CN116996281A - Dynamic searchable symmetric encryption method, system and medium supporting cipher text sharing - Google Patents

Abstract

The invention discloses a dynamic searchable symmetric encryption method, a system and a medium supporting ciphertext sharing, belonging to the field of cloud storage security, wherein the method comprises the following steps: the data owner calculates a linked list pointer corresponding to the file identifier to be shared, generates a sharing bill containing the file identifier to be shared, the linked list pointer and the decryption key, and sends the sharing bill to the data user; the data user acquires a corresponding ciphertext to be shared from the server by using the sharing bill, encrypts the ciphertext to be shared again and stores the encrypted ciphertext to a user ciphertext database of the server package; the data user calculates a search trapdoor by using the private key of the user and the keyword to be searched and sends the search trapdoor to the server; the server searches ciphertext corresponding to the trapdoor from the user ciphertext database and returns the ciphertext to the data user, and plaintext content corresponding to the ciphertext is a file identifier corresponding to the keyword to be searched. And generating a sharing bill according to the sharing file identifier, so that safe and efficient sharing of the searchable ciphertext among different users is realized and efficient searching is supported.

Description

Dynamic searchable symmetric encryption method, system and medium supporting ciphertext sharing

Technical field

The invention belongs to the field of cloud storage security, and more specifically, relates to a dynamic searchable symmetric encryption method, system and medium that support ciphertext sharing.

Background technique

In the information age, the scale of local data has greatly expanded, and more and more users choose to upload data to the cloud to reduce the burden of local storage. Most enterprises or users will choose to encrypt the original plaintext data and then upload it to the cloud server for storage to protect the privacy of the data. For encrypted data stored in the cloud, in addition to meeting their own needs, data owners usually need to share these ciphertexts with other users for search.

Searchable encryption technology enables keyword search functions for ciphertext data. The user generates a trapdoor for the specified keyword and sends it to the server. The server matches the trapdoor with the ciphertext and returns the search results. Searchable encryption technology not only facilitates users to use ciphertext data, but also further protects the privacy and security of encrypted files. For different application scenarios, searchable encryption technology can be divided into searchable public key encryption technology and searchable symmetric encryption technology in terms of cryptography system. Among them, the latter is more widely used in data outsourcing storage scenarios.

In the traditional ciphertext sharing method, ciphertext is usually shared by sharing a key. In this type of sharing mode, the searchable ciphertext itself will not be copied and shared. What data users share is actually the short-term ability to perform keyword searches on the ciphertext. When the sharing link times out or becomes invalid, data users cannot continue to use the ciphertext data. Existing ciphertext sharing methods cannot share the ciphertext itself, and data users cannot maintain long-term keyword search capabilities for shared ciphertexts.

Contents of the invention

In view of the shortcomings and improvement needs of the existing technology, the present invention provides a dynamic searchable symmetric encryption method, system and medium that supports ciphertext sharing. The purpose is to achieve long-term sharing of searchable ciphertext by sharing tickets, so that data usage The user has long-term keyword search capabilities for shared files.

In order to achieve the above object, according to one aspect of the present invention, a dynamic searchable symmetric encryption method that supports ciphertext sharing is provided for a system including a data owner, a server and a data user. The method includes: a ciphertext sharing stage S1-S3 and keyword search stage S4-S5; S1, the data owner calculates the linked list pointer corresponding to the file identifier to be shared, generates a sharing ticket including the file identifier to be shared, the linked list pointer and the decryption key and sends it to the data user S2, the data user uses the sharing ticket to obtain the ciphertext to be shared corresponding to the file identifier to be shared from the server, uses the user's private key to re-encrypt the shared ciphertext and stores it in the server; S3, the server re-encrypts the ciphertext to be shared. The shared ciphertext is stored in the user ciphertext database, in which the ciphertext to be shared is uploaded to the owner ciphertext database of the server by the data owner; S4, the data user uses the keywords to be searched and the user's private key to calculate the search trap. door and sent to the server; S5, the server searches for the ciphertext corresponding to the trapdoor from the user's ciphertext database and returns it to the data user, where the plaintext content corresponding to the ciphertext is the file identifier corresponding to the keyword to be searched.

