Adaptive security proxy re-encryption method and system with compact security

Abstract

The invention provides a self-adaptive security proxy re-encryption method and system with compact security, and belongs to the technical field of cryptography. The method supports operation under honest re-encryption attack and selective ciphertext attack security models, and comprises the following steps: executing system initialization based on security parameters, and outputting public parameters; executing a key generation algorithm based on the public parameter, outputting a public key and a private key of the user, and generating a re-encryption token based on the private key; executing an encryption algorithm based on the user public key and the plaintext message, and outputting a ciphertext; executing a decryption algorithm based on the user private key and the ciphertext, and recovering the plaintext message; and executing a re-encryption algorithm based on the re-encryption token, the source user public key, the target user public key and the ciphertext, and outputting a re-encrypted ciphertext. According to the invention, the problem that the security loss is increased along with the user number index under the self-adaptive attack in the existing scheme is solved. And the internal contradiction between the CCA security and the re-encryption function is solved.

Description

Technical Field

[0001] This invention belongs to the field of cryptography technology, and in particular relates to an adaptive secure proxy re-encryption method and system with compact security. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] In modern information systems, data encryption has become a fundamental means of protecting user privacy and system security. However, with the popularization of technologies such as cloud storage, big data collaborative analysis, and multi-party secure computation, users have placed higher demands on the controllable sharing capabilities of encrypted data. Proxy Re-Encryption (PRE) technology has emerged to address this need. Its core function is to enable authorized forwarding of encrypted data, allowing data owners to authorize a trusted third-party proxy to securely convert ciphertext from one user's public-key encryption form to another designated user's public-key encryption form without decrypting the original ciphertext.

[0004] In the field of PRE (Pre-Encryption) technology, there are three main core models: Choose-plaintext attack (CPA), Honest Re-encryption attack (HRA), and Choose-ciphertext attack (CCA). However, most existing PRE solutions have inherent flaws in their security models. They lack full adaptability, requiring the adversary to pre-select a subset of users to be corrupted before the attack begins. While this limitation reduces the difficulty of constructing the solution, it leads to exponential security losses and makes it difficult to cope with adaptive attacks in complex scenarios. Although adaptive security in some scenarios has been achieved by introducing adaptive token re-encryption mechanisms or graph pebbling game techniques, these solutions either only achieve quasi-polynomial level security losses or are limited by specific re-encryption strategies, and all lack tight-security reduction. More importantly, the inherent ciphertext flexibility of proxy re-encryption is inherently contradictory to CCA security. The re-encryption process requires modifying the ciphertext structure to adapt to the target user's public key, which conflicts with the "ciphertext immutability" requirement of CCA security. Existing technologies struggle to achieve strict CCA security guarantees while retaining re-encryption functionality.

[0005] Meanwhile, existing solutions also have shortcomings in terms of practicality. Some solutions do not support multi-challenge queries and can only handle single ciphertext challenges. Some solutions have excessively large ciphertext volumes, and some solutions do not support multi-hop re-encryption, making it difficult to meet the needs of high-frequency interaction, low bandwidth consumption, and complex authorization flow in practical applications. Summary of the Invention

[0006] To overcome the shortcomings of the prior art, this invention provides an adaptive security proxy re-encryption method and system with compact security. It aims to solve the problems of insufficient security, large security loss and limited applicability of existing proxy re-encryption schemes in adaptive attack scenarios. At the same time, it achieves compact (or almost compact) security reduction, supports single-challenge and multi-challenge scenarios, and meets the requirements of both HRA and CCA security levels.

[0007] The first aspect of this invention provides an adaptive security proxy re-encryption method with compact security; An adaptive security proxy re-encryption method with compact security supports operation under honest re-encryption attack and chosen-ciphertext attack security models. The method includes: System initialization is performed based on safety parameters, and common parameters are output. The key generation algorithm is executed based on public parameters, and the user's public key and private key are output. The public key is composed of the projection key corresponding to the private key, and the private key corresponds to the hash key of the vector space hash proof system. A re-encryption token is generated based on the private keys of two users, wherein the re-encryption token is the difference between the hash keys corresponding to the private keys of the two users; The encryption algorithm is executed based on the user's public key and the plaintext message, and the ciphertext is output. Based on the re-encryption token, the source user's public key, the target user's public key, and the ciphertext, the re-encryption algorithm is executed, the evaluation component of the ciphertext is modified, and the non-interactive zero-knowledge proof is updated to output the re-encrypted ciphertext. The decryption algorithm is executed based on the user's private key and ciphertext, and the plaintext message is recovered by verifying the validity of the proof from the signature and the non-interactive zero-knowledge proof system.

