authorization mechanism by using a key generation algorithm KeyGen; s2, the user locally determines the confusion intensity; s3, locally analyzing the index information by the user; s4, locally confusing index information by the user; s5, uploading fragment information, encrypting fragment content and a security index by a user, and uploading the fragment content and the security index to a cloud server for storage; s6, sending a query request; s7, searching data by the user; s8, decrypting the search result; s9, updating the user permission; according to the method, the dynamic access control of the user permission can be efficiently realized, and meanwhile, the problem of privacy degradation caused by user privacy level preference is effectively relieved in a cross-user data search process, so that a higher security requirement in a complex application scene is met.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of computer application, and particularly relates to a multi-user ciphertext retrieval method supporting mode leakage regulation and dynamic permission management. BACKGROUND

[0002] Searchable Symmetric Encryption (SSE) is a typical ciphertext retrieval technology, and the core idea is to encrypt data and generate a secure index through symmetric encryption, allowing users to search encrypted data without decrypting the data, and realizing the "useful but invisible" of data. At present, the symmetric searchable encryption technology is widely used in cloud storage, data sharing, medical treatment and finance and other fields.

[0003] However, although the SSE scheme can effectively prevent the server from directly obtaining the data content and the query keyword, and ensure the data and query privacy, in order to improve the query performance, most schemes still inevitably leak some "seemingly acceptable information". Typical leakage forms include: (a) search pattern, identifying the same queries in the search request sequence; (b) access pattern, revealing the document identifier set matched with the query; (c) size pattern, reflecting the number of documents contained in the search result. These seemingly harmless leakage information may be maliciously used to launch leakage abuse attacks, recover the query keyword, and even reconstruct the database record.

[0004] At present, there are various protection mechanisms that can alleviate the above-mentioned mode leakage, and the mainstream methods include: (a) a protection mechanism based on cryptography, such as ORAM, Fully Homomorphic Encryption (FHE) and Function Secret Sharing (FSS) and other technologies to realize mode protection. However, these mechanisms usually have high computing and communication overhead, and are difficult to be directly applied to large-scale data processing. (b) a protection scheme based on differential privacy (Differential Privacy, DP), which adds noise to introduce false positive and false negative responses to confuse the query result to efficiently hide the mode leakage. Strong noise injection will significantly affect the query accuracy, but due to its high efficiency and flexibility, it is widely studied.

[0005] Existing protection schemes using differential privacy technology mainly focus on the pattern leakage problem in single-user scenarios. In real-world applications, it is more common for multiple users to upload local encrypted data to a cloud server and search each other's data. Although these schemes can be extended to a multi-user environment in theory, directly migrating single-user schemes in practical applications will face many challenges, such as key isolation decryption difficulties, privacy degradation, search accuracy decline, and complex permission management. Existing multi-user schemes mainly assume that users can securely share encryption keys, i.e., each user encrypts local data using the same key, but this poses high requirements for the security and flexibility of the system. Once the key is compromised, it poses a significant threat to the security of all users' data.

[0006] Due to the inconsistent privacy levels of local data required by each user, independent noise addition may occur when maintaining data locally. This independent noise addition method can protect individual privacy, but it increases the overall noise level and further reduces query efficiency. At the same time, the data correlation between multiple users is not fully considered, which may lead to uneven privacy protection effects and even cause new privacy leakage problems. Attackers may leak sensitive information such as query keywords based on allowed access patterns and other leakage function information in symmetric searchable encryption. This poses challenges to data confidentiality and query privacy, thus raising higher requirements for secure search methods in multi-user scenarios where different keys are used for encryption. For example, among three users, due to the inconsistent privacy requirements of local data, the degree of data distortion observed by attackers is different for the same data, which can achieve different privacy protection levels based on user preferences. However, the difficulty of attackers in guessing the underlying keywords of each user may be reduced to the minimum level. Attackers may perform word frequency statistics based on the pattern information leaked by the user with the lowest privacy, thus guessing the underlying keyword corresponding to the search token of that user and linking it to the search token from other users uploaded at the same time.

[0007] At the same time, multi-user scenarios also face the problem of dynamic user exit and entry for permission management. For example, in a company's file access permissions, the general manager can access files from all departments, department managers can only access files from their own departments, and ordinary employees can only view their own relevant files. In addition, there may be promotions and demotions among employees. When an employee is promoted, the access permission needs to be expanded, and the demand for dynamic management of permissions increases.

[0008] Therefore, it is necessary to design a multi-user secure search method that supports pattern leakage regulation and dynamic permission management to meet the above needs. SUMMARY

[0009] In view of the problems mentioned in the background art, the present application proposes a multi-user encrypted state retrieval method supporting mode leakage regulation and dynamic permission management, which can determine the privacy protection level of each user from the perspective of maximum leakage risk during data retrieval, alleviate the privacy degradation problem caused by the allowed mode information leakage in searchable encryption, improve the reliability and security of the system, and support dynamic update of user permissions.

