A lightweight group certificateless ciphertext equivalence test encryption system and method

Abstract

The application discloses a lightweight group certificateless ciphertext equivalence test encryption system and method, and relates to the technical field of information security and cryptography. The system is composed of a key generation center (KGC), group users, a group administrator, an authorized tester and a cloud server. The method comprises the following steps: the KGC generates public parameters and a master key, and generates partial private keys and partial public keys for each user in the group; each user in the group generates a complete public key and a complete private key in combination with the partial private keys and the partial public keys; the group administrator generates a group private key and a group public key for each user in the group; a sender encrypts a message plaintext and then uploads the ciphertext to the cloud server; a receiver decrypts the ciphertext; the group administrator generates a group trapdoor; and the authorized tester performs equivalence test on the ciphertext based on the group trapdoor. The system and the method are realized based on an elliptic curve without bilinear pair operation, thereby effectively reducing the calculation cost; meanwhile, only one group trapdoor is needed to support ciphertext equivalence test in the group, thereby significantly reducing the management cost of the trapdoor.

Description

Technical Field

[0001] This invention relates to the fields of information security and cryptography, specifically to a lightweight group certificateless ciphertext equivalence testing encryption system and method. Background Technology

[0002] With the development of cloud computing, cloud storage, and big data technologies, an increasing amount of personal medical data, enterprise business data, and financial transaction data are being uploaded to cloud servers for storage and processing. Since cloud servers are often not entirely trustworthy, user data needs to be encrypted before uploading. However, because the plaintext content is hidden after encryption, traditional plaintext-based data retrieval, comparison, and processing methods are difficult to apply directly to encrypted data, thus reducing data availability in the cloud environment. To address the problem of comparing encrypted data, ciphertext equivalence testing encryption technology has been proposed. This technology allows authorized testers to determine whether ciphertexts generated by different public keys correspond to the same plaintext without decrypting the ciphertext. It is suitable for scenarios such as medical data comparison, duplicate data detection, encrypted data retrieval, and privacy-preserving data sharing.

[0003] In existing technologies, traditional public-key cryptography suffers from high management costs related to certificate generation, distribution, verification, and revocation. While identity-based cryptography simplifies certificate management, it carries the risk of key escrow. Certificateless public-key cryptography, on the other hand, generates partial private keys for users through a Key Generation Center (KGC), allowing users to choose secret values ​​to generate the complete private key, thus avoiding both certificate management burdens and key escrow issues. However, existing certificateless ciphertext equivalence testing encryption schemes still have shortcomings. Firstly, some schemes rely on bilinear pairing operations, resulting in significant computational overhead and making them unsuitable for resource-constrained environments such as mobile terminals, medical devices, and wireless sensors. Secondly, in group data sharing scenarios, existing schemes typically require generating multiple test trapdoors for different users or authorization relationships, leading to high costs for trapdoor computation, transmission, and storage, thus reducing system efficiency. Summary of the Invention

[0004] In view of at least one of the above technical problems, this application provides a lightweight group certificateless ciphertext equivalence test encryption system and method. The system and method introduce a group authorization mechanism under a certificateless public key cryptosystem, use elliptic curve operations that do not require bilinear pairing operations to generate and decrypt ciphertext, and only use a single group trapdoor to perform equivalence tests, which can effectively reduce system overhead as well as the costs of trapdoor generation, transmission and storage.

[0005] The technical solution of this invention is: A lightweight group certificateless ciphertext equality test encryption system, comprising: The Key Generation Center (KGC) is used to generate public parameters and master keys. Based on the public parameters, master keys, and user identity identifiers submitted by each user in the target group when registering with KGC, it generates partial private keys and partial public keys for each user in the group. Group users are responsible for generating their own complete public and private keys based on their partial public and private keys; sending their complete public keys to the group administrator to obtain their group public key; group users who are message senders encrypt messages to be sent, generate ciphertext, and upload it to the cloud server; group users who are message receivers retrieve the ciphertext to be decrypted from the cloud server, decrypt it to obtain the plaintext message, and verify the validity of the ciphertext to be decrypted. If valid, the plaintext message is output; if invalid, an invalid flag is output. The group administrator is responsible for generating a group private key based on public parameters; generating a group public key for each user in the group based on their complete public key, public parameters, and group private key; and generating a group trapdoor that corresponds one-to-one with the group based on the group private key and sending it to authorized testers. Authorized testers, either as independent entities or as group users, are used to send requests to the cloud server when an equivalence test needs to be performed on two specified ciphertexts to be compared. Based on public parameters and group trapdoors, they perform equivalence tests on the two ciphertexts to be compared provided by the cloud server and output the corresponding equivalence test results. The cloud server is used to receive and store ciphertext sent by the message sender; in response to the ciphertext retrieval request sent by the message receiver, it provides the message receiver with the corresponding ciphertext to be decrypted; in response to the request of the authorized tester, it provides the authorized tester with two ciphertexts to be compared that were previously generated and uploaded to the cloud server by the message senders in the target group.

