CN111310210A

CN111310210A - Double-authentication symmetric searchable encryption algorithm based on password and secret signcryption

Info

Publication number: CN111310210A
Application number: CN202010097171.6A
Authority: CN
Inventors: 王会歌; 赵运磊; 隋光烨
Original assignee: Fudan University
Current assignee: Fudan University
Priority date: 2020-02-17
Filing date: 2020-02-17
Publication date: 2020-06-19
Anticipated expiration: 2040-02-17
Also published as: CN111310210B

Abstract

The invention belongs to the technical field of passwords, and particularly relates to a double-authentication symmetric searchable encryption algorithm based on passwords and secret signcryption. Searchable encryption technology is a cryptographic primitive that allows users to retrieve ciphertext data, leveraging the powerful computing resources of cloud servers for keyword retrieval without revealing any information to the server that protects the data. The present invention presents a symmetric searchable encryption algorithm that is oriented to multiple data owners and has access control properties, authentication properties, and anonymity properties. The algorithm enhances the function and the safety of the existing searchable encryption scheme, provides the functions of user identity hiding and identity authentication, but is not obvious in the increase of the calculation time, and obtains the comprehensive performance advantage compared with the current international advanced symmetrical searchable scheme. The scheme is suitable for data communication systems of most of clients and servers.

Description

Double-authentication symmetric searchable encryption algorithm based on password and secret signcryption

Technical Field

The invention belongs to the technical field of passwords, and particularly relates to a double-authentication symmetric searchable encryption algorithm based on a password and an secret signcryption.

Background

In esorcics 2016, Sun et al propose an efficient non-interactive multi-client symmetric searchable encryption that improves the scheme in the CCS2013 of s.jarecki et al by reducing the communication overhead between the data owner and the data user. Specifically, the scheme in CCS2013 of s.janeki et al requires that a data user interact with the data owner each time a search is made on an encrypted database, whereas in esorcis 2016 of Sun et al, the data user must interact with the data owner no matter how many times the data user has. The query is executed and the data owner interacts only once with the query key as long as it is in the authorized set of keys determined by the owner. However, despite the many advantages of the solution in Sun et al ESORICS 2016, there are still many other problems that have yet to be resolved. For example, their solution is only applicable to single data owner/multiple data user settings, and how to design a solution applicable to multiple data owner/multiple data user settings remains an open question. In particular, in their solutions, the above solutions are vulnerable to masquerading attacks, since the identity information of the data user is publicly transmitted to the server, and authentication from the data user to the server is not provided when the data user interacts with the server. In addition, since the search token generated by the data user is sent in clear text and authentication is not provided to the server either, its solution is vulnerable to search attacks on plain text tokens. Based on the above, we present the following problems.

Motive machine 1: we can propose an SSE scheme that supports multiple data owner/multiple data user setup and has the same efficiency advantage as the Sun et al scheme.

An authentication protocol with identity hiding is an efficient encryption tool that can be used to enable secure end-to-end communication over the Internet. Implementing authentication and identity privacy in searchable encryption is important to enhance security and privacy. However, existing searchable encryption schemes, particularly in esorcis 2016, Sun et al's SSE scheme, fail to provide authentication, data protection, and identity concealment for communications between clients and servers, which may result in serious security risks. For example, an adversary may masquerade as a client to launch a large number of search queries to a server, resulting in a phasing attack and a DoS attack. Furthermore, if protection is not provided for a search token generated by a data user, an adversary may use a previously generated token to launch a large-scale search query against a server, resulting in a replay search attack. In addition, an adversary can obtain more sensitive information about the data user through identity information (through a meat search, etc.) without identity privacy, which would seriously compromise the privacy of the data user.

Intuitively, we should use standard protocols like TLS1.3 or Google's QUIC to solve the above problem. However, these protocols provide too many functions that we do not need, which will exacerbate the efficiency problem of SSE and make our solution less practical. In public key settings, authenticated encryption refers to signcryption (proposed by y. zheng in crypt 1997), which is also standardized by ISO-29150. The results show that signcryption is functionally equivalent to a single pass authenticated key exchange, which in turn can be used for asymmetric key encapsulation. Zheng's signcryption and onepass HMQV (HOMQV) are potential solutions to our problem, but they do not consider the ID hiding problem and their efficiency is still unsatisfactory. Identity is a fundamental privacy issue. Identity confidentiality is now mandated by a range of important standards (e.g. TLS1.3, EMV, QUIC and 3 GPP's 5G telecommunications standards). European union has also generally used the european union regulations (GDPR) for enforcing data protection that mandate protection of user identity privacy.

