A log security storage method based on distributed LowMC encryption

Abstract

This invention discloses a secure log storage method based on distributed LowMC encryption, comprising: obtaining a log secret share sent by a client; using a pre-held escrow key secret share as private input, and obtaining an extended key through a lookup table-based LowMC algorithm, wherein the lookup table-based LowMC algorithm includes: XORing the current round with the escrow key secret share to obtain a round key; calculating the first few bits of the round key using an s-box based on a lookup table to obtain a nonlinear layer output secret share; performing linear calculations on the nonlinear layer output secret share and the remaining bits of the round key to obtain a linear layer output secret share; performing a bit-by-bit XORing of the linear layer output secret share with fixed parameters of LowMC to obtain the output of the LowMC algorithm; encrypting the log secret share based on the extended key and sending it to a storage server, thereby achieving secure log storage.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a secure log storage method based on distributed LowMC encryption. Background Technology

[0002] Logs are key data for recording system behavior, conducting security audits, and diagnosing faults. Traditional centralized log encryption storage has two significant drawbacks: (1) Single point of failure: The encryption key is centrally managed by the log platform. Once leaked, all historical encrypted logs may be decrypted in batches, causing serious data leakage; (2) Trust dependency: The data provider (client) must completely trust that the log platform will not tamper with or snoop on its plaintext log content before or after storage. Existing technologies such as conventional secret sharing or MPC-based data analysis, while focusing on data privacy, are not designed for the specific scenario of decentralized governance of the encryption operation itself. In addition, existing log encryption schemes still rely on a trusted center to perform encryption, which cannot solve the aforementioned fundamental trust problem. Log encryption under distributed keys is an effective solution. Traditional schemes mainly include two types: schemes based on fully homomorphic encryption (FHE), which can support direct computation on ciphertext, but have large computational latency and high resource consumption, and are not suitable for real-time encryption. While encryption schemes based on general MPC can maintain the privacy of keys and plaintext, the computational cost of nonlinear layers is high if S-box intensive cryptography such as AES or PRESENT is used.

[0003] A typical approach is to select block ciphers or pseudo-random generators (PRGs) such as AES or LowMC, describe them as Boolean gate circuits, and then perform security assessments using common secure multi-party computation protocols such as GMW, Yao obfuscation circuits, and SPDZ. The key is stored secretly on multiple servers, and the plaintext is also secretly shared. Servers compute the ciphertext or extended key using secure two-party or multi-party circuits. The main problems with this type of scheme include: (1) Huge computation and communication overhead: The S-box and linear layer of block ciphers or PRGs are decomposed into a large number of AND gates and XOR gates under Boolean circuits. The GMW / confusion circuit needs to interact with each AND gate or transmit ciphertext tags, resulting in many computation rounds and a large amount of communication. For scenarios that require batch encryption or high-frequency PRG calls, the system latency and bandwidth consumption are unacceptable.

[0004] (2) Implementation complexity caused by bit-level operations: Servers often need to frequently convert, package, and split between bit-level secret sharing, and even perform format conversion between Boolean sharing and arithmetic sharing. The protocol stack is complex and can easily introduce implementation errors and additional performance loss.

[0005] (3) Difficulty in fully utilizing the structural advantages of LowMC: The original design intention of LowMC is low gate count and low nonlinearity layer, which is suitable for evaluation in MPC. However, general circuit-type MPC usually performs gate-level evaluation of the circuit in a black box manner, without making special optimizations for the sparse S-box layer and regular linear layer of LowMC. As a result, the nonlinear part still becomes the performance bottleneck, and the structural advantages of LowMC are not fully utilized. Summary of the Invention

[0006] The purpose of this application is to address the problems existing in the prior art by providing a secure log storage method based on distributed LowMC encryption.

[0007] According to a first aspect of the embodiments of this application, a secure log storage method based on distributed LowMC encryption is provided, comprising: Obtain the secret share of the logs sent by the client; Using a pre-held escrow key secret share as private input, an extended key is obtained through a lookup table-based LowMC algorithm. The lookup table-based LowMC algorithm includes: XORing the current round with the escrow key secret share to obtain the round key; calculating the nonlinear layer output secret share using a lookup table-based s-box for the first few bits of the round key; performing linear calculations on the nonlinear layer output secret share and the remaining bits of the round key to obtain the linear layer output secret share; and performing a bit-by-bit XORing of the linear layer output secret share with fixed parameters of LowMC to obtain the output of the LowMC algorithm. The log secret share is encrypted using the extended key and sent to the storage server, thereby achieving secure log storage.