Furthermore, the server uses a bidirectional index linked list structure to store the ciphertext uploaded by the data owner into the owner's ciphertext database; the linked list pointers include: the linked list tail node pointer L ¹ corresponding to the file identifier to be shared, and the linked list corresponding to L ¹ Auxiliary positioning parameter J _id ¹ , J _id ¹ is used to assist in locating the previous node of the file identifier dimension linked list:

L ¹ ←F(K _σ，1 ,w ¹ ||id ¹ )

J _id ¹ ←F(K _σ，2 ,id ¹ ||w ¹ )

Among them, F() is a pseudo-random function, K _σ,1 and K _σ,2 are the two keys that constitute the data owner’s master key, w ¹ is the keyword corresponding to id ¹ , and id ¹ is the file identification to be shared. symbol.

Furthermore, the server obtains the ciphertext to be shared corresponding to the file identifier to be shared, including: S21. The server extracts the searchable ciphertext at position L ¹ in the owner's ciphertext database. The searchable ciphertext includes the file identifier dimension linked list. I _id ¹ , the file identifier random string R _id ¹ and the keyword ciphertext C _id ¹ ; S22, the server adds C _id ¹ to the shared collection and calculates the file identification based on I _id ¹ , R _id ¹ and J _id ¹ The previous node pointer ^{L 1 '} _of the character dimension linked list and the corresponding auxiliary positioning parameter J _id ¹ ' are updated to L ¹ ' and J _id ¹ ' respectively:

Among them, H() is the hash function; S23, repeat S21-S22 until the linked list corresponding to the file identifier to be shared is traversed, and the final shared set is the ciphertext to be shared.

Furthermore, the user's private key is used to re-encrypt the ciphertext to be shared and then store it in the server, including: S25, decrypting the ciphertext to be shared to obtain a keyword set of keyword w ¹ , for each w ¹ in the keyword set, Execute S26-S28 respectively; S26, search the latest updated file identifier id ¹ ' corresponding to w ¹ in the ID status table; S27, use K _{σ', 1} to generate a ciphertext index corresponding to the (w ¹ , id ¹ ) pair L ¹ , use K _{σ', 2} , w ¹ , id ¹ to calculate the file identifier ciphertext C _w ¹ , K _{σ', 1} , K _{σ', 2} are the two private keys that constitute the user's master key, id ¹ is the identifier of the file to be shared, and the ID status table is updated to correspond to w ¹ and id ¹ ; S28, according to whether id ¹ ' is empty, calculate the keyword dimension linked list I w ¹ corresponding to _w ¹ according to the situation, and obtain the correspondence of w ¹ ciphertext (L ¹ , I _w ¹ , R _w ¹ , C _w ¹ ), L ¹ is the end node pointer of the linked list corresponding to the file identifier to be shared, R _w ¹ is a random string of keywords; S29, add each The set composed of w ¹ corresponding ciphertext (L ¹ , I _w ¹ , R _w ¹ , C _w ¹ ) is stored in the server.

Furthermore, when id ¹ ' is empty, I _w ¹ is:

When id ¹ 'is not empty, I _w ¹ is:

L ¹ '←F(K _σ'，1 ,w ¹ ||id ¹ ')

J _w ¹ '←F(K _σ'，2 ,w ¹ ||id ¹ ')

Among them, H() is the hash function, F() is the pseudo-random function, L ¹ ' is the previous node pointer of the file identifier dimension linked list, and J _w ¹ ' is the value of the last updated ciphertext.

Furthermore, the server uses a bidirectional index linked list structure to copy the re-encrypted ciphertext to be shared to the user ciphertext database. S5 includes: S51. The server extracts the ciphertext at position L ² in the user ciphertext database. The ciphertext Including keyword dimension linked list I _w ² , keyword random string R _w ² and file identifier ciphertext C _w ² , L ² is the end node pointer of the linked list corresponding to the keyword to be searched; S52, the server adds C _w ² into the search result set, calculate the previous node pointer L ² ' of the file identifier dimension linked list and the corresponding auxiliary positioning parameter J _w ² ' based on I _w ² , R _w ² and J _w ² , and add L ² and J _w ² are updated to L ² ' and J _w ² ' respectively:

Among them, H() is the hash function, J _w ² is the corresponding auxiliary positioning parameter of L ² ; S53, repeat S51-S52 until the keyword corresponding linked list is traversed, and the final set of search results is the keyword corresponding to the search trapdoor. arts.