[0010] Technical scheme: In order to solve the above technical problems, the technical scheme adopted by the present application is as follows:

[0011] A multi-user encrypted state retrieval method supporting mode leakage regulation and dynamic permission management, the participating entities include a trusted authorization agency, users and a cloud server, and specifically includes the following steps:

[0012] S1: method initialization, the trusted authorization agency generates an encryption key, private information and auxiliary information for each user by using a key generation algorithm KeyGen;

[0013] S2: the user locally determines the confusion strength, the user determines the privacy protection level of the data by using a Bayesian-based budget allocation mechanism by counting the distribution characteristics of the local data;

[0014] S3: the user locally analyzes the index information, the user uses erasure code technology to cut the file content into fragments for storage, and then analyzes the cut fragments into matching pairs of fragment identifiers and keywords;

[0015] S4: the user locally confuses the index information, the user performs noise processing on the matching pairs of processed fragment identifiers and keywords based on the confusion strength of S2, and generates a secure index of noise through an index algorithm;

[0016] S5: upload the fragment information, the user encrypts the fragment content and the secure index, and uploads them to the cloud server for storage;

[0017] S6: send a query request, the user recovers the authorized user key set based on the private information and the auxiliary information by using a key management mechanism, and generates a search token set by encrypting the keys and uploading it to the cloud server;

[0018] S7: the user searches for data, the cloud server retrieves the encrypted database based on the search token set and returns the search result;

[0019] S8: decrypt the search result, the user decrypts the fragment content in the search result and reconstructs the original file by using erasure code decoding technology;

[0020] S9: user permission update, the trusted authorization agency responds to the user request, performs key update, permission addition or permission deletion operation, updates the auxiliary information and the corresponding data in the cloud server.

[0021] As preferred, in S1, the specific implementation process is as follows:

[0022] The trusted authority runs a key generation algorithm KeyGen to generate the key of each user, maintains the private information s of the data owner key i and the auxiliary information Δ for recovering the data owner key i, j; Specifically:

[0023] Δ i,j ← Enc(s i , K j ),

[0024] where Δ i,j represents the auxiliary information for recovering the data owner key, Enc represents a symmetric encryption algorithm, K j represents the encryption key of the data owner, K j contains the index encryption key k j and the shard encryption key k jS .

[0025] As preferred, in S2, the specific implementation process is as follows:

[0026] First, the user needs to parse the file content into a matching pair of file identifier and keyword; then determine the user data proportion and the coverage of the keyword; each user calculates the appropriate privacy budget according to the local document proportion π and the coverage of the keyword ρ w , which is specifically:

[0027] ε ← Obfuscate(π, ρ w ),

[0028] where ε represents the privacy budget; Obfuscate() represents a function for calculating the confusion strength.

[0029] As preferred, in S3, the specific implementation process is as follows:

[0030] The user uses erasure code encoding technology to split a file content into m shards for storage, which is specifically:

[0031] S ← ErasureCode.Encode(D, m, z) ;

[0032] where S represents the shard content; D represents the file content to be split; m represents the number of shards; z represents the minimum number of shards that can be used to recover the original document content; ErasureCode.Encode() represents an erasure code encoding algorithm;

[0033] Then parse the split shard content into shardid a match pair (S, W) with the keyword w.

[0034] As preferred, in S4, the specific implementation process is as follows:

[0035] Each user performs confusion on the match pair (S, W) according to the privacy protection strength ε calculated for each keyword w.

[0036] First, the user converts the privacy protection strength ε of a keyword into the flip probabilities p and q of performing differential privacy confusion.

[0037] Then, the fragments of the keyword are confused, specifically in two ways: for the fragments containing the keyword, the user randomly generates a random number r1, if the random number r1> p, the fragment is retained, otherwise, it is discarded; for the fragments not containing the keyword, the user randomly generates a random number r2, if the random number r2< q, the fragment is added to the match pair with the keyword, otherwise, there is no match relationship.

[0038] Finally, each user can obtain the confused noisy index information (S', W').

[0039] Then, each user processes the noisy secure index based on the index algorithm BldInx, specifically as follows:

[0040] I←BldInx(k, (S', W'));

[0041] Wherein, I represents the noisy secure index; k represents the key used to encrypt the noisy plaintext index.

[0042] As preferred, in S5, the specific implementation process is as follows:

[0043] The user processes the local fragment content, encrypts it using the fragment key, and uploads it together with the secure index.

[0044] Based on the data encryption algorithm SymEnc, each user locally calculates the fragment ciphertext, specifically as follows:

[0045] c←SymEnc(k S , S);

[0046] Wherein, c represents the ciphertext of the encrypted fragment content; k S represents the symmetric key for encrypting and decrypting the fragment content; S represents the fragment content.