Higncryption is a cryptographic primitive proposed by Zhao in CCS16 that enables simultaneous identity hiding, identity verification and confidentiality in the system. Higncryption has similar efficiency compared to signcryption and HOMQV, but achieves higher security (e.g., CMIM, UKS, KCI, CNM, PFS, x-publication, etc. the reader is referred to the Zhao paper in CCS16 for detailed information) and provides more functionality. Furthermore, Higncryption can be perfectly applied to TLS1.3 and QUIC protocols. Based on this, we propose the following problem.

An engine 2: whether we can propose a symmetric searchable encryption method, while also supporting identity hiding, authentication and confidentiality.

1. Symbol convention

If S is a finite set, | S | represents the size of the set, | S ← S represents the uniform random selection of elements x from the set S. We define the concept of a probability state algorithm, C ← Alg means that the algorithm Alg runs and outputs the result C. if α is neither an algorithm nor a set, x ← α represents a simple assignment.A string or value α is represented as a binary string, | α | is a binary length^*And x | | y denotes their connection.

Let G' be an Abelian group of order N, G ═<g>Is the only subgroup of G' generated by the generator G of prime order q. In this context, all clusters are multiplicative clusters, with the length of q (i.e., q |) as a security parameter. 1_GRepresenting a unit element of group G, G \1_GRepresenting the set of elements in group G except for the unit cell, and t ═ N/q is the cofactor value. When instantiated with an elliptic curve, G' is a set of points E (L) over a finite field L of the elliptic curve E, and G is a subset of a prime order q-point set E (L). For elliptic curve based clusters, the cofactor t is typically relatively small.

The discrete logarithm hypothesis based on G illustrates that given X ═ G^xTo a

Without a Probabilistic Polynomial Time (PPT) algorithm, x is output with a non-negligible probability. The computational Diffie-Hellman (CDH) assumption means that, for

Given X ═ g^x，Y＝g^yWithout probabilistic polynomial time algorithm, g is calculated with non-negligible probability^xyI.e., CDH (X, Y).

2. Associated data authentication encryption

Briefly, an associated data Authentication Encryption (AEAD) scheme converts a message M and header information H (e.g., a packet header, IP address, etc.) into a ciphertext C. C provides both privacy protection for the message and message authentication for the ciphertext C and the header H [23 ]. In practice, when an AEAD is used in a cryptographic system, the associated data is typically implicitly determined by the content (e.g., running a hash protocol process or making some predefined declaration).

Safety of AEAD. Let SE be (K)_seEnc, Dec) denotes a symmetric encryption protocol, probabilistic polynomial time algorithm K_seA security parameter k is selected as input and is selected from a finite non-empty set

A key K is selected. For simplicity of description, we assume

Polynomial time encryption algorithm Enc: k x {0, 1}^*×{0，1}^*→{0，1}^*∪ { ⊥ }, polynomial time decryption algorithm Dec: Kx {0, 1}^*×{0，1}^*→{0，1}^*∪ { ⊥ }, any associated data H ∈ {0, 1}, and so on^*And message M ∈ {0, 1}^*If Enc_K(H, M) output C ≠ ⊥, then Dec_K(C) M is always output. Here we assume that the ciphertext C uses the associated data H.

Order to

Indicating the probability of success of the adversary in the safety experiment of table 1. If the probability of adversary success for any polynomial time is negligible for a sufficiently large κ, we call the SE protocol AEAD safe.

Table 1: AEAD safety test

The AEAD safety described above is quite robust. In particular, this means that even if a polynomial amount of ciphertext is adaptively selected, an adversary may not generate new legitimate ciphertext if decryption is possible. And, for two independent keys K, K' ← K_seWith arbitrary message M, headerPart information H, probability Pr [ Dec_K′(Enc_K(H，M))≠⊥]Is negligible.

Disclosure of Invention

The present invention aims to provide a symmetric searchable encryption algorithm that is oriented towards multiple data owners and has access control properties, authentication properties, and anonymity properties.

The symmetric searchable encryption algorithm provided by the invention is based on a password and secret sign-cipher double authentication technology. The searchable encryption technology is a cryptographic primitive that allows a user to retrieve ciphertext data, using the powerful computing resources of a cloud server for keyword retrieval, without revealing any information to the server that protects the data.

The double authentication symmetric searchable encryption algorithm (icSSE) based on the password and the secret signcryption comprises eight PPT algorithms, which are abbreviated as: tup, LKeyGen, DWKeyGen, EDBGen, SKeyGen, ETokenGen, Search, Retrieve.

