CN108551390A - A kind of band keyword search public key encryption method without safe lane - Google Patents

Abstract

The present invention discloses a kind of band keyword search public key encryption method without safe lane, includes the following steps：Step 1, security parameter λ is obtained, according to the global common parameter GP of security parameter λ outputs；Step 2, the public private key pair (pk of server S is obtained according to global common parameter GP_S,sk_S)；Step 3, the public private key pair (pk of recipient is obtained according to global common parameter GP_R,sk_R) and keyword ω；Step 4, it obtains PEKS ciphertexts C with keyword ω encryptions and returns to security parameter λ；Step 5, according to the private key sk of recipient_RWith keyword ω, output trapdoor T_ω；Step 6, according to the private key sk of server S_S, PEKS ciphertexts C and trapdoor T_ω, counter to push away keyword ω '；Step 7, judge whether ω=ω ' is true, if set up, export " Correct ", encrypt successfully, otherwise export " Incorrect ", encryption is unsuccessful.Such encryption method is capable of providing the better Encryption Model of more efficient and safety.

Description

A kind of band keyword search public key encryption method without safe lane

Technical field

The present invention relates to a kind of public key cryptography with keyword search, more particularly to a kind of bands without safe lane Keyword search public key encryption method.

Background technology

With internet, the development of cloud computing, user needs to store encrypted data beyond the clouds, is needed at this time to ciphertext It scans for, then proposes band keyword search and encrypt.Typical application is as follows：Assuming that user A wants to send encrypted electronics Mail gives user B, and in order to ensure anyone in addition to user B cannot decrypt Email, user A is sending Email The public key encryption of the user B mail is used before, therefore only user B possesses the ability of decryption.However encrypted electronics postal Part is completely random, and server's (mail server) will be unable to carry out Intelligent routing.For example, user B wants to be received with its mobile phone Those include the mail of keyword " urgent ", and the mail of other keywords is wished to route in (download) to computer to read, So user B needs to establish a kind of ciphertext matching mechanisms between mail service person, i.e., server is in non-decrypting mail ciphertext Under the conditions of test (TEST) mail whether include keyword " urgent ".

Keyword often from small set, and ordinary user commonly using known keyword (as it is urgent, Tourism etc.) it encrypts, the public key cryptography scheme with keyword search studied before only provides search plan, without providing User decrypts the ability of encrypted information, and attacker can only obtain the relevant trapdoor of keyword and cannot obtain in security model Test result between trapdoor and keyword.In reality, the recipient (attacker) of a malice oneself can generate selected close The trapdoor of keyword, and by interacting to obtain the relationship between trapdoor and ciphertext with server to realize attack.The prior art In existing enhance security model by increasing test query attacker obtained between non-challenge ciphertext and trapdoor Relationship, and give the public key with keyword search without safe lane safe under enhancing model under random oracle Encipherment scheme.Although the existing public key cryptography scheme with keyword search without safe lane is very ripe, he Safety can only be in approved safe under random oracle model, and random oracle model is a Utopian model, at this All participants can access the hash function of true random by black box under model, and under random oracle model Proof is only capable of being taken as a didactic argument, and the insecurity of system can be caused in actual environment.

Invention content

The purpose of the present invention is to provide a kind of band keyword search public key encryption method without safe lane, can There is provided more efficient and safety better Encryption Model.

In order to achieve the above objectives, solution of the invention is：

A kind of band keyword search public key encryption method without safe lane includes the following steps：

Step 1, security parameter λ is obtained, according to the global common parameter GP of security parameter λ outputs；

Step 2, the public private key pair (pk of server S is obtained according to global common parameter GP_S,sk_S)；

Step 3, the public private key pair (pk of recipient is obtained according to global common parameter GP_R,sk_R) and keyword ω；

Step 4, it obtains PEKS ciphertexts C with keyword ω encryptions and returns to security parameter λ；

Step 5, according to the private key sk of recipient_RWith keyword ω, output trapdoor T_ω；

Step 6, according to the private key sk of server S_S, PEKS ciphertexts C and trapdoor T_ω, counter to push away keyword ω '；

Step 7, judge whether ω=ω ' is true, if set up, export " Correct ", encrypt successfully, otherwise export " Incorrect ", encryption are unsuccessful.

