CN109246098B - A Method for Supporting Synchronous Ciphertext Comparison of Backup Servers - Google Patents

Abstract

The present invention proposes a method for supporting synchronous ciphertext comparison of a backup server, including: a trusted authority TA selects a security parameter and an anti-collision hash function to generate public parameters; Data decryptor; the primary server and the backup server generate their own public and private keys; the data encryptor uses the public keys of the two data decryptors to perform the encryption algorithm, and the generated ciphertext is sent to the two servers; the data decryptor from Either server downloads the corresponding ciphertext, and then uses its own private key to decrypt the ciphertext; the data decryptor generates the authorization token ctk, and authorizes the primary server and the backup server to perform an equivalent comparison of the ciphertext; The received authorization token ctk is decrypted to obtain the authorization token tk; the two servers use the authorization token tk to compare the stored user ciphertext data to determine whether the compared user ciphertext is encrypted with the same plaintext information.

Description

A Method for Supporting Synchronous Ciphertext Comparison of Backup Servers

technical field

The invention relates to the field of information security ciphers, in particular to a method for supporting synchronizing ciphertext comparison of a backup server.

Background technique

With the rapid development of information technology, the amount of data generated in people's daily work and life is increasing. In order to reduce the burden of local storage of large-scale data, more and more users use remote data storage methods such as cloud storage. With the services provided by cloud servers, users can access their data anytime and anywhere, and it is easy to realize data sharing among multiple users. However, while users enjoy the convenience provided by cloud storage services, user data is completely controlled by cloud servers, which inevitably leads to concerns about the privacy and security of their data.

Considering the software and hardware configuration of the cloud server and the complex network environment, if the software and hardware fails, it cannot provide services to users in real time; if it is attacked by a network, it may not only make the cloud server unable to provide services to users for a certain period of time, And it is likely to cause leakage of user data. In recent years, cases of cloud storage user data leakage and loss have been continuously reported. Therefore, it is urgent to design and deploy corresponding cloud data security protection measures to ensure the privacy, security and availability of user data.

In order to ensure the security and availability of user data in the cloud server, the encryption technology suitable for dual servers is introduced, and the user's ciphertext data is stored on the main server and the backup server at the same time. When the main server fails or is attacked, it will be immediately Use the backup server to provide services to users and complete seamless server switching without affecting the user experience. This requires that at any time, the primary server and the backup server must store the same user data and obtain the same authorization, and the work of either server does not require the cooperation of the other server to complete.

Considering the multi-user environment, user data often has more than one receiver and user. For example, a user's ciphertext data can not only be decrypted and used by himself, but the leading agency where he is located should also have access and use rights. In this case, Dual-receiver encryption (DRE) can be used to solve this problem. Using DRE technology, the sender can specify two intended recipients of ciphertext data when encrypting data, so that they can both decrypt the ciphertext without interaction during the decryption process.

Since cloud servers not only have powerful storage capacity, but also have strong computing capabilities, users may wish to authorize some computing tasks to cloud servers for execution without affecting user data privacy. Consider that the cloud server is entrusted to perform an Equality test on ciphertexts (ETC) on the user's ciphertext data to determine whether the user's ciphertext encrypts the same plaintext data. The ciphertext equivalent comparison technology has a wide range of application scenarios, such as ciphertext data table connection and ciphertext data deduplication.

Since the user's authorization may be eavesdropped during the transmission process, the authorization information needs to be encrypted so that only the legitimate cloud server can decrypt and obtain authorization. Combined with the above-mentioned dual-server model and dual-receiver application scenario, it is obviously required that any ciphertext data receiver must be able to authorize the two servers to perform ciphertext comparison at the same time when authorizing the server, so as to ensure that the primary server and the backup server have the ability to serve the user at the same time. The ability to provide the same service. Therefore, the authorized encryption process also needs to be solved using DRE technology.

At present, some DRE technologies and ETC technologies have been proposed, and very successful research results have been achieved: design a provably secure (IND-CCA2) cryptographic scheme under the condition of adaptive chosen ciphertext attack; construct provable security under the standard model cryptographic scheme; construct provably secure cryptographic scheme based on identity environment; design general and semi-universal cryptographic scheme construction technology, etc. Although the above research results have good performance or properties in one aspect, the existing DRE technology and ETC technology cannot be effectively integrated to meet the aforementioned needs.

SUMMARY OF THE INVENTION

In view of the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a method for supporting the synchronization of ciphertext comparison of a backup server.