[0047] As preferred, in S6, the specific implementation process is as follows:

[0048] Using the key derivation algorithm KeyDer, the authorized user key set is recovered based on the private information and auxiliary information.

[0049] If user u wants to search other users' data on the server, the user needs to directly use the local private information s u and auxiliary information Δ u , the key K v of the authorized user is recovered u , Δ u,v ), where K v = (k v , k vS ), k v represents the index encryption key of user v, and k vS represents the fragment content encryption key of user v;

[0050] The user uses the same key recovery algorithm to recover the keys of the data owners that can be legally accessed one by one, obtaining the user key set K set ;

[0051] The trapdoor generation algorithm Trdr: the client inputs the key k1 and the keyword w of the query, and finally the client obtains the search token tk; using the trapdoor generation algorithm Trdr, the user encrypts the keyword of interest using all the user keys recovered in the user key set K set to obtain the search credential tk←Trdr(k,w) for accessing the corresponding user encrypted database, where tk represents the generated search credential, k represents the key used to encrypt the noisy plaintext index, and w represents the keyword of interest;

[0052] The user uses the same trapdoor generation algorithm to obtain the search token set that can access all the encrypted databases that can be legally accessed and uploads it.

[0053] As a preferred, in S8, the specific implementation process is:

[0054] S81: The user uses the recovered fragment decryption key of the authorized user to decrypt to obtain the original fragment content;

[0055] S82: The user puts the plaintext fragments belonging to the same document into the same set SGroup, and if the set size |SGroup| is greater than the document recovery threshold z, the ErasureCode.Decode() decoding algorithm is used to recover the original file content, specifically:

[0056]

[0057] wherein, represents the original file content successfully recovered by |SGroup| shards; m represents the total number of shards into which the document content is divided; z represents the minimum number of shards that can be used to recover the original document content; SGroup represents the set of all shards belonging to the same document.

[0058] As preferred, in S81, specifically:

[0059] Shard←SymDec(k S ,c);

[0060] wherein, SymDec represents a data decryption algorithm; Shard represents the decrypted shard plaintext; k S represents a symmetric key for encrypting and decrypting shard content; c represents the ciphertext of the encrypted shard content.

[0061] Advantages: Compared with the prior art, the present application has the following advantages:

[0062] (1) The present application takes symmetric searchable encryption technology and differential privacy technology as the core, and designs a multi-user independent encryption scenario. The method of the present application breaks through the limitations of existing symmetric searchable encryption technology in access control and leakage evaluation, can efficiently realize dynamic access control of user permissions, and effectively alleviates the privacy degradation problem caused by user privacy level preference in the cross-user data search process, thereby meeting higher security requirements in complex application scenarios.

[0063] (2) The method of the present application determines the privacy protection level of each user from the perspective of tolerable maximum leakage risk, alleviates the privacy degradation problem caused by the allowed pattern information leakage in searchable encryption, and improves the reliability and security of the system. Support pattern information hiding and dynamic permission update, and can configure fine confusion strategies according to the access needs of different users. At the same time, while protecting data confidentiality, it also supports dynamic updating of user permissions, controls the pattern leakage degree of the query process, allows legitimate users to access their own data and the data of users with lower permission levels, and realizes safe and efficient data retrieval. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 is a system model diagram of the present application;

[0065] Figure 2 is a user permission access control relationship diagram of the present application;

[0066] Figure 3 is a user search diagram of the present application;

[0067] Figure 4 is a key update diagram of the present application;

[0068] Figure 5 adding a schematic diagram for user authority of the present application;

[0069] Figure 6 deleting a schematic diagram for user authority of the present application;

[0070] Figure 7 Flow chart of the overall scheme of the present application. DETAILED DESCRIPTION

[0071] The present application will be further illustrated below in combination with specific embodiments, which are implemented on the premise of the technical scheme of the present application, and it should be understood that these embodiments are only used for illustrating the present application and not for limiting the scope of the present application.

[0072] As Figure 1 shown, the multi-user secret state retrieval method supporting mode leakage regulation and dynamic authority management provided by the present embodiment involves the following entities: a trusted authority (TA), a user, and a cloud server.

[0073] Trusted authority (TA): formulating and maintaining the access control policy of user data; assigning data encryption keys to each user class and maintaining the private information of the encryption key and the auxiliary information for restoring the encryption keys of other users.

[0074] It involves the creation of the authority relationship between users, the key assignment to each node user, and the maintenance of the access control policy.

[0075] User: the producer and owner of private data, who can encrypt local data and upload and request the cloud server to store, generate a query token and request to query data, and change the access authority and request the TA to update. The access authority includes the update of the user encryption key, the addition and deletion of the access authority, etc.