In above-mentioned steps 1, the specific acquisition methods of global common parameter GP are：If (p, g, G₁,G₂, e) and it is Bilinear map Parameter selects one-way Hash functionIf keyword domain isRandomly generate random parameter u, v ∈ G₁Once signed Sig=(G, S, V) can not be forged by force；The global common parameter of output is GP=(p, g, G₁,G₂,e,u,v,Sig, H,KS_ω)。

In above-mentioned steps 2, the public private key pair (pk of server S_S,sk_S) specific acquisition methods be：Select random parameterEnable X=g^x, select random parameterG₁ ^*It is random parameter u, the intersection of v exports the public private key pair of server (pk_S,sk_S), wherein pk_S=(GP, X, Q), sk_S=(pk_S,x)。

In above-mentioned steps 3, the public private key pair (pk of recipient_R,sk_R) specific acquisition methods be：Select random parameterEnable Y=g^y, select random parameterExport the public private key pair (pk of recipient_R,sk_R), pk_R=(GP, Y, h), sk_S=(pk_R,y)。

In above-mentioned steps 5, trapdoor T_ωSpecific acquisition methods be：Select random parameterIt enablesTrapdoor is T_ω=(s_ω,d_ω)。

In above-mentioned steps 6, the anti-specific method for pushing away keyword ω ' is：

Step 61, selection can not forge by force once signed key pair (ssk, svk) ← G (λ), and C is arranged₀=svk；

Step 62, random parameter is selectedEnable C₁=g^s, t=H (e (X, Q)^s), C₂=(Yg^-ω)^r/t, C₃=e (g, g)^r, C₄=e (g, h)^r, C₅=(u^svkv)^s；

Step 63, to five-tuple (C₁,C₂,C₃,C₄,C₅) generate one can not forge once signed σ=S (ssk, (C by force₁, C₂,C₃,C₄,C₅))；

Step 64, PEKS ciphertexts are C=(C₀,C₁,C₂,C₃,C₄,C₅,σ)。

In above-mentioned steps 7, judge that the whether true specific methods of ω=ω ' are：

Step 71, the Formula V (C such as verification₀,σ,(C₁,C₂,C₃,C₄,C₅))=1 whether true, go to step 72 if setting up；

Step 72, equation is verifiedIt is whether true, go to step 73 if setting up；

Step 73, t=H (e (C are calculated₁,Q)^x)；

Step 74, equation is verifiedIt is whether true, if set up, export " Correct ", encrypts Otherwise success exports " Incorrect ", encryption is unsuccessful.

After adopting the above scheme, compared with prior art in various encipherment schemes, enhancing proposed by the present invention without peace The safety of the public key cryptography scheme with keyword search of all channel, to improve the safety of one-to-one communication in internet Property, it can effectively prevent third-party attack, and the front that safety and consistency of the invention avoids in proof procedure The shortcomings that random oracle is used in case, has the characteristics that：

(1) present invention has stronger security model.The security model of the present invention allow attacker obtain non-challenge ciphertext with Relationship namely attacker's ability between trapdoor is stronger, then the solution security of approved safe is more under this enhancing model It is high.

(2) since be proved to be under random oracle model in the practical application that safe scheme interconnects beyond the clouds may be uneasy Entirely, and the solution of the present invention does not depend on random oracle model and is individually present, and can bring better safety.

Specific implementation mode

Below with reference to specific embodiment, technical scheme of the present invention and advantageous effect are described in detail.

First to used in the present invention to concept illustrate：

1.1 negligible functions

Function of ε (n):N → R is referred to as insignificant, if for all n, 1/ ε (n) is nonpolynomial circle Amount.

1.2 Bilinear map

If G₁,G₂It is the cyclic group that exponent number is prime number p, g is crowd G₁Generation member (G is indicated respectively₁\{1},Z_p\ {0}).Claim e:G₁×G₁→G₂It is a Bilinear map, is set up and if only if following condition：

1.Wherein a, b ∈ Z_P,g₁,g₂∈G₁；

2.e(g,g)≠1；

3. for all g₁,g₂∈G₁, e (g₁,g₂) it is computable.

1.3 DBDH assume

If e:G₁×G₁→G₂It is a Bilinear map, defines the attack dominance function of opponent BIt is as follows：

a,b,c,r∈Z_pAnd it randomly selects.If for all probabilistic polynomial time opponent B, It is insignificant, then the decisive Diffie-Hellman based on Bilinear map assumes to set up (reference can be made to Boneh D, Boyen X..Efficient selective-ID Identity based encryption without random oracles [C].In Proc.of EUROCRYPT 2004,Springer Berlin Heidelberg,2004:223-238 and Gentry C..Practical identity-based encryption without random oracles[C].In Proc.of EUROCRYPT 2006,Springer-Verlag,2006:457-464)。

1.4 Truncated (Decisional) q-ABDHE assumes

If e:G₁×G₁→G₂It is a Bilinear map, defines the advantage function of opponent BIt is as follows：

Wherein x, z, r ∈ Z_pIt randomly selects.If for all probabilistic polynomial time opponent B,It is insignificant, then decisive Truncated q-ABDHE assume to set up.