In order to achieve the above-mentioned purpose and other related purposes, the present invention provides a method for supporting the synchronization of backup server ciphertext comparison, and the method comprises the following steps:

The trusted authority TA selects security parameters and anti-collision hash functions to generate public parameters;

Each user generates its own public key and private key according to the public parameters, and the user includes a data decryptor;

The primary server and the backup server respectively generate their own public key and private key according to the public parameters;

The data encryptor executes the encryption algorithm according to the public keys of the two data decryptors and generates corresponding ciphertext, and the corresponding ciphertext is sent to the primary server and the backup server;

The data decryptor downloads the corresponding ciphertext from the main server or the backup server, and then decrypts the ciphertext using the respective private key;

The data decryptor generates an authorization token ctk through an authorization process, and at the same time authorizes the primary server and the backup server to perform an equivalent comparison of its ciphertext;

The primary server or the backup server decrypts the received authorization token ctk to obtain the authorization token tk;

The primary server or the backup server uses the authorization token tk to compare the stored user ciphertext data to determine whether the compared user ciphertext encrypts the same plaintext message.

Optionally, the public parameter para is specifically: para=(G, G _T , g, e, q, H ₁ ( ), H ₂ ( )), where G and G _T are two orders is a group of prime numbers q, e represents a bilinear mapping operation e: G×G→G _T , and H ₁ (·) and H ₂ (·) represent collision-resistant hash functions, respectively.

Optionally, the generation of the respective public key and private key by each user according to the public parameter specifically includes:

表示域Z_q的非零元素子集{1,2,..,q-1}，i＝1,2，

User U _i randomly selects two non-zero elements x _i,1 , _xi,2 in the field of Z _q , and computes two exponentiation operations X _i,1 and X _i,2 on the group G, where

represents the non-zero element subset {1,2,..,q-1} of the field Z _q , i=1,2,

User U _i obtains public key rpk _i =(X _i,1 ,X _i,2 ) and private key rsk _i =( _xi,1 , _xi,2 ).

Optionally, the main server and the backup server generate their respective public keys and private keys according to the public parameters, which specifically includes:

The server S _i randomly selects two non-zero elements y _i,1 ,y _i,2 in the field Z _q and computes the two exponentiation operations Y _i,1 and Y _i,2 on the group G, where

The server S _i obtains the public key tpk _i =(Y _i,1 ,Y _i,2 ) and the private key tsk _i =(y _i,1 , _yi,2 ).

Optionally, the data encryptor executes the encryption algorithm according to the public keys of the two data decryptors and generates the corresponding ciphertext specifically including:

||表示字符串连接，

表示二进制异或运算，

t₁和t₂分别表示群G_T上的两个幂运算，

The data encryptor randomly selects two non-zero elements α ₁ , α ₂ in the field Z _q , and calculates the ciphertext C of the data m, where C=(c ₁ ,c ₂ ,c ₃ ,c ₄ ),

|| means string concatenation,

represents the binary XOR operation,

t ₁ and _{t 2} represent the two exponentiation operations on the group GT, respectively,

Optionally, the data decryptor downloads the corresponding ciphertext from the main server or the backup server, and then decrypts the ciphertext by using the respective private keys, which specifically includes:

The data decryptor U _i computes the exponentiation _t ' ₂ and m||α ₁ on the group GT,

并验证

和

是否成立；如果成立，解密者U_i得到明文消息m，否则解密失败。The data decryptor U _i computes the exponentiation _{t 1} ' on the group GT,

and verify

and

Whether it is established; if so, the decryptor U _i gets the plaintext message m, otherwise the decryption fails.

Optionally, the data decryptor generates an authorization token ctk through an authorization process, and at the same time authorizes the main server and the backup server to perform an equivalent comparison on its ciphertext, specifically including:

r₁,r₂分别表示群G_T上的两个幂运算，r₁＝e(Y_1,1,Y_2,1)^β，r₂＝e(Y_1,2,Y_2,2)^β，v₁＝g^β，

The data decryptor U _i randomly selects a non-zero element β in the field Z _q and calculates v ₁ , v ₂ and v ₃ ; where,

r ₁ , r ₂ respectively represent two exponentiation operations on the group _GT , r ₁ =e(Y _1,1 ,Y _2,1 ) ^β , r ₂ =e(Y _1,2 ,Y _2,2 ) ^β , v ₁ =g ^β ,

The data decryptor U _i sends the encrypted authorization token ctk=(v ₁ , v ₂ , v ₃ ) to the primary server S ₁ and the backup server S ₂ .

Optionally, the primary server or the backup server decrypts the received authorization token ctk to obtain the authorization token tk specifically including:

tk＝v₂/H₁(r'₁)；Server Si _computes exponentiation r' ₁ , r' ₂ and authorization token tk on group _GT , where

tk=v ₂ /H ₁ (r' ₁ );

Verify whether H ₂ (v ₁ ||v ₂ ||tk||r' ₂ )=v3 is established; if so, the server Si obtains the correct authorization token tk, otherwise it fails.