[0006] A lightweight group-based, certificateless ciphertext equality test encryption method, comprising: S1. The Key Generation Center (KGC) generates public parameters and the master key; S2, KGC generates partial private keys and partial public keys for each user in the target group based on public parameters, master key, and user identity identifiers submitted by each user in the target group when registering with KGC; S3. Each user in the group obtains a complete private key based on their partial private key and a randomly selected secret value, and obtains a complete public key based on their partial public key, a randomly selected secret value, and the generator of the elliptic curve group. S4. The group administrator randomly selects a secret value based on the public parameters to generate a group private key; S5. The group administrator generates a group public key for each user in the group, which is bound to their respective public key, based on the public parameters, the group private key, and the complete public key of each user in the group. S6. As the message sender, the group user encrypts the message to be sent based on their own complete private key, their own group public key, public parameters, the message receiver's public key, and the message receiver's identity identifier, generates the corresponding ciphertext, and sends the generated ciphertext to the cloud server for storage. S8. The group administrator generates a group trapdoor that corresponds to each group based on the group private key, and sends the generated group trapdoor to the authorized tester. S9. The authorized tester sends an equivalent test request to the cloud server; S10, the cloud server responds to the equivalence test request and provides the authorized tester with two encrypted messages to be compared, which were previously generated and uploaded to the cloud server by the message senders in the target group and stored separately. S11. The authorized tester performs an equivalence test on the two ciphertexts to be compared based on the common parameters and the trapdoor, and outputs the corresponding equivalence test results.

[0007] Optionally, according to the lightweight group certificateless ciphertext equivalence test encryption method described above, the KGC generates public parameters and a master key, including: KGC based on preset security parameters The generating order is a prime number Elliptic curve groups whose operations within the group follow the rules of elliptic curve addition. and selection generator ; KGC randomly selects a secret value. As the master key The master public key is obtained from the master key. ; KGC selects 8 collision-resistant one-way hash functions: , , , , , , , ;in, For model The cyclic multiplication group consisting of non-zero residue classes; Indicates the message to be encrypted bit length, express The bit length of a medium integer; The closure is a set of binary strings of arbitrary finite length consisting of 0s and 1s. The set consisting of the above common parameters .

[0008] Optionally, according to the lightweight group certificateless ciphertext equivalence test encryption method described above, KGC is the group user The method for generating part of the private key and part of the public key is as follows: KGC randomly selects a secret value. And through public parameters and group users Identity identifier Calculate group users Partial private key and part of the public key Specifically, this is achieved through the following formula: ; ; Group users Based on a portion of their private key and part of the public key The method for generating a complete private key and a complete public key is as follows: Group users Randomly select secret value ; Calculate group users according to the following formula Full private key:

[0009] Calculate group users according to the following formula The public key is:

[0010] in, Elliptic curve group generator, For the first public key component Second public key component An ordered pair of tuples.

[0011] Optionally, according to the lightweight group certificateless ciphertext equivalence test encryption method, the group administrator generates a group private key based on a secret value randomly selected according to public parameters, including: the group administrator selecting a random number. ,Will and The ordered binary tuples formed serve as the group private key ,in These are the first and second group private key components of the group private key, respectively. The method by which the group administrator generates a group trapdoor that corresponds one-to-one with the group based on the group private key is as follows: [The method is described in the original text, which is not translated here.] .

[0012] Optionally, according to the lightweight group certificateless ciphertext equivalence test encryption method described above, the group administrator uses the group private key... For group users Generate group public key Specifically, it is achieved through the following formula:

[0013]

[0014]

[0015] in, and These are group users group public key The first and second components.

[0016] Optionally, according to the lightweight group certificateless ciphertext equivalence test encryption method, the group user, acting as the message sender, encrypts the message to be sent using their own complete private key, their own group public key, public parameters, the message receiver's public key, and the message receiver's identity identifier, generating corresponding ciphertext, including: Message sender Regarding the message Calculate message mapping points And construct through message mapping points and origin linear function ; In the linear function Randomly select another point ,in and , ; Randomly select secret value Calculate the 6 components of the ciphertext according to the following formula. and auxiliary parameters : (1) ; (2) ; (3) ; (4) ; (5) ; (6) ; (7) ; in, For elements of the elliptic curve group, A bit string protected by a mask. This is the value used to verify the integrity of the encrypted text. These are auxiliary parameters bound to the message receiver's public key used when calculating the ciphertext component; they are not part of the ciphertext component itself. Indicates the message recipient Identity identifier Mapped to The result of the winning bid; Finally, the message sender was obtained. message receiver to be sent The encrypted message sent: .

[0017] Optionally, according to the lightweight group certificateless ciphertext equivalence test encryption method, the method further includes steps executed in parallel with S8-S11, including: S7. As the message recipient, the group user sends a ciphertext retrieval request to the cloud server and receives the ciphertext to be decrypted provided by the cloud server in response to the ciphertext retrieval request. Then, based on its own complete private key, public parameters, the group public key of the message sender, the public public key of the message sender, and the identity identifier of the message sender, it decrypts the ciphertext fed back by the cloud server, recovers the plaintext message, and verifies the validity of the ciphertext to be decrypted. If valid, it outputs the plaintext message; if invalid, it outputs an invalid flag.