The last 1.5 can not forge once signed

It includes a triple algorithm Sig=(G, S, V) that once signed can not be forged by force.Input parameter λ, G generate a pair of Key (ssk, svk).For any message M, the V (svk, σ)=1 as σ=S (ssk, M), otherwise V (svk, σ)=0.By force can not Forgery once signed, which refers to no any probabilistic polynomial timing attack person A, can forge a new signature, even to once signing Cross the message of name.

Sig=(G, S, V), which is one, can not forge by force once signed, multinomial for any probability and if only if the following time The probability of formula time adulterator F is insignificant：

Adv^OTS=Pr [(ssk, svk) ← G (λ)；

(m,St)←F(svk)；σ←S(ssk,m)；

(m',σ')←F(m.,σ,svk,St):

∧ (m', σ ') ≠ (m, the σ) of V (svk, σ ', m')=1]

Wherein St indicates the status information that each stage F is obtained.

The 1.6 public key encryption definition with keyword search without safe lane

Define 1 (public key encryption with keyword search for being not necessarily to safe lane)：Band keyword without safe lane is searched The public key cryptography scheme of rope includes following several algorithms：

-GloSetup(λ):Security parameter λ is inputted, global common parameter GP is exported.

-KeyGen_receiver(GP):It is input, the public private key pair (pk of output recipient R with common parameter GP_R,sk_R)。

-KeyGen_sever(GP):It is input, the public private key pair (pk of output server S with common parameter GP_S,sk_S)。

-SCF-PEKS(GP,pk_R,pk_S,ω)：Input common parameter GP, the public key pk of recipient_R, the public key of server pk_S, keyword ω.One is returned with the encrypted PEKS ciphertexts C of keyword ω.

-Trapdoor(CP,sk_R,ω)：Input common parameter GP, the private key sk of recipient_RAnd keyword ω, output Trapdoor T_ω。

-Test(GP,sk_S,C,T_ω)：Input common parameter GP, the private key sk of server_S, trapdoor T_ωAnd PEKS ciphertexts C, wherein C=SCF-PEKS (GP, pk_R,pk_S,ω').If ω=ω ', export " Correct ", otherwise export " Incorrect"。

Similar document Abdalla M, Bellare M, Catalano D, et al.Advances in Cryptology- CRYPTO 2005[C].Springer Berlin Heidelberg,2005:The conformance definition of 205-222, without safety letter The conformance definition of the public key cryptography scheme with keyword search in road is as follows：

Define 2 (consistency)：Assuming that there are an opponent A, want that the consistency to ruin a plan, formalization are defined as follows：

(pk_R,sk_R)←KeyGen_receiver(GP)；(pk_S,sk_S)←KeyGen_sever(GP)

(ω,ω')←A(pk_R,pk_S)

C←SCF-PEKS(GP,pk_R,pk_S,ω)；T_ω'←Trapdoor(GP,sk_R,ω')

ifω≠ω'and Test(GP,sk_S,C,T_ω')=" Correct "

Then return 1,

else return 0。

The wherein advantage of A is as follows：

If the probability for winning above-mentioned game for the opponent A of all probabilistic polynomial time is all insignificant, Scheme is to calculate consistency.

Next the safety definition for providing the public key encryption with keyword search without safe lane, that is, be not necessarily to safety The public key encryption with keyword search of channel resists the indistinguishability (IND-DT-CKA) of selection keyword attack.IND- DT-CKA ensure that in the case where that can obtain any non-challenge keyword trapdoor, not have any server that can distinguish PEKS close Text is by his selected keyword ω₀, ω₁Which of keyword encrypt.Also, it is any to there is no server It is by his selected keyword ω that the external attacker (including recipient) of private key, which cannot distinguish between PEKS ciphertexts,₀, ω₁In which What a keyword was encrypted, even if he can obtain the relationship between non-challenge ciphertext and trapdoor.It is defined as follows：

Define 3 (IND-DT-CKA game)：λ is security parameter, and A is attacker.Consider following attacker A and mimic B Two game：

Game 1：Assuming that A is server.

System is established：Common parameter generates algorithm GloSetup (λ) and two encryption key generating algorithms KeyGen_receiver (GP), KeyGen_sever(GP) it is performed, generates common parameter GP, the public private key pair (pk of recipient and server_R,sk_R), (pk_S,sk_S), then mimic B is (pk_S,sk_S) and pk_RIt is sent to attacker A.