[0076] The user who gets the key distributed by the trusted authority encrypts the local data using the user private key, and uploads the corresponding encrypted database to the cloud server. In the system, a legitimate user can apply to the cloud server to query data, and according to the position of the user class in the access structure, the data of the child node can be accessed, otherwise it is not allowed. At the same time, the user can also request the cloud server to update the key.

[0077] Cloud server: providing remote data storage services, storing user uploaded data, and providing secure search services for users; including the storage of secure index and fragment content, and completing the request of user query data after receiving the search credential.

[0078] In the present embodiment, the cloud server is designed for defense.

[0079] The application provides a multi-user secret state search method supporting mode leakage regulation and dynamic permission management, supports dynamic user permission change, aims to realize efficient and safe data retrieval, and constructs a safe and efficient user permission change mechanism, a mode leakage controllable mechanism and a mode hiding mechanism.

[0080] 1. User permission access control: the application generates and maintains the access permission control strategy between users through a trusted authorization agency, allocates a key to each user node, and enables users to access their own data and the data of their child nodes according to their role permissions, so as to realize fine-grained permission management and ensure that the access permissions of different role users are isolated from each other.

[0081] 2. Mode leakage controllable: the application calculates a reasonable privacy budget and implements a corresponding strength of confusion strategy under the principle of tolerable maximum leakage risk by calculating the data distribution of each user. At the same time, the method does not need to establish a threat detection model in advance, but only relies on offline prior probability to provide adaptive privacy level guidance values for users.

[0082] 3. Mode information hiding: the application provides a mode hiding mechanism, allowing the mode information stored by the cloud server to be hidden in a secure index. This scheme can effectively defend against various attack methods such as term frequency attacks, while ensuring data privacy, reducing the ability of an adversary to guess the underlying keywords, and ensuring system storage and computing efficiency, meeting the actual security application requirements under the monitoring of a semi-honest server by a potential adversary.

[0083] 4. Efficient secret state search: the application supports efficient retrieval of encrypted data, enabling users to quickly obtain the required data without decrypting all encrypted content, balancing data availability and security.

[0084] 5. User permission update: the application provides a user permission change mechanism, which allows a legitimate user to request key update after key leakage. After the key is updated, the data related to the user on the server side will be updated, and the legitimate user who can access the data of the user still has access permission. When a non-legitimate user accesses the data permission changes to a legitimate user, the user permission is increased, allowing the user to view all data owned by the data owner, realizing dynamic addition of user access permission; when a legitimate user accesses the data permission changes to a non-legitimate user, the user permission is deleted, allowing the user to view all data owned by the data owner, realizing dynamic deletion of user access permission, thereby improving the flexibility and reliability of the system, meeting the actual application requirements in a dynamically changing environment while ensuring data confidentiality.

[0085] Through the above functions, the application realizes flexible and efficient access control while protecting data confidentiality and mode information hiding, significantly improves the security, reliability and practicability of the system, and is suitable for various scenes such as cloud storage and data sharing.

[0086] In the embodiment, a Bayesian-based budget allocation mechanism is used to achieve the goal of controllable mode leakage, but the specific implementation is not limited to this method.

[0087] The present example needs to apply a multi-user searchable encryption method DPE-MUSE supporting mode leakage control and user permission update, including a variety of related algorithms, as shown in the following table 1.

[0088] Table 1 Related algorithm table

[0089]

[0090]

[0091] Based on the above components, participating entities, and related technical methods, the specific implementation steps of the method of the application are as follows:

[0092] S1: Method initialization, the trusted authority uses the key generation algorithm KeyGen to generate the encryption key K of each user, the private information s and the auxiliary information Δ of the data owner key;

[0093] As shown in Figure 2 , the TA runs KeyGen to generate the key K i of each user, the private information s i of the data owner key, and the auxiliary information Δ i,j for restoring the data owner key; specifically:

[0094] Δ i,j ←Enc(s i ,K j ),

[0095] Wherein, Δ i,j represents the auxiliary information for restoring the data owner key, Enc represents the symmetric encryption algorithm of cryptography, K j represents the encryption key of the data owner, K j contains the index encryption key k j and the fragment encryption key k jS .

[0096] Each user receives the information K i , s i , Δ i,j generated at the TA.

[0097] S2: User locally determines obfuscation strength: the user determines the privacy protection level of the data by counting the distribution characteristics of the local data, using a budget allocation mechanism based on Bayes;

[0098] First, the user needs to parse the file content into a matching pair of file identifier and keyword, which is used to calculate the following two key indicators.

[0099] Then, by counting the proportion of local file quantity in the global file quantity, the first key indicator, i.e. user data proportion, is determined; and by counting the proportion of the number of documents matching the user content and each keyword in the local document quantity, the second key indicator, i.e. keyword coverage rate, is determined.