[0008] As a further technical solution, system initialization is performed based on security parameters, and common parameters are output, including: When configured in HRA security mode, input security parameter λ; based on the security parameter λ, generate a language public key lpk and a corresponding trapdoor td for a difficult subset membership problem, wherein the language public key lpk is used to define a subset membership language L_lpk; Output the public parameter pp, which at least includes the language public key lpk; When configured in CCA security mode, a hash key hk for a vector space hash proof system is generated based on the security parameter λ. Calculate the corresponding projection key projk based on the subset member language L_lpk defined by the hash key hk and the language public key lpk; Based on the security parameter λ, a public reference string crs is generated that simulates a reliable, tagged, language-based, plastic, non-interactive zero-knowledge proof. Output public parameters pp, which at least include the language public key lpk, the projection key projk, and the public reference string crs.

[0009] As a further technical solution, a key generation algorithm is executed based on public parameters to output the user's public and private keys, including: When configured in CCA security mode, a user-specific first hash key hk' is generated based on the public parameter pp; Based on the first hash key hk' and the subset member language L_lpk, calculate the user-specific first projection key projk'; By combining the global projection key projk contained in the public parameter pp with the user-specific first projection key projk', the user's complete public key pk is generated, which corresponds to a projection key projk_i; Output the user's public key pk and private key sk, wherein the private key sk is set to the first hash key hk'.

[0010] When configured in HRA security mode, the private key is the first hash key and the public key is the first projection key.

[0011] As a further technical solution, when configured in CCA security mode, the ciphertext includes a first component ct0, a second component ct1, a third component ct2, a one-time verification key ovk, a digital signature σ, and a non-interactive zero-knowledge proof π. When configured in HRA security mode, the ciphertext includes a first component ct0 and a second component ct1.

[0012] As a further technical solution, based on the public key pk of the encrypted object and the plaintext m, an encryption algorithm is executed, including: When configured in HRA security mode, based on the language public key lpk, the language sampling algorithm Sample_L is executed to generate statement x and the corresponding witness w; where x is the first component of the ciphertext ct0; Using the projection key projk_i corresponding to the public key pk of the encrypted object, the first component ct0, the witness w, the vector space hash proof system algorithm PEval is executed, the result is added to the plaintext m, and the encrypted ciphertext is output. The ciphertext includes the first component ct0 and the second component ct1. When configured in CCA security mode, the projection key projk_i corresponding to the public key pk of the encrypted object, the first component ct0, the witness w, and the vector space hash proof system algorithm PEval are executed to obtain the second component ct1. Using the projection key projk in the public parameters, the first component ct0, witness w, execute the vector space hash proof system algorithm PEval, and add the plaintext m to the result to obtain the third component ct2; Based on the aforementioned encryption scheme, its key generation algorithm is executed to generate a verification key ovk and a signature key osk; a tag t for non-interactive zero-knowledge proof is derived from the verification key ovk; and a signature σ is generated from the first component ct0 and the second component ct2 based on the signature key osk. Based on the public reference string crs of the specially simulated reliable tagged language plastic non-interactive zero-knowledge proof, the tag t, the first component ct0, the second component ct1, the witness w corresponding to the first component, the Prove algorithm of non-interactive zero-knowledge proof is executed to generate zero-knowledge proof π. Output encrypted ciphertext, which includes a first component ct0, a second component ct1, a third component ct2, a primary verification key ovk, a signature σ, and a zero-knowledge proof π.

[0013] As a further technical solution, a re-encryption algorithm is executed based on the re-encryption token, the source user's public key, the target user's public key, and the ciphertext. The evaluation components of the ciphertext are modified, and the non-interactive zero-knowledge proof is updated to output the re-encrypted ciphertext, including: When configured in HRA security mode, a new statement x' and a corresponding statement w' are generated based on the language public key lpk; Modify the original first component ct0 and the new statement x' to generate a new first component ct0'; Modify the original second component ct1 and combine it with the evaluation value of the first component ct0 using the re-encryption token d_{i,j} and the evaluation value of the statement x' using the target user public key pk_j; Output re-encrypted ciphertext ct', which includes at least the new first component ct0 and the new second component ct1; When configured in CCA security mode, the second component ct1 is modified through the first modification step, and combined with the evaluation value of the first component ct0 using the re-encryption token d_{i,j} to generate a new second component ct'1. The proof update step, based on the public reference string crs, the language public key lpk_i corresponding to the source user public key pk_i, the tag t, the first component ct0, the proof π and the re-encryption token d_{i,j}, generates a new non-interactive zero-knowledge proof π' through the proof transformation algorithm; The output is a re-encrypted ciphertext ct', which includes at least the first component ct0, the new second component ct'1, the third component ct2, the one-time verification key ovk, the digital signature σ, and the new proof π'.