Inquiry phase one：Attacker A does following inquiry：

(3.1) trapdoor is inquired<ω>:A inquires that trapdoors of the B about keyword ω, B return to A trapdoors T_ω=Trapdoor (GP,sk_R,ω)。

(3.2) test query<C,ω>:A inquires test queries of the B about keyword ω and PEKS ciphertext.B does one first A trapdoor inquiry<ω>To obtain trapdoor T_ω, B returns to A algorithm Test (GP, T_ω,sk_S, C) result.

(3.3) it challenges：Once A determines that 1 stage of inquiry terminates, he exports challenge keyword to (ω₀,ω₁) (note that ω₀, ω₁Cannot be the keyword for any trapdoor inquiry that A is done in inquiry phase one).Challenge keyword is received to rear, B is randomly B ∈ { 0,1 } are selected, and generate challenge ciphertext C^*=SCF-PEKS (GP, pk_R,pk_S,ω_b), it is sent to A.

Inquiry phase two：A do with one identical inquiry of stage, the only limitation is that A cannot be to ω₀, ω₁Trapdoor inquiry is done, And if<C,ω>=<C^*,ω₀>Or<C,ω>=<C^*,ω₁>Then permit no.<C,ω>Test query.

(3.4) guess：Attacker exports his conjecture b'.If b=b', attacker wins.

The advantage of attacker A in definition game 1：

Game 2：Assuming that A is external attacker (including recipient).

System is established：Common parameter generates algorithm GloSetup (λ) and two encryption key generating algorithms KeyGen_receiver (GP), KeyGen_sever(GP) it is performed, generates common parameter GP, the public private key pair (pk of recipient and server_R,sk_R), (pk_S,sk_S), then mimic B is (pk_R,sk_R) and pk_SIt is sent to attacker A.

Inquiry phase one：Attacker A does following inquiry：

(3.5) trapdoor is inquired<ω>:A inquires that trapdoors of the B about keyword ω, B return to A trapdoors T_ω=Trapdoor (GP,sk_R,ω)。

(3.6) test query<C,ω>:A inquires test queries of the B about keyword ω and PEKS ciphertext C.B does one first A trapdoor inquiry<ω>To obtain trapdoor T_ω, B returns to A tests Test (GP, T_ω,sk_S, C) result.

(3.7) it challenges：Once A determines that 1 stage of inquiry terminates, output challenge keyword is to (ω₀,ω₁) (note that ω₀, ω₁Cannot be that any trapdoor that A is done in inquiry phase one inquires relevant keyword).Receive challenge keyword to rear, B with B ∈ { 0,1 } are selected to machine, and generate challenge ciphertext C^*=SCF-PEKS (GP, pk_R,pk_S,ω_b), it is sent to A.

Inquiry phase two：A do with one identical inquiry of stage, if limitation<C,ω>=<C^*,ω₀>Or<C,ω>=< C^*,ω₁>Then permit no.<C,ω>Test query.With 1 different, ω of game₀, ω₁Here it is allowed to do trapdoor inquiry.

(3.8) guess：Attacker exports his conjecture b', if b=b', attacker wins.We define trip The advantage of attacker A in play 1：IfI=1 or 2 be it is insignificant, The public key cryptography scheme with keyword search for being so not necessarily to safe lane is IND-SCF-CKA safety.

Next the implementation and Security Proof of the present invention are specifically described.

The solution of the present invention includes following specific building method：

·GloSetup(λ):λ is security parameter, if (p, g, G₁,G₂, e) be Bilinear map parameter.Select one-way hash function FunctionIf keyword domain isRandomly generate u, v ∈ G₁Once signed Sig can not be forged by force =(G, S, V).The global common parameter of output is GP=(p, g, G₁,G₂,e,u,v,Sig,H,KS_ω)。

·KeyGen_sever(GP):Random selectionCalculate X=g^x, random selectionExport the public affairs of server Private key is to (pk_S,sk_S), wherein pk_S=(GP, X, Q), sk_S=(pk_S,x)。

·KeyGen_receiver(GP):Random selectionCalculate Y=g^y, random selectionExport recipient's Public private key pair, (pk_R,sk_R), pk_R=(GP, Y, h), sk_S=(pk_R,y)。

·PEKS(GP,pk_R,pk_S,ω)：

Selection can not forge by force once signed key pair (ssk, svk) ← G (λ), and C is arranged₀=svk, is as follows：

(1) it randomly choosesCalculate C₁=g^s, t=H (e (X, Q)^s), C₂=(Yg^-ω)^r/t, C₃=e (g, g)^r, C₄ =e (g, h)^r, C₅=(u^svkv)^s。

(2) to five-tuple (C₁,C₂,C₃,C₄,C₅) generate one can not forge once signed σ=S (ssk, (C by force₁,C₂,C₃, C₄,C₅))

(3) PEKS ciphertexts are C=(C₀,C₁,C₂,C₃,C₄,C₅, σ), return to C.