Furthermore, the method also ^includes a ciphertext update stage: the data owner searches for the latest updated file identifier id ³ corresponding to w ³ based on the pair of keyword w ³ - file identifier id 3 to be updated (w ³ , id ³ ). ', and find the latest updated keyword w ³ ' corresponding to id ³ ; use K _σ,1 to generate the ciphertext index L ³ corresponding to the (w ³ , id ³ ) pair, and use K _{σ, 2} , w ³ , id ³ Calculate the file identifier ciphertext C _w ³ and the keyword ciphertext C _id ³ ; K _σ,1 and K _σ,2 are the two keys that constitute the data owner's master key; according to whether w ³ ' is empty, divide Calculate and update the file identifier dimension linked list I id ³ corresponding to _id ³ ; according to whether id ³ ' is empty, calculate and update the keyword dimension linked list I w ³ corresponding to _w ³ according to the situation; convert the ciphertext (L ³ , I _w ³ ,R _w ³ ,C _w ³ ,I _id ³ ,R _id ³ ,C _id ³ ) are sent to the server, causing the server to store the ciphertext in the owner ciphertext database. R _w ³ and R _id ³ are respectively of length The keyword random value of λ and the file identifier random value.

Furthermore, when w ³ ' is empty, I _id ³ is:

When w ³ ' is not empty, I _id ³ is:

L ³ '←F(K _σ，1 ,w ³ '||id ³ )

J _id ³ '←F(K _σ,2 ,id ³ ||w ³ ')

When id ³ ' is empty, I _w ³ is:

When id ³ 'is not empty, I _w ³ is:

L ³ '←F(K _σ'，1 ,w ³ ||id ³ ')

J _w ³ '←F(K _σ'，2 ,w ³ ||id ³ ')

Among them, H() is the hash function, F() is the pseudo-random function, L ³ ' is the previous node pointer of the file identifier dimension linked list corresponding to the keyword to be updated, J _w ³ ' is the previous update key value of text.

According to another aspect of the present invention, a dynamic searchable symmetric encryption system that supports ciphertext sharing is provided, including a data owner, a server and a data user; the ciphertext sharing stage: the data owner calculates the identifier corresponding to the file to be shared The linked list pointer generates a sharing ticket containing the file identifier to be shared, the linked list pointer and the decryption key and sends it to the data user; the data user uses the sharing ticket to obtain the ciphertext to be shared corresponding to the file identifier to be shared from the server, using The user's private key re-encrypts the ciphertext to be shared and stores it in the server; the server stores the re-encrypted ciphertext to be shared in the user's ciphertext database, where the ciphertext to be shared is uploaded to the server's owner's secret key by the data owner. text database; keyword search stage: the data user uses the keyword to be searched and the user's private key to calculate the search trapdoor and sends it to the server; the server searches for the ciphertext corresponding to the search trapdoor from the user's ciphertext database and returns it to Data user, where the plaintext content corresponding to the ciphertext is the file identifier corresponding to the keyword to be searched.

According to another aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the dynamic searchable symmetric encryption method supporting ciphertext sharing is implemented as described above.

Generally speaking, through the above technical solutions conceived by the present invention, the following beneficial effects can be achieved:

(1) Provides a dynamic searchable symmetric encryption method that supports ciphertext sharing. The data owner generates a sharing ticket based on the file identifier that needs to be shared. The server finds the shared ciphertext based on the sharing ticket, and the data user performs the sharing on the shared ciphertext. After re-encryption, it is updated to the user's ciphertext database, and the private key can be used to generate a trapdoor for long-term search, thereby enabling the sharing of searchable ciphertext while allowing data users to retain long-term search capabilities;

(2) The server constructs a ciphertext index structure based on a two-way linked list. When sharing ciphertext or searching for keywords, the server can locate the node at the end of the chain based on the ciphertext index in the shared ticket or search trapdoor, and calculate the linked list. The ciphertext index of the previous node, thereby connecting all searchable ciphertexts associated with the same file identifier or keyword, thereby reducing the ciphertext search time complexity to a sub-linear level, achieving Efficient sharing and searching;

(3) Every time a ciphertext is shared or a keyword search is performed, the corresponding key information will be regenerated and updated, so that the sharing ticket or search trapdoor generated at a certain time can only share or search the previous ciphertext. , and cannot have an effect on the subsequent ciphertext, thus ensuring forward security; ciphertext sharing does not involve deletion operations and will not affect backward security, and the file identifiers in the ciphertext are encrypted. The server cannot obtain the file identifier saved in the deleted searchable ciphertext, and the deletion operation ciphertext uploaded earlier will not affect the add operation ciphertext uploaded later, thus ensuring backward security. Therefore, the method has forward and backward security. sex;

(4) The server can support users to add new searchable ciphertexts to the ciphertext database, and can delete specified searchable ciphertexts during search, making the method dynamic.

