Forward and backward security searchable encryption method and system supporting access authorization

Abstract

The invention designs a forward and backward security searchable encryption method and system supporting access authorization. Comprising the steps that when a data owner uploads data, an access control strategy of the data is uploaded at the same time, and the autonomy of a user to the data is improved; before a data user retrieves the data, an access control authorization link is added, fine-grained access control of the encrypted data is achieved, and the practicability and the safety of ciphertext data retrieval are improved; a probabilistic trap door generation algorithm is designed, random numbers are added into trap door information, so that different trap doors are generated in each retrieval, and off-line keyword guessing attacks are resisted; based on a puncturable encryption primitive, an entry is operated to add a label, and a ciphertext with a specific label is deleted by updating a key, so that backward security is realized; and an updatable encryption technology is introduced, and a client key and an encryption database are updated according to an updating strategy, so that the security risk caused by key damage is avoided, and the security of the searchable encryption method is further improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and relates to a forward and backward secure searchable encryption method and system supporting access authorization. BACKGROUND

[0002] With the rapid development of new generation information technologies such as big data and cloud computing, data has become an important strategic resource in the network era. As the most characteristic production factor of the times, data is the new driving force of economic development and the new engine of social development. Due to the limitations of local storage (such as geographical restrictions, high labor costs, machine maintenance costs, etc.), the pay-as-you-go mode and powerful functions of cloud computing have prompted individuals and organizations to outsource data storage and computing tasks to cloud servers. However, outsourcing data to the cloud can lead to a loss of control over data by users, thus making data privacy a key issue. Although data can be encrypted before outsourcing using traditional encryption algorithms, this makes data less usable. Therefore, methods that enable privacy-preserving search on encrypted data have become a hot research direction.

[0003] Searchable symmetric encryption (SSE) technology allows users to search encrypted data while protecting data privacy. In recent years, there have been many technical advances in the field of SSE, particularly in attacks on SSE and corresponding privacy protection defenses and various functional extensions of SSE. With the extensive research on SSE in recent years, the gap in practicality between SSE and plaintext databases is gradually narrowing, and there is good application prospect in various fields. Even so, there are still the following problems in the practical application of SSE that need to be solved urgently: (1) Existing searchable encryption technology lacks access permission management for users, making it difficult to meet the fine-grained access control requirements of encrypted data; (2) Existing schemes have deficiencies in security against complex attacks, such as keyword guessing attacks; (3) Existing searchable encryption schemes lack effective key update mechanisms, and once the key is leaked or damaged, the security of the system will face great security risks. SUMMARY

[0004] In view of the deficiencies of the prior art, the present application combines attribute-based access control technology, puncturable encryption and updateable encryption primitives to construct a forward and backward dynamic searchable encryption method and system supporting access authorization, realizes fine-grained access control of encrypted data, and improves the practicality and security of ciphertext data retrieval; a probabilistic trapdoor generation algorithm is designed to realize trapdoor indistinguishability and resist offline keyword guessing attacks; puncturable encryption and updateable encryption primitives are introduced to further improve the security of the searchable encryption method.

[0005] The application discloses a forward and backward secure searchable encryption method supporting access authorization. , a secret state State and an encrypted database EDB of a server side; A data updating step: the client uses the client key to perform an encryption operation on an operation entry containing an operation type, a keyword and a file identifier and a label t, and updates the secret state State and the encrypted database EDB; An access authorization step: after receiving a search request of the client, the server queries subject attributes of the client, object attributes of target data and an access control policy, performs access control determination, and only when authorization is passed, can subsequent search be performed; A trapdoor generation step: the client inputs the public parameter PP, a keyword to be searched w, the client key and the label t, and outputs an updated key and a search trapdoor , wherein the trapdoor is generated by introducing a random number, so that the trapdoor generated for the same keyword each time is different; A data search step: the server uses the search trapdoor and the updated key to search the encrypted database EDB, decrypts the operation entry and processes the file identifier according to the operation type, generates a search result list and returns the search result list to the client; A key updating step: the client generates a key updating token Δ, and uses the token Δ to update the client key = , and the server uses the token Δ to update the encrypted database . Further, the client key includes a key for generating the search trapdoor and a key for decrypting a data file.

