A method for key encapsulation and encryption with unintentional password authentication

Abstract

The present application belongs to the field of authentication encryption technology, and provides an involuntary password authentication key encapsulation and encryption method, which performs initialization, generates public parameters and keys; generates an authentication token required for encapsulating and decapsulating a data encryption key; encapsulates random group elements by using the authentication token for key encapsulation and decapsulation; and only a user with a correct authentication token can restore the original random group elements. In a cloud storage participating scenario, the present application encrypts data by using a high-entropy key, the key is securely encapsulated under an easily remembered password, the password is kept hidden from all other participants, and the protection of user private data is realized.

Description

Technical Field

[0001] This invention belongs to the field of authentication and encryption technology, specifically relating to a method for encapsulating and encrypting unintentional password authentication keys. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Modern remote storage services and cloud platforms have become crucial infrastructure for information systems, providing users with cross-device data storage, access, and synchronization capabilities. These services inevitably handle highly sensitive user information, including personally identifiable information, medical and health data, and financial transaction records. Therefore, how to achieve secure data storage and use without compromising user privacy has become a key research issue in the field of applied cryptography.

[0004] As one of the representative real-world application scenarios, in the cloud storage scenario, users upload personal data (such as documents, photos, videos, or backup files) to cloud servers for long-term storage and multi-terminal synchronization. There are two main data management modes in the existing system: (1) Most cloud storage trusts cloud service providers, and the encryption, decryption, and key management of data are all the responsibility of cloud service providers. Once the server is compromised or internal personnel abuse their power, the confidentiality of user data will be seriously threatened. For example, when users upload personal photos to the cloud for backup, the cloud server uses its own managed key for encrypted storage. If the server key is leaked, attackers can directly decrypt and obtain the content of the user's photos. (2) Some cloud storage uses client-side encryption and decryption operations, and the server only stores ciphertext data. This method reduces the server's ability to access plaintext data and brings a complex key management burden to users. For example, users encrypt files locally and then upload them to the cloud for storage, but they need to save the encryption key or mnemonic phrase themselves. Once the device is damaged or the key is lost, even if the data in the cloud still exists, it cannot be decrypted and recovered. In both cloud storage scenarios, the server does not allow access to plaintext data.

[0005] Cloud platforms are also widely used in online service scenarios, such as e-commerce, subscription services, or payment systems. In such applications, servers need to access or use some encrypted user information in subsequent business processing without exposing complete sensitive data. For example, in online payment platforms, users need to submit sensitive information such as credit card numbers and account credentials to the server for encrypted storage for subsequent automatic deductions or subscription renewals. Servers need to participate in some calculations or verification processes with legal authorization, but should not obtain user passwords or plaintext sensitive data. In many real-world systems, cloud storage scenarios and online service storage scenarios often coexist. For example, the same cloud platform provides users with both personal data backup services and online services such as payment, subscription, or identity authentication. Users typically expect to securely manage all cloud data and service permissions using only a single, easy-to-remember password. However, existing solutions are usually designed separately for different scenarios, lacking a unified cryptographic framework, leading to increased system complexity and introducing potential security vulnerabilities. This dual service requires exposing a trade-off between user data confidentiality and server auxiliary functions, prompting the generation of a unified cryptographic framework to securely support cloud storage and online service storage.

[0006] Passwords, as a practical alternative to cryptographic keys, eliminate the need for dedicated key storage devices and are widely used in modern authentication systems. However, using passwords to protect data also presents several significant challenges. First, human-memorable passwords are inherently low in entropy and vulnerable to dictionary attacks. Second, the security of most schemes relies on Transport Layer Security (TLS), making them susceptible to potential flaws and backdoors in real-world implementations, thereby compromising the confidentiality and integrity of user data. A third challenge lies in supporting cloud storage and online service storage scenarios, each requiring different technological solutions. Therefore, enabling users to efficiently and conveniently manage personal data stored in the cloud with just a password remains a field worth exploring. Summary of the Invention

[0007] To address the aforementioned issues, this invention proposes an unintentional password authentication key encapsulation and encryption method. In cloud storage scenarios, this invention utilizes high-entropy keys to encrypt data. The key is securely encapsulated within an easy-to-remember password, ensuring that the password remains hidden from all other participants and thus protecting user privacy data.