[0014] As a further technical solution, a decryption algorithm is executed based on the user's private key and ciphertext. By verifying the validity of the signature and the proof from a non-interactive zero-knowledge proof system, the plaintext message is recovered, including: When configured in CCA security mode, the input ciphertext ct and the user's private key sk are used; a tag t for non-interactive zero-knowledge proofs is derived from the one-time verification key ovk. The first verification is performed based on the public reference string crs, the label t, the first component ct0 and the second component ct1 to verify the validity of the non-interactive zero-knowledge proof π. Second verification step: Based on the one-time verification key ovk, the first component ct0 and the third component ct2, a second verification is performed to verify the validity of the digital signature σ; If both the first and second verifications are successful, decryption calculation is performed. By combining the third component ct2 and the second component ct1 and using the evaluation value of the first component ct0 using the private key sk, the plaintext message m is recovered and output. When configured in HRA security mode, no signature or zero-knowledge proof verification is performed; only decryption calculation is performed. The plaintext m is obtained by subtracting the second component ct1 from the third component ct2 and adding the private key to the evaluation value of the first component ct0.

[0015] A second aspect of the present invention provides an adaptive security proxy re-encryption system with tight security.

[0016] An adaptive secure proxy re-encryption system with compact security includes: Supports operation under honest re-encryption attack and chosen ciphertext attack security models. The system includes: an initialization module, which is configured to perform system initialization based on security parameters and output common parameters. The key generation module is configured to: execute a key generation algorithm based on public parameters and output the user's public key and private key, wherein the public key is composed of a projected key and the private key corresponds to the hash key of the vector space hash proof system; The re-encryption token generation module is configured to generate a re-encryption token based on the private keys of two users, wherein the re-encryption token is the difference between the hash keys corresponding to the private keys of the two users; The encryption module is configured to execute an encryption algorithm based on the user's public key and the plaintext message, and output ciphertext. The re-encrypted ciphertext output module is configured to: execute a re-encryption algorithm based on the re-encryption token, the source user's public key, the target user's public key, and the ciphertext, modify the evaluation components of the ciphertext, update the non-interactive zero-knowledge proof, and output the re-encrypted ciphertext; The decryption module is configured to execute a decryption algorithm based on the user's private key and ciphertext, and recover the plaintext message by verifying the validity of the signature and the proof from a non-interactive zero-knowledge proof system.

[0017] A third aspect of the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps of an adaptive security proxy re-encryption method with compact security as described in the first aspect of the present invention.

[0018] A fourth aspect of the present invention provides an electronic device including a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of an adaptive secure proxy re-encryption method with compact security as described in the first aspect of the present invention.

[0019] The above one or more technical solutions have the following beneficial effects: This invention, by introducing a core lemma from selectivity to adaptation, perfectly hides the guessing step in the security proof within a hybrid game transformation, thus achieving compact security reduction. This makes the security loss independent of the number of users, amounting only to the logarithm of the security parameters, or even at the constant level. It overcomes the theoretical bottleneck of adaptive security, making the solution truly usable in real-world scenarios. This invention not only achieves basic HRA security but also, through novel cryptographic tools, constructs for the first time an adaptive, compactly secure CCA security PRE scheme, capable of resisting stronger chosen ciphertext attacks, greatly expanding the application scenarios of the scheme.

[0020] All four schemes of this invention support bidirectional, multi-hop re-encryption, allowing ciphertext to undergo multiple chain-like transformations among multiple users while ensuring the correctness of the final decryption. This satisfies the needs of complex data flow and collaboration, whereas existing compact reduction adaptive security schemes only have one scheme, which is a single-hop, unidirectional scheme. In comparison, the HRA of this invention is more efficient and can be implemented on CCA; it uses fewer group elements, which are prime groups, and even smaller composite groups, and can achieve multi-hop. The construction of this invention is based on the matrix decision Diffie-Hellman hypothesis on prime groups, which is a standard and widely studied security hypothesis. Compared with schemes based on complex assumptions such as composite groups or lattices, this scheme has higher computational and bandwidth efficiency and is more practically valuable for deployment.

[0021] To resolve the inherent contradiction between CCA security and re-encryption functionality (i.e., ciphertext transformability), this invention proposes a tagged, language-extendable special simulation-reliable non-interactive zero-knowledge proof. This tool maintains simulation reliability while allowing specific transformations of the proof (to support re-encryption). This novel primitive cleverly balances "extensibility" and "unforgeability," which is not only key to implementing this scheme but also provides a completely new approach and tool for resolving similar conflicts in other cryptographic protocols.