[0006] Further, the operation type in the data updating step includes data addition add and data deletion del.

[0007] Further, the data updating step uses a puncturable encryption primitive to encrypt the operation entry and the label t, so that the updated key generated in the trapdoor generation step cannot decrypt ciphertext with the label t, thereby realizing backward security.

[0008] Further, the access authorization step is based on an attribute-based access control model, which matches subject attributes, object attributes, request operations with rules in the access control policy, and performs policy conflict analysis to output an authorization result.

[0009] Further, in the trapdoor generation step, the client key K is processed by a puncturing algorithm with the tag t to generate the updated key K . .

[0010] Further, the key update step uses an updatable encryption primitive to convert ciphertext in the encrypted database EDB into ciphertext that can be decrypted by the updated client key K without decrypting the data, thereby achieving forward security.

[0011] Based on the same inventive concept, the application also provides a system for implementing a forward and backward secure searchable encryption method supporting access authorization, comprising: a client for performing system initialization, data update, trapdoor generation, key update operations, and sending a search request; a server for storing an encrypted database EDB, subject attributes, object attributes, and access control policies, and performing access authorization determination and data search operations.

[0012] Further, the client uploads the data attribute access control policy Policy as metadata to the server when updating data.

[0013] Based on the same inventive concept, the application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a forward and backward secure searchable encryption method supporting access authorization.

[0014] Compared with the prior art, the application has the following advantages and beneficial effects: 1. Compared with the prior art, the application can support dynamic access authorization, resist keyword guessing attacks, have forward and backward security, and enhance the security and practicality of encrypted data search.

[0015] 2. Compared with the prior art that does not use updatable encryption, the application can efficiently update the client key, avoid security risks caused by key damage, and effectively improve the security of the system.

[0016] 3. Compared with the prior art based on puncturable encryption and updatable encryption, the application supports data owners to customize data access control policies, effectively improves the autonomy of users over data, supports access control authorization, and can achieve fine-grained access control of encrypted data. BRIEF DESCRIPTION OF DRAWINGS ​

[0017] Figure 1 This is a flowchart of the forward and backward secure searchable encryption method system that supports access authorization according to the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0019] Terminology Explanation Attribute-based access control (ABAC) is a trusted relational access control model that uses the attributes of related entities (such as subjects, objects, and environments) as the basis for authorization to study how to perform access control. For this purpose, entity attributes can be divided into subject attributes, object attributes, and environment attributes. In attribute-based access control, access decisions are based on the attributes possessed by the requester and the resource. Requesters and resources are identified through characteristics in ABAC, giving ABAC sufficient flexibility and scalability, while also enabling secure anonymous access.

[0020] Punctuable encryption (PE) can be used to achieve backward security in searchable encryption. Each message is tagged, and ciphertext with a specific tag can be removed by re-keying. In a puncturable encryption scheme, the key can be updated using a "puncture algorithm." This algorithm takes the current key and a tag (or specific information) as input and outputs a new key. The new key can decrypt all ciphertext not encrypted with that tag, but cannot decrypt ciphertext encrypted with that tag.

[0021] The core idea of ​​Updateable Encryption (UE) is to allow encrypted data to be converted from an old key to a new key without revealing the plaintext data. This technology is typically implemented using an update token, which is generated by the key holder and indicates how to update the ciphertext from the old key to the new key.

[0022] Example 1 A forward-and-backward secure dynamic symmetric searchable encryption method supporting access authorization, as shown in the appendix. Figure 1 As shown, its specific description includes: 1. System Initialization System initialization algorithm With safety parameters As input, generate common parameters Establish a secure channel and generate a key for the client. and secret state Generate an encrypted database for the server .