[0018] Optionally, according to the lightweight group certificateless ciphertext equivalence test encryption method described above, step S7 includes: Calculate the auxiliary parameters according to the following formula. :

[0019] in Indicates the message sender Identity identifier mapping to The result of the winning bid; and for The public key has two components; for Identity identifier; According to auxiliary parameters Message receiver Full private key and ciphertext components Recover the message to be encrypted using the following formula. With the second random secret value splicing value Thus, extracting and ;

[0020] The mask of the fifth ciphertext component is removed using the following formula to recover the message test digest and the x and y coordinates of the auxiliary points:

[0021] Finally, the ciphertext to be decrypted is verified by checking whether the following two equations hold true. Validity:

[0022]

[0023] The first equation is used to verify the second random secret value recovered from the fourth ciphertext component. Is it related to the second ciphertext component? The second equation is used to verify whether the recovered message test digest and the first to fifth ciphertext components are consistent with the sixth ciphertext component. Consistent; If both of the above equations are true, the ciphertext to be decrypted is determined to have passed the validity verification, and the recovered plaintext message is output. Otherwise, the ciphertext to be decrypted is determined to have failed the validity verification, and an invalid flag is output. .

[0024] Optionally, according to the lightweight group certificateless ciphertext equivalence test encryption method, the authorized tester performs an equivalence test on two ciphertexts to be compared based on public parameters and a group trapdoor, including: Authorized testers based on group trapdoors And the first ciphertext ,calculate:

[0025] Authorized testers based on group trapdoors Second ciphertext ,calculate:

[0026] Verify whether the following two equations are true:

[0027]

[0028] If all the above equations hold true, then construct the equations passing through the origin respectively. With point linear function and passing through the origin With point linear function ; Verify whether the stated linear function satisfies:

[0029] If true, output , indicating the first ciphertext With the second ciphertext If the plaintext corresponds to the same text, then output the corresponding plaintext. Otherwise, output the plaintext. , indicating the first ciphertext With the second ciphertext They do not correspond to the same plaintext.

[0030] The beneficial effects of adopting the above technical solution are as follows: (1) The present invention adopts the technical route of no bilinear pairing, and realizes the system initialization, key generation, encryption, decryption, authorization and equivalence test process based on elliptic curve group operation. It does not need to perform bilinear pairing operation with large computational overhead, which can effectively reduce the computational cost and is more suitable for resource-constrained environments.

[0031] (2) This invention supports a group-level authorization mechanism. The group administrator only needs to generate one group trapdoor to authorize testers to perform equivalence tests on ciphertexts encrypted by different users and different public keys within the group. This reduces the costs of trapdoor generation, transmission, and storage, and improves the execution efficiency of ciphertext equivalence tests in a group environment. The group trapdoor is a group-level equivalence test authorization parameter generated by the group administrator based on the target group's group private key. It is used to authorize testers to perform equivalence tests on ciphertexts encrypted by different group users and different public keys within the same group. For the same group, the group administrator only needs to generate one group trapdoor, without needing to generate trapdoors separately for each group user or each ciphertext to be compared. After obtaining the group trapdoor, the authorized tester can obtain the test auxiliary information required to perform equivalence judgment from the ciphertext, and thus determine whether two ciphertexts correspond to the same plaintext, but cannot decrypt the ciphertext or recover the plaintext based on this information.

[0032] (3) This invention not only focuses on secure communication between entities within a group, but also enables ciphertext equivalence testing without decrypting the ciphertext, and determines whether ciphertexts generated by different public keys within the group correspond to the same plaintext, thus making it more suitable for application scenarios such as cloud-based ciphertext data comparison.

[0033] (4) The present invention adopts a certificateless public key cryptosystem. The key generation center KGC generates a partial private key for the group users, and the group users then combine it with the secret value they choose to generate the complete private key. This avoids the certificate management problem in the traditional public key cryptosystem and the key escrow problem in the identity-based cryptosystem, thus improving the security and practicality of the encryption system. Attached Figure Description

[0034] Figure 1 This is a communication diagram of the lightweight group certificateless ciphertext equivalence test encryption system of this embodiment. Figure 2 This is a flowchart of a lightweight group certificateless ciphertext equivalence test encryption method according to this embodiment. Detailed Implementation

[0035] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0036] This invention provides, in one aspect, a lightweight group-based certificateless ciphertext equivalence test encryption system, such as... Figure 1 As shown, the system includes a Key Generation Center (KGC), group administrators, group users, authorized testers, and a cloud server.