[0100] Finally, by using the above two key indicators as the two prior probabilities of Bayes, different obfuscation strengths are determined for each keyword according to the Bayes formula and user preferences, and the data association among multiple users is established, thereby alleviating the pattern leakage problem caused by the privacy level preferences of each user. Specifically:

[0101] First, each user calculates the appropriate privacy budget according to the proportion of local documents π and the coverage rate of keywords ρ w , which is specifically:

[0102] ε←Obfuscate(π,ρ w ),

[0103] where ε is the privacy budget, representing the parameter of obfuscation strength; Obfuscate() represents the function of calculating obfuscation strength.

[0104] i.e. determining the privacy protection degree of the information matching the keyword w.

[0105] S3: User locally parses index information, and the user uses erasure code technology to cut the file content into fragments for storage, and then parses the cut fragment content into a matching pair of fragment identifier and keyword;

[0106] The user changes the processing object from a matching pair of file identifier and keyword to a matching pair of fragment identifier and keyword to ensure search accuracy. When a false negative file appears, it means that the file is missing, and measures are taken to prevent search accuracy from declining.

[0107] First, the user uses erasure code encoding technology to cut a file content into m (m≥z) fragments for storage. This technology requires that as long as enough (≥z) fragment quantity is retained, the original file content can be reconstructed, i.e. false negative fragments are allowed. Finally, the user needs to parse the fragment content into a matching pair of fragment identifier and keyword.

[0108] The data uploaded by the user here is obfuscated index information, and the obfuscation technology uses differential privacy (DP). To prevent DP from directly acting on the document id (doc id ) and causing serious search accuracy problems, an erasure code is used to split the obfuscated object from the doc id ) into a shard id (shard id ).

[0109] The splitting technology needs to use the erasure code encoding algorithm ErasureCode.Encode() to implement. The erasure code splits the original document content into shards for storage, obtaining m shards, specifically:

[0110] S <- ErasureCode.Encode(D, m, z);

[0111] Where S represents the shard content; D represents the file content that needs to be split; m represents the number of shards; z represents the minimum number of shards that can be used to recover the original document content; and ErasureCode.Encode() represents the erasure code encoding algorithm.

[0112] Even if false negative shards appear after the DP obfuscation is completed, the client can still rely on the remaining z shards to reconstruct the content of the original file. Finally, the split shard content is parsed into a shard id ) that matches the keyword w.

[0113] S4: The user locally obfuscates the index information, and the user performs noise processing on the matching pair of the processed shard identifier and the keyword based on the obfuscation strength of S2, and generates a noisy security index through an index algorithm;

[0114] The legitimate user processes the local index by adding noise, hides the pattern information, and uploads the encrypted local noisy security index. The legitimate user uses the above determined obfuscation strength to act on the matching pair of the processed shard identifier and the keyword, obtains a noisy shard index, and uploads it after encryption using the user key.

[0115] Specifically: each user implements confusion on the matching pair (S, W) according to the privacy protection strength ε calculated for each keyword w; first, the user converts the privacy protection strength ε of a keyword into the flip probabilities p and q of implementing differential privacy confusion (the conversion formula here can depend on the optimization goal of the user, and can be designed to support goals such as minimizing storage overhead or maximizing search performance); then, the fragments of the keyword are confused, specifically in two ways: for the fragments containing the keyword, the user randomly generates a random number r1, if the random number r1 > p, the fragment is retained, otherwise, it is discarded; for the fragments not containing the keyword, the user randomly generates a random number r2, if the random number r2 < q, the fragment is added to the matching pair with the keyword, otherwise, there is no matching relationship. Finally, each user can obtain the noisy index information (S', W') after confusion.

[0116] Then, each user locally calculates and processes the noisy secure index based on the index algorithm BldInx, specifically:

[0117] I←BldInx(k, (S', W'));

[0118] wherein I represents the noisy secure index; k represents the key used to encrypt the noisy plaintext index.

[0119] S5: Legal users upload fragment information: users encrypt fragment content and secure index, and upload to the cloud server for storage;

[0120] Legal users process local fragment content, and upload the encrypted fragment content together with the secure index after encryption using the fragment key.

[0121] Each user locally calculates and processes the noisy secure index I←BldInx(k, (S', W')).

[0122] Then each user locally calculates the fragment ciphertext based on the data encryption algorithm SymEnc, specifically:

[0123] c←SymEnc(k S ,S);

[0124] wherein c represents the ciphertext of the encrypted fragment content; k S represents the symmetric key for encrypting and decrypting the fragment content; S represents the fragment content of the file.

[0125] Finally, each user locally generates two ciphertexts (I, c), which are uploaded to the server end and stored in the EDB.

[0126] S6: The legitimate user sends a query request. The user uses the key management mechanism to recover the authorized user key set based on private information and auxiliary information, encrypts the key to generate a search token set, and uploads it to the cloud server;

[0127] Legitimate users use the key management mechanism to locally recover the user key set that is lower than their authority with the help of their own private information and auxiliary information.