·Trapdoor(GP,sk_R,ω)：Random selectionIt calculatesTrapdoor is T_ω= (s_ω,d_ω), return to T_ω。

·Test(GP,sk_S,C,T_ω)：Whether true verify following several equatioies：

V(C₀,σ,(C₁,C₂,C₃,C₄,C₅))=1

If set up, calculate：T=H (e (C₁,Q)^x), whether true then verify following formula：

If above equation is all set up, " Correct " is returned, otherwise returns to " Incorrect ".

The consistency checking of the present invention is as follows：

Assuming that 1：The public key cryptography scheme with keyword search without safe lane of above-mentioned construction is to calculate consistency 's.

It proves：Assuming that there are the consistency that a polynomial time attacker A can destroy scheme above.

Enable (ω₀,ω₁) it is the keyword pair that attacker A is returned in consistent sex play.Without loss of generality, it is assumed that ω ≠ ω '.

It enablesIt is to generate ciphertext SCF-PEKS (GP, pk_R,pk_S, ω) when it is randomly selected.(ssk, svk) be it is strong not The key pair of once signed can be forged.H=g^z, C₁=g^s, t=H (e (X, Q)^s), C₂=(Yg^-ω)^r/t, C₃=e (g, g)^r, C₄=e (g,h)^r, T_ω'=(s_ω',d_ω'), whereinIt is to be fallen into caused by keyword ω ' Door.

The condition that obvious A wins is ω ≠ ω ', and needs to meetThen have：

It is transparent to attacker because y, z are private keys, therefore, Pr [s_ω'=z]=1/ (p-1), and Pr [ω '=y]= 1/ (p-1), wherein p-1 isThe number of middle element.As described above, when ω ≠ ω ', Test (GP, sk_S,C,T_ω')=" Correct"。

The security verification of the present invention is as follows：

Assuming that 2：Assuming that DBDH and q-ABDHE problems are difficult to resolve, then said program is the IND-DT- under master pattern CKA safety.

In order to prove this it is assumed that two citations is divided to complete to prove.

Citation 1：If q >=q_k+ 1, wherein q_kIt is the total degree of the done trapdoor inquiry of attacker.Assuming that q-ABDHE problems are difficult Solution, above-mentioned scheme is that anti-selection keyword attacks Semantic Security under master pattern in game 1.

It proves：Assuming that in game 1, there are a polynomial time attacker A, and above-mentioned side can be attacked under master pattern Case.Q-ABDHE can be solved the problems, such as by establishing a mimic B.Physical simulation is as follows：First, group G is arranged in challenger₁,G₂And it is double Linearly to e and group G₁Generation member g.Mimic B is entered a q-ABDHE problem-instanceThe target of mimic B is to discriminate betweenOr T is crowd G₂In one Random number.

System is established：λ is security parameter, (p, g, G₁,G₂, e) and it is Bilinear map parameter, one-way Hash functionKeyword domainGenerate u, v ∈ G₁Once signed Sig=(G, S, V) can not be forged by force.It is public Parameter is GP=(p, g, G altogether₁,G₂,e,u,v,Sig,H,KS_ω).It randomly selectsCalculate X=g^a, random selectionThe public and private key that server is arranged is respectively pk_S=(GP, X, Q), sk_S=(GP, a).

Q rank multinomials f (X) is randomly selected, Y=g is defined^x, h=g^f(x).The public key of recipient is pk_R=(pk_S,Y,h)。 Send (pk_R,pk_S,sk_S) give attacker A.

Inquiry phase one：Attacker A does following inquiry：

Trapdoor is inquired<ω>:A inquires that s is arranged in trapdoors of the B about keyword ω, B_ω=f (ω) calculates d_ω=g^{(f(x )-f(ω))/(x-ω)}, send trapdoor T_ω=(s_ω,d_ω) give A.As q >=q_kWhen+1, s_ω=f (ω) is a random number for A, Because f (X) is a random q rank multinomial.

Test query<C,ω>:A inquires B about the test result between keyword ω and PEKS ciphertext.B does one first Trapdoor is inquired<ω>To obtain trapdoor T_ω, B returns to A tests Test (GP, T_ω,sk_S, C) result.