[0023]

[0024] The client referred to in this invention is a legitimate user in the system, whose identity information in the system includes their subject attributes. And this attribute is updated dynamically.

[0025] Client key ,in Used for retrieval. Used to decrypt files.

[0026] The secret state and the encrypted database are two empty mappings. , .

[0027] 2. Data Update Data update algorithm With client key Operation Items ,Label Secret State and encrypted database As input, output the updated secret state. and encrypted database .

[0028]

[0029] During the data addition phase, the client will access data attributes. and control strategies As additional information, the identifier of the encrypted data to be uploaded Together they form metadata The same applies when data is stored on the server and deleted.

[0030] operate Including new data and data deletion Two update operations, Keywords to be searched This is the file identifier.

[0031] The algorithm uses puncture-proof encryption to secure operation entries. and tags Perform encryption operations.

[0032] The puncturable encryption scheme PE consists of four algorithms (KeyGen, Encrypt, Puncture, Decrypt) that encrypt the operation item and the label The specific process is as follows: (1) PE.KeyGen(l λ ): The key generation algorithm outputs the public key PK PE and the initial private key SK PE . (2) PE.Encrypt(PK PE , M, t): The encryption algorithm outputs the ciphertext CT of the tuple composed of the operation item and its label t. (3) PE.Puncture(SK i , t): The puncture algorithm outputs a new key SK i+1 which cannot decrypt the ciphertext with label t, and in addition can decrypt all the ciphertexts that SK i can decrypt. (4) PE.Decrypt(SK i , CT, t): If decrypted correctly, the decryption algorithm outputs the plaintext M, otherwise it outputs ⊥.

[0033] The final result of the algorithm execution is to complete the update of the secret state and the encrypted database .

[0034] 3. Access authorization The access authorization algorithm takes the client request , subject attributes , object attributes and access control policies as input, and outputs the authorization result .

[0035]

[0036] The server queries the subject attributes , object attributes and access control policies respectively, and makes access control decisions according to the queried attribute and policy information, first matching the attributes, policies and requests

[0037]

[0038]

[0039] Then the strategy conflict analysis

[0040] If the result is true, enter the trap generation phase, otherwise deny access.

[0041] 4. Trap generation Trap generation algorithm Take public parameters , the keyword to be queried And the client key And the label As input, output new key And search trap .

[0042]

[0043] The puncture algorithm outputs a new key , so that the updated key Cannot decrypt the ciphertext with label , and can decrypt all ciphertexts that can be encrypted In addition.

[0044] The client selects a random number Participate in trap generation, generate search trap Its main idea is to add random values to trap information, so that different traps are generated each time the search is performed.

[0045] 5. Data retrieval Data retrieval algorithm Take search trap , secret state , encrypted database As input, output the search result list .

[0046]

[0047] The server uses the search trap And the key , search the encrypted database , and use the key Decryption operation entry, get file identifier And its corresponding operation , according to the operation to add or delete the file, put it into the result list , return to the client.

[0048] 6. Key update Key update algorithm With client key , secret state , encrypted database As input, output updated key , secret state And encrypted database .

[0049]

[0050] Client randomly selects key update token , calculate .

[0051] Server updates encrypted database .

[0052] The design introduces an updateable encryption, which can realize data security after key leakage, that is, after the database is updated, the previous key cannot access the database, which can prevent the harm caused by key leakage Embodiment two Based on the same inventive concept, the application also provides a system for realizing a forward and backward secure searchable encryption method supporting access authorization, comprising: a client, configured to perform system initialization, data update, trapdoor generation, key update operation, and send a search request; a server, configured to store an encrypted database EDB, subject attribute, object attribute and access control policy, and perform access authorization determination and data search operation.

[0053] Among them, the client uploads the data attribute access control policy Policy as metadata to the server at the time of data update.