Optionally, the main server or the backup server uses the authorization token tk to compare the stored user ciphertext data to determine whether the compared user ciphertext is encrypted with the same plaintext message, which specifically includes:

是否成立；如果成立，则密文C和密文C'加密了相同的明文消息，否则密文C和密文C'加密了不同的明文消息。Server _Si authentication

Is it true; if true, then ciphertext C and ciphertext C' encrypt the same plaintext message, otherwise ciphertext C and ciphertext C' encrypt different plaintext messages.

In order to achieve the above purpose and other related purposes, a device for supporting the synchronization of ciphertext comparison of a backup server, the device includes:

The initialization module is suitable for selecting security parameters and anti-collision hash function according to the trusted authority TA, and generating public parameters;

A user key generation module, suitable for each user to generate their own public key and private key according to the public parameters, and the user includes a data encryptor and a data decryptor;

The server key generation module is suitable for the main server and the backup server to generate their own public key and private key according to the public parameters;

A data encryption module, which is suitable for a data encryptor to perform an encryption algorithm according to the public keys of the two data decryptors and generate corresponding ciphertexts, and the corresponding ciphertexts are sent to the primary server and the backup server;

The data decryption module is suitable for the data decryptor to download the corresponding ciphertext from the main server or the backup server, and then use the respective private key to decrypt the ciphertext;

The authorization generation module is suitable for the data decryptor to generate the authorization token ctk through an authorization process, and at the same time authorize the main server and the backup server to perform an equivalent comparison of its ciphertext;

The authorization decryption module is suitable for the primary server or the backup server to decrypt the received authorization token ctk to obtain the authorization token tk;

The ciphertext comparison module is suitable for the main server or the backup server to use the authorization token tk to compare the stored user ciphertext data to judge whether the compared user ciphertext encrypts the same plaintext message.

As described above, a method for supporting the comparison of ciphertext synchronization of a backup server of the present invention has the following beneficial effects:

The present invention provides a method for supporting synchronous ciphertext comparison of backup servers. Using this method in a cloud storage environment encrypts, decrypts, synchronously stores data in dual servers, and authorizes encryption and decryption for users, which can ensure that user data is not completely encrypted. Privacy and availability under a trusted two-server model. By using the main server and the backup server to store user data at the same time, and to obtain the authorization of the user at the same time, when the function of the main server fails, the backup server can seamlessly realize the function replacement; through the double decryptor technology of ciphertext, the data encryptor can specify two For each intended recipient or user of the data, the encryptor only needs to encrypt the data once, thereby reducing the computational overhead of encryption.

Description of drawings

In order to further illustrate the content described in the present invention, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings. It should be understood that these drawings are presented by way of example only and should not be considered as limiting the scope of the present invention.

FIG. 1 is a system architecture diagram of the method according to the present invention.

FIG. 2 is a block flow diagram of the method of the present invention.

Detailed ways

The embodiments of the present invention are described below through specific specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments may be combined with each other under the condition of no conflict.

It should be noted that the drawings provided in the following embodiments are only used to illustrate the basic concept of the present invention in a schematic way, so the drawings only show the components related to the present invention rather than the number, shape and number of components in actual implementation. For dimension drawing, the type, quantity and proportion of each component can be changed at will in actual implementation, and the component layout may also be more complicated.

In order to make the technical solutions of the present invention more clearly understood by those skilled in the art, some technical terms in the present invention are described first.

(1) Trusted Authority (TA): Trusted by various entities, responsible for generating public parameters of the system and maintaining public key information of all users.

(2) Data encryptor (DE): also known as data sender, calculates its own pair of public and private keys according to the public parameters of the system, sends the public key to TA for maintenance, and can choose two expectations when executing the data encryption algorithm and upload the encrypted ciphertext data to the primary server and backup server.

(3) Data decryptor (DD): also known as data receivers, there are two in total. They calculate their own pair of public and private keys according to the public parameters of the system, and send the public keys to TA for maintenance. The corresponding ciphertext data is read and the decryption algorithm is executed, and the authorization in the form of ciphertext is generated and sent to the primary server and the backup server.

(4) Master server (MS): Calculates its own pair of public and private keys according to the public parameters of the system, sends the public key to TA for maintenance, can provide data storage services for users, and can decrypt the user's ciphertext authorization and then execute the encryption. Text equivalence comparison.

(5) Backup server (BS): Calculate its own pair of public and private keys according to the public parameters of the system, and send the public key to the TA for maintenance, which can provide users with data storage services, decrypt the user's ciphertext authorization, and then execute the encryption. When the main server function fails, it can provide services to users immediately.