Description of the drawings

Figure 1 is a flow chart of a dynamic searchable symmetric encryption method that supports ciphertext sharing provided by an embodiment of the present invention;

Figure 2 is a schematic architectural diagram of a ciphertext sharing system provided by an embodiment of the present invention;

Figure 3 is a schematic diagram of a bidirectional index linked list provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

In the present invention, the terms "first", "second", etc. (if present) in the present invention and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

Figure 1 is a flow chart of a dynamic searchable symmetric encryption method that supports ciphertext sharing provided by an embodiment of the present invention. Referring to Figure 1, combined with Figures 2 and 3, the dynamic searchable symmetric encryption method supporting ciphertext sharing in this embodiment will be described in detail. The method is used in a system including a data owner, a server and a data user, and includes a ciphertext sharing stage (including operations S1-operation S3) and a keyword search stage (including operations S4-operation S5).

The architecture of the ciphertext sharing system used in this embodiment is shown in Figure 2. Referring to Figure 2, the ciphertext sharing system includes three entities: data owner, server and data user. The data owner is responsible for updating the ciphertext index and generating sharing tickets; the server is responsible for storing and maintaining the ciphertext database, sharing ciphertext, and searching for keywords; the data user is responsible for re-encrypting the ciphertext and searching for keywords.

The functions of the data owner include the following three aspects: (1) Initialize the system locally, generate symmetric keys, local states, and initialize the owner ciphertext database on the server; (2) Use symmetric keys and local states to pair Encrypt the specified keyword-file identifier pair and operation type, and upload the encrypted ciphertext to the server for storage; (3) Use the symmetric key, local status and file identifier to be shared to generate a sharing ticket and send it To servers and data consumers.

The functions of the server include the following three aspects: (1) After receiving the submitted searchable ciphertext, it saves it in the owner's ciphertext database; (2) After receiving the sharing ticket, it finds the searchable ciphertext of the corresponding file based on the sharing ticket. Search the ciphertext and return it to the data user; (3) After receiving the search trapdoor submitted by the data user, match the searchable ciphertext in the user's ciphertext database and return the search results.

The functions of the data user include the following four aspects: (1) Initialize the system locally, generate symmetric keys, local status and initialize the user ciphertext database on the server; (2) Use the private key to share the data returned by the server. The ciphertext is re-encrypted and updated to the user ciphertext database; (3) Use the private key and local status to generate a search trapdoor for the specified keyword and submit it to the server; (4) Receive the search results returned by the server, Decrypt the search results and obtain the file identifiers within them.

In the initialization phase, it is necessary to predefine the security parameter λ according to the application requirements, and determine the pseudo-random function F, the hash function H with random seeds, and the symmetric encryption algorithm SE based on the security parameter λ. Among them, λ is a non-zero natural number. The larger the value, the more secure the searchable symmetric encryption system will be, but the corresponding computational complexity will be higher. Pseudo-random function F:K _F ×X _F →Y _F , where K _F ={0,1} ^λ is the key space of the pseudo-random function, X _F ={0,1} ^* is the data space, Y _F = {0,1} ^λ is the value range space, that is, F requires that the key in the key space is a bit string with a binary length of λ. There is no limit on the data length in the data space, and the output result is required to be a binary length of λ. bit string. Hash function H with random seed: {0,1} ^λ ×{0,1} ^λ →{0,1} ^2λ , that is, the random seed and input of H are both bit strings with binary length λ, and the output is binary A bit string of length 2λ. Symmetric encryption algorithm SE: {E, D}, which includes encryption algorithm E() and decryption algorithm D(). The binary length of the key in its key space is at least λ. The Advanced Encryption Standard is generally selected for implementation. ,AES) series. The data owner randomly selects two keys K _σ,1 and K _σ,2 from F's key space K _F ={0,1} ^λ to form the data owner's master key K _σ .

EDB _σ and EDB _σ' correspond to the owner ciphertext database and the user ciphertext database respectively. They are both located on the server and are used to store ciphertext according to the ciphertext index. The keyword status table lastW _σ and the ID status table lastID _σ are located at the data owner end, are kept secretly by the data owner, and are both inaccessible to the outside world; lastW _σ is used to record the most recently updated keyword w corresponding to the same file identifier id. ', lastID _σ is used to record the file identifier id corresponding to the latest update of the same keyword w'.