Challenge：Once A determines that 1 stage of inquiry terminates, he exports challenge keyword to (ω₀,ω₁) (note that ω₀, ω₁No Can be the keyword for any trapdoor inquiry that A is done in inquiry phase one).B is randomly chosen b ∈ { 0,1 }, and ω is arranged^*=ω_b, Key pair (the ssk of once signed can not be forged by force by generating^*,svk^*C is arranged in) ← G (λ)₀ ^*=svk^*,It calculates

B is randomly choosedAnd it calculatesDefine q+1 rank multinomials

It calculates

Once signed σ can not be forged by force by generating one^*=S (ssk^*,(C₁ ^*,C₂ ^*,C₃ ^*,C₄ ^*,C₅ ^*)).Send challenge ciphertext C^*=(C₀ ^*,C₁ ^*,C₂ ^*,C₃ ^*,C₄ ^*,C₅ ^*,σ^*) give attacker A.

If r^*=zF^*(x), ifSo,

Inquiry phase two：A do with one identical inquiry of stage, limitation is that A cannot be to ω₀, ω₁Trapdoor inquiry is done, and such as Fruit<C,ω>=<C^*,ω₀>Or<C,ω>=<C^*,ω₁>, then do not allow pair<C,ω>Do test query.

Conjecture：Attacker exports his conjecture b', if b=b', exports 1, indicatesOtherwise it exports 0, indicate T=e (g, g)^r。

Probability analysis：IfSimulation is perfect, and the probability that A correctly guesss out b is 1/2+ ε.Otherwise T It is a random number, (C₂ ^*,C₃ ^*) be completely random and independently of each other.Inequality in this case The probability of establishment is 1-1/p.When inequality is set up, because of because private keyIt is random, soIt is random.And the angle of information, C are obtained from A₄ ^*With it is close Other elements are independent from each other (C in text₃ ^*Except).Therefore C₄ ^*It is random and mutually independent.Because of s^*∈Z_p ^*It is to select at random It takes, thereforeBe it is random and with (C₂ ^*,C₃ ^*,C₄ ^*) be independent from each other.Challenge ciphertext C^*=(C₀ ^*,C₁ ^*,C₂ ^*,C₃ ^*, C₄ ^*,C₅ ^*,σ^*) without revealing any information about b.To the proof of this completion game 1.

Citation 2：Assuming that DBDH problems are difficult to resolve, the solution of the present invention is the anti-selection under master pattern in game 2 Keyword attacks Semantic Security.

It proves：Assuming that in game 2, there are a polynomial time attacker A, and this paper structures can be attacked under master pattern The scheme made, we, which establish a mimic B, can solve the problems, such as DBDH.Physical simulation is as follows：

First, cyclic group G is arranged in challenger₁,G₂And Bilinear map e and group G₁Generation member g.Mimic is entered One DBDH problem-instances (g, g^a,g^b,g^c, T), the target of mimic B is to discriminate between T=e (g, g)^abcOr T is crowd G₂In one A random number.

Before describing B, event F is defined first_OTSAnd provide its probable range.Allow C^*=(C₀ ^*,C₁ ^*,C₂ ^*,C₃ ^*,C₄ ^*, C₅ ^*,σ^*) indicate the challenge ciphertext that attacker A is sent in game.F_OTSIndicate A to ciphertext C=(svk^*,C₁,C₂,C₃,C₄,C₅, Inquiry, and V (svk σ) is decrypted^*,σ,(C₁,C₂,C₃,C₄,C₅))=1.In the stage one, A does not know about svk^*It is any Information, therefore event F_OTSIt is no more than q in the probability that the stage one occurs_kθ.Wherein q_kIt is the total degree of test query, θ indicates primary The authentication secret svk of signature^*The maximum probability (being no more than 1/p) of appearance.Obviously in stage two, F_OTSGeneration equally forge Strong once signed.Therefore Pr [F_OTS]≤q_k/p+Adv^OTS, second part is the probability that can not be forged once signed by force and be destroyed, Therefore it is also insignificant.

In simulation process, if event F_OTSOccur, then mimic B stops playing and exporting a random number representative The result of conjecture.Key pair (the ssk of once signed can not be forged by force by being generated in preparation stage B^*,svk^*) ← G (λ), and attacked The person's of hitting A parametersWithWhereinIt is randomly selected.Entire simulation process is as follows：

System is established：λ is security parameter, (p, g, G₁,G₂, e) be Bilinear map parameter, one-way Hash functionCommon parameter is GP=(p, g, G₁,G₂,e,H,KS_ω)。KS_ωIndicate keyword domain.Enable X=g^a, Q=g^b, The public key that server is arranged is pk_S=(GP, X, Q).

Random selectionCalculate Y=g^y.Random selectionExport the public private key pair (pk of recipient_R,sk_R), Wherein pk_R=(GP, Y, h), sk_S=(pk_R,y)。(pk_R,sk_R) and pk_SIt is sent to attacker A.