[0022] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0023] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0024] Figure 1 This is a flowchart of the method in the first embodiment.

[0025] Figure 2 This is a system structure diagram of the second embodiment. Detailed Implementation

[0026] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0027] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations of the present invention.

[0028] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0029] Example 1 This embodiment discloses an adaptive security proxy re-encryption method with compact security; like Figure 1 As shown, an adaptive security proxy re-encryption method with compact security supports operation under both honest re-encryption attack and chosen-ciphertext attack security models, including: Step S1: Perform system initialization based on security parameters and output common parameters; Step S2: Execute the key generation algorithm based on the public parameters to output the user's public key and private key, wherein the public key is composed of the projection key corresponding to the private key, and the private key corresponds to the hash key of the vector space hash proof system; Step S3: Generate a re-encryption token based on the private keys of the two users. The re-encryption token is the difference between the hash keys corresponding to the private keys of the two users. Step S4: Execute the encryption algorithm based on the user's public key and the plaintext message, and output the ciphertext; Step S5: Execute the re-encryption algorithm based on the re-encryption token, the source user's public key, the target user's public key, and the ciphertext, modify the evaluation components of the ciphertext, update the non-interactive zero-knowledge proof, and output the re-encrypted ciphertext.

[0030] Step S6: Execute the decryption algorithm based on the user's private key and ciphertext, and recover the plaintext message by verifying the validity of the proof from the signature and the non-interactive zero-knowledge proof system.

[0031] Specifically, it also includes the following: Step S1: Perform system initialization based on security parameters and output common parameters.

[0032] When configured in HRA security mode, input security parameter λ; based on the security parameter λ, generate a language public key lpk and a corresponding trapdoor td for a difficult subset membership problem, wherein the language public key lpk is used to define a subset membership language L_lpk; Output the public parameter pp, which at least includes the language public key lpk; When configured in CCA security mode, a language public key lpk and a corresponding trapdoor td for a difficult subset membership problem are generated based on the security parameter λ, wherein the language public key lpk is used to define a subset membership language L_lpk; Simultaneously, based on the security parameter λ, a hash key hk for a vector space hash proof system is generated; Calculate the corresponding projection key projk based on the subset member language L_lpk defined by the hash key hk and the language public key lpk; Based on the security parameter λ, a public reference string crs is generated that simulates a reliable, tagged, language-based, plastic, non-interactive zero-knowledge proof. Output public parameters pp, which at least include the language public key lpk, the projection key projk, and the public reference string crs.

[0033] Step S2: Execute the key generation algorithm based on the public parameters to output the user's public key and private key. The public key is composed of the projection key corresponding to the private key, and the private key corresponds to the hash key of the vector space hash proof system.

[0034] When configured in CCA security mode, a user-specific first hash key hk' is generated based on the public parameter pp; Based on the first hash key hk' and the subset member language L_lpk, calculate the user-specific first projection key projk'; By combining the global projection key projk contained in the public parameter pp with the user-specific first projection key projk', the user's complete public key pk is generated, which corresponds to a projection key projk_i; Output the user's public key pk and private key sk, wherein the private key sk is set to the first hash key hk'.

[0035] When configured in HRA security mode, the public key is directly the first projection key projk', and the private key is the same as that set in CCA.

[0036] The vector space hash proof system comprises four algorithms: Setup, PKGen, PEval, and SEval. The Setup algorithm takes a security parameter λ as input and outputs a hash key hk. The PKGen algorithm takes the hash key hk and the language L_lpk as input and outputs a projection key projk. The PEval algorithm takes the projection key projk, a statement x, and a witness w of x as input and outputs a hash value. The SEval algorithm takes the hash key hk and a statement x as input and outputs a hash value.

[0037] Furthermore, the key properties of the vector space hash proof system include: Correctness: For valid statement-witness pairs, the outputs of PEval and SEval are completely identical, that is:

[0038] Vector space structure: Hash key set, projection key set, statement set, and witness set are all vector spaces over finite fields.

[0039] Triple homomorphism: For a vector space structure, it satisfies projection homomorphism, message homomorphism, and key homomorphism. That is, the hash key hk is additively homomorphic to PKGen; the statement x is additively homomorphic to PEval; and the hash key hk is additively homomorphic to PEval.

[0040] Key collision resistance: The probability of different hash keys generating the same projected key is negligible.

[0041] - Generality: For the same projected key, its possible corresponding hash keys form a d-dimensional affine vector space, and correspond to a vector space; the probability that a random statement will produce all 0 hash values ​​in this vector space does not exceed .

[0042] d-Minimum Entropy: The minimum entropy of the hash value distribution of a specific set of statements is ,in, Let d represent a finite field, where d is the random dimension of the hash key.