The initialization process of the data user refers to the data owner and will not be repeated here.

In operation S1, the data owner calculates the linked list pointer corresponding to the file identifier to be shared, generates a sharing ticket including the file identifier to be shared, the linked list pointer and the decryption key, and sends it to the data user.

Specifically, the data owner searches for the current status information w ¹ ← lastW _σ [id ¹ ] based on the file identifier id ¹ to be shared. If the status information is empty, return ⊥, otherwise, based on K _σ,1 , K _σ,2 , id ¹ , w ¹ calculates the sharing ticket and sends it to the data user.

According to the embodiment of the present invention, the server uses a bidirectional index linked list structure to store the ciphertext uploaded by the data owner into the owner ciphertext database. In the bidirectional index linked list structure, the linked list pointer includes: the linked list tail node pointer L ¹ corresponding to the file identifier to be shared, and the auxiliary positioning parameter J _id ¹ corresponding to L ^1. J _id ¹ is used to assist in locating the file identifier dimension linked list. previous node. The sharing ticket P _id can be expressed as:

P _id ←(L ¹ ,J _id ¹ ,id ¹ ,K _id )

L ¹ ←F(K _σ，1 ,w ¹ ||id ¹ )

J _id ¹ ←F(K _σ，2 ,id ¹ ||w ¹ )

K _id ←F (K _{σ, 2} , id ¹ )

Among them, F() is a pseudo-random function, K _σ,1 and K _σ,2 are the two keys that constitute the data owner’s master key, w ¹ is the keyword corresponding to id ¹ , and id ¹ is the file identification to be shared. symbol, K _id is the decryption key.

In operation S2, the data user uses the sharing ticket to obtain the ciphertext to be shared corresponding to the file identifier to be shared from the server, re-encrypts the ciphertext to be shared using the user's private key, and then stores it in the server.

In this embodiment, operation S2 includes sub-operations S20-S29. Sub-operations S21 to S23 are the process of the server obtaining the ciphertext to be shared corresponding to the file identifier to be shared; sub-operations S25 to S29 are the process of re-encrypting the ciphertext to be shared using the user's private key and then storing it in the server.

In sub-operation S20, the data user extracts part of the information D _id ← (L, J _id ) from the shared ticket P _id and sends it to the server, while the remaining information is stored locally.

In sub-operation S21, the server extracts the searchable ciphertext (I _id ¹ , R _id ¹ , C _id ¹ ) at the L ¹ position (EDB _σ [L ¹ ]) in the owner ciphertext database. The searchable ciphertext includes the file identifier dimension linked list I _id ¹ , the file identifier random string R _id ¹ and the keyword ciphertext C _id ¹ .

In sub-operation S22, the server adds C _id ¹ to the shared set, and calculates the previous node pointer L ¹ ' of the file identifier dimension linked list and the corresponding auxiliary positioning parameters based on I _id ¹ , R _id ¹ and J _id ¹ J _id ¹ ', update L ¹ and J _id ¹ to L ¹ ' and J _id ¹ ' respectively:

L ¹ ← L ¹ '

J _id ¹ ←J _id ¹ '

Among them, H() is the hash function.

In sub-operation S23, sub-operation S21-sub-operation S22 are repeatedly executed until the linked list corresponding to the file identifier to be shared is traversed, and the final shared set is the ciphertext to be shared.

In sub-operation S24, the server sends the finally obtained sharing set to the data user.

In sub-operation S25, the shared set is decrypted to obtain a keyword set of keyword w ^1. For each w ¹ in the keyword set, sub-operations S26 to S28 are executed respectively.

In sub-operation S26, the latest updated file identifier id ¹ ' corresponding to w ¹ is searched in the ID status table.

For each keyword ciphertext C _id ¹ in the shared set, the data user uses the corresponding decryption key K _id to perform calculation w ¹ ←D(K _id ,C _id ¹ ), thereby recovering the keyword w ¹ , according to The file identifier id ¹ ' to be shared and the decrypted keyword w ¹ are used to obtain all keyword-file identifier pairs (w ¹ , id ¹ ).

For each keyword w ¹ , find the most recently updated file identifier id ¹ '←lastID _σ' [w ¹ ] corresponding to the keyword w ¹ . Generate a random string of keys R _w ¹ with binary length λ.