The details are respectively as follows:

(1)Setup(1^λ): the algorithm is run by the owner of the data, who has a security parameter 1^λAs input, and outputs a long-term key generation common parameter par_LAnd the encrypted database identifier to generate the common parameter par_eWherein par_LFor generating long-term public and private keys, par_EFor generating an encrypted database identifier.

(2)LKeyGen(par_L，id_U): the algorithm is run by a long-term key generation center LK-KGC which generates the long-term key into a common parameter par_LAnd user identity id_U∈{0，1}^*As input, and outputs the long-term public key, private key pair (pk) of the user_U，sk_U)。

(3)DWKeyGen(1^λ，id_DW): the algorithm is run by a data owner key generation center DWK-KGC, which centers security parameters 1^λAnd data owner identity id_DWAs an input. It is the data owner id_DWOutputting an encrypted database public key and private key pair(EPK_DW，ESK_DW)。

(4)EDBGen(par_E；EPK_DW；ESK_DW(ii) a DB; A) the method comprises the following steps The algorithm is composed of data owner id_DWRun the id_DWGenerating the encrypted database identifier into a common parameter par_EEncrypted database public key EPK of data owner_DWAnd an encrypted database secret key ESK_DWPlaintext database DB, access control structure a as input; the algorithm encrypts the database DB into the ciphertext database EDB_DWAnd EDB_DWAnd sending to the server.

(5)SKeyGen(EPK_DW，ESK_DW；S；w；id_U): the algorithm is run by a data owner DW who encrypts a database public key EPK of the data owner_DWAnd encrypting the database secret key ESK_DWAttribute set S, authorization key set w and data user identity id_U∈{0，1}^*As input, it is the data user id_UGenerating a search private key SK_U＝(SK_MS，U；SK_S，U) Where SK_UPrivate key SK by master search_MS，UAnd partial search private key SK_S，UAnd (4) forming.

(6)

The algorithm is based on data user id_URun, the user id_UPrivate key SK for searching data user_ULong term private key sk_UPublic identity information pid_U＝(id_U，pk_U＝U＝g^u，cert_U) Public identity information pid of server_v＝(id_v，pk_v＝V＝g^v，cert_v) Query Q and encryption database EDB_DWOf (2)

As input, and outputting an encrypted search token est; note that the token est does not contain public identity information pid_UAnd pid_vWherein pid_vPublic identity information representing the server.

(7)Search(sk_V；pid_v；pid_U(ii) a est; EDB): the algorithm is run by the server, which algorithm uses the server's long-term private key sk_VAnd public identity information pid_vData user id_UPublic identity information pid of_UThe encrypted search token est and the current fully encrypted database EDB are taken as input. Note that the encrypted database EDB contains all the partially encrypted databases EDB generated by some data owners DW_DW(ii) a Finally, the matching result R is output to the data user id_U。

(8)Retrieve(SK_U(ii) a R): the algorithm is based on data user id_URun, the user id_UWill search for the private key SK_UAnd search result set R as input, and output with id_UA given document index for which the search key w matches.

Published in Sun et alESORICS2016 (acronym for Sun), the prototype of the present invention can be used in both multiple data user and multiple data owner environments. Multiple data owners mean that multiple data owners can outsource their storage and services to the cloud server at the same time, while leaking information about queries and plain text data to the server as little as possible. In addition, the primitive may also prevent data users from performing any search queries on unauthorized keywords. In particular, it also captures authentication of the data user to the server, with the aim of preventing an adversary from launching a denial of service (DoS) attack. In addition, identity hiding and confidentiality of the search token is also achieved in the original system of the present invention, with the aim of resisting impersonation and token replay attacks, respectively.

The double authentication symmetrical searchable encryption algorithm based on the password and the secret sign-cipher is further explained as follows in specific structure.

First, some basic cipher suites for constructing this scheme are listed:

an attribute-based encryption scheme: ABE ═ (abe.setup, abe.keygen, abe.enc, abe.dec);

one Chinese character' haHight function

Where l represents the length of the hash output;

using pseudorandom functions, using KDF, F and F_pRepresents;

a symmetric encryption system, AEAD ═ by (aead.gen, aead.enc, aead.dec).

(1)Setup(1^λ): the algorithm uses a security parameter 1^λFor input, a long-term key generation public parameter par is generated_L＝(G′₁，N，G₁，g′，q′)←g′(1^λ) Generating a long-term key; the term "public/private key" refers to the basic set that the GDH is supposed to hold and generates the encrypted database identifier to generate the public parameter par_EH, where H is a compression function; the algorithm finally outputs par_LAnd par_E。

(2)LKeyGen(par_L，id_U): the algorithm is run by a long-term key generation center LK-KGC which generates the long-term key into a common parameter par_LAnd user identity id_U∈{0，1}^*As input, and outputs the long-term public key, private key pair (pk) of the user_U，sk_U) (ii) a The algorithm sets and outputs a key pair (pk)_U，sk_U) (ii) a User identity id_UAnd the binding between the public key U thereof is authenticated by a certificate certA issued by the CA.