[0008] Furthermore, the extended key is obtained through n rounds of the LowMC algorithm based on a lookup table: [k]=LowMC(s, 0)|| LowMC(s, 1)||…|| LowMC(s, n), Where n is the length to be expanded, and s is the escrow key secret share.

[0009] Furthermore, in the extended key generation process, the output of the i-th round LowMC algorithm is used as the input of the (i+1)-th round LowMC algorithm, where i=1,2,…,n-1.

[0010] Furthermore, for a 128-bit LowMC(s, a), where s is the escrow key secret share and a is the current round, the lookup table-based LowMC algorithm includes: XOR the current round 'a' with the secret share 's' of the escrow key, and calculate the round key. ; Take the first 30 bits As input to the s-box, for each s-box, its possible inputs are transformed into offset index secret shares through two-way secure multiplication. The offset index secret shares are subtracted from the pre-acquired offset secret shares to obtain the index secret shares. The index secret shares are exchanged with another participant to restore the index. Based on the index, the output of the s-box is selected from the pre-acquired lookup table secret shares to obtain the nonlinear layer output secret shares. The output of each s-box is concatenated with the remaining bits of the round key and linearly calculated with the sparse matrix to obtain the secret share of the linear layer output. The output secret share of the linear layer is XORed bit by bit with the fixed parameters of LowMC to obtain the output of the LowMC algorithm in the a-th round.

[0011] Furthermore, the offset secret share and lookup table secret share of each s-box are pre-generated by the client and distributed to each server. For the first s-box, this process is as follows: For each possible input ,make Given the S-box input x, the corresponding lookup table obtained from the LowMC S-box formula is as follows: , Randomly generated offset ,Will Shift list to the left ,Will In the ring We perform a secret sharing on the top layer, and then secretly share the left-shifted list bit by bit to obtain the result. .

[0012] Furthermore, its possible inputs Transformed into an offset index secret share through two-way secure multiplication. Specifically: By performing safe multiplication on both sides, we obtain Secret sharing output ; The original input minus Secret sharing output ,get Input on .

[0013] According to a second aspect of the embodiments of this application, a log security storage system based on distributed LowMC encryption is provided, comprising: The client is used to share the plaintext secret of the logs to be stored with the two servers; Two servers are used, each receiving a log secret share sent by the client. Using its own pre-held escrow key secret share as private input, each server uses a lookup table-based LowMC algorithm to obtain an extended key. The log secret share is then encrypted using this extended key and sent to the storage server. The lookup table-based LowMC algorithm includes: XORing the current round with the escrow key secret share to obtain the round key; calculating the first few bits of the round key using an s-box based on a lookup table to obtain a non-linear layer output secret share; performing a linear calculation on the non-linear layer output secret share and the remaining bits of the round key to obtain a linear layer output secret share; and performing a bit-by-bit XORing of the linear layer output secret share with fixed parameters of LowMC to obtain the output of the LowMC algorithm. A storage server is used to receive encrypted log secret shares, recover the plaintext, and store it, thereby achieving secure log storage.

[0014] According to a third aspect of the embodiments of this application, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the method described in the third aspect.

[0015] According to a fourth aspect of the embodiments of this application, an electronic device is provided, comprising: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors perform the method as described in the first aspect.

[0016] According to a fifth aspect of the embodiments of this application, a computer-readable storage medium is provided that stores computer instructions thereon, which, when executed by a processor, implement the steps of the method as described in the first aspect.

[0017] The technical solutions provided by the embodiments of this application may include the following beneficial effects: As can be seen from the above embodiments, this application achieves deep collaborative optimization of the LowMC structure and the secret sharing protocol. First, considering that LowMC contains only a small number of 3-bit S-boxes, this invention proposes a nonlinear layer evaluation method based on a secret-shared lookup table. This transforms the S-box calculation, which would otherwise require multiple secure multiplications, into a one-hot selection process, significantly reducing nonlinear communication and computation costs.