In sub-operation S27, K _σ',1 is used to generate the ciphertext index L ¹ corresponding to the (w ¹ , id ¹ ) pair, and K _{σ', 2} , w ¹ , and id ¹ are used to calculate the file identifier ciphertext C _w ¹ , update the ID status table to w ¹ corresponding to id ¹ , lastID _σ' [w ¹ ]←id ¹ . L ¹ and C _w ¹ can be expressed as:

L ¹ ←F(K _σ'，1 ,w ¹ ||id ¹ )

C _w ¹ ←E(F(K _σ'，2 ,w ¹ ),id ¹ )

Among them, K _σ',1 and K _σ',2 are the two private keys that constitute the user's master key, and id ¹ is the identifier of the file to be shared.

In sub-operation S28, depending on whether id ¹ ' is empty, the keyword dimension linked list I _w ¹ corresponding to w ¹ is calculated in each case, and the ciphertext (L ¹ , I _w ¹ , R _w ¹ , C _{w )} corresponding to w ¹ is obtained. ¹ ), L ¹ is the end node pointer of the linked list corresponding to the file identifier to be shared, and R _w ¹ is a random string of keywords.

Specifically, when id ¹ ' is empty, I _w ¹ is:

When id ¹ 'is not empty, I _w ¹ is:

L ¹ '←F(K _σ'，1 ,w ¹ ||id ¹ ')

J _w ¹ '←F(K _σ'，2 ,w ¹ ||id ¹ ')

Among them, H() is the hash function, F() is the pseudo-random function, L ¹ ' is the previous node pointer of the file identifier dimension linked list, and J _w ¹ ' is the value of the last updated ciphertext.

In sub-operation S29, the set composed of the ciphertext (L ¹ , I _w ¹ , R _w ¹ , C _w ¹ ) corresponding to each w ¹ is stored in the server.

In operation S3, the server stores the re-encrypted ciphertext to be shared in the user ciphertext database, where the ciphertext to be shared is uploaded by the data owner to the owner ciphertext database of the server.

The server stores the ciphertext (L ¹ , I _w ¹ , R _w ¹ , C _w ¹ ) in the EDB _σ' [L] location of the user's ciphertext database, and then completes the sharing of the file corresponding to the file identifier to be shared.

In operation S4, the data user uses the keyword to be searched and the user's private key to calculate the search trapdoor and sends it to the server.

The data user searches the status table id ² ←lastID _σ' [w ² ] based on the keyword w ² to be searched. If the status information value id ² is empty, return ⊥; otherwise, based on w ² , id ² , K _{σ', 1} Generate the search trapdoor T _w and send it to the server. The search trapdoor T _w is composed of:

T _w ←(L ² ,J _w ² )

L ² ←F(K _σ'，1 ,w ² ||id ² )

J _w ² ←F(K _σ'，2 ,w ² ||id ² )

Among them, L ² is the end node pointer of the linked list corresponding to the keyword to be searched, and J _w ² is the corresponding auxiliary positioning parameter of L ² , which is used to assist in calculating the previous node pointer.

In operation S5, the server searches for the ciphertext corresponding to the search trapdoor from the user's ciphertext database and returns it to the data user, where the plaintext content corresponding to the ciphertext is the file identifier corresponding to the keyword to be searched.

According to an embodiment of the present invention, the server uses a bidirectional index linked list structure to copy the re-encrypted ciphertext to be shared to the user ciphertext database. Operation S5 includes sub-operations S51-S53.

In sub-operation S51, the server extracts the ciphertext (I _w ² , R _w ² , C _w ² ) at the L ² position (EDB _σ' [L ² ]) in the user ciphertext database. The ciphertext includes the keyword dimension. Linked list I _w ² , keyword random string R _w ² and file identifier ciphertext C _w ² , L ² is the end node pointer of the linked list corresponding to the keyword to be searched.

In sub-operation S52, the server adds C _w ² to the search result set, and calculates the previous node pointer L ² ' of the file identifier dimension linked list and the corresponding auxiliary positioning based on I _w ² , R _w ² and J _w ² Parameter J _w ² ', update L ² and J _w ² to L ² ' and J _w ² ' respectively:

L ² ← L ² '

J _w ² ←J _w ² '

Among them, H() is the hash function, and J _w ² is the corresponding auxiliary positioning parameter of L ² .

In sub-operation S53, sub-operation S51 - sub-operation S52 are repeatedly executed until the keyword corresponding linked list is traversed. The finally obtained set of search results is the ciphertext corresponding to the search trapdoor, which is returned to the data user.