[0128] Using the key derivation algorithm KeyDer: Input user u's private information s u , auxiliary information Δ u , low-privilege target user v, finally, the client obtains the encryption key K of user v v .

[0129] If user u wants to search for data of other users (such as user v) on the server, the user needs to directly use the local private information s u and auxiliary information Δ u , recover the authorized user's key K v ←Dec(s u ,Δ u,v ), where K v =(k v ,K vS ), where k v Represents the index encryption key of user v, K vS Represents the fragment content encryption key of user v. Here, the user uses the same key recovery algorithm to recover the keys of the legally accessible data owners one by one, and obtains the user key set K set .

[0130] Trapdoor generation algorithm Trdr: The client inputs the key k and the query keyword w, and finally the client obtains the search token tk. Using the trapdoor generation algorithm Trdr, the user uses the recovered user key set K set All user keys in the cipher encrypt the keywords of interest, generating a search credential tk←Trdr(k,w) for accessing the corresponding user's encrypted database, where th is the generated search credential, k is the key used to encrypt the noisy plaintext index, and w is the keyword of interest. Using the same trapdoor generation algorithm, users obtain and upload a set of search tokens for all legally accessible encrypted databases.

[0131] like Figure 3 As shown in the figure, if user 3 wants to search the data of other users (user 5 and user 6) on the server, the user needs to directly use the private information s3 and the auxiliary information Δ3 to recover the authorized user's key K5,K6←Dec(s3,Δ3), where K5=(k5,k 5S ), K6=(k6,k6s ). In this way, the legitimate user can obtain the key set (K5, K6) of all authorized users with the help of auxiliary information Δ3.

[0132] User 3 uses the recovered authorized user's index encryption key to encrypt each keyword w of interest, generating a search token tk←Trdr(k3,w). To facilitate querying other users' ciphertext data on the server, the user encrypts the keyword w using all authorized keys (k5,k6), generating a set of search tokens tks for searching all authorized users, and then uploads it to the server.

[0133] S7: Legitimate users search for data: Legitimate users can query the data they uploaded by submitting query requests to the cloud server. They can also query the data of user nodes with access rights.

[0134] like Figure 3 As shown in the figure, after receiving the search token set tks, the server will search on the encrypted data set of the corresponding user and use the data search algorithm Srch. Finally, the server obtains the matching index and matching document R←Srch(EDB,tks) corresponding to the search token and returns them to the client.

[0135] Among them, R represents the matching result returned by the server; EDB represents the encrypted database stored on the server; tks represents the search token set.

[0136] S8: Legitimate User Decrypts Search Results: Legitimate users receive the noisy search results returned by the server and decrypt the fragmented ciphertext locally using the fragment key. They then reconstruct the original file content using erasure coding techniques from the retained fragments (≥z) belonging to the same file.

[0137] Decrypt each user's data:

[0138] S81: The user uses the recovered fragment decryption key of the authorized user (the same as the encryption key) to decrypt and obtain the original fragment content, specifically:

[0139] Shard←SymDec(k S ,c);

[0140] Among them, SymDec represents the data decryption algorithm; Shard represents the fragmented plaintext obtained after decryption; k S represents the symmetric key for encrypting and decrypting the fragment content; c represents the ciphertext of the encrypted fragment content.

[0141] S82: The user puts plaintext fragments belonging to the same document into the same set SGroup, and if the size of the set |SGroup| is greater than the document recovery threshold z, the original file content is recovered using the erasure code decoding algorithm ErasureCode.Decode(), which is as follows:

[0142]

[0143] wherein, represents the original file content successfully recovered from |SGroup| fragments; m represents the total number of fragments into which the document content is divided; z represents the minimum number of fragments that can be used to recover the original document content; and SGroup represents a set of all fragments belonging to the same document.

[0144] S9: User permission update: A legitimate user can provide dynamic permission management functions for each user in a multi-user scenario using a key management mechanism, such as user key update, addition and deletion of user access permissions.

[0145] First, the user can submit a key update request to send the updated key to the TA, or the TA can randomly generate an updated key for the user. At the same time, the TA updates all the auxiliary information related to the user, and the cloud server updates the corresponding data ciphertext while keeping the original user permission relationship unchanged.

[0146] Second, when a legitimate user who can access the data is added, the access permission of the new user needs to be added, and the TA needs to use the private information of the new user to maintain the encryption key of the data owner and update it to the auxiliary information, so as to realize the function of recovering the data owner key before the legitimate user accesses the data.

[0147] Third, when a legitimate user who can access the data is deleted, the access permission of the original legitimate user needs to be deleted, and the TA first updates the encryption key for the data owner and deletes part of the auxiliary information related to the old key in the original auxiliary information. The cloud server updates the corresponding data ciphertext while keeping the permission relationship of other users unchanged.