[0018] In existing technologies, schemes based on general MPC for evaluating block ciphers suffer from problems such as a large number of nonlinear gates, high communication overhead, and poor real-time performance; schemes based on homomorphic encryption suffer from problems such as large ciphertext expansion, high computational cost, and reliance on strong security assumptions. This invention adopts a lightweight secret-sharing scheme. In the nonlinear layer, this invention does not use traditional MPC to perform multiple multiplication gate evaluations on the 3-bit S-box. Instead, it pre-constructs a secret-sharing lookup table and selects the correct output from the lookup table at runtime. This completely transforms the high-cost multiplication operation into a secure lookup process with constant complexity, significantly reducing nonlinear communication and accelerating the overall round function evaluation of LowMC.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] Figure 1 This is a flowchart illustrating a log secure storage method based on distributed LowMC encryption according to an exemplary embodiment.

[0022] Figure 2 This is a block diagram illustrating a log security storage device based on distributed LowMC encryption according to an exemplary embodiment.

[0023] Figure 3 This is a schematic diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0024] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application.

[0025] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0026] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0027] This application provides a secure log storage method based on distributed LowMC encryption. In this method, ownership of log data and control of the encryption key are technically and forcibly separated: the client divides the plaintext log to be stored into multiple secret fragments and distributes them to a group of pre-initialized servers, each holding only one secret fragment of the master key. These servers then initiate a secure multi-party computation protocol, using their respective key fragments and log fragments as private inputs. Without reconstructing the complete key or plaintext, they collaboratively execute the LowMC encryption algorithm in an encrypted state to jointly generate the final ciphertext log and output it for storage. This process ensures that, throughout the entire input-output chain, neither the complete encryption key nor the plaintext log exists in any single entity, thus achieving secure encrypted storage while eliminating the single-point leakage risk of centralized key management and the possibility of internal snooping or tampering by the data custodian. To accelerate the efficiency of LowMC encryption under secure multi-party computation, this scheme introduces a lookup table to evaluate the LowMC encryption scheme.

[0028] Specifically, this method includes the following steps: Step S1: The client secretly shares the plaintext log data, and both servers obtain the secret share [m] of the log data sent by the client. This secret sharing can be done using any method... Additive secret sharing, such as additive secret sharing, involves two servers that are pre-initialized and each holds a managed key secret share s=[key], which can be preset by the hardware manufacturer; Step S2: Each server uses its own share of the escrow key as private input and obtains the extended key through the LowMC algorithm based on the lookup table. Specifically, LowMC is a block cipher optimized for secure multi-party computation (MPC). Its characteristic is that each round contains only a very small number of nonlinear S-boxes (e.g., 10 3-bit S-boxes), while other operations are linear XOR or matrix multiplications. The overall structure of LowMC includes round key addition, a nonlinear S-box layer, and a linear diffusion layer. An S-box is a nonlinear transformation component in a cryptographic algorithm, mapping a number of input bits to an equal number of output bits to provide the cryptographic system with nonlinearity and resistance to linear attacks. LowMC uses 3-bit input, 3-bit output S-boxes, far fewer than traditional ciphers (such as the 8-bit S-boxes of AES). This application uses LowMC as a pseudo-random generator (PRG) and performs calculations on each layer using secret sharing. The parameters of LowMC... During initialization, the hardware manufacturer pre-sets a secret that is shared between the two servers.

[0029] For a LowMC circuit and a key s, the key expansion that needs to be calculated is: [k] = LowMC(s, 0)|| LowMC(s, 1)||…|| LowMC(s, n), where n is the length to be extended. For example, if 1024 bits of data need to be encrypted, and each LowMC outputs 128 bits, then n is 1024 / 128 = 8. Then, k is used to encrypt the plaintext m to obtain the ciphertext. The calculation process for LowMC(s, a) of the 128-bit LowMC in round a is as follows: i. Round key addition: XOR key a with key s ii. Nonlinear s-box: For The first 30 bits are used for inputting the S-box. ,in With a 3-bit input s-box, 10 s-boxes yield a 30-bit output; iii. Linear layer, multiplied by a 128×128 full-rank linear matrix: using And the original The last 98 bits are used for linear calculation to obtain... ,because It can be viewed as 128-dimensional. The vector shared secretly, L is in A 128×128 dimensional matrix.

[0030] For LowMC(s, a), The server secretly shares the information on a Boolean basis. , for Sharing the additive secrets.