The cryptosystem designed in the present invention uses the mathematical knowledge related to bilinear mapping, and the relevant definitions are explained here.

Define a function map e:G×G→G _T to map the elements in the cyclic group G to the cyclic group G _T , where both G and G _T are two cyclic groups whose order is prime q. The bilinear map e needs to satisfy the following properties:

(1) Bilinear characteristic: for any u, v∈G, any a, b∈Z _q , e(u ^a ,v ^b )=e(u,v) ^ab holds, where Z _q ={0 ,1,2,...,q-1};

(2) Non-degenerate characteristics: there is at least one element g in the group G, so that e(g, g) is the generator of the group G _T ;

(3) Efficiency: There are efficient algorithms such that for any u, v ∈ G, the value of e(u, v) can be efficiently calculated.

The hash function used in the present invention has two basic characteristics: one-way and anti-collision; one-way means that it is efficient to deduce the output from the input of the hash function, but cannot be calculated from the output of the hash function. Its input; collision resistance is the inability to find two different inputs that have the same hash function value.

As shown in FIG. 1 , the present invention provides a method for supporting the comparison of ciphertext synchronization of a backup server, and the method includes the following steps:

Step 1. The trusted authority TA selects the security parameters and the anti-collision hash function to generate public parameters.

Specifically, this step 1 specifically includes the following sub-steps:

Step 11: The trusted authority TA inputs the system security parameter λ, runs the initialization algorithm Γ(1 ^λ ), and outputs two groups G and G _T with prime q order and a bilinear mapping operation e: G×G→G _T ;

Among them, the initialization algorithm Γ(1 ^λ ), the operation method is as follows: the trusted authority TA inputs the system security parameter λ, and the system selects the corresponding elliptic curve according to the size of λ: Y ² =X ³ +aX+b (a and b are coefficients), use the points on the elliptic curve to form two prime q-order groups G and G _T , select a mapping function e, and map the elements in the group G to the group G _T ; generally, safe The larger the value of parameter λ, the more points on the selected elliptic curve and the larger the group.

Step 12: The trusted authority TA runs the random number generation algorithm, and randomly selects a generator g in the group G;

The method of the random number generation algorithm is as follows: according to the elliptic curve Y ² =X ³ +aX+b selected in step 11, randomly select a value x ₁ of the independent variable X, and calculate the value corresponding to the dependent variable Y y ₁ ; if the point (x ₁ , y ₁ ) is in the group to be mapped, the random element is successfully generated; if the point (x ₁ , y ₁ ) is not in the group, continue to re-select the value of X until the occurrence of point in the cluster.

Step 13: The trusted authority TA selects two collision-resistant hash functions H ₁ (·) and H ₂ (·), both of which satisfy the collision-resistant hash function H ₁ (·) and H ₂ (·) All properties of the function. The anti-collision hash functions H ₁ (·) and H ₂ (·) described therein can be called and run from the Pairing-Based Cryptosystems library functions. The input of the collision-resistant hash function H ₁ (·) is an element in the group G _T , and the output is an element in the group G, and the input of H ₂ (·) contains three elements in the group G and one in the group G _T element, the output is log ₂ (q)+log ₂ |G|, and |G| represents the length of the element in the group G.

Finally, the system public parameters are expressed as para=(G, _GT , g, e, q, H ₁ (·), H ₂ (·)).

Step 2. Each user generates his own public key and private key according to the public parameters, and the user includes a data decryptor.

并计算

和

数据解密者U_i得到公钥rpk_i＝(X_i,1,X_i,2)以及私钥rsk_i＝(x_i,1,x_i,2)；X_i,1和X_i,2分别表示群G上的两个幂运算。Specifically, the data decryptor U _i randomly selects two non-zero elements in the Z _q field

and calculate

and

The data decryptor U _i obtains the public key rpk _i =(X _i,1 ,X _i,2 ) and the private key rsk _i =( _xi,1 , _xi,2 ); Xi _,1 and Xi _,2 respectively represents an exponentiation of two on the group G.

表示域Z_q的非零元素子集{1,2,..,q-1}，随机选择

中元素的函数能从Pairing-Based Cryptosystems库函数中调用运行。in,

represents a subset {1,2,..,q-1} of nonzero elements of the field Z _q , chosen at random

The functions of the elements can be called and run from the Pairing-Based Cryptosystems library functions.

Step _{3. The} primary server S1 and the backup server S2 respectively generate their own public key and private key according to the public parameters.