Further, after sub-operation S53, a decryption operation performed on the data user end may also be included. The decryption operation includes: if the search result set is empty, it means that there is no file matching the keyword w ² , and the operation ends; otherwise, the elements in the search result set are obtained in sequence and decrypted. The decryption operation is id ² ←D(K _w ² ,C _w ² ), and finally obtain all the file identifiers associated with the keyword w ² in the current user ciphertext database EDB _σ' .

According to the embodiment of the present invention, the method also includes a ciphertext update stage, which is used to update the ciphertext in the owner's ciphertext database, including sub-operation S01 to sub-operation S05.

In sub-operation S01, ^the data owner searches for the latest updated file identifier id 3' corresponding to w ³ based on the pair of keyword w ³ - file identifier id ³ to be updated (w ³ , id ³ ), and searches for id ³ Corresponding to the latest updated keyword w ³ '. w ³ '←lastW _σ [id ³ ], id ³ '←lastID _σ [w ³ ].

In sub-operation S02, use Kσ _{, 1} to generate the ciphertext index L ³ corresponding to the (w ³ , id ³ ) pair, and use K _{σ, 2} , w ³ , id ³ to calculate the file identifier ciphertext C _w ³ and key The word ciphertext C _id ³ ; K _σ,1 and K _σ,2 are the two keys that constitute the master key of the data owner.

The generated ciphertext index L ³ is:

L ³ ←F(Kσ _，1 ,w ³ ||id ³ )

Among them, w ³ ||id ³ represents the bit string connection value of w ³ and id ³ .

The calculated file identifier ciphertext C _w ³ is:

C _w ³ ←E(K _w ³ ,id ³ )

K _w ³ ←F (K _{σ, 2} , w ³ )

The calculated keyword ciphertext C _id ³ is:

C _id ³ ←E(K _id ³ ,w ³ )

K _id ³ ←F (K _{σ, 2} , id ³ )

In sub-operation S03, depending on whether w ³ ' is empty, the file identifier dimension linked list I _id ³ corresponding to id ³ is calculated and updated on a case-by-case basis. To construct a linked list of file identifier dimensions in a bidirectional index linked list.

Specifically, when w ³ ' is empty, I _id ³ is:

When w ³ ' is not empty, I _id ³ is:

L ³ '←F(K _σ，1 ,w ³ '||id ³ )

J _id ³ '←F(K _σ,2 ,id ³ ||w ³ ')

In sub-operation S04, depending on whether id ³ ' is empty, the key dimension linked list I _w ³ corresponding to w ³ is calculated and updated in each case. To construct a linked list of key dimensions in a bidirectional index linked list.

Specifically, when id ³ ' is empty, I _w ³ is:

When id ³ 'is not empty, I _w ³ is:

L ³ '←F(K _σ'，1 ,w ³ ||id ³ ')

J _w ³ '←F(K _σ'，2 ,w ³ ||id ³ ')

Among them, H() is the hash function, F() is the pseudo-random function, L ³ ' is the previous node pointer of the file identifier dimension linked list corresponding to the keyword to be updated, J _w ³ ' is the previous update key value of text. ⊥||⊥ represents the connection value of two all-0 strings with binary length λ, and is intended to be operated with the output value of the hash function length 2λ.

In sub-operation S05, the ciphertext (L ³ , I _w ³ , R _w ³ , C _w ³ , I _id ³ , R _id ³ , C _id ³ ) is sent to the server, causing the server to store the ciphertext in the owner At the position of EDB _σ [L ³ ] in the ciphertext database, R _w ³ and R _id ³ are respectively the keyword random value and the file identifier random value of length λ.

Further, the keyword w ³ is updated to the status table lastW _σ , and the corresponding file identifier id ³ is updated to the status table lastID _σ . The specific update operations are lastW _σ [id ³ ]←w ³ , lastID _σ [w ³ ] ←id ³ .

Referring to Figure 3, according to an embodiment of the present invention, performing the ciphertext sharing step and the keyword search step actually performs a chain search from two different dimensions of the bidirectional index linked list. When executing the ciphertext sharing step, the end node of the file identifier dimension linked list is located through the ciphertext index L ¹ in the sharing ticket, and the pointer of the previous node on the chain is calculated through the XOR operation and the previous search is performed. , the two nodes before and after are related through the status information lastW; when executing the keyword search step, the tail node of the keyword dimension linked list is located by searching the ciphertext index L ² in the trapdoor, and the item is calculated through the XOR operation The pointer of the previous node on the chain is searched, and the two nodes before and after are related through the status information lastID.