(3)DWKeyGen(1^λ，id_DW): the algorithm is run by a data owner key generation center named DWK-KGC, which centers the security parameter 1^λAnd data owner identity id_DWAs an input; it generates its generation (G)₂，g，n，p，q)←g(1^λ) Wherein G is a random group generator, G₂Is a group of multiplication cycles, and G ← G₂A random generator of order n and n ═ pq, p and q are two large prime numbers; it then checks whether (p; q) is already in the table Tab and if so, DWK-KGC will rerun g (1)^λ) Until (p; q) is not in Tab, and then (p; q) storing into Tab; next, K is randomly selected_X，K_I，K_Z，K_E←K；g₁，g₂，g₃←G₂And calculates (mpk, msk) ← abe^λ) Wherein K is a key space; the encryption database secret key and the public key of the data owner DW are set to ESK, respectively_DW←(K_X，K_I，K_Z，K_E，p，q，g₁，g₂，g₃Msk) and EPK_DW＝(n，mpk)。

(4)EDBGen(par_E；EPK_DW；ESK_DW(ii) a DB; A) the method comprises the following steps The algorithm is composed of data owner id_DWRun the id_DWGenerating the database identifier into parameter par_EEncrypted database public key EPK_DW= (n; mpk) and secret key ESK_DW←(K_X，K_I，K_Z，K_E，p，q，g₁，g₂，g₃Msk), database DB and access control structure a as inputs; it outputs an encrypted database

Wherein

Representing an encrypted database EDB_DWAn identifier of (a); the detailed program code is demonstrated in algorithm 1, see appendix 1.

(5)

The algorithm is composed of data owner id_DWRun, the data owner will encrypt the database public key EPK_DW(n, mpk) and private key ESK_DW(K_X，K_I，K_Z，K_E，p，q，g₁，g₂，g₃Msk), a set of keys w, a data owner identity id_DWData user identity id_UAnd encrypted database identifier

(assuming that once the data owner has generated an encrypted database, it records the corresponding identifier immediately) as input; assume allowed data user id_UFor authorization key w ═ w₁，...，w_nCarrying out searching; data owner id_DWFirst of all, calculate

Then calculates the attribute key sk_SC ° re abe. keygen (msk, S), where S ∈ U is the set of properties of authorized data users, U is the property space; next, data owner id_DWWill search for the private key SK_U＝(SK_MSU，SK_SU) Send to data user id_UWherein

And SK_SU＝sk_SRespectively representing data user id_UAnd partial search of the private key, and

of particular note is the encryption of database EDB_DWOf (2)

Also included in the master search private key SK_MSUIn order to data user id_UBy means of

The database to be encrypted is easily found.

(6)ETokenGen(SK_U；sk_U；pid_U；pid_v；Q；

): the algorithm is based on data user id_URun, the user will search for the private key

Long-term private key sk_UU, public identityInformation pid_U＝(id_u，pk_U＝U＝g^u，cert_U) Public identity information pid of server_v＝(id_v，pk_v＝V＝g^v，cert_V) A set of authorization keys

And an encrypted database identifier

As an input; when data user id_UIntending to execute a query

When first determining s terms

Suppose that

And w'₁Is the selected s term, and then computes the encrypted search token for that query (that is, the encrypted search token is computed according to the program code (algorithm 2))

). Algorithm 2 is seen in appendix 2.

(7)Search(sk_V；pid_v；pid_U(ii) a est; EDB): the algorithm is represented by the server id_VRunning, the server will server id_VLong-term private key sk_VAnd public identity information pid_VPublic identity information pid of a server_UAs an input; data user, an encrypted search token

Currently complete encrypted database

Wherein

Representing a set of data owners registered on a cloud server; the algorithm first uses the long-term private key sk_VAnd public identity information pid_VAnd pid_UPerforming an authentication procedure and then recovering the search token st and the database identifier from the encrypted search token est

Next, the identifier is used

Screening encrypted database EDB_DW(ii) a The server then uses the search token

Carrying out single keyword search and obtaining an encrypted document index set R matched with the search condition; the detailed search process is described in algorithm 3, which algorithm 3 is referred to in appendix 3.