并计算

和

服务器S_i得到公钥tpk_i＝(Y_i,1,Y_i,2)以及私钥tsk_i＝(y_i,1,y_i,2)；Y_i,1和Y_i,2分别表示群G上的两个幂运算。Specifically, the server S _i (i=1,2) randomly selects two non-zero elements in the field Z _q

and calculate

and

The server S _i obtains the public key tpk _i =(Y _i,1 ,Y _i,2 ) and the private key tsk _i =(y _i,1 ,y _i,2 ); Yi _,1 and Yi _,2 respectively represent the group Two exponentiation operations on G.

Step 4. The data encryptor executes the encryption algorithm according to the public keys of the two data decryptors and generates corresponding ciphertexts, which are sent to the primary server and the backup server.

并计算

和

其中||表示字符串连接，

表示二进制异或运算，t₁和t₂分别表示群G_T上的两个幂运算。Specifically, the data encryptor randomly selects two non-zero elements in the field Z _q

and calculate

and

where || represents string concatenation,

Represents the binary XOR operation, and t ₁ and _{t 2} represent the two exponentiation operations on the group GT, respectively.

The data encryptor obtains the ciphertext C=(c ₁ , c ₂ , c ₃ , c ₄ ) of the data m, which is stored on the primary server S ₁ and the backup server S ₂ .

Among them, the generated ciphertext C can be decrypted by the data decryptors U1 and U2 at the same time, and there is no need for interaction between the data _decryptors U1 and U2 _; the ciphertext C is stored _{on both} the primary server _S1 and the backup server _S2 Above, it is ensured that the _two servers store the same data. When the main server _S1 fails and cannot provide services to users, it can be switched to the synchronized backup server S2 in real time.

Step 5. The data decryptor U _i (i= ₁ , ₂ ) downloads the corresponding ciphertext C from the primary server S1 or the backup server S2, and then decrypts the ciphertext C with the respective private keys.

Specifically, step 5 specifically includes the following sub-steps:

和

Step 51: Data decryptor U _i (i=1,2) calculation

and

验证

和

是否成立；如果验证通过，解密者U_i(i＝1,2)得到明文消息m，否则解密失败；Step 52: Calculate the data decryptor U _i (i=1,2)

verify

and

Whether it is established; if the verification is passed, the decryptor U _i (i=1, 2) obtains the plaintext message m, otherwise the decryption fails;

Step 6. The data decryptor U _i (i=1, 2) generates an authorization token ctk through an authorization process, and at the same time authorizes the primary server S ₁ and the backup server S ₂ to perform an equivalent comparison on its ciphertext.

Specifically, the step 6 specifically includes the following sub-steps:

计算v₁＝g^β，r₁＝e(Y_1,1,Y_2,1)^β，r₂＝e(Y_1,2,Y_2,2)^β，

和

Step 61. The data decryptor U _i (i=1,2) randomly selects a non-zero element in the field Z _q

Calculate v ₁ =g ^β , r ₁ =e(Y _1,1 ,Y _2,1 ) ^β ,r ₂ =e(Y _1,2 ,Y _2,2 ) ^β ,

and

Step 62. The data decryptor U _i (i=1, 2) sends the encrypted authorization token ctk=(v ₁ , v ₂ , v ₃ ) to the primary server S ₁ and the backup server S ₂ .

Wherein, both the data decryptors U ₁ and U ₂ can perform step 6 to generate an authorization token ctk in the form of cipher text, and ctk can be decrypted by the primary server S ₁ and the backup server S ₂ to restore the authorization token tk at the same time, as long as ctk If it is not damaged, the primary server _S1 and the backup server _S2 must be decrypted to obtain tk. During the decryption process, the primary server _S1 and the backup server _S2 do not need to interact, which ensures that the primary server _S1 and the backup server _S2 can communicate with the user. provide the same service.

Step 7. The primary server or/and the backup server decrypt the received authorization token ctk to obtain the authorization token tk.

Each of the servers S _i (i=1 is the primary server S ₁ , i=2 is the backup server S ₂ ) can decrypt the received ciphertext authorization token ctk to obtain the authorization token tk.

Specifically, the step 7 specifically includes the following sub-steps:

以及tk＝v₂/H₁(r'₁)；Step 71. Server _Si calculation

and tk=v ₂ /H ₁ (r' ₁ );

验证H₂(v₁||v₂||tk||r'₂)＝v3是否成立；如果验证通过，服务器S_i(i＝1,2)得到正确的授权令牌tk，否则失败。Step 72. Server _Si calculation

Verify whether H ₂ (v ₁ ||v ₂ ||tk||r' ₂ )=v3 is established; if the verification passes, the server S _i (i=1,2) obtains the correct authorization token tk, otherwise it fails.

Step 8. The primary server or the backup server uses the authorization token tk to compare the stored user ciphertext data to determine whether the compared user ciphertext encrypts the same plaintext message.