[0043] Step S3: Generate a re-encryption token based on the private keys of the two users. The re-encryption token is the difference between the hash keys corresponding to the private keys of the two users.

[0044] The process is executed by a trusted third party, which obtains the private keys sk_i and sk_j of two users, i and j, respectively. The re-encryption token from user i to j is then d_{i,j} = sk_j - sk_i, and the token from user j to i is the inverse of sk_i. This re-encryption token is then sent to the third-party agent.

[0045] Step S4: Execute an encryption algorithm based on the user's public key and the plaintext message to output ciphertext. The ciphertext includes a first component ct0, a second component ct1, a third component ct2, a one-time verification key ovk, a digital signature σ, and a non-interactive zero-knowledge proof π.

[0046] When configured in CCA security mode, the ciphertext includes a first component ct0, a second component ct1, a third component ct2, a one-time verification key ovk, a digital signature σ, and a non-interactive zero-knowledge proof π; when configured in HRA security mode, the ciphertext includes a first component ct0 and a second component ct1.

[0047] Specifically, based on the public key pk of the encrypted object and the plaintext m, an encryption algorithm is executed, including: When configured in HRA security mode, based on the language public key lpk, the language sampling algorithm Sample_L is executed to generate statement x and the corresponding witness w; where x is the first component of the ciphertext ct0; Using the projection key projk_i corresponding to the public key pk of the encrypted object, the first component ct0, the witness w, the vector space hash proof system algorithm PEval is executed, and the result is added to the plaintext m, which is the ciphertext second component ct1; then the encrypted ciphertext is output, which includes the first component ct0 and the second component ct1.

[0048] When configured in CCA security mode, the projection key projk_i corresponding to the public key pk of the encrypted object, the first component ct0, the witness w, and the vector space hash proof system algorithm PEval are executed, and the result is the second component ct1. Using the projection key projk in the public parameters, the first component ct0, witness w, execute the vector space hash proof system algorithm PEval, and add the plaintext m to the result, which is the third component ct2; Based on the aforementioned encryption scheme, its key generation algorithm is executed to generate a verification key ovk and a signature key osk; a tag t for non-interactive zero-knowledge proof is derived from the verification key ovk; and a signature σ is generated from the first component ct0 and the second component ct2 based on the signature key osk.

[0049] Based on the public reference string crs of the specially simulated reliable tagged language plastic non-interactive zero-knowledge proof, the tag t, the first component ct0, the second component ct1, and the witness w corresponding to the first component, the Prove algorithm of non-interactive zero-knowledge proof is executed to generate zero-knowledge proof π.

[0050] Output encrypted ciphertext, which includes a first component ct0, a second component ct1, a third component ct2, a primary verification key ovk, a signature σ, and a zero-knowledge proof π.

[0051] Step S5: Execute the re-encryption algorithm based on the re-encryption token, the source user's public key, the target user's public key, and the ciphertext, modify the evaluation components of the ciphertext, update the non-interactive zero-knowledge proof, and output the re-encrypted ciphertext.

[0052] When configured in CCA security mode, the second component ct1 is modified through the first modification step, and combined with the evaluation value of the first component ct0 using the re-encryption token d_{i,j} to generate a new second component ct'1. The proof update step, based on the public reference string crs, the language public key lpk_i corresponding to the source user public key pk_i, the tag t, the first component ct0, the proof π and the re-encryption token d_{i,j}, generates a new non-interactive zero-knowledge proof π' through the proof transformation algorithm; Output re-encrypted ciphertext ct', which includes at least the first component ct0, the new second component ct'1, the third component ct2, the one-time verification key ovk, the digital signature σ, and the new proof π'; When configured in HRA security mode, a new statement x' and a corresponding statement w' are generated based on the language public key lpk; Modify the original first component ct0 and the new statement x' to generate a new first component ct0'; Modify the original second component ct1 and combine it with the evaluation value of the first component ct0 using the re-encryption token d_{i,j} and the evaluation value of the statement x' using the target user's public key pkj; Output re-encrypted ciphertext ct', which includes at least the new first component ct0 and the new second component ct1.

[0053] Step S6: Execute the decryption algorithm based on the user's private key and ciphertext, and recover the plaintext message by verifying the validity of the proof from the signature and the non-interactive zero-knowledge proof system.

[0054] When configured in CCA security mode, the input ciphertext ct and the user's private key sk are used; a tag t for non-interactive zero-knowledge proofs is derived from the one-time verification key ovk.

[0055] The first verification is performed based on the public reference string crs, the label t, the first component ct0, and the second component ct1 to verify the validity of the non-interactive zero-knowledge proof π.