[0031] (1) XOR a with the key s to obtain the round key. (2) Evaluation of nonlinear layer (3-bit S-box) lookup table assumed Bit-block encryption, taking a 30-bit S-box, has Each round requires There are 8 S-boxes. The S-box of LowMC is a 3-bit → 3-bit mapping, with a total of 8 input values.

[0032] Taking the first S-box as an example, the client pre-generates the offset and secret share of the lookup table, specifically: For each possible input ( ),make Given the S-box input x, the corresponding lookup table obtained from the LowMC S-box formula is as follows: Randomly generated offset ,Will Shift list to the left Then In the ring We perform a secret sharing on the top layer, and then secretly share the left-shifted list bit by bit to obtain the result. Square brackets indicate secret sharing. .

[0033] server and Share the secret Transform into The specific process is as follows: and Call , in Indicates in The two-party multiplication agreement, enter , enter Using the BMW protocol, the following calculations were performed. Secret sharing output For additive secret sharing, the typical BMW protocol can be used; for other additive secret sharing, the corresponding multiplication protocol can be used. Then calculate... Corresponding to The additive secrets are shared, and finally calculated. .

[0034] For the first S-box, each server calculates... and send to each other Calculate per side .

[0035] The local settings for the first S-box output are as follows: .

[0036] Based on this, the output of 10 S-boxes can be obtained. .

[0037] (2) Evaluation of linear layers For the output of 10 S-boxes First, connect them in series. ,get LowMC linear layer adopts sparse matrix ( Linear computation is performed, and matrix multiplication is performed locally for all computational methods. (3) Calculate the offset XOR right In XOR , get output Performing the above steps for 12 rounds completes one key expansion, resulting in the key. This corresponds to executing n extensions of length 128n, with the corresponding key being... Each of them .

[0038] Step S3: The client will The secret is shared with the server, and the server performs calculations. Encryption complete, among which For each element and The XOR calculation, due to the use of additive secret sharing, can be performed locally. This yields a share of the encrypted log secret. It was then sent to another storage server, which recovered the data. , and store.

[0039] Corresponding to the aforementioned embodiments of the log secure storage method based on distributed LowMC encryption, this application also provides embodiments of a log secure storage device based on distributed LowMC encryption.

[0040] Figure 2 This is a block diagram illustrating a log security storage device based on distributed LowMC encryption, according to an exemplary embodiment. (Refer to...) Figure 2 The device may include: Module 21 is used to obtain the log secret share sent by the client; The key expansion module 22 is used to obtain an expanded key by using its pre-held escrow key secret share as private input and a lookup table-based LowMC algorithm. The lookup table-based LowMC algorithm includes: XORing the current round with the escrow key secret share to obtain a round key; calculating the nonlinear layer output secret share using a lookup table-based s-box for the first few bits of the round key; performing a linear calculation on the nonlinear layer output secret share and the remaining bits of the round key to obtain a linear layer output secret share; and performing a bit-by-bit XORing of the linear layer output secret share with fixed parameters of LowMC to obtain the output of the LowMC algorithm. The encryption module 23 is used to encrypt the log secret share based on the extended key, thereby achieving secure log storage.

[0041] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0042] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0043] Accordingly, this application also provides a log security storage system based on distributed LowMC encryption, including: The client is used to share the plaintext secret of the logs to be stored with the two servers; Two servers are used, each receiving a log secret share sent by the client. Using its own pre-held escrow key secret share as private input, each server uses a lookup table-based LowMC algorithm to obtain an extended key. The log secret share is then encrypted using this extended key and sent to the storage server. The lookup table-based LowMC algorithm includes: XORing the current round with the escrow key secret share to obtain the round key; calculating the first few bits of the round key using an s-box based on a lookup table to obtain a non-linear layer output secret share; performing a linear calculation on the non-linear layer output secret share and the remaining bits of the round key to obtain a linear layer output secret share; and performing a bit-by-bit XORing of the linear layer output secret share with fixed parameters of LowMC to obtain the output of the LowMC algorithm. A storage server is used to receive encrypted log secret shares, recover the plaintext, and store it, thereby achieving secure log storage.

[0044] Accordingly, this application also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the log secure storage method based on distributed LowMC encryption as described above.