[0037] The Key Generation Center (KGC) is used to generate public parameters and a master key based on security parameters; and to generate partial private keys and partial public keys for each user in the group based on the public parameters and the master key, combined with the user identity identifiers submitted by each user in the target group when registering with the KGC. The group users are responsible for obtaining their respective partial public and private keys from KGC; generating their respective complete public and private keys based on their partial public and private keys; sending their respective complete public keys to the group administrator to obtain their respective group public keys; encrypting the message to be sent to generate ciphertext and sending the generated ciphertext to the cloud server for storage; and obtaining the ciphertext to be decrypted from the cloud server to decrypt the message plaintext and verifying the validity of the ciphertext to be decrypted. If valid, the message plaintext is output; otherwise, an invalid flag is output. The group administrator is responsible for generating a group private key based on public parameters; generating a group public key for each user in the group based on their complete public key, public parameters, and group private key; generating a group trapdoor that corresponds one-to-one with the group based on the group private key; and sending the generated group trapdoor to authorized testers. The group trapdoor corresponds to the group, and only one group trapdoor needs to be generated for the same group. Authorized testers can perform equivalence tests on ciphertexts generated by different group users within the group based on the group trapdoor. The authorized tester is used to send a request to the cloud server when an equivalence test needs to be performed on two specified ciphertexts to be compared. Based on public parameters and a group trapdoor, the tester performs an equivalence test on the two ciphertexts provided by the cloud server, determining whether the two ciphertexts generated by different public keys correspond to the same plaintext and outputting the corresponding equivalence test result. For example, if the two ciphertexts correspond to the same plaintext, the output equivalence test result is 1; if the two ciphertexts correspond to different plaintexts, the output equivalence test result is 0. If necessary, if at least one ciphertext fails the validity verification, an invalid flag is output. The authorized tester is an independent entity and is not required to be a group user. When the tester belongs to the group, they can also be a group user, but their group user status is not a necessary condition for performing the equivalence test. The two ciphertexts to be compared are previously generated and uploaded to the cloud server by message senders within the target group, and are not ciphertexts from arbitrary sources. When the authorized tester needs to perform an equivalence test, they send a request to the cloud server, which then provides them with the two specified ciphertexts to be compared.

[0038] The cloud server is used to receive and store ciphertext sent by a message sender; respond to a ciphertext retrieval request sent by a message receiver and provide the message receiver with the corresponding ciphertext to be decrypted; respond to a ciphertext equivalence test request sent by an authorized tester and provide the authorized tester with two ciphertexts to be compared that were previously generated and uploaded to the cloud server by message senders within the target group.

[0039] Another aspect of the present invention provides a lightweight group-based certificateless ciphertext equivalence test encryption method, such as... Figure 2 As shown, the method includes: S1. The system designer or deployer determines the security parameters based on the expected security strength. The key generation center (KGC) generates public parameters and the system master key that needs to be kept secret based on these security parameters. This step is the encryption system initialization step. The Key Generation Center (KGC) executes the setup algorithm: the KGC receives security parameters determined by the system designer or deployer based on the expected security strength. It outputs public parameters and the system master key that needs to be kept secret; specifically, it includes the following steps: S1.1 Key Generation Center (KGC) receives security parameters According to safety parameters The generating order is a prime number. Elliptic curve group The operations within the group follow the elliptic curve addition rule; the elliptic curve group is selected. generator , obtain the parameters of the elliptic curve group ; Among them, safety parameters The KGC is pre-determined by the system designer or deployer based on the expected security strength, and is used to determine the elliptic curve group order, random secret value space, and hash output length. Elliptic curve groups that meet the corresponding security strength are selected. Elliptic curves are used to generate keys, encrypt messages, and calculate auxiliary values ​​for ciphertext equivalence tests. Unlike bilinear pairing operations, which have high computational overhead, the computational overhead of key generation, encryption, decryption, and ciphertext equivalence tests is reduced based on the computational difficulty of the Diffie-Hellman problem on the elliptic curve group. This also reduces the transmission and storage costs of common parameters, keys, and ciphertext. S1.2, KGC randomly selects a secret value. As the system master key The master public key is obtained from the master key. KGC selects 8 collision-resistant one-way hash functions: , , , , , , , ; in, For model The cyclic multiplication group consisting of non-zero residue classes; Indicates the message to be encrypted bit length, express The bit length of a medium integer; The closure is a set of binary strings of arbitrary finite length consisting of 0s and 1s. Used for identity mapping, that is, mapping the identity identifiers of group users to... The scalar in the code is used to bind the identity identifier to the user key; and Used for message mapping, that is, mapping the message to be encrypted into two scalars, and constructing a message mapping point for ciphertext equivalence judgment based on the two scalars; Used to map elliptic curve shared values ​​calculated based on the keys of both communicating parties to scalars; Used to generate a message mask based on the shared value, so as to perform XOR protection on the message to be encrypted and the random secret value; Used to generate an equivalent test digest of the message to be encrypted and a random secret value; Used to generate a test information mask based on the shared value related to the group public key and the ciphertext components, in order to protect the equivalent test auxiliary information in the ciphertext; Used to generate a ciphertext integrity verification value based on the equivalent test digest and ciphertext components. The hash function satisfies the conditions of the preimage being difficult to solve and the second preimage being highly collision-resistant, to ensure the security of the message and the key; S1.3, Generate common parameters as follows The system master key is secretly stored by the Key Generation Center (KGC). .