[0056] The second verification step is to perform a second verification based on the one-time verification key ovk, the first component ct0, and the third component ct2 to verify the validity of the digital signature σ.

[0057] If both the first and second verifications are successful, decryption calculation is performed. By combining the third component ct2 and the second component ct1 and using the evaluation value of the first component ct0 using the private key sk, the plaintext message m is recovered and output.

[0058] When configured in HRA security mode, no signature or zero-knowledge proof verification is performed; only decryption calculation is performed. This corresponds to the final operation step in CCA: the third component ct2 minus the second component ct1 plus the evaluation value of the private key on the first component ct0, and the result is the plaintext m.

[0059] Furthermore, when configured in CCA security mode, the validity of the proofs from the signature and non-interactive zero-knowledge proof system is also verified, specifically: When the sender wants to encrypt message m for user i, after completing the calculation of the core ciphertext components (ct0, ct1, ct2), a zero-knowledge proof π needs to be generated. The process is as follows: (1) The encryption algorithm first generates a one-time signature key pair (ovk, osk). Then, it computes the label t = H(ovk) required for the proof, where H is a collision-resistant hash function. This step binds the proof to a unique ovk generated by this encryption operation.

[0060] (2) The encryption algorithm prepares the statement to be proved. This statement is a compound statement, specifically: a tuple (ct0, ct1) consisting of the first component ct0 and the second component ct1 of the ciphertext.

[0061] (3) The encryption algorithm explicitly requires proof of a relationship, which is defined as: there exists a valid witness w such that: The first component ct0 belongs to a valid language L_lpk defined by the language public key lpk, that is, ct0 is a valid statement in the language L_lpk; the second component ct1 is equal to the public evaluation value of ct0 and w using the public key pk_i of user i, that is, the projection key projk_i, i.e., ct1 = PEval(projk_i, ct0, w).

[0062] (4) The encryption algorithm calls the proof algorithm IL.Prove of the label-based language-extendable non-interactive zero-knowledge (tLM-NIZK) proof system. The input of the algorithm includes the system public reference string crs, the generated label t, the statement (ct0, ct1), and the valid witness w sampled when generating ct0.

[0063] (5) The proof algorithm IL.Prove outputs a zero-knowledge proof π. This proof π, the one-time verification key ovk, and its signature σ are jointly appended to the ciphertext to form the complete CCA secure ciphertext ct = (ct0, ct1, ct2, ovk, σ,π).

[0064] When the recipient needs to decrypt the ciphertext, or the agent needs to perform re-encryption, the validity of the zero-knowledge proof is verified first.

[0065] First, the decryption or re-encryption algorithm parses the components (ct0, ct1, ovk, π) from the input ciphertext ct. Then, it calculates the same label t = H(ovk) as during encryption.

[0066] Subsequently, the verification algorithm IL.Ver of the tLM-NIZK proof system is invoked. The inputs of this algorithm include: the system's common reference string crs, the label t, the statement (ct0, ct1), and the proof π.

[0067] Finally, the verification algorithm IL.Ver outputs a single bit (0 or 1). If the output is 1, it proves that π is valid for the statement (ct0, ct1) and the label t, meaning the ciphertext components (ct0, ct1) are in the correct format. This successful verification is a mandatory prerequisite for performing subsequent decryption calculations or re-encryption operations. If the verification fails, the process immediately aborts and returns an error.

[0068] Example 2 This embodiment discloses an adaptive secure proxy re-encryption system with compact security; like Figure 2 As shown, an adaptive security proxy re-encryption system with compact security supports operation under both honest re-encryption attacks and chosen-ciphertext attack security models. The system includes: The initialization module is configured to perform system initialization based on security parameters and output common parameters. The key generation module is configured to: execute a key generation algorithm based on public parameters and output the user's public key and private key, wherein the public key is composed of the projection key corresponding to the private key and the private key corresponds to the hash key of the vector space hash proof system; The re-encryption token generation module is configured to generate a re-encryption token based on the private keys of two users, wherein the re-encryption token is the difference between the hash keys corresponding to the private keys of the two users; The encryption module is configured to execute an encryption algorithm based on the user's public key and the plaintext message, and output ciphertext. The re-encrypted ciphertext output module is configured to: execute a re-encryption algorithm based on the re-encryption token, the source user's public key, the target user's public key, and the ciphertext, modify the evaluation components of the ciphertext, update the non-interactive zero-knowledge proof, and output the re-encrypted ciphertext; The decryption module is configured to execute a decryption algorithm based on the user's private key and ciphertext, and recover the plaintext message by verifying the validity of the signature and the proof from a non-interactive zero-knowledge proof system.