(8)Retrieve(SK_U(ii) a R): the algorithm is based on data user id_UIn operation, the user will search for the private key SK_UAnd an encrypted document index set R as input; it first uses part of the private key sk_S(contained in secret Key SK_UIn) decrypt each element in R to obtain an authorized portion of the document index; in particular, for each e ∈ R, if the set of attributes of the data user S ∈ U satisfies the access control policy A associated with the ciphertext e (for the query and query)

The matching index ind is encrypted), then the index ind is calculated as abe_S，e)。

The algorithm of the invention is characterized in that:

based on the work proposed in Sun et al ESORICS 2016 and zhao in CCS16, the present invention proposes an SSE scheme that supports any Boolean query and multiple data owner/multiple data user setup. In particular, the inventive arrangements not only meet the same security requirements as they specify, but also further enhance the security of the same class correlation scheme by providing identity concealment, authentication of the data user to the server, and confidentiality of the search, as compared to the Sun's arrangement. Identity hiding aims to provide privacy protection for data users by hiding their identity information, while authentication is protected against masquerading attacks by applying certificate-based mechanisms to the solution of the invention. Furthermore, the inventive arrangements provide a forward ID privacy attribute, meaning that even if a client's long-term private key is compromised, its ID privacy is preserved. Note that neither signcryption nor HOMQV can implement ID hiding and forward ID privacy. In particular, the confidentiality of the search token provides resistance to replay attacks by encrypting a clear text search token generated by the data user. In other similar works, an adversary may use a previously generated clear text search token to force the server to execute the same search query multiple times.

When the multi-data owner function is realized, the invention firstly establishes a data owner key generation center (DWKKGC) to generate an encrypted database public key/private key pair for the data owner. The plaintext database is then converted to a ciphertext database using the key pair. For identity concealment, authentication and confidentiality, the present invention is implemented by modifying and integrating the encryption scheme in Zhao's CCS16, specifically, first inserting Zhao's encryption algorithm after generating the search token, and then replacing the plaintext and sender's identity information with the search token and the data user's identity, respectively.

Like the Sun's solution, attribute-based encryption is also deployed in the present invention to allow fine-grained access control to the document index that is encrypted by the data user. In addition, through efficiency analysis, the scheme of the invention achieves performance comparable to that of the Sun scheme. In addition, like the encryption scheme in Zhao's CCS16, the inventive scheme can also be applied directly to O-RTT authentication, which shows that the present invention is well suited and compatible with both QUIC-based and OPTLS-based SSE schemes.

Detailed Description

First, all algorithm participants should call Setup (1)^λ): algorithm with security parameter 1^λFor input, a long-term key generation public parameter par is generated_L＝(G′₁，N，G₁，g′，q′)←g′(1^λ) Each participant of the algorithm saves the set of parameters and applies the parameters to participate in the subsequent operation.

Then, a long-term key generation center LK-KGC should be established, the LK-KGC calling LKEyGen (par)_L，id_U) Function, LK-KGC generates long-term key to public parameter par at call time_LAnd user identity id_U∈{0，1}^*As input, and outputs the long-term public key, private key pair (pk) of the user_U，sk_U). The algorithm sets and outputs a key pair (pk)_U，sk_U). User identity id_UAnd the binding between the public keys U is authenticated by a certificate certA issued by the CA, which is public to all. And each public key and private key pair is sent to the corresponding user by the LK-KGC. The user saves the public and private key pairs for later operation.

Then, a data owner key generation center DWK-KGC is also established, and the DWK-KGC calls DWKeyGen (1)^λ，id_DW) The algorithm. DWK-KG center assigns a safety parameter 1^λAnd data owner identity id_DWAs an algorithm input. The algorithm generates an encrypted database secret key and a public key. The encryption database secret key and the public key of the data owner DW are set to ESK, respectively_DW(K_X，K_I，K_Z，K_E，p，q，g₁，g₂，g₃Msk) and EPK_DW= (n, mpk). The specific generation process is shown in the specification.

Then, when the data owner id_DWWhen wanting to share own data, id_DWCalling EDBGen (par)_e；EPK_DW；ESK_DW(ii) a DB; A) and (4) an algorithm. The id_DWGenerating the database identifier into parameter par_EEncrypted database public key EPK_DW= (n; mpk) and secret key ESK_DW(K_X，K_I，K_Z，K_E，p，q，g₁，g₂，g₃Msk), database DB and access control Structure A as inputs it outputs an encrypted database

Wherein

Representing an encrypted database EDB_DWOf (2) is detected. EDB_DWStored in a server and disclosed to all for access.