[0040] S2. The Key Generation Center (KGC) verifies and receives the identity identifiers submitted by each user in the group when registering with the KGC. Then, it executes a partial key generation algorithm: The Key Generation Center (KGC) generates and sends corresponding partial private keys and partial public keys for each user in the group based on the user identity identifiers submitted by each user in the group when registering, combined with public parameters and the system master key. S2.1 The Key Generation Center (KGC) receives the identity identifiers submitted by each user in the group when registering with the KGC. Public parameters, master key ; S2.2, KGC randomly selects a secret value. And according to the random number System Master Key and the identity identifiers of each user in the group Calculate the partial private key according to the following formula. and part of the public key : ; ; in, The hash function selected for the system initialization phase. Elliptic curve group Generators; S2.3, Key Generation Center (KGC) outputs a portion of the private key. and part of the public key For all users in the group.

[0041] S3. After each user in the group receives a partial private key and a partial public key generated for them by the key generation center KGC, on the one hand, they obtain the complete private key that needs to be kept secret based on the partial private key and the randomly selected secret value; on the other hand, they obtain the complete public key based on the partial public key, the same secret value, and the generator of the elliptic curve group. S3.1, Each user in the group receives public parameters and a portion of the private key issued by the Key Generation Center (KGC) to each user in the group. and part of the public key ; S3.2, Each user in the group randomly selects a secret value. On the one hand, based on partial private keys Calculate group users Full private key:

[0042] On the other hand, based on partial public keys Calculate group users The public key is:

[0043] in, Elliptic curve group generator, For the first public key component Second public key component Ordered pairs; S3.3 Each user in the group outputs and secretly saves their complete private key. At the same time, it publicly discloses its complete public key. .

[0044] S4. The group administrator randomly selects two secret values ​​based on the public parameters to generate a group private key that needs to be kept secret. The group private key is an ordered binary tuple. The first secret value serves as the first component of the group private key and participates in the generation of the group user's group public key. The second secret value serves as the second component of the group private key and is used to generate a group trapdoor and support ciphertext equivalence testing. S4.1 Group administrators receive public parameters; S4.2, The group administrator randomly selects a secret value. and the random number and Group private key :

[0045] Among them, ordered binary pairs The first component Used to generate the group public key for participating users, an ordered tuple. The second component Used to generate group trapdoors and support subsequent ciphertext equivalence tests; S4.3 The group administrator outputs and secretly saves the group private key. .

[0046] S5. Group administrator executes the join algorithm: The group administrator performs the join algorithm based on the group's users. The public full key Combining public parameters and group private key Generate a corresponding group public key for each user in the group. The group public key is then sent to the corresponding group users. S5.1, Group administrator receives public parameters and information from all users in the group. public key and group private key ; S5.2, the group administrator uses the group private key. Elliptic curve group generator and all users in the group public key Calculate the number of users in the group group public key :

[0047]

[0048]

[0049] and These are the users in the group. group public key The first and second components; S5.3, Group administrator outputs group users group public key The group public key is then sent to the corresponding group users.

[0050] S6, Group users as message senders Execute encryption algorithm: Message sender Treating encrypted messages According to the message sender Your own complete private key Message sender Its own group public key, public parameters, and message receivers public key and message recipients Identity identifier After generating the corresponding ciphertext, the ciphertext is uploaded to the cloud server for storage; S6.1, Message Sender Receive public parameters and messages to be encrypted Message sender Your own complete private key Message sender group public key Message receiver public key and message recipients Identity identifier ; in, and These are the group public keys of the message sender. The first and second components; and These are the message receiver's complete public key. The first and second components; The scalar obtained after hash mapping the message to be protected; Messages to be protected bit length, In this context, 0 and 1 represent binary bits, indicating all bits of length 1. A collection of binary strings of bits; S6.2, According to the message Calculate message mapping points Constructing the message mapping point and origin linear function ; S6.3, in the linear function Randomly select another point ,in and , ; S6.4 Randomly select a secret value And calculate the 6 components of the ciphertext. and auxiliary parameters : (1)

[0051] (2)

[0052] (3)

[0053] (4)

[0054] (5)

[0055] (6)

[0056] (7)

[0057] in, Elliptic curve group Generators; Publicize system parameters; to The hash function selected for the system initialization phase; Indicates the message recipient Identity identifier Mapped to The result of the winning bid; The ciphertext consists of a total of 6 ciphertext components. to ,in, For elements of the elliptic curve group, A bit string protected by a mask. This is the value used to verify the integrity of the encrypted text. It is an auxiliary parameter bound to the message receiver's public key used when calculating the ciphertext component, and it is not part of the ciphertext component; S6.5 Output Message Sender To the message recipient The generated ciphertext:

[0058] The ciphertext For the first ciphertext component Second ciphertext component Third ciphertext component Fourth ciphertext component Fifth ciphertext component and the sixth ciphertext component An ordered six-tuple is formed in a fixed order. During ciphertext storage or transmission, each ciphertext component is deterministically encoded and combined according to a preset order and length to form ciphertext data; the receiver parses the data based on the data type, order, and length of each component to obtain the ciphertext. to .

[0059] S8. Group administrator executes authorization algorithm: The group administrator executes the authorization algorithm based on the group private key. Generate a group of trapdoors The trapdoor is then sent to authorized testers.