Inquiry phase one：Attacker A does following inquiry：

Trapdoor is inquired<ω>:B randomly chooses s_ω∈Z_p ^*, calculateSend trapdoor T_ω=(s_ω,d_ω) To A.

Test query<C,ω>:A inquires B about keyword ω and PEKS ciphertext C=(C₀,C₁,C₂,C₃,C₄,C₅, σ) between Test result.B does a trapdoor inquiry first<ω>To obtain trapdoor T_ω, whether true then verify following formula：

V(C₀,σ,(C₁,C₂,C₃,C₄,C₅))=1,

If set up, it is divided into following two situation：

If C₀=svk=svk^*=C₀ ^*, and,

(C₁,C₂,C₃,C₄,C₅,σ)≠(C₁ ^*,C₂ ^*,C₃ ^*,C₄ ^*,C₅ ^*,σ^*)。

It is event F in this case_OTSOccur, stops game.

If C₀=svk ≠ svk^*=C₀ ^*, the legitimacy of ciphertext makesAnd

Because of C₁=g^s, B can calculateThen B can be calculated

B checks whether following formula is true：

If all equatioies are all set up, returns correctly, otherwise return to mistake.

Challenge：A output challenge keywords pair.B is randomly chosen b ∈ { 0,1 }, enables challenge keyword ω^*=ω_b, C₀ ^*= svk^*, C₁ ^*=g^c, t^*=H (T) randomly selects r ∈ Z_p ^*, calculateC₃ ^*=e (g, g)^r, C₄ ^*=e (g, h)^r,

Once signed σ can not be forged by force by generating one^*=S (ssk^*,(C₁ ^*,C₂ ^*,C₃ ^*,C₄ ^*,C₅ ^*)),

Return to ciphertext C^*=(C₀ ^*,C₁ ^*,C₂ ^*,C₃ ^*,C₄ ^*,C₅ ^*,σ^*), send C^*To A.

Inquiry phase two：A do with one identical inquiry of stage, limitation be if<C,ω>=<C^*,ω₀>Or<C,ω> =<C^*,ω₁>Then permit no.<C,ω>Test query.With 1 different, ω of game₀, ω₁Here it is allowed to do trapdoor and look into It askes.

Conjecture：Attacker exports his conjecture b', if b=b', output 1 indicates T=e (g, g)^abc.Otherwise 0 is exported, Indicate T=e (g, g)^r。

Probability analysis：Assuming that the existing probability polynomial time attacker A in game 2, it can be under master pattern with excellent Gesture ε wins game.The probability of mimic B is provided now：

As T=e (g, g)^abcWhen, A meets | Pr [b=b'] -1/2 | >=ε.When T is G₂ ^*In a random number when, then t^*=H (T) be it is random, equallyIt is random, then there is Pr [b=b']=1/2.A, b, c are Z_p ^*In member Element, T are G₂ ^*In element, then have

It is that can not ignore.To the proof of this completion game 2.

Below by the solution of the present invention and a kind of scheme progress performance comparison in the prior art：

Because of security model (Rhee H.S., Park J.H., Susilo W., the et al.Improved of Rhee et al. searchable public key encryption with designated tester[C].In Proc.of the 4th international Symposium on information,Computer,and Communications Security (ASIACCS’09),ACM,New York,NY,2009:376–379.)⁰Safety in the security model of the prior art compared with Height, therefore be compared with above-mentioned security model (hereinafter referred to as Rhee schemes).

Wherein G₁, G₂Indicate cyclic group；t_eIndicate group G₁, G₂The cost of upper exponent arithmetic, t_pIt is the flower of Bilinear map operation Take, and the cost t of Bilinear map operation_pAt least it is several times as much as the cost t of exponent arithmetic_e；t_s, t_vSignature and verification are indicated respectively Calculating spend.The present invention will not consider two-wire linearly to e (Q, X), the calculating time of e (g, g) and e (g, Y), because they It can be regarded as public key.The meter of Bilinear map e (g, h) in Rhee et al. schemes, e (g, u) and e (g, u~) are not considered equally Evaluation time.Result of the comparison such as the following table 1." test query C^*" expression pair<C^*,ω>Test query, wherein ω ≠ ω₀, ω ≠ ω₁。

The result of table 1. present invention and Rhee project plan comparisons

Rhee et al. schemes refer to Rhee H.S., Park J.H., Susilo W., et al.Improved searchable public key encryption with designated tester[C].In Proc.of the 4th international Symposium on information,Computer,and Communications Security (ASIACCS’09),ACM,New York,NY,2009:376–379。

Obtained from table 1, the solution of the present invention in terms of the public key size and PEKS encryptions of recipient and server more Efficiently.But the solution of the present invention is in the security model approved safe of enhancing, you can with to challenging ciphertext C^*Do about<C^*,ω >Test query, wherein ω ≠ ω₀, ω ≠ ω₁.And be approved safe under master pattern, avoid the dependence of Rhee schemes This disadvantage of random oracle.