[0069] Example 3 The purpose of this embodiment is to provide a computer-readable storage medium.

[0070] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of an adaptive security proxy re-encryption method with compact security as described in Example 1.

[0071] Example 4 The purpose of this embodiment is to provide an electronic device.

[0072] An electronic device includes a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of an adaptive secure proxy re-encryption method with compact security as described in Embodiment 1.

[0073] The steps and methods involved in the apparatuses of Embodiments 2, 3, and 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0074] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0075] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. An adaptive secure proxy re-encryption method with compact security, characterized in that, Support for operation under honest re-encryption attack and chosen-ciphertext attack security models, including: System initialization is performed based on safety parameters, and common parameters are output. The key generation algorithm is executed based on public parameters, and the user's public key and private key are output. The public key is composed of the projection key corresponding to the private key, and the private key corresponds to the hash key of the vector space hash proof system. A re-encryption token is generated based on the private keys of two users, wherein the re-encryption token is the difference between the hash keys corresponding to the private keys of the two users; The encryption algorithm is executed based on the user's public key and the plaintext message, and the ciphertext is output. Based on the re-encryption token, the source user's public key, the target user's public key, and the ciphertext, the re-encryption algorithm is executed, the evaluation component of the ciphertext is modified, and the non-interactive zero-knowledge proof is updated to output the re-encrypted ciphertext. The decryption algorithm is executed based on the user's private key and ciphertext, and the plaintext message is recovered by verifying the validity of the proof from the signature and the non-interactive zero-knowledge proof system.

2. The adaptive secure proxy re-encryption method with compact security as described in claim 1, characterized in that, System initialization is performed based on security parameters, and common parameters are output, including: When configured in HRA security mode, input security parameter λ; based on the security parameter λ, generate a language public key lpk and a corresponding trapdoor td for a difficult subset membership problem, wherein the language public key lpk is used to define a subset membership language L_lpk; Output the public parameter pp, which at least includes the language public key lpk; When configured in CCA security mode, a hash key hk for a vector space hash proof system is generated based on the security parameter λ. Calculate the corresponding projection key projk based on the subset member language L_lpk defined by the hash key hk and the language public key lpk; Based on the security parameter λ, a public reference string crs is generated that simulates a reliable, tagged, language-based, plastic, non-interactive zero-knowledge proof. Output public parameters pp, which at least include the language public key lpk, the projection key projk, and the public reference string crs.

3. The adaptive secure proxy re-encryption method with compact security as described in claim 1, characterized in that, The key generation algorithm is executed based on the public parameters, and the user's public and private keys are output, including: When configured in CCA security mode, a user-specific first hash key hk' is generated based on the public parameter pp; Based on the first hash key hk' and the subset member language L_lpk, calculate the user-specific first projection key projk'; By combining the global projection key projk contained in the public parameter pp with the user-specific first projection key projk', the user's complete public key pk is generated, which corresponds to a projection key projk_i; Output the user's public key pk and private key sk, wherein the private key sk is set to the first hash key hk'; When configured in HRA security mode, the private key is the first hash key and the public key is the first projection key.

4. The adaptive secure proxy re-encryption method with compact security as described in claim 1, characterized in that, When configured in CCA security mode, the ciphertext includes a first component ct0, a second component ct1, a third component ct2, a one-time verification key ovk, a digital signature σ, and a non-interactive zero-knowledge proof π. When configured in HRA security mode, the ciphertext includes a first component ct0 and a second component ct1.

5. The adaptive secure proxy re-encryption method with compact security as described in claim 1, characterized in that, Based on the public key pk of the encrypted object and the plaintext m, execute the encryption algorithm, including: When configured in HRA security mode, based on the language public key lpk, the language sampling algorithm Sample_L is executed to generate statement x and the corresponding witness w; where x is the first component of the ciphertext ct0; Using the projection key projk_i corresponding to the public key pk of the encrypted object, the first component ct0, the witness w, the vector space hash proof system algorithm PEval is executed, the result is added to the plaintext m, and the encrypted ciphertext is output. The ciphertext includes the first component ct0 and the second component ct1. When configured in CCA security mode, the projection key projk_i corresponding to the public key pk of the encrypted object, the first component ct0, the witness w, and the vector space hash proof system algorithm PEval are executed to obtain the second component ct1. Using the projection key projk in the public parameters, the first component ct0, witness w, execute the vector space hash proof system algorithm PEval, and add the plaintext m to the result to obtain the third component ct2; Based on the aforementioned encryption scheme, its key generation algorithm is executed to generate a verification key ovk and a signature key osk; a tag t for non-interactive zero-knowledge proof is derived from the verification key ovk; and a signature σ is generated from the first component ct0 and the second component ct2 based on the signature key osk. Based on the public reference string crs of the specially simulated reliable tagged language plastic non-interactive zero-knowledge proof, the tag t, the first component ct0, the second component ct1, the witness w corresponding to the first component, the Prove algorithm of non-interactive zero-knowledge proof is executed to generate zero-knowledge proof π. Output encrypted ciphertext, which includes a first component ct0, a second component ct1, a third component ct2, a primary verification key ovk, a signature σ, and a zero-knowledge proof π.