[0148] Key update and permission update:

[0149] As shown in Figure 4 , if user 2 wants to update the key op=key_update, the TA will generate a random key K'2 to replace the original key K2. The legitimate users related to the permission of user 2 use the private information s2 to obtain the updated auxiliary information Δ←Enc(s2, K'2). Finally, the TA updates the updated auxiliary information Δ' of all legitimate users related to user 2.

[0150] As shown in Figure 5As shown, if user 6 wants to add an authorization relationship op=edge_add to user 1, the TA uses the private information s1 of user 1 to maintain the encryption key K6 of the authorized user 6 to obtain updated auxiliary information Δ←Enc(s1,K6). Finally, the TA updates the auxiliary information Δ' containing the permission associated user (1, 6).

[0151] As shown, if user 6 wants to add an authorization relationship op=edge_add to user 1, the TA uses the private information s1 of user 1 to maintain the encryption key K6 of the authorized user 6 to obtain updated auxiliary information Δ←Enc(s1,K6). Finally, the TA updates the auxiliary information Δ' containing the permission associated user (1, 6). Figure 6 As shown, if user 6 wants to delete an authorization relationship op=edge_delete to user 3, the TA first updates the key K'6 of the authorized user 6, and then deletes the auxiliary information related to the old key K6 in the original auxiliary information, such as Enc(s3,K6). Finally, the TA updates the auxiliary information Δ' without permission associated with user 6.

[0152] The above embodiment takes a single keyword as an example, and if it is extended to multiple keywords, only the encryption step of the cross item needs to be added in the update, and the judgment step of the cross item needs to be added in the query.

[0153] The application adds a privacy protection function for pattern information on the basis of a symmetric searchable encryption method, and extends a dynamic access control mechanism. While guaranteeing data confidentiality and supporting efficient data retrieval, the application can effectively alleviate the problem of an attacker guessing a query keyword. The application allows a legal user to access own data and data of a user below the permission of the legal user. The application allows a semi-honest server to observe confused noisy pattern information, prevents real pattern information from being leaked in a data retrieval process, and can improve the security and reliability of the system.

[0154] On the basis of protecting sensitive data privacy, the application determines a reasonable privacy level allocation strategy, effectively alleviates the problem of sensitive information leakage caused by pattern information leakage in a query process, and thus significantly improves the security and flexibility of the system. In order to realize flexible management of data, in the multi-user scene set in the application, a user can encrypt local data using a private key.

[0155] The above only describes the preferred embodiments of the application, and it should be noted that, for those skilled in the art, without departing from the principles of the application, a number of improvements and refinements can be made, and these improvements and refinements should also be considered as the protection scope of the application.

Claims

1. A multi-user secret state retrieval method supporting pattern leakage control and dynamic rights management, characterized by: The participating entities include a trusted authorization agency, users, and a cloud server, and the specific steps are as follows: S1: Method initialization. The trusted authorization agency uses the key generation algorithm KeyGen to generate the encryption key, private information, and auxiliary information for each user; S2: The user locally determines the obfuscation strength. The user determines the privacy protection level of the data by statistically analyzing the distribution characteristics of the local data and adopting a Bayesian-based budget allocation mechanism; S3: The user locally parses the index information. The user uses the erasure code technology to split the file content into fragments for storage, and then parses the split fragment content into a matching pair of fragment identifiers and keywords; S4: The user locally obfuscates the index information. The user performs noise addition processing on the processed matching pair of fragment identifiers and keywords based on the obfuscation strength in S2, and generates a secure index of the noise through an indexing algorithm; S5: Upload the fragment information. The user encrypts the fragment content and the secure index and uploads them to the cloud server for storage; S6: Send a query request. The user uses the key management mechanism to recover the authorized user key set based on the private information and auxiliary information, encrypts the keys to generate a search token set, and uploads it to the cloud server; S7: The user searches for data. The cloud server retrieves the encrypted database based on the search token set and returns the search results; S8: Decrypt the search results. The user decrypts the fragment content in the search results and reconstructs the original file using the erasure code decoding technology; S9: User permission update. The trusted authorization agency responds to the user's request, executes key update, permission addition, or permission deletion operations, and updates the auxiliary information and the corresponding data in the cloud server.

2. The multi-user secret state retrieval method supporting mode leakage control and dynamic rights management according to claim 1 is characterized by: In S1, the specific implementation process is: The trusted authority runs the key generation algorithm KeyGen to generate the key for each user and maintain the private information of the data owner's key. i and auxiliary information Δ used to recover the data owner's key i, j; Specifically: D i,j ←Enc(s i ,K j ), Among them, Δ i,j Indicates auxiliary information used to recover the data owner's key, Enc represents the cryptographic symmetric encryption algorithm, K j Represents the encryption key of the data owner, K j Contains the index encryption key k j and the fragment encryption key k jS .