[0008] According to some embodiments, the present invention adopts the following technical solution: A method for encapsulating unintentional password authentication keys includes the following steps: Perform initialization to generate common parameters and keys; Authentication tokens required to generate encryption keys for encapsulating and decapsulating data; The authentication token is used to encapsulate and decapsulate the key, and the random group elements are encapsulated. Only users with the correct authentication token can recover the original random group elements.

[0009] As an alternative implementation, the process of initialization and generating public parameters and keys includes: specifying security parameters. Choose a cyclic group of prime order q. The generator is g; Instantiate three cryptographic hash functions. ; The server generates its secret key through uniform random sampling. The final publicly available parameters are: The server's private key is .

[0010] As an alternative implementation, the process of generating the authentication token required for encapsulating and decapsulating data encryption keys includes: the client sending a blinded password pw to the server, and randomly sampling to obtain... Calculate password blinding value ; The server uses the private key sk to calculate the response value for the blinded password. ,in, For the user's identifier, This is the identifier for the server; After receiving the response value, the client deblinds it to obtain the authentication token y. .

[0011] As an alternative implementation, the process of encapsulating and decapsulating keys using authentication tokens includes: The data encryption key encapsulation step involves uniform random sampling. Encapsulate using authentication token y , ,from Derive the data encryption key ; Data encryption key The decapsulation process allows the user to recover the data using the authentication token y. This allows for the reconstruction of the data encryption key. .

[0012] An unintentional password authentication encryption method, based on the above method, includes the following steps: Perform initialization to generate all common parameters required for subsequent encryption and decryption stages; The client uses an authentication token derived from the password to encrypt the data and stores the ciphertext and the encapsulated key on the server; Decryption is performed to recover the plaintext data, ensuring that the client ultimately obtains the original data when the client provides the correct password.

[0013] As an alternative implementation, the process of initializing and generating all common parameters required for subsequent encryption and decryption stages includes: Generate security parameters The server runs and initializes, generating public parameters and keys, and obtaining the public parameters. The server initializes an empty list. It is used to track user data and store user identifiers and data file identifiers; User initializes an identifier And choose a private password. .

[0014] As an alternative implementation, the process of the client encrypting data using an authentication token derived from a password and storing the ciphertext and the encapsulated key on the server includes: in a cloud storage scenario, the client and server generate an authentication token y required for encapsulating and decapsulating the data encryption key; the server runs a zero-knowledge proof scheme to provide authentication and generates a discrete logarithm proof. , The client performs verification and confirmation. The effectiveness, ; The client and server use authentication tokens to encapsulate and decapsulate keys, obtaining the data encryption key k and the encapsulated value of the data encryption key k. ,in, The identifier chosen by the user for the data file; The client then encrypts the data m using the authentication encryption scheme and the data encryption key k, obtaining ciphertext c. The ciphertext c and the encapsulated value of the data encryption key k are then... The key is sent to the server, which checks the tuple before receiving it. , Is it already in the storage table? It exists in the file. Finally, the client erases all local sensitive material.

[0015] As an alternative implementation, the process of the client encrypting data using an authentication token derived from a password and storing the ciphertext and the encapsulated key on the server includes: in a cloud online service scenario, the client and server generate authentication tokens required for encapsulating and decapsulating the data encryption key; the server runs a zero-knowledge proof scheme to provide identity authentication and generates a discrete logarithm proof. , The client performs verification and confirmation. The effectiveness, Meanwhile, the client and server perform an unintentional pseudo-random function operation, and the client ultimately calculates a clue key. And combine them into a certification label ; The client and server use authentication tokens to encapsulate and decapsulate keys, obtaining the data encryption key k and the encapsulated value of the data encryption key k. ,in, The identifier chosen by the user for the data file; The client then uses the authentication encryption scheme and data encryption key k to encrypt the data m, obtaining ciphertext c. The ciphertext c and the encapsulated value of the data encryption key k are then... The authentication tag t is sent to the server. Before receiving the encapsulated key, the server checks the tuple ( , Is it already in the storage table? The data exists. Finally, the client securely erases all local sensitive material.