Then, assume data owner id_DWWant to allow data user id_UFor authorization key w ═ w₁，...，w_nCarry on the search. id_DWCall out

And (4) an algorithm. The specific calling process is referred to the specification. Next, data owner id_DWWill search for the private key SK_U＝(SK_MSU，SK_SU) Send to data user id_UWherein

of particular note is the encryption of database EDB_DWOf (2)

The database to be encrypted is easily found.

Then, when the data user id_UWhen he wants to access the data he needs to generate a search token and pass it to the server. Data user id_UInvoking

The function generates a search token. The specific calling process is referred to the specification.

Then, when the server id_VUser id of received data_UWhen searching for a token, he calls Search (sk)_V；pid_v；pid_U(ii) a est; EDB) algorithm. The server sends the server id_VLong-term private key sk_VAnd public identity information pid_VPublic identity information pid of a server_UAs an input. Encrypted search token for data users

The current complete encryption database

Wherein

Represents a collection of data owners registered on the cloud server. The algorithm first uses the long-term private key sk_VAnd public identity information pid_VAnd pid_UPerforming an authentication procedure and then recovering the search token st and the database identifier from the encrypted search token est

Next, the identifier is used

Screening encrypted database EDB_DW. The server then uses the search token

A single keyword search is performed and an encrypted document index set R matching the search conditions is obtained. The detailed search process is described in algorithm 3 in the appendix. The document index set R is returned to the data user id_U。

Finally, when the data user id_UReceiving server id_VAfter returning to his document index set R, the data user id_UCall Retrieve (SK)_U(ii) a R) obtaining a search result by an algorithm. The user will search for the private key SK_UAnd an encrypted document index set R as input. It first uses part of the private key sk_S(contained in secret Key SK_UIn) decrypt each element in R to obtain the authorized portion of the document index. In particular, for each e ∈ R, if the set of attributes of the data user S ∈ U satisfies the access control policy A associated with the ciphertext e (for the query and query)

Appendix 1:

appendix 2:

appendix 3:

Claims

1. a double authentication symmetric searchable encryption algorithm based on password and secret signcryption, abbreviated as icSSE, comprises eight PPT algorithms, which are respectively described as follows:

(1)Setup(1^λ): the algorithm is run by the owner of the data, who has a security parameter 1^λAs input, and outputs a long-term key generation common parameter par_LAnd the encrypted database identifier to generate the common parameter par_EWherein par_LFor generating long-term public and private keys, par_EFor generating an encrypted database identifier;

(2)LKeyGen(par_L,id_U): the algorithm is run by a long-term key generation center LK-KGC which generates the long-term key into a common parameter par_LAnd user identity id_U∈{0，1}^*As input, and outputs the long-term public key, private key pair (pk) of the user_U，sk_U)；

(3)DWKeyGen(1^λ，id_DW): the algorithm is run by a data owner key generation center DWK-KGC, which centers security parameters 1^λAnd data owner identity id_DWAs an input; it is the data owner id_DWExporting an encrypted database public and private key pair (EPK)_DW,ESK_DW)；

(4)EDBGen(par_E；EPK_DW；ESK_DW(ii) a DB; A) the method comprises the following steps The algorithm is composed of data owner id_DWRun the id_DWGenerating the encrypted database identifier into a common parameter par_EEncrypted database public key EPK of data owner_DWAnd an encrypted database secret key ESK_DWPlaintext database DB, access control structure a as input; the algorithm encrypts the database DB into the ciphertext database EDB_DWAnd EDB_DWSending to a server;

(5)SKeyGen(EPK_DW,ESK_DW；S；w；id_U): the algorithm is run by a data owner DW who encrypts a database public key EPK of the data owner_DWAnd encrypting the database secret key ESK_DWAttribute set S, authorization key set w and data user identity id_U∈{0，1}^*As input, it is the data user id_UGenerating a search private key SK_U＝(SK_MS，U；SK_S，U) Where SK_UPrivate key SK by master search_MS，UAnd partial search private keySK_S，UComposition is carried out;

(6)

the algorithm is based on data user id_URun, the user id_UPrivate key SK for searching data user_ULong term private key sk_UPublic identity information pid_U＝(id_U,pk_U＝U＝g^u,cert_U) Public identity information pid of server_v＝(id_v,pk_v＝V＝g^v,cert_V) Query Q and encryption database EDB_DWOf (2)

As input, and outputting an encrypted search token est; here, the token est does not contain public identity information pid_UAnd pid_vWherein pid_vPublic identity information representing a server;