The server S _i (i=1 is the main server S ₁ , i=2 is the backup server S ₂ ) can use the authorization token tk to compare the stored user ciphertext data (such as C and C') to determine the password Whether the texts C and C' encrypt the same plaintext message; among them, the calculation methods of the ciphertexts C' and C are the same.

Specifically, the step 8 specifically includes:

是否成立；如果成立，输出“1”，表明密文C和C’加密了相同的明文消息，否则输出“0”，表示C和C’加密了不同的明文消息；Server S _i (i=1,2) authentication

Whether it is established; if so, output "1", indicating that the ciphertext C and C' encrypt the same plaintext message, otherwise output "0", indicating that C and C' encrypt different plaintext messages;

如果成立，则密文C和C’加密了相同的明文消息，否则C和C’加密了不同的明文消息。Wherein, _both the primary server S1 and the backup server S2 can use the obtained authorization token tk to compare the ciphertext data _of the user who issued the authorization to them, which means that the primary server _S1 and the backup server S2 can issue the authorization token _tk to the user. Users provide the same service; in addition, step ₈ also supports the primary server S1 and the backup server _S2 to perform equivalent comparison of ciphertext data from different sources, as long as the legal authorization issued by these users can be obtained, for example, if the ciphertext C The authorization tokens corresponding to C' are tk ₁ and tk ₂ respectively, and the server S _i (i=1, 2) verifies

If true, then the ciphertexts C and C' encrypted the same plaintext message, otherwise C and C' encrypted different plaintext messages.

To sum up, the present invention proposes a method for supporting the synchronization of ciphertext comparison of the backup server. First of all, in the cloud storage environment, the data sender can specify two receivers for the data to be encrypted, and then store the ciphertext data in the cloud. Only the specified receivers can obtain the plaintext content of the data, which fully ensures the integrity of user data. Privacy; secondly, when the user sends the ciphertext data to the cloud, it needs to be stored on the main server and the backup server at the same time, so that when the main server fails or is attacked and cannot provide services for the user, it can immediately switch to the backup server. Improve the availability of user data; thirdly, the two recipients of the data can simultaneously authorize the main server and the backup server to compare their ciphertext data without decrypting it, which not only maximizes the privacy of user data, but also ensures The state consistency of the primary server and the backup server is ensured; finally, the authorization of the data receiver is sent to the primary server and the backup server in the form of cipher text, which ensures the privacy of the authorization during the transmission process.

In another embodiment, the present invention also provides a device for supporting the synchronization of ciphertext comparison of a backup server, the device comprising:

The initialization module is suitable for selecting security parameters and anti-collision hash function according to the trusted authority TA, and generating public parameters;

A user key generation module, suitable for each user to generate their own public key and private key according to the public parameters, and the user includes a data encryptor and a data decryptor;

The server key generation module is suitable for the main server and the backup server to generate their own public key and private key according to the public parameters;

A data encryption module, which is suitable for a data encryptor to perform an encryption algorithm according to the public keys of the two data decryptors and generate corresponding ciphertexts, and the corresponding ciphertexts are sent to the primary server and the backup server;

The data decryption module is suitable for the data decryptor to download the corresponding ciphertext from the main server or the backup server, and then use the respective private key to decrypt the ciphertext;

The authorization generation module is suitable for the data decryptor to generate the authorization token ctk through an authorization process, and at the same time authorize the main server and the backup server to perform an equivalent comparison of its ciphertext;

The authorization decryption module is suitable for the primary server or the backup server to decrypt the received authorization token ctk to obtain the authorization token tk;

The ciphertext comparison module is suitable for the main server or the backup server to use the authorization token tk to compare the stored user ciphertext data to judge whether the compared user ciphertext encrypts the same plaintext message.

In this embodiment, the initialization module, the user key generation module, the server key generation module, the data encryption module, the data decryption module, the authorization generation module, the authorization decryption module, and the ciphertext comparison module are constituted or implemented. All the methods can be implemented in another embodiment, which is not repeated in this embodiment.

The device for supporting the comparison of synchronous ciphertext of the backup server described in the present invention ensures the privacy and availability of user data stored in the cloud, reduces the computational overhead of the sender's encrypted data, and realizes secure data sharing among multiple users. The computing resources of the cloud server reduce the computing cost of users.