[0016] As an alternative implementation, the process of decrypting and recovering the plaintext data includes: in a cloud storage scenario, the client generates an authentication token y required for encapsulating and decapsulating the data encryption key; the client regenerates the authentication token y using the password pw; and simultaneously, the server verifies the storage list. Does a tuple exist in ( ) , If it does not exist, the service will be terminated; otherwise, the ciphertext c and the encapsulated key value will be stored. Return to the client; The client uses the authentication token to encapsulate and decapsulate the key to obtain the data encryption key k. The client then uses the corresponding authentication encryption scheme and the recovered data encryption key k to decrypt the ciphertext c and obtain the plaintext data.

[0017] As an alternative implementation, the process of decrypting and restoring the plaintext data includes: in a cloud online service scenario, the client generates an authentication token required for encapsulating and decapsulating the data encryption key; using the password pw, the authentication token y is regenerated; and the server runs an unintentional pseudo-random function operation to generate... At the same time, the server verifies the storage list. If the tuple (uid, mid) exists, terminate the service; otherwise, encapsulate the ciphertext c and the key value. and Return to the client; The client uses the authentication token to encapsulate and decapsulate the key to obtain the data encryption key k; the client uses the corresponding authentication encryption scheme and the recovered data encryption key k to decrypt the ciphertext c to obtain the plaintext data. Client computing The response value assists the server in regenerating the authentication tag t, and the response value... Send to the server, the server according to Recover And the symmetric key k, and recalculate the authentication tag. ,if If so, the server obtains the client's authentication and decrypts the ciphertext using the key k.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention proposes an unintentional password authentication encryption method for a remote storage framework. The client encrypts data and encryption keys with the assistance of the server using a password, while the server cannot obtain the client's password. This can alleviate common vulnerabilities in existing password-based remote storage systems.

[0019] In cloud storage scenarios, this invention utilizes high-entropy keys to encrypt data. The key is securely encapsulated in an easy-to-remember password, ensuring that the password remains hidden from all other participants and thus protecting user privacy data.

[0020] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0021] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0022] Figure 1 This is a diagram of the overall system architecture. Figure 2 A flowchart for the Unintentional Password Authentication Key Encapsulation Mechanism (OPaKEM); Figure 3 Flowchart for Unintentional Password Authentication Encryption (OPAE); Figure 4 A flowchart for Unintentional Password Authentication (OPA); Figure 5 The flowchart for the Unintentional Pseudo-Random Function (OPRF); Figure 6 A flowchart of 3HashSDHI, a partially unintentional pseudo-random function (POPRF); Figure 7 This is a flowchart for the TwinStore instance. Detailed Implementation

[0023] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0025] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0026] Where there is no conflict, the embodiments and features described in this application may be combined with each other.

[0027] Example 1 An unintentional password authentication encryption (OPAE) scheme. The implementation of the unintentional password authentication encryption (OPAE) scheme is based on the unintentional password authentication key encapsulation mechanism (OPaKEM).

[0028] An unintentional password authentication key encapsulation mechanism (OPaKEM) is constructed based on a partially unintentional pseudo-random function (POPRF) instance (3HashSDHI) to encapsulate data encryption keys. OPaKEM involves two parties: a client and a server. Figure 1 As shown, it mainly consists of three stages: initialization, authentication token generation, and key encapsulation and decapsulation. Figure 2 As shown, the specific steps include: Step 1, initialization phase, generates public parameters and keys.

[0029] Step 1.1: First, specify the security parameters. Choose a cyclic group of prime order q. The generator is g.

[0030] Step 1.2, instantiate three cryptographic hash functions. .

[0031] Step 1.3: The server generates its secret key through uniform random sampling. The final publicly available parameters are: The server's private key is .