6. The adaptive secure proxy re-encryption method with compact security as described in claim 1, characterized in that, Based on the re-encryption token, the source user's public key, the target user's public key, and the ciphertext, a re-encryption algorithm is executed, the evaluation component of the ciphertext is modified, and the non-interactive zero-knowledge proof is updated. The output re-encrypted ciphertext includes: When configured in HRA security mode, a new statement x' and a corresponding statement w' are generated based on the language public key lpk; Modify the original first component ct0 and the new statement x' to generate a new first component ct0'; Modify the original second component ct1 and combine it with the evaluation value of the first component ct0 using the re-encryption token d_{i,j} and the evaluation value of the statement x' using the target user's public key pkj; Output re-encrypted ciphertext ct', which includes at least the new first component ct0 and the new second component ct1; When configured in CCA security mode, the second component ct1 is modified through the first modification step, and combined with the evaluation value of the first component ct0 using the re-encryption token d_{i,j} to generate a new second component ct'1. The proof update step, based on the public reference string crs, the language public key lpk_i corresponding to the source user public key pk_i, the tag t, the first component ct0, the proof π and the re-encryption token d_{i,j}, generates a new non-interactive zero-knowledge proof π' through the proof transformation algorithm; The output is a re-encrypted ciphertext ct', which includes at least the first component ct0, the new second component ct'1, the third component ct2, the one-time verification key ovk, the digital signature σ, and the new proof π'.

7. The adaptive secure proxy re-encryption method with compact security as described in claim 1, characterized in that, Based on the user's private key and ciphertext, a decryption algorithm is executed to recover the plaintext message by verifying the validity of the proof from the signature and a non-interactive zero-knowledge proof system. When configured in CCA security mode, the input ciphertext ct and the user's private key sk are used; a tag t for non-interactive zero-knowledge proofs is derived from the one-time verification key ovk. The first verification is performed based on the public reference string crs, the label t, the first component ct0 and the second component ct1 to verify the validity of the non-interactive zero-knowledge proof π. Second verification step: Based on the one-time verification key ovk, the first component ct0 and the third component ct2, a second verification is performed to verify the validity of the digital signature σ; If both the first and second verifications are successful, decryption calculation is performed. By combining the third component ct2 and the second component ct1 and using the evaluation value of the first component ct0 using the private key sk, the plaintext message m is recovered and output. When configured in HRA security mode, no signature or zero-knowledge proof verification is performed; only decryption calculation is performed. The plaintext m is obtained by subtracting the second component ct1 from the third component ct2 and adding the private key to the evaluation value of the first component ct0.

8. An adaptive secure proxy re-encryption system with compact security, characterized in that: The system supports operation under both honest re-encryption attacks and chosen-ciphertext attacks. The system includes: The initialization module is configured to perform system initialization based on security parameters and output common parameters. The key generation module is configured to: execute a key generation algorithm based on public parameters and output the user's public key and private key, wherein the public key is composed of the projection key corresponding to the private key and the private key corresponds to the hash key of the vector space hash proof system; The re-encryption token generation module is configured to generate a re-encryption token based on the private keys of two users, wherein the re-encryption token is the difference between the hash keys corresponding to the private keys of the two users; The encryption module is configured to execute an encryption algorithm based on the user's public key and the plaintext message, and output ciphertext. The re-encrypted ciphertext output module is configured to: execute a re-encryption algorithm based on the re-encryption token, the source user's public key, the target user's public key, and the ciphertext, modify the evaluation components of the ciphertext, update the non-interactive zero-knowledge proof, and output the re-encrypted ciphertext; The decryption module is configured to execute a decryption algorithm based on the user's private key and ciphertext, and recover the plaintext message by verifying the validity of the signature and the proof from a non-interactive zero-knowledge proof system.

9. A computer-readable storage medium having a program stored thereon, characterized in that, When executed by a processor, the program implements the steps of an adaptive secure proxy re-encryption method with compact security as described in any one of claims 1-7.

10. An electronic device comprising a memory, a processor, and a program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the adaptive secure proxy re-encryption method with compact security as described in any one of claims 1-7.

Images