Embodiments of the present invention also provide a dynamic searchable symmetric encryption system that supports ciphertext sharing, including a data owner, a server, and a data user. Ciphertext sharing stage: The data owner calculates the linked list pointer corresponding to the file identifier to be shared, generates a sharing ticket including the file identifier to be shared, the linked list pointer and the decryption key and sends it to the data user; the data user uses the sharing ticket to The server obtains the ciphertext to be shared corresponding to the file identifier to be shared, uses the user's private key to re-encrypt the ciphertext to be shared, and then stores it in the server; the server stores the re-encrypted ciphertext to be shared in the user ciphertext database, where, The ciphertext to be shared is uploaded by the data owner to the owner ciphertext database of the server. Keyword search stage: The data user uses the keyword to be searched and the user's private key to calculate the search trapdoor and sends it to the server; the server searches for the ciphertext corresponding to the search trapdoor from the user's ciphertext database and returns it to the data user , where the plaintext content corresponding to the ciphertext is the file identifier corresponding to the keyword to be searched.

In this embodiment, the data owner, server and data user are the same as the data owner, server and data user in the dynamic searchable symmetric encryption method that supports ciphertext sharing in the embodiment shown in Figures 1 to 3. Here No longer.

Embodiments of the present invention also provide a computer-readable storage medium on which a computer program is stored. When the program is executed by the processor, the dynamic searchable symmetric encryption method supporting ciphertext sharing in the embodiment shown in Figures 1 to 3 is implemented, which will not be described again here.

It is easy for those skilled in the art to understand that the above descriptions are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements, etc., made within the spirit and principles of the present invention, All should be included in the protection scope of the present invention.

Claims (10)

1. A dynamic searchable symmetric encryption method that supports ciphertext sharing and is used in systems including data owners, servers and data users. It is characterized in that the method includes: ciphertext sharing stages S1-S3 and keyword search stages. S4-S5; S1, the data owner calculates the linked list pointer corresponding to the file identifier to be shared, generates a sharing ticket including the file identifier to be shared, the linked list pointer and the decryption key and sends it to the data user; S2, the data user uses the sharing ticket to obtain the ciphertext to be shared corresponding to the file identifier to be shared from the server, uses the user's private key to re-encrypt the ciphertext to be shared and then stores it in the server; S3, the server stores the re-encrypted ciphertext to be shared in the user ciphertext database, where the ciphertext to be shared is uploaded by the data owner to the owner ciphertext database of the server; S4, the data user uses the keyword to be searched and the user's private key to calculate the search trapdoor and sends it to the server; S5, the server searches for the ciphertext corresponding to the search trapdoor from the user's ciphertext database and returns it to the data user, where the plaintext content corresponding to the ciphertext is the file identifier corresponding to the keyword to be searched. 2. The method of claim 1, wherein the server uses a bidirectional index linked list structure to store the ciphertext uploaded by the data owner into the owner ciphertext database; the linked list pointer includes: the end of the linked list corresponding to the identifier of the file to be shared. The node pointer L ¹ and ^the auxiliary positioning parameter J _id ¹ corresponding to L ¹ are used _to assist in locating the previous node of the file identifier dimension linked list: L ¹ ←F(K _σ，1 ,w ¹ ||id ¹ ) J _id ¹ ←F(K _σ，2 ,id ¹ ||w ¹ ) Among them, F() is a pseudo-random function, K _{σ, 1} and K σ _{, 2} are the two keys that constitute the data owner’s master key, w ¹ is the keyword corresponding to id ¹ , and id ¹ is the file identifier to be shared . 3. The method of claim 2, wherein the server obtains the ciphertext to be shared corresponding to the file identifier to be shared, including: S21, the server extracts the searchable ciphertext at position L ¹ in the owner's ciphertext database. The searchable ciphertext includes the file identifier dimension linked list I _id ¹ , the file identifier random string R _id ¹ and the keyword ciphertext C _id ¹ ; S22, the server adds C _id ¹ to the shared set, and calculates the previous node pointer L ¹ ' of the file identifier dimension linked list and the corresponding auxiliary positioning parameter J _id ¹ ' based on I _id ¹ , R _id ¹ and J _id ¹ , update L ¹ and J _id ¹ to L ¹ ' and J _id