[0054] Since the device introduced in embodiment two of the application is a computer readable medium used to implement the forward and backward secure dynamic symmetric searchable encryption method supporting access authorization of embodiment one of the application, the specific structure and deformation of the electronic device can be understood by those skilled in the art based on the method introduced in embodiment one of the application, so the specific structure and deformation of the electronic device will not be described here. Any electronic device used in the method of embodiment one of the application belongs to the scope of protection of the application.

[0055] Embodiment three Based on the same inventive concept, the application also provides a computer readable medium having a computer program stored thereon, wherein the program is executed by a processor to realize the method described in embodiment one.

[0056] Since the device introduced in the embodiment three of the present application is a computer readable medium for implementing the computer readable medium of the forward and backward security dynamic symmetric searchable encryption method supporting access authorization in the embodiment one of the present application, the specific structure and deformation of the electronic device can be understood by the person skilled in the art based on the method introduced in the embodiment one of the present application, and thus will not be described here again. The electronic device used in the method of the embodiment one of the present application belongs to the scope of the present application.

[0057] The specific embodiments described herein merely exemplify the spirit of the present application. Those skilled in the art of the present application can make various modifications or supplements to the described specific embodiments or replace them with similar ways, but will not deviate from the spirit of the present application or exceed the scope defined by the appended claims.

Claims

1. A forward and backward secure searchable encryption method supporting access authorization, characterized by, The method comprises the following steps: System initialization step: input security parameter λ, generate public parameters PP, client key , secret state State and server-side encrypted database EDB; Data update step: the client uses the client key performing an encryption operation on an operation entry containing an operation type, a keyword and a file identifier, and a tag t, updating the secret state State and the encrypted database EDB; The access authorization step: after receiving the retrieval request of the client, the server queries the subject attribute of the client, the object attribute of the target data and the access control policy, performs access control judgment, and only after authorization is passed, the subsequent retrieval can be executed; Trapdoor generating step: the client inputs public parameter PP, the keyword to be queried w, the client key and the tag t, and outputs the updated key and the search trapdoor , wherein the generation of the trapdoor introduces a random number, so that the trapdoor generated each time for the same keyword is different. Data retrieval step: the server uses the search trapdoor and the updated key The encrypted database EDB is searched, the operation entry is decrypted and the file identifier is processed according to the operation type, generating a search result list returned to the client; Key update step: the client generates a key update token Δ and uses said token Δ to update the client key = , while the server uses said token Δ to update the encrypted database .

2. The method of claim 1, wherein, The client key comprises a key for generating a retrieval trapdoor and a key for decrypting the data file .

3. The method of claim 1, wherein, The operation type in the data updating step includes data addition add and data deletion del.

4. The method of claim 1, wherein, The data update step encrypts the operation entry and tag t using a puncturable encryption primitive such that subsequent updates by the trapdoor generation step The ciphertext with tag t cannot be decrypted, achieving backward security.

5. The method of claim 1, wherein, The access authorization step is based on an attribute-based access control model, which matches the subject attribute, the object attribute, the request operation and the rules in the access control policy, and performs policy conflict analysis to output the authorization result.

6. The method of claim 1, wherein, In the trapdoor generating step, the client key is processed by a puncturing algorithm with the tag t to generate the updated key . .

7. The method of claim 1, wherein, The key update step uses an updatable encryption primitive to transform the ciphertext in the encrypted database EDB by the update token D without decrypting the data, making it decryptable by the updated client key decrypting, thereby achieving forward security.

8. A forward and backward secure searchable encryption system supporting access authorization implementing the method according to any one of claims 1 to 7, characterized in that, It comprises: The client is used for performing system initialization, data updating, trap generation, key updating operation, and sending retrieval request; the server is used for storing encrypted database EDB, subject attribute, object attribute and access control policy, and performing access authorization judgment and data retrieval operation.

9. The system of claim 8, wherein, The client uploads the data attribute access control policy Policy as metadata to the server when updating data. 10.A computer readable storage medium, having stored thereon a computer program, which when executed by a processor, implements the method of any one of claims 1-7.

Images