[0060] S8.1 Group administrator receives group private key ;in, The first component of the group private key. This is the second component of the group private key; the second component of the group public key for each user in the same target group is generated based on the second component of the group private key. S8.2, The group administrator uses the group private key... Parameters in Generate group trapdoors ; The group trapdoor is a group-level equivalence test authorization parameter generated by the group administrator based on the target group's group private key. It authorizes testers to perform equivalence tests on ciphertexts encrypted with different public keys by different group users within the same group. For the same group, the group administrator only needs to generate one group trapdoor; it is not necessary to generate trapdoors separately for each group user or each ciphertext to be compared. While the group private key remains valid, the number of group trapdoors does not increase with the number of group users or the number of ciphertexts to be compared.

[0061] Since all users within the same target group share a single group trapdoor, even when there are n users or multiple ciphertexts to be compared, the group administrator only needs to generate, transmit, and maintain one group trapdoor. Compared to generating test trapdoors for each user or each ciphertext to be compared, the number of group trapdoors changes from increasing with the number of users to a constant independent of the group size. This reduces the overhead of trapdoor generation, transmission, and storage, and improves the execution efficiency of ciphertext equivalence testing in a group environment.

[0062] S8.3, The group administrator will remove the aforementioned group trap. When sent to an authorized tester, the second ciphertext component of any ciphertext generated by a user within the target group satisfies the following:

[0063] Authorized testers calculate based on the group trapdoor:

[0064] The calculation result and the fifth component of the generated ciphertext Since the shared values ​​of the group public key used at the time are the same, the authorized tester can remove the mask of the equivalence test information in the fifth component of the ciphertext and obtain the test auxiliary information required to perform the ciphertext equivalence judgment. S9. The authorized tester sends an equivalent test request to the cloud server; S10, the cloud server responds to the equivalence test request and provides the authorized tester with two encrypted messages to be compared, which were previously generated and uploaded to the cloud server by the message senders in the target group and stored separately. S11. Authorized testers execute the equivalence test algorithm: Based on public parameters and the group trapdoor, authorized testers perform an equivalence test on the two ciphertexts to be compared, determining whether the two ciphertexts generated by different public keys correspond to the same plaintext and outputting the corresponding equivalence test result. For example, if the two ciphertexts correspond to the same plaintext, the output equivalence test result is 1 or true; if the two ciphertexts correspond to different plaintexts, the output equivalence test result is 0 or false. If necessary, if at least one ciphertext fails the validity verification, an invalid flag is output. The first ciphertext and the second ciphertext are generated by group users within the same target group using the aforementioned encryption algorithm and uploaded to the cloud server. S11.1 Authorized testers receive public parameters and group trapdoors. The first ciphertext to be compared The second ciphertext to be compared ; S11.2, According to the aforementioned trapdoor And the first ciphertext ,calculate:

[0065] S11.3, According to the aforementioned trapdoor Second ciphertext ,calculate:

[0066] Once the authorized tester obtains the trapdoor, they can extract the necessary testing assistance information from the ciphertext to perform the equivalence judgment. and However, this does not allow you to decrypt the ciphertext or recover the plaintext.

[0067] S11.4 Verify whether the following two equations are true:

[0068]

[0069] If all the above equations hold true, then construct the equations passing through the origin respectively. With point linear function and passing through the origin With point linear function ; S11.5 Verify whether the stated linear function satisfies

[0070] If true, output , indicating the first ciphertext With the second ciphertext If the plaintext corresponds to the same text, then output the corresponding plaintext. Otherwise, output the plaintext. , indicating the first ciphertext With the second ciphertext Do not correspond to the same plaintext; The method also includes step S7, which is executed in parallel with S8-S11. The content of S7 is: group users as message receivers Send a ciphertext retrieval request to the cloud server and receive the ciphertext to be decrypted provided by the cloud server in response to the ciphertext retrieval request. Subsequently, group users who were message recipients Execute the decryption algorithm: Message receiver For ciphertext Based on the message recipient's own complete private key Public parameters, group public key of the message sender The message sender's public key Message sender's identity identifier The ciphertext is decrypted to recover the plaintext message; and the validity of the ciphertext to be decrypted is verified. If it is valid, the plaintext message is output; if it is invalid, an invalid flag is output.

[0071] S7.1, Message Receiver Receive public parameters and ciphertext Message sender group public key Message sender public key Message sender Identity identifier and message recipients Full private key ,in and These are the public keys of the message sender. The first and second components; S7.2 Calculate auxiliary parameters: ,in This indicates that the message sender's identity is mapped to... The result of the winning bid.

[0072] S7.3, According to the auxiliary parameters Message recipient's complete private key and ciphertext components Restore the message to be encrypted With the second random secret value splicing value :

[0073] because and The length is fixed, so extracting the concatenated value of the two is equivalent to extracting the values ​​separately. and ; S7.4, Further Calculations

[0074] This indicates that the mask of the fifth ciphertext component is removed, and the message test digest and the horizontal and vertical coordinates of the auxiliary points are restored. S7.5, Based on the plaintext message Treating decrypted ciphertext Perform validity verification; based on the extracted plaintext message. Verify whether the following two equations are true:

[0075]

[0076] The first equation is used to verify the second random secret value recovered from the fourth ciphertext component. Is it related to the second ciphertext component? The second equation is used to verify whether the recovered message test digest and the first to fifth ciphertext components are consistent with the sixth ciphertext component. Consistent; If both of the above equations are true, the ciphertext to be decrypted is determined to have passed the validity verification, and the recovered plaintext message is output. Otherwise, the ciphertext to be decrypted is determined to have failed the validity verification, and an invalid flag is output. The receiver actually verifies the consistency and integrity of the ciphertext and the decryption result, rather than judging whether the plaintext content is semantically valid.