To sum up, the present invention uses this method to encrypt, decrypt, and store data synchronously in dual servers in a cloud storage environment, and authorize encryption and decryption for users, which can ensure the privacy of user data in an incompletely trusted dual server model. and availability. By using the main server and the backup server to store user data at the same time, and to obtain the authorization of the user at the same time, when the function of the main server fails, the backup server can seamlessly realize the function replacement; through the double decryptor technology of ciphertext, the data encryptor can specify two For each intended recipient or user of the data, the encryptor only needs to encrypt the data once, thereby reducing the computational overhead of encryption. The advantages and efficacy of this method are:

1) The method of the present invention uses the main server and the backup server to store user data and obtain user authorization at the same time, which realizes the synchronization of the states of the two servers. When the main server cannot provide services due to software and hardware configuration failures or network attacks, the system can Immediately switch to a backup server without affecting the user experience of using cloud storage services. The primary server and the backup server not only store the user's ciphertext data, but also can perform an equivalent comparison operation on the user's ciphertext data after obtaining the legal authorization of the user, and realize the division of the ciphertext data set without decryption. Thus, the computational burden of the user is reduced.

2) The method of the present invention allows the data sender to designate two data receivers, and the ciphertext data generated by one encryption process can be decrypted by the two receivers at the same time, without the need to repeat the encryption process twice and send it to the two receivers respectively. It reduces the computational burden of the data encryptor. Since the ciphertext data is stored on the cloud server, the data is securely shared between the sender and the two receivers. After any recipient obtains the ciphertext data from the cloud server, it only needs to execute the decryption algorithm with the secretly kept decryption private key to obtain the corresponding plaintext data.

3) The method of the present invention considers the security of the user ciphertext data comparison authorization, when the user issues authorization to the main server and the backup server, first encrypts it, and then sends the authorization in the ciphertext form to the two servers, so that in the transmission The authorized content will not be disclosed during the process. After the primary server and the backup server respectively obtain the authorization in the form of ciphertext, they only need to execute the authorization decryption algorithm with the decryption private key which is kept strictly to obtain the legal user authorization. Before obtaining the legal authorization of the user, neither the main server nor the backup server can perform an equivalent comparison of the user's ciphertext data, which further ensures the security of the user's data stored in the cloud.

The above-mentioned embodiments merely illustrate the principles and effects of the present invention, but are not intended to limit the present invention. Anyone skilled in the art can modify or change the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or changes made by those with ordinary knowledge in the technical field without departing from the spirit and technical idea disclosed in the present invention should still be covered by the claims of the present invention.

Claims (10)

1. A method for supporting synchronous ciphertext comparison of a backup server is characterized by comprising the following steps:

a trusted authority TA selects a safety parameter and a collision-resistant hash function to generate a public parameter; the method specifically comprises the following steps: the trusted authority TA inputs the system security parameter lambda and runs the initialization algorithm gamma (1)^λ) Outputs two groups G and G of prime q_TAnd a bilinear mapping operation e: GXG → G_TWherein, the initialization algorithm gamma (1)^λ) The operation method comprises the following steps: the trusted authority TA inputs a system security parameter lambda, and the system selects a corresponding elliptic curve according to the size of lambda: y is²＝X³+ aX + b, a and b are coefficients, with points on the elliptic curve forming two prime q-th order clusters G, G_TSelecting a mapping function e to map the elements in the group G to the group G_TPerforming the following steps;

each user generates a respective public key and a private key according to the public parameters, and the users comprise data decryptors;

the main server and the backup server respectively generate respective public keys and private keys according to the public parameters;

the data encryptor executes an encryption algorithm according to the public keys of the two data decryptors and generates corresponding ciphertexts, and the corresponding ciphertexts are sent to the main server and the backup server;

the data decryptor downloads the corresponding ciphertext from the main server or the backup server, and then decrypts the ciphertext by using respective private key;

a data decryptor generates an authorization token ctk through a one-time authorization process, and meanwhile, the main authorization server and the backup authorization server perform equivalence comparison on ciphertexts of the main authorization server and the backup authorization server;

the main server or the backup server decrypts the received authorization token ctk to obtain an authorization token tk;

the main server or the backup server compares the stored user ciphertext data by using the authorization token tk to judge whether the compared user ciphertext encrypts the same plaintext message.

2. The method for supporting comparison of synchronous ciphertexts of a backup server according to claim 1, wherein the public parameters specifically include: para ═ G_T,g,e,q,H₁(·),H₂(. DEG)), wherein G and G_TFor two groups with prime number q, e represents bilinear mapping operation e, G × G → G_T，H₁(. and H)₂(. cndot.) denotes the collision-resistant hash function, respectively, and G is an element in the group G.

3. The method of claim 2, wherein the step of generating a public key and a private key for each user according to the public parameters specifically comprises:

user U_iRandom selection of Z_qTwo non-0 elements x in a domain_i,1,x_i,2And calculating two exponentiations X on the group G_i,1And X_i,2Wherein x is_i,1,

Representation field Z_qIs given as a non-zero subset of elements {1,2, ·, q-1}}，i＝1,2，

User U_iGet the public key rpk_i＝(X_i,1,X_i,2) And private key rsk_i＝(x_i,1,x_i,2) And G is an element in group G.