[0032] Step 2, Authentication Token Generation Stage: Derive the authentication token required for the encryption keys of the encapsulated and decapsulated data.

[0033] Step 2.1: The client sends the password pw to the server after it has been blinded, and obtains it through random sampling. Calculate password blinding value .

[0034] Step 2.2, the server uses the private key sk to calculate the response value of the blinded password. Where uid is the user identifier and sid is the server identifier.

[0035] Step 2.3: After receiving the response value, the client deblinds the authentication token y. .

[0036] Step 3, the key encapsulation and decapsulation stage, uses the authentication token y to encapsulate and decapsulate the key. The core step is to use a random group element ( This is encapsulated so that only users with the correct authentication token can recover the original data. .

[0037] Step 3.1, the data encryption key encapsulation step, involves uniform random sampling. Encapsulate using authentication token y , ,from Derive the data encryption key .

[0038] Step 3.2, Data Encryption Key The decapsulation process allows the user to recover the data using the authentication token y. This allows for the reconstruction of the data encryption key. .

[0039] Example 2 This embodiment proposes an Unintentional Password Authentication Encryption (OPAE) scheme based on the Unintentional Password Authentication Key Encapsulation Mechanism (OPaKEM). Two OPAE protocols are constructed, tailored for different remote storage scenarios (cloud storage and cloud online service storage), demonstrating applicability. Figure 3 As shown.

[0040] The OPAE solution in cloud storage scenarios includes three steps: initialization, encryption, and decryption. The specific implementation of these steps is shown below: Step 1, Initialization Step, generates all the common parameters required for subsequent encryption and decryption stages.

[0041] Step 1.1, Generate security parameters The server SID runs step 1 of OPaKEM to obtain common parameters. The server initializes an empty list. It is used to track user data and store user identifiers and data file identifiers.

[0042] Step 1.2, the user initializes an identifier. And choose a private password. .

[0043] Step 2, the step of encrypting data, the client uses a password. Derived authentication token The data is encrypted, and the ciphertext and the encapsulated key are stored on the server.

[0044] Step 2.1: The client and server execute Step 2 of OPaKEM, namely the generation phase of the authentication token y. Simultaneously, the server runs a zero-knowledge proof scheme to provide identity authentication and generate a discrete logarithm proof. , The client performs verification and confirms. The effectiveness, .

[0045] Step 2.2: The client and server perform the key encapsulation stage in Step 3 of OPaKEM to obtain the data encryption key k and the encapsulation value of the data encryption key k. , where mid is the identifier selected by the user for the data file.

[0046] Step 2.3: The client then encrypts the data m using the authentication encryption scheme and the data encryption key k, obtaining ciphertext c. The ciphertext c and the encapsulated value of the data encryption key k are then... The key is sent to the server. Before receiving the encapsulated key, the server needs to check whether the tuple (uid, mid) already exists in the storage table. It exists within. Finally, the client can safely erase all local sensitive material.

[0047] Step 3, the process of decrypting and recovering plaintext data. This step involves decryption if the client can provide the correct password. Then the client can eventually obtain the original data m.

[0048] Step 3.1: The client performs step 2 of OPaKEM, namely the generation phase of authentication token y, by regenerating authentication token y using the password pw. Simultaneously, the server verifies the stored list. If the tuple (uid, mid) exists, terminate the service; otherwise, encapsulate the ciphertext c and the key value. Return to the client.

[0049] Step 3.2: The client performs the key decapsulation stage in step 3 of OPaKEM to obtain the data encryption key k.

[0050] Step 3.3: Subsequently, the client uses the corresponding authentication encryption scheme and the recovered data encryption key k to decrypt the ciphertext c and obtain the plaintext data.

[0051] The OPAE solution in cloud online service scenarios includes three steps: initialization, encryption, and decryption. The specific implementation of these steps is shown below: Step 1, Initialization Step, generates all the common parameters required for subsequent encryption and decryption stages.

[0052] Step 1.1, Generate security parameters The server SID runs step 1 of OPaKEM to obtain common parameters. The server initializes an empty list. It is used to track user data, store user identifiers, identifiers of data files, and authentication tags t, which are used to verify the user's identity based on the provided password.