(7)Search(sk_v；pid_v；pid_U(ii) a est; EDB): the algorithm is run by the server, which algorithm uses the server's long-term private key sk_vAnd public identity information pid_vData user id_UPublic identity information pid of_UThe encrypted search token est and the current fully encrypted database EDB are taken as inputs; here, the encryption database EDB contains all the partial encryption databases EDB generated by some data owners DW_DW(ii) a Finally, the matching result R is output to the data user id_U；

2. The password and secret signcryption based dual authentication symmetric searchable encryption algorithm according to claim 1, wherein each PPT algorithm is specifically configured as follows:

(1)Setup(1^λ): the algorithm uses a security parameter 1^λFor input, a long-term key generation public parameter par is generated_L＝(G₁′，N，G₁，g′，q′)←ɡ′(1^λ) Generating a long-term key; the term "public/private key" refers to the basic set that the GDH is supposed to hold and generates the encrypted database identifier to generate the public parameter par_EH, where H is a compression function; the algorithm finally outputs par_LAnd par_E；

(2)LKeyGen(par_L,id_U): the algorithm is run by a long-term key generation center LK-KGC which generates the long-term key into a common parameter par_LAnd user identity id_U∈{0，1}^*As input, and outputs the long-term public key, private key pair (pk) of the user_U，sk_U) (ii) a The algorithm sets and outputs a key pair (pk)_U，sk_U) (ii) a User identity id_UAnd the binding between the public keys U is authenticated by a certificate certA issued by CA;

(3)DWKeyGen(1^λ，id_DW): the algorithm is run by a data owner key generation center named DWK-KGC, which centers the security parameter 1^λAnd data owner identity id_DWAs an input; it generates (G)₂，g，n，p，q)←ɡ′(1^λ) Where Ag is a random group generator, G₂Is a group of multiplication cycles, and G ← G₂A random generator of order n and n ═ pq, p and q are two large prime numbers; then it checks if (p; q) is already in table Tab, and if so DWK-KGC will rerun (1)^λ) Until (p; q) is not in Tab, and then (p; q) storing into Tab; next, it randomly selects K_X,K_I,K_Z,K_E←K；g₁,g₂,g₃←G₂And calculates (mpk, msk) ← abe^λ) Wherein K is a key space; the encryption database secret key and the public key of the data owner DW are set to ESK, respectively_DW←(K_X,K_I,K_Z，K_E,p，q，g₁,g₂,g₃Msk) andEPK_DW＝(n，mpk)；

(4)EDBGen(par_E；EPK_DW；ESK_DW(ii) a DB; A) the method comprises the following steps The algorithm is composed of data owner id_DWRun the id_DWGenerating the database identifier into parameter par_EEncrypted database public key EPK_DW= (n; mpk) and secret key ESK_DW←(K_X,K_I,K_Z，K_E,p，q，g₁,g₂,g₃Msk), database DB and access control structure a as inputs; it outputs an encrypted database

Wherein

Representing an encrypted database EDB_DWAn identifier of (a);

(5)

the algorithm is composed of data owner id_DWIn operation, the data owner encrypts database public key EPW_DW(n, mpk) and private key ESK_DW←(K_X,K_I,K_Z，K_E,p，q，g₁,g₂,g₃Msk); a set of keywords w, data owner identity id_DWData user identity id_UAnd encrypted database identifier

(assuming that once the data owner has generated an encrypted database, it records the corresponding identifier immediately) as input; assume allowed data user id_UFor authorization key w ═ w₁，…，w_nCarrying out searching; data owner id_DWFirst of all, calculate

Then calculate the attribute keyKey sk_SC ° re abe. keygen (msk, S), where S ∈ U is the set of properties of authorized data users, U is the property space; next, data owner id_DWWill search for the private key SK_U＝(SK_MSU，SK_SU) Send to data user id_UWherein

here, the database EDB is encrypted_DWOf (2)

Easily find the database to be encrypted;

(6)

the algorithm is based on data user id_URun, the user will search for the private key

Long-term private key sk_UU, public identity information pid_U＝(id_U,pk_U＝U＝g^u,cert_U) Public identity information pid of server_v＝(id_v,pk_v＝V＝g^v,cert_V) A set of authorization keys

And an encrypted database identifier

As an input; when data user id_UIntending to execute a query

When first determining s terms

Suppose that

And w'₁Is the selected s term, and then computes the encrypted search token for that query, i.e.