[0077] In summary, the security of the method of this invention depends on the difficulty of the computational Diffie-Hellman (CDH) problem, specifically, for the prime-order elliptic curve group generated in S1.1. and its generators Randomly select an unknown scalar In the known In the case of calculating within the feasible computation time It is difficult. Among them, The assumed variables used to define the computationally difficult Diffie-Hellman problem do not correspond to the secret parameters in the specific algorithmic steps of this scheme. This assumption supports ciphertext indistinguishability and message unidirectionality. Provable security: Under the stochastic oracle model, the scheme proves that it satisfies ciphertext indistinguishability under chosen-ciphertext attack (IND-CCA) and message ciphertext unidirectionality (OW-CCA) by reducing attacks on the ciphertext to the CDH problem. This ensures that the scheme is theoretically resistant to a variety of known attacks.

[0078] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the present invention.

Claims

1. A lightweight group-based certificateless ciphertext equivalence test encryption system, characterized in that, The system includes: The Key Generation Center (KGC) is used to generate public parameters and master keys. Based on the public parameters, master keys, and user identity identifiers submitted by each user in the target group when registering with KGC, it generates partial private keys and partial public keys for each user in the group. Group users are responsible for generating their own complete public and private keys based on their partial public and private keys; sending their complete public keys to the group administrator to obtain their group public key; group users who are message senders encrypt messages to be sent, generate ciphertext, and upload it to the cloud server; group users who are message receivers retrieve the ciphertext to be decrypted from the cloud server, decrypt it to obtain the plaintext message, and verify the validity of the ciphertext to be decrypted. If valid, the plaintext message is output; if invalid, an invalid flag is output. The group administrator is responsible for generating a group private key based on public parameters; generating a group public key for each user in the group based on their complete public key, public parameters, and group private key; and generating a group trapdoor that corresponds one-to-one with the group based on the group private key and sending it to authorized testers. Authorized testers, either as independent entities or as group users, are used to send requests to the cloud server when an equivalence test needs to be performed on two specified ciphertexts to be compared. Based on public parameters and group trapdoors, they perform equivalence tests on the two ciphertexts to be compared provided by the cloud server and output the corresponding equivalence test results. The cloud server is used to receive and store ciphertext sent by the message sender; in response to the ciphertext retrieval request sent by the message receiver, it provides the message receiver with the corresponding ciphertext to be decrypted; in response to the request of the authorized tester, it provides the authorized tester with two ciphertexts to be compared that were previously generated and uploaded to the cloud server by the message senders in the target group.

2. A lightweight group-based, certificateless ciphertext equivalence test encryption method, characterized in that, The method includes: S1. The Key Generation Center (KGC) generates public parameters and the master key; S2, KGC generates partial private keys and partial public keys for each user in the target group based on public parameters, master key, and user identity identifiers submitted by each user in the target group when registering with KGC; S3. Each user in the group obtains a complete private key based on their partial private key and a randomly selected secret value, and obtains a complete public key based on their partial public key, a randomly selected secret value, and the generator of the elliptic curve group. S4. The group administrator randomly selects a secret value based on the public parameters to generate a group private key; S5. The group administrator generates a group public key for each user in the group, which is bound to their respective public key, based on the public parameters, the group private key, and the complete public key of each user in the group. S6. As the message sender, the group user encrypts the message to be sent based on their own complete private key, their own group public key, public parameters, the message receiver's public key, and the message receiver's identity identifier, generates the corresponding ciphertext, and sends the generated ciphertext to the cloud server for storage. S8. The group administrator generates a group trapdoor that corresponds to each group based on the group private key, and sends the generated group trapdoor to the authorized tester. S9. The authorized tester sends an equivalent test request to the cloud server; S10, the cloud server responds to the equivalence test request and provides the authorized tester with two encrypted messages to be compared, which were previously generated and uploaded to the cloud server by the message senders in the target group and stored separately. S11. The authorized tester performs an equivalence test on the two ciphertexts to be compared based on the common parameters and the trapdoor, and outputs the corresponding equivalence test results.

3. The lightweight group-based certificateless ciphertext equivalence test encryption method according to claim 2, characterized in that, The KGC generates public parameters and a master key, including: KGC based on preset security parameters The generating order is a prime number Elliptic curve groups whose operations within the group follow the rules of elliptic curve addition. and selection generator ; KGC randomly selects a secret value. As the master key The master public key is obtained from the master key. ; KGC selects 8 collision-resistant one-way hash functions: , , , , , , , ;in, For model The cyclic multiplication group consisting of non-zero residue classes; Indicates the message to be encrypted bit length, express The bit length of a medium integer; The closure is a set of binary strings of arbitrary finite length consisting of 0s and 1s. The set consisting of the above common parameters .