[0053] Step 1.2, the user initializes an identifier. And choose a private password. .

[0054] Step 2, the step of encrypting data, the client uses a password. Derived authentication token The data is encrypted, and the ciphertext and the encapsulated key are stored on the server. At the same time, an authentication tag t is generated, which determines whether the server is granted permission to decrypt sensitive data later.

[0055] Step 2.1: The client and server execute Step 2 of OPaKEM, namely the generation phase of the authentication token y. The server runs a zero-knowledge proof scheme to provide identity authentication and generates a discrete logarithm proof. , The client performs verification and confirms. The effectiveness, Simultaneously, the client and server perform OPRF operations, such as... Figure 5 As shown, the client ultimately calculates a clue key. And combine them into a certification label .

[0056] Step 2.2: The client and server perform the key encapsulation stage in Step 3 of OPaKEM to obtain the data encryption key k and the encapsulation value of the data encryption key k. , where mid is the identifier selected by the user for the data file.

[0057] Step 2.3: The client then encrypts the data m using the authentication encryption scheme and the data encryption key k, obtaining ciphertext c. The ciphertext c and the encapsulated value of the data encryption key k are then... The authentication tag t is sent to the server. Before receiving the encapsulated key, the server needs to check whether the tuple (uid, mid) already exists in the storage table. It exists within. Finally, the client can safely erase all local sensitive material.

[0058] Step 3, the process of decrypting and recovering plaintext data. This step involves decryption if the client can provide the correct password. Then the client can eventually recover the original data m.

[0059] Step 3.1: The client performs step 2 of OPaKEM, namely the generation phase of authentication token y, by regenerating authentication token y using the password pw. The server runs the OPRF operation to generate... At the same time, the server verifies the storage list. If the tuple (uid, mid) exists, terminate the service; otherwise, encapsulate the ciphertext c and the key value. and Return to the client.

[0060] Step 3.2: The client performs the key decapsulation stage in step 3 of OPaKEM to obtain the data encryption key k.

[0061] Step 3.3: Subsequently, the client uses the corresponding authentication encryption scheme and the recovered data encryption key k to decrypt the ciphertext c and obtain the plaintext data.

[0062] Step 3.4, Client-side calculation The response value assists the server in regenerating the authentication tag t. The response value... Send to the server, the server according to Recover And the symmetric key k, and recalculate the authentication tag. ,if Then the server obtains the client's authentication and decrypts the ciphertext using the key k.

[0063] Example 3 This embodiment derives an unintentional password authentication (OPA) mechanism from the OPAE scheme of the above embodiments, such as... Figure 4 As shown, the main steps are as follows: Step 1, Initialization Phase: The client and server perform Unintentional Password Authentication Key Encapsulation Mechanism (OPaKEM) Step 1, Generating Common Parameters. .

[0064] Step 2, registration phase: The client registers with the server.

[0065] Step 2.1, the client and server execute the 3HashSDHI protocol, such as... Figure 6 As shown. The client sends the password pw to the server after it has been blinded, and the password is obtained through random sampling. Calculate password blinding value The server uses the private key sk to calculate the response value for the blinded password. Where uid is the user's identifier and sid is the server's identifier. After receiving the response value, the client deblinds it to obtain the authentication token y. .

[0066] Step 2.2, the client generates a token commitment. And send (uid, cy) to the server.

[0067] Step 3, authentication phase: The client authenticates its identity with the server.

[0068] Step 3.1: The client and server re-execute the 3HashSDHI protocol to generate authentication tokens. As long as the client uses the same password pw as during the registration phase, it can obtain the same authentication token as during the registration phase. .

[0069] Step 3.2: The server randomly samples a challenge message. The response is sent to the client, which then calculates the response. ; Send (b,rc) to the server.

[0070] Step 3.3, Server Check To determine if the statement is true or false, output 1 if the verification is successful, otherwise output 0.