3. The multi-user secret state retrieval method supporting mode leakage control and dynamic rights management according to claim 1 is characterized by: In S2, the specific implementation process is: First, the user parses the file content into a matching pair of file identifiers and keywords; then determines the user data ratio and keyword coverage; each user is based on the local document ratio π and keyword coverage ρ w , calculate the appropriate privacy budget, specifically: ε←Obfuscate(π,ρ w ), Among them, ε represents the privacy budget; Obfuscate() represents the function for calculating the obfuscation strength.

4. The multi-user secret state retrieval method supporting mode leakage control and dynamic rights management according to claim 1 is characterized by: In S3, the specific implementation process is: The user uses the erasure code encoding technology to split the content of a file into m fragments for storage, specifically: S←ErasureCode.Encode(D,m,z); Among them, S represents the fragment content; D represents the file content to be split; m represents the number of fragments; z represents the minimum number of fragments that can be used to recover the original document content; ErasureCode.Encode() represents the erasure code encoding algorithm; Then parse the fragmented content into shard id Matches the pair (S,W) with keyword w.

5. The multi-user secret state retrieval method supporting mode leakage control and dynamic rights management according to claim 1 is characterized by: In S4, the specific implementation process is: Each user performs obfuscation on the matching pair (S,W) according to the privacy protection strength ε calculated for each keyword w; First, the user converts the privacy protection strength ε of a certain keyword into the flipping probabilities p and q for implementing differential privacy obfuscation; Then, there are two specific ways to obfuscate the fragments of this keyword: for the fragment containing this keyword, the user randomly generates a random number r1. If the random number r1>p, the fragment is retained; otherwise, it is discarded. For the fragment not containing this keyword, the user randomly generates a random number r2. If the random number r2<q, the fragment will be added to the matching pair of this keyword; otherwise, there is no matching relationship; Finally, each user can obtain the obfuscated index information with noise (S′,W′); Then, each user processes the noisy security index based on the indexing algorithm BldInx, specifically: I←BldInx(k,(S′,W′)); Where I represents the noisy security index; k represents the key used to encrypt the noisy plaintext index.

6. The multi-user secret state retrieval method supporting mode leakage control and dynamic rights management according to claim 1 is characterized by: In S5, the specific implementation process is: Users process local fragmented content, encrypt it with the fragment key, and upload it together with the security index; Based on the data encryption algorithm SymEnc, each user calculates the fragment ciphertext locally, specifically: c←SymEnc(k S ,S); Among them, c represents the encrypted ciphertext of the fragment content; k S Represents the symmetric key for encrypting and decrypting the fragment content; S represents the fragment content.

7. The multi-user secret state retrieval method supporting mode leakage control and dynamic rights management according to claim 1 is characterized by: In S6, the specific implementation process is: Using the key derivation algorithm KeyDer, the authorized user key set is recovered based on private information and auxiliary information; If user u wants to search for other users' data on the server, the user needs to directly use the local private information s u and auxiliary information Δ u , recover the authorized user's key K v ←Dec(s u ,Δ u,v ), where K v =(k v ,K vS ), k v represents the index encryption key of user v, k vS represents the fragment content encryption key of user v; The user uses the same key recovery algorithm to recover the keys of the legally accessible data owners one by one and obtain the user key set K set ; Trdr: The client inputs the key k and the query keyword w. Finally, the client obtains the search token tk. Using the Trdr algorithm, the user uses the recovered user key set K. set All user keys in encrypt the keywords of interest respectively, and obtain the search credentials tk←Trdr(k,w) for accessing the corresponding user encrypted database, where tk represents the generated search credentials, k represents the key used to encrypt the noisy plaintext index, and w represents the keyword of interest; The user uses the same trapdoor generation algorithm to obtain and upload a set of search tokens for all legally accessible encrypted databases.

8. The multi-user secret state retrieval method supporting mode leakage control and dynamic rights management according to claim 1 is characterized by: In S8, the specific implementation process is: S81: The user decrypts the fragment using the recovered authorized user's fragment decryption key to obtain the original fragment content; S82: The user puts the plaintext fragments belonging to the same document into the same set SGroup. If the set size |SGroup| is greater than the document recovery threshold z, the erasure code decoding algorithm ErasureCode.Decode() is used to restore the original file content. Specifically: in, Indicates the original file content successfully recovered by |STroup| fragments; m represents the total number of fragments into which the document content is divided; z represents the minimum number of fragments that can be used to recover the original document content; SGroup represents the set of all fragments belonging to the same document.

9. The multi-user secret state retrieval method supporting mode leakage control and dynamic rights management according to claim 8, characterized in that: In S81, specifically: Shard←SymDec(k S ,c); Among them, SymDec represents the data decryption algorithm; Shard represents the fragmented plaintext obtained after decryption; k S represents the symmetric key for encrypting and decrypting the fragment content; c represents the ciphertext of the encrypted fragment content.

Images