Currently complete encrypted database

Wherein

Representing a set of data owners registered on a cloud server; the algorithm first uses the long-term private key sk_VAnd public identity information pid_VAnd pid_UPerforming an authentication procedure and then recovering the search from the encrypted search token estToken st and database identifier

Next, the identifier is used

Screening encrypted database EDB_DW(ii) a The server then uses the search token

Carrying out single keyword search and obtaining an encrypted document index set R matched with the search condition;

(8)Retrieve(SK_U(ii) a R): the algorithm is based on data user id_UIn operation, the user will search for the private key SK_UAnd an encrypted document index set R as input; it first uses part of the private key sk_SDecrypting each element in R to obtain an authorized portion of the document index; specifically, for each e ∈ R, if the set of attributes of the data user S ∈ U satisfies the access control policy a associated with the ciphertext e, then ind ═ abe_S，e)。

3. The password and secret signcryption based dual authentication symmetric searchable encryption algorithm of claim 2, wherein in implementing multiple data owner functionality, a data owner key generation center DWKKGC is first established to generate an encrypted database public/private key pair for the data owner; then, the plain text database is converted into a ciphertext database by using the key pair; for identity concealment, authentication and confidentiality, this is achieved by modifying and integrating the encryption scheme in Zhao's CCS 16; specifically, Zhao's encryption algorithm is first inserted after the search token is generated, and then the plaintext and the sender's identity information are replaced with the search token and the identity of the data user, respectively.

4. The password and secret signcryption based dual authentication symmetric searchable encryption algorithm according to claim 3, characterized in that the specific flow is as follows:

first, all algorithm participants invoke Setup (1)^λ): algorithm with security parameter 1^λFor input, a long-term key generation public parameter par is generated_L＝(G′₁，N，G₁，g′，q′)←ɡ′(1^λ) Each participant of the algorithm stores the group of parameters and uses the parameters to participate in the subsequent operation;

then, a long-term key generation center LK-KGC is established, and the LK-KGC calls LKEyGen (par)_L,id_U) Algorithm, LK-KGC generates long-term key into public parameter par at call time_LAnd user identity id_U∈{0，1}^*As input, and outputs the long-term public key, private key pair (pk) of the user_U，sk_U) (ii) a The algorithm sets and outputs a key pair (pk)_U，sk_U) (ii) a User identity id_UAnd the binding between the public keys U is authenticated by a certificate certA issued by CA, and the certificate is public to all persons; each public key and each private key pair are sent to the corresponding user by the LK-KGC; the user saves the public and private key pairs for later operation;

then, a data owner key generation center DWK-KGC is established, and the DWK-KGC calls DWKeyGen (1)^λ，id_DW) The algorithm; DWK-KG center assigns a safety parameter 1^λAnd data owner identity id_DWAs an algorithm input; the algorithm generates an encrypted database secret key and a public key; the encryption database secret key and the public key of the data owner DW are set to ESK, respectively_DW(K_X,K_I,K_Z，K_E,p，q，g₁,g₂,g₃Msk) and EPK_DW＝(n，mpk)；

Then, when the data owner id_DWWhen wanting to share own data, id_DWCalling EDBGen (par)_E；EPK_DW；ESK_DW(ii) a DB; A) an algorithm; the id_DWGenerating the database identifier into parameter par_EEncrypted number HDatabase public key EPK_DW= (n; mpk) and secret key ESK_DW(K_X,K_I,K_Z，K_E,p，q，g₁,g₂,g₃Msk), database DB and access control structure a as inputs; it outputs an encrypted database

Wherein

Representing an encrypted database EDB_DWAn identifier of (a); EDB_DWStored in a server and disclosed to all for access;

then, if the data owner id_DWWant to allow data user id_UFor authorization key w ═ w₁，...，w_nCarrying out searching; id_DWCall out

An algorithm; next, data owner id_DWWill search for the private key SK_U＝(SK_MSU，SK_SU) Send to data user id_UWherein

here, the database EDB is encrypted_DWOf (2)

Easily find the database to be encrypted;

then, when the data user id_UWhen the data is required to be accessed, a search token needs to be generated and transmitted to the server; data user id_UInvoking

An algorithm generates a search token;

then, when the server id_vUser id of received data_USearch token (sk) is called_v；pid_v；pid_U(ii) a est; EDB) algorithm; the server sends the server id_VLong-term private key sk_VAnd public identity information pid_VPublic identity information pid of a server_UAs an input; encrypted search token for data users

The current complete encryption database

Wherein

Next, the identifier is used

Screening encrypted database EDB_DW(ii) a Then, the clothesServer use search token

Carrying out single keyword search and obtaining an encrypted document index set R matched with the search condition; the document index set R is returned to the data user id_U；

Finally, when the data user id_UReceiving server id_VAfter returning to his document index set R, the data user id_UCall Retrieve (SK)_U(ii) a R) algorithm, and obtaining a search result.