[0071] Example 4 This embodiment, based on OPAE and OPA, developed TwinStore, a OPAE system for unintentional password authentication and encryption. It has two interchangeable instances: TwinStore-1 for cloud storage and TwinStore-2 for cloud online service storage. These two instances can be switched between each other, providing flexible deployment under different access policies.

[0072] TwinStore integrates the functionalities of OPA and OPAE, such as Figure 7As shown, the main steps are as follows: Step 1, initialization phase, generates public parameters and keys.

[0073] Step 1.1, the security parameters are: The server runs OPaKEM's first initialization phase, obtaining common parameters. Specify hash function Generate public-private key pairs ,in .

[0074] Step 1.2, the server initializes its identifier. And two empty lists, including the registration list Reg and the storage list Str.

[0075] Step 2, the registration phase, the client uses the password pw to register with the server by executing OPA.

[0076] Step 2.1, the client selects a public identifier. and a password .

[0077] Step 2.2: The client executes the OPA's second registration phase to complete identity registration.

[0078] Step 3, the authentication phase, involves the client using the password "pw" to execute OPA and gain system access. The client executes step 2 of the OPA authentication phase to authenticate with the server.

[0079] Step 4, encryption stage: The client and server interact to complete the encrypted storage of data.

[0080] Step 4.1, the client specifies a data identifier. Step 2 of the OPA process is the authentication phase.

[0081] Step 4.2: The client completes the encryption of the data and the encapsulation of the key by executing the encryption phase of OPAE, and stores the ciphertext and encapsulated value on the server.

[0082] Step 5, Decryption Phase: The client and server interact to complete data retrieval and decryption. The client retrieves and downloads the encrypted data from the server, executes the OPAE decryption phase, and completes the key decapsulation and data decryption.

[0083] Step 6, Key Update Phase: An optional key update phase allows the server to periodically rotate the encryption key.

[0084] Step 6.1, the server maintains a master key in the enclave. Save in storage ,in The server's private key .

[0085] Step 6.2: When the server needs to update the key, using msk as the existing master key, the server selects a new master key. ,calculate Update e to .

[0086] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of one or more computer-usable storage media (including, but not limited to, disk storage, etc.) containing computer-usable program code. CD - ROM It takes the form of a computer program product implemented on (such as optical memory, etc.).

[0087] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0088] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0089] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0090] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made by those skilled in the art without creative effort within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for encapsulating unintentional password authentication keys, characterized in that, Includes the following steps: Perform initialization to generate common parameters and keys; Authentication tokens required to generate encryption keys for encapsulating and decapsulating data; The authentication token is used to encapsulate and decapsulate the key, and the random group elements are encapsulated. Only users with the correct authentication token can recover the original random group elements. The process of generating the authentication token required for the encryption keys of the encapsulated and decapsulated data includes: the client sending the password pw to the server after blinding it, and obtaining it through random sampling. Calculate password blinding value ; The server uses the private key sk to calculate the response value for the blinded password. ,in, For the user's identifier, This is the identifier for the server; After receiving the response value, the client deblinds it to obtain the authentication token y. ; The process of encapsulating and decapsulating keys using authentication tokens includes: The data encryption key encapsulation step involves uniform random sampling. Encapsulate using authentication token y , ,from Derive the data encryption key ; Data encryption key The decapsulation process allows the user to recover the data using the authentication token y. This allows for the reconstruction of the data encryption key. .

2. The method for encapsulating an unintentional password authentication key as described in claim 1, characterized in that, The process of initialization and generating public parameters and keys includes: specifying security parameters. Choose a cyclic group of prime order q. The generator is g; Instantiate three cryptographic hash functions. ; The server generates its secret key through uniform random sampling. The final publicly available parameters are: The server's private key is .

3. A method for unintentional password authentication encryption, characterized in that, The method based on any one of claims 1-2 includes the following steps: Perform initialization to generate all common parameters required for subsequent encryption and decryption stages; The client uses an authentication token derived from the password to encrypt the data and stores the ciphertext and the encapsulated key on the server; Decryption is performed to recover the plaintext data, ensuring that the client ultimately obtains the original data when the client provides the correct password.