4. The lightweight group-based certificateless ciphertext equivalence test encryption method according to claim 3, characterized in that, KGC is for group users The method for generating part of the private key and part of the public key is as follows: KGC randomly selects a secret value. And through public parameters and group users Identity identifier Calculate group users Partial private key and part of the public key Specifically, this is achieved through the following formula: ； ； Group users Based on a portion of their private key and part of the public key The method for generating a complete private key and a complete public key is as follows: Group users Randomly select secret value ; Calculate group users according to the following formula Full private key: Calculate group users according to the following formula The public key is: in, Elliptic curve group generator, For the first public key component Second public key component An ordered pair of tuples.

5. A lightweight group-based certificateless ciphertext equivalence test encryption method according to claim 4, characterized in that, The group administrator generates a group private key based on a secret value randomly selected according to public parameters, including: the group administrator selecting a random number. ,Will and The ordered binary tuples formed serve as the group private key ,in These are the first and second group private key components of the group private key, respectively. The method by which the group administrator generates a group trapdoor that corresponds one-to-one with the group based on the group private key is as follows: [The method is described in the original text, which is not translated here.] .

6. A lightweight group-based certificateless ciphertext equivalence test encryption method according to claim 5, characterized in that, Group administrators based on group private key For group users Generate group public key Specifically, it is achieved through the following formula: in, and These are group users group public key The first and second components.

7. A lightweight group-based certificateless ciphertext equivalence test encryption method according to claim 6, characterized in that, The group user, acting as the message sender, encrypts the message to be sent using their own complete private key, their own group public key, public parameters, the message receiver's public key, and the message receiver's identity identifier, generating corresponding ciphertext, including: Message sender Regarding the message Calculate message mapping points And construct through message mapping points and origin linear function ; In the linear function Randomly select another point ,in and , ; Randomly select secret value Calculate the 6 components of the ciphertext according to the following formula. and auxiliary parameters : （1） ； （2） ； （3） ； （4） ； （5） ； （6） ； （7） ； in, For elements of the elliptic curve group, A bit string protected by a mask. This is the value used to verify the integrity of the encrypted text. These are auxiliary parameters bound to the message receiver's public key used when calculating the ciphertext component; they are not part of the ciphertext component itself. Indicates the message recipient Identity identifier Mapped to The result of the winning bid; Finally, the message sender was obtained. message receiver to be sent The encrypted message sent: 。 8. A lightweight group-based certificateless ciphertext equivalence test encryption method according to claim 7, characterized in that, The method also includes steps that are executed in parallel with S8-S11, including: S7. As the message recipient, the group user sends a ciphertext retrieval request to the cloud server and receives the ciphertext to be decrypted provided by the cloud server in response to the ciphertext retrieval request. Then, based on its own complete private key, public parameters, the group public key of the message sender, the public public key of the message sender, and the identity identifier of the message sender, it decrypts the ciphertext fed back by the cloud server, recovers the plaintext message, and verifies the validity of the ciphertext to be decrypted. If valid, it outputs the plaintext message; if invalid, it outputs an invalid flag.

9. A lightweight group-based certificateless ciphertext equivalence test encryption method according to claim 8, characterized in that, S7 includes: Calculate the auxiliary parameters according to the following formula. : in Indicates the message sender Identity identifier mapping to The result of the winning bid; and for The public key has two components; for Identity identifier; According to auxiliary parameters Message receiver Full private key and ciphertext components Recover the message to be encrypted using the following formula. With the second random secret value splicing value Thus, extracting and ; The mask of the fifth ciphertext component is removed using the following formula to recover the message test digest and the x and y coordinates of the auxiliary points: Finally, the ciphertext to be decrypted is verified by checking whether the following two equations hold true. Validity: The first equation is used to verify the second random secret value recovered from the fourth ciphertext component. Is it related to the second ciphertext component? The second equation is used to verify whether the recovered message test digest and the first to fifth ciphertext components are consistent with the sixth ciphertext component. Consistent; If both of the above equations are true, the ciphertext to be decrypted is determined to have passed the validity verification, and the recovered plaintext message is output. Otherwise, the ciphertext to be decrypted is determined to have failed the validity verification, and an invalid flag is output. .

10. A lightweight group-based certificateless ciphertext equivalence test encryption method according to claim 9, characterized in that, The authorized tester performs an equivalence test on the two ciphertexts to be compared based on public parameters and a group trapdoor, including: Authorized testers based on group trapdoors And the first ciphertext ,calculate: Authorized testers based on group trapdoors Second ciphertext ,calculate: Verify whether the following two equations are true: If all the above equations hold true, then construct the equations passing through the origin respectively. With point linear function and passing through the origin With point linear function ; Verify whether the stated linear function satisfies: If true, output , indicating the first ciphertext With the second ciphertext If the plaintext corresponds to the same text, then output the corresponding plaintext. Otherwise, output the plaintext. , indicating the first ciphertext With the second ciphertext They do not correspond to the same plaintext.

Images