[0045] Accordingly, this application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the log secure storage method based on distributed LowMC encryption as described above. Figure 3 The diagram shown is a hardware structure diagram of any device with data processing capabilities, where a log security storage device based on distributed LowMC encryption, provided by an embodiment of the present invention, is located. (Except for...) Figure 3 In addition to the processor, memory, and network interface shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0046] Accordingly, this application also provides a computer-readable storage medium storing computer instructions thereon, which, when executed by a processor, implement the log secure storage method based on distributed LowMC encryption as described above. The computer-readable storage medium can be an internal storage unit of any data processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.

[0047] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

Claims

1. A log secure storage method based on distributed LowMC encryption, characterized by, include: Obtain the secret share of the logs sent by the client; Using the escrow key secret share held in advance as private input, the extended key is obtained through the lookup table-based LowMC algorithm, wherein the lookup table-based LowMC algorithm includes: XORing the current round with the escrow key secret share to obtain the round key; The first few bits of the round key are used to calculate the nonlinear layer output secret share using an s-box based on a lookup table; the nonlinear layer output secret share and the remaining bits of the round key are used to perform linear calculations to obtain the linear layer output secret share; the linear layer output secret share is then XORed bit by bit with the fixed parameters of LowMC to obtain the output of the LowMC algorithm. The log secret share is encrypted using the extended key and sent to the storage server, thereby achieving secure log storage.

2. The method according to claim 1, characterized in that, The extended key is obtained through n rounds of the LowMC algorithm based on a lookup table: [k]=LowMC(s, 0)|| LowMC(s, 1)||…|| LowMC(s, n), Where n is the length to be expanded, and s is the escrow key secret share.

3. The method according to claim 1, characterized in that, During the extended key generation process, the output of the i-th round LowMC algorithm is used as the input of the (i+1)-th round LowMC algorithm, where i = 1, 2, ..., n-1.

4. The method according to claim 1, characterized in that, For a 128-bit LowMC(s, a), where s is the escrow key secret share and a is the current round, the lookup table-based LowMC algorithm includes: XOR the current round 'a' with the secret share 's' of the escrow key, and then XOR the round key. ; Take the first 30 bits As input to the s-box, for each s-box, its possible inputs are transformed into offset index secret shares through two-way secure multiplication. The offset index secret shares are subtracted from the pre-acquired offset secret shares to obtain the index secret shares. The index secret shares are exchanged with another participant to restore the index. Based on the index, the output of the s-box is selected from the pre-acquired lookup table secret shares to obtain the nonlinear layer output secret shares. The output of each s-box is concatenated with the remaining bits of the round key and linearly calculated with the sparse matrix to obtain the secret share of the linear layer output. The output secret share of the linear layer is XORed bit by bit with the fixed parameters of LowMC to obtain the output of the LowMC algorithm in the a-th round.

5. The method according to claim 4, characterized in that, The offset secret share and lookup table secret share of each S-box are pre-generated by the client and distributed to each server. For the first S-box, the process is as follows: For each possible input ,make Given the S-box input x and its output, the corresponding lookup table obtained from the LowMC S-box formula is as follows: ， Randomly generated offset ,Will Shift list to the left ,Will In the ring We perform a secret sharing on the top layer, and then secretly share the left-shifted list bit by bit to obtain the result. 。 6. The method according to claim 4, characterized in that, Its possible inputs Transformed into an offset index secret share through two-way secure multiplication. Specifically: By performing safe multiplication on both sides, we obtain Secret sharing output ; The original input minus Secret sharing output ,get Input on .

7. A secure log storage system based on distributed LowMC encryption, characterized in that, include: The client is used to share the plaintext secret of the logs to be stored with the two servers; Two servers are used, each receiving a log secret share sent by the client. Using its own pre-held escrow key secret share as private input, each server uses a lookup table-based LowMC algorithm to obtain an extended key. The log secret share is then encrypted using this extended key and sent to the storage server. The lookup table-based LowMC algorithm includes: XORing the current round with the escrow key secret share to obtain the round key; calculating the first few bits of the round key using an s-box based on a lookup table to obtain a non-linear layer output secret share; performing a linear calculation on the non-linear layer output secret share and the remaining bits of the round key to obtain a linear layer output secret share; and performing a bit-by-bit XORing of the linear layer output secret share with fixed parameters of LowMC to obtain the output of the LowMC algorithm. A storage server is used to receive encrypted log secret shares, recover the plaintext, and store it, thereby achieving secure log storage.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the method as described in any one of claims 1-6.

9. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-6.

10. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, this instruction implements the steps of the method as described in any one of claims 1-6.

Images