4. The method for unintentional password authentication encryption as described in claim 3, characterized in that, The process of initializing and generating all the common parameters required for subsequent encryption and decryption stages includes: Generate security parameters The server runs and initializes, generating public parameters and keys, and obtaining the public parameters. The server initializes an empty list. It is used to track user data and store user identifiers and data file identifiers; User initializes an identifier And choose a private password. .

5. The method for unintentional password authentication encryption as described in claim 3, characterized in that, The process by which the client encrypts data using an authentication token derived from a password and stores the ciphertext and the encapsulated key on the server includes: In a cloud storage scenario, the client and server generate the authentication token y required for encapsulating and decapsulating the data encryption key; the server runs a zero-knowledge proof scheme to provide authentication; and generates a discrete logarithm proof. , The client performs verification and confirmation. The effectiveness, ; The client and server use authentication tokens to encapsulate and decapsulate keys, obtaining the data encryption key k and the encapsulated value of the data encryption key k. ,in, The identifier chosen by the user for the data file; The client then encrypts the data m using the authentication encryption scheme and the data encryption key k, obtaining ciphertext c. The ciphertext c and the encapsulated value of the data encryption key k are then... The key is sent to the server, which checks the tuple before receiving it. , Is it already in the storage table? The client erases all local sensitive materials.

6. The method for unintentional password authentication encryption as described in claim 3, characterized in that, The process by which the client encrypts data using an authentication token derived from a password and stores the ciphertext and the encapsulated key on the server includes: In a cloud online service scenario, the client and server generate authentication tokens required for encapsulating and decapsulating the data encryption key; the server runs a zero-knowledge proof scheme to provide authentication; and a discrete logarithm proof is generated. , The client performs verification and confirmation. The effectiveness, Meanwhile, the client and server perform an unintentional pseudo-random function operation, and the client ultimately calculates a clue key. And combine them into a certification label ; The client and server use authentication tokens to encapsulate and decapsulate keys, obtaining the data encryption key k and the encapsulated value of the data encryption key k. ,in, The identifier chosen by the user for the data file; The client then uses the authentication encryption scheme and data encryption key k to encrypt the data m, obtaining ciphertext c. The ciphertext c and the encapsulated value of the data encryption key k are then... The authentication tag t is sent to the server. Before receiving the encapsulated key, the server checks the tuple ( , Is it already in the storage table? The client securely erases all local sensitive materials.

7. The method for unintentional password authentication encryption as described in claim 3, characterized in that, The process of decrypting and recovering plaintext data includes: In a cloud storage scenario, the client generates an authentication token y required for encapsulating and decapsulating the data encryption keys, regenerates the authentication token y using the password pw, and simultaneously, the server verifies the storage list. Does a tuple exist in ( ) , If it does not exist, the service will be terminated; otherwise, the ciphertext c and the encapsulated key value will be stored. Return to the client; The client uses the authentication token to encapsulate and decapsulate the key to obtain the data encryption key k. The client then uses the corresponding authentication encryption scheme and the recovered data encryption key k to decrypt the ciphertext c and obtain the plaintext data.

8. The method for unintentional password authentication encryption as described in claim 3, characterized in that, The process of decrypting and recovering plaintext data includes: In a cloud online service scenario, the client generates an authentication token required for encapsulating and decapsulating the data encryption key; the client regenerates the authentication token y using the password pw; and the server runs an unintentional pseudo-random function operation to generate... At the same time, the server verifies the storage list. If the tuple (uid, mid) exists, terminate the service; otherwise, encapsulate the ciphertext c and the key value. and Return to the client; The client uses the authentication token to encapsulate and decapsulate the key to obtain the data encryption key k; the client uses the corresponding authentication encryption scheme and the recovered data encryption key k to decrypt the ciphertext c to obtain the plaintext data. Client computing The response value assists the server in regenerating the authentication tag t, and the response value... Send to the server, the server according to Recover And the symmetric key k, and recalculate the authentication tag. ,if If so, the server obtains the client's authentication and decrypts the ciphertext using the key k.

Images