Above example is merely illustrative of the invention's technical idea, and protection scope of the present invention cannot be limited with this, every According to technological thought proposed by the present invention, any change done on the basis of technical solution each falls within the scope of the present invention Within.

Claims (7)

1. a kind of band keyword search public key encryption method without safe lane, it is characterised in that include the following steps：

Step 1, security parameter λ is obtained, according to the global common parameter GP of security parameter λ outputs；

Step 2, the public private key pair (pk of server S is obtained according to global common parameter GP_S,sk_S)；

Step 3, the public private key pair (pk of recipient is obtained according to global common parameter GP_R,sk_R) and keyword ω；

Step 4, it obtains PEKS ciphertexts C with keyword ω encryptions and returns to security parameter λ；

Step 5, according to the private key sk of recipient_RWith keyword ω, output trapdoor T_ω；

Step 6, according to the private key sk of server S_S, PEKS ciphertexts C and trapdoor T_ω, counter to push away keyword ω '；

Step 7, judge whether ω=ω ' is true, if set up, export " Correct ", encrypt successfully, otherwise export " Incorrect ", encryption are unsuccessful.

2. a kind of band keyword search public key encryption method without safe lane as described in claim 1, it is characterised in that： In the step 1, the specific acquisition methods of global common parameter GP are：If (p, g, G₁,G₂, e) be Bilinear map parameter, choosing Select one-way Hash function H:If keyword domain isRandomly generate random parameter u, v ∈ G₁By force not Once signed Sig=(G, S, V) can be forged；The global common parameter of output is GP=(p, g, G₁,G₂,e,u,v,Sig,H,KS_ω)。

3. a kind of band keyword search public key encryption method without safe lane as described in claim 1, it is characterised in that： In the step 2, the public private key pair (pk of server S_S,sk_S) specific acquisition methods be：Select random parameterEnable X =g^x, select random parameterG₁ ^*It is random parameter u, the intersection of v exports the public private key pair (pk of server_S,sk_S), Middle pk_S=(GP, X, Q), sk_S=(pk_S,x)。

4. a kind of band keyword search public key encryption method without safe lane as described in claim 1, it is characterised in that： In the step 3, the public private key pair (pk of recipient_R,sk_R) specific acquisition methods be：Select random parameterEnable Y= g^y, select random parameterExport the public private key pair (pk of recipient_R,sk_R), pk_R=(GP, Y, h), sk_S=(pk_R,y)。

5. a kind of band keyword search public key encryption method without safe lane as claimed in claim 4, it is characterised in that： In the step 5, trapdoor T_ωSpecific acquisition methods be：Select random parameterIt enablesTrapdoor For T_ω=(s_ω,d_ω)。

6. a kind of band keyword search public key encryption method without safe lane as described in claim 1, it is characterised in that： In the step 6, the anti-specific method for pushing away keyword ω ' is：

Step 61, selection can not forge by force once signed key pair (ssk, svk) ← G (λ), and C is arranged₀=svk；

Step 62, random parameter is selectedEnable C₁=g^s, t=H (e (X, Q)^s), C₂=(Yg^-ω)^r/t, C₃=e (g, g)^r, C₄=e (g, h)^r, C₅=(u^svkv)^s；

Step 63, to five-tuple (C₁,C₂,C₃,C₄,C₅) generate one can not forge once signed σ=S (ssk, (C by force₁,C₂,C₃, C₄,C₅))；

Step 64, PEKS ciphertexts are C=(C₀,C₁,C₂,C₃,C₄,C₅,σ)。

7. a kind of band keyword search public key encryption method without safe lane as described in claim 1, it is characterised in that： In the step 7, judge that the whether true specific methods of ω=ω ' are：

Step 71, the Formula V (C such as verification₀,σ,(C₁,C₂,C₃,C₄,C₅))=1 whether true, go to step 72 if setting up；

Step 72, equation is verifiedIt is whether true, go to step 73 if setting up；

Step 73, t=H (e (C are calculated₁,Q)^x)；

Step 74, equation is verifiedIt is whether true, if set up, " Correct " is exported, is encrypted successfully, Otherwise " Incorrect " is exported, encryption is unsuccessful.