4. The method of claim 3, wherein the step of generating the public key and the private key of the primary server and the backup server according to the public parameter respectively comprises:

server S_iRandomly selecting field Z_qTwo non-0 elements y in (1)_i,1,y_i,2And calculating two exponentiations Y on the group G_i,1And Y_i,2Wherein y is_i,1,

Server S_iGet the public key tpk_i＝(Y_i,1,Y_i,2) And private key tsk_i＝(y_i,1,y_i,2)。

5. The method for supporting comparison of synchronous ciphertexts of a backup server according to claim 4, wherein the data encryptor executes an encryption algorithm according to the public keys of the two data decryptors and generates corresponding ciphertexts specifically comprises:

random selection of domain Z by data encryptor_qTwo non-0 elements of (1)₁,α₂And calculating a ciphertext C of the data m, where C ═ (C)₁,c₂,c₃,c₄)，

The | | represents the character string concatenation,

representing a binary exclusive-OR operation, alpha₁,

t₁And t₂Respectively represent group G_TThe two power operations of the above are performed,

6. the method of claim 5, wherein the data decryptor downloads the corresponding ciphertext from the primary server or the backup server, and then decrypts the ciphertext with a respective private key specifically comprises:

data decryptor U_iComputing group G_TOf power over t'₂And m | | | α₁，

Data decryptor U_iComputing group G_TOf power over t'₁，

And verify

And

whether the result is true or not; if true, the decryptor U_iAnd obtaining a plaintext message m, otherwise, failing to decrypt.

7. The method for supporting comparison of synchronous ciphertexts of a backup server according to claim 6, wherein the data decryptor generates an authorization token ctk through an authorization process, and the authorization of the main server and the backup server to perform equivalence comparison on the ciphertexts thereof specifically comprises:

data decryptor U_iRandomly selecting field Z_qIs not a 0 element beta, calculates v₁，v₂And v₃(ii) a Wherein,

r₁,r₂respectively represent group G_TTwo power operations of r₁＝e(Y_1,1,Y_2,1)^β，r₂＝e(Y_1,2,Y_2,2)^β，v₁＝g^β，

Data decryptor U_iThe encrypted authorization token ctk is given by (v)₁,v₂,v₃) Is sent to the main server S₁And a backup server S₂。

8. The method of claim 7, wherein the decrypting, by the primary server or the backup server, the received authorization token ctk to obtain the authorization token tk specifically comprises:

server S_iComputing group G_TOf power-over operation r'₁、r'₂And an authorization token tk, wherein

tk＝v₂/H₁(r'₁)；

Verification H₂(v₁||v₂||tk||r'₂)＝v₃Whether the result is true or not; if so, the server S_iGet the correct authorization token tk, otherwise fail.

9. The method of claim 8, wherein the step of comparing the stored user ciphertext data with the authorization token tk by the primary server or the backup server to determine whether the compared user ciphertext encrypts the same plaintext message specifically comprises:

server S_iAuthentication

Whether the result is true or not; if so, the ciphertext C and the ciphertext C 'encrypt the same plaintext message, otherwise, the ciphertext C and the ciphertext C' encrypt different plaintext messages.

10. An apparatus based on the method for supporting comparison of synchronization ciphertexts of the backup server as claimed in any one of claims 1 to 9, wherein the apparatus comprises:

the initialization module is suitable for selecting safety parameters and a collision-resistant hash function according to a trusted authority TA to generate public parameters; the user key generation module is suitable for each user to generate a respective public key and a private key according to the public parameters, and the users comprise a data encryptor and a data decryptor;

the server key generation module is suitable for the main server and the backup server to generate respective public keys and private keys according to the public parameters respectively;

the data encryption module is suitable for a data encryptor to execute an encryption algorithm according to public keys of two data decryptors and generate corresponding ciphertexts, and the corresponding ciphertexts are sent to the main server and the backup server;

the data decryption module is suitable for a data decryptor to download the corresponding ciphertext from the main server or the backup server and then decrypt the ciphertext by utilizing respective private keys;

the authorization generation module is suitable for generating an authorization token ctk by a data decryptor through an authorization process, and simultaneously authorizing the main server and the backup server to perform equivalence comparison on ciphertexts of the main server and the backup server;

the authorization decryption module is suitable for the main server or the backup server to decrypt the received authorization token ctk so as to obtain an authorization token tk;

and the ciphertext comparison module is suitable for the main server or the backup server to compare the stored user ciphertext data by using the authorization token tk so as to judge whether the compared user ciphertext encrypts the same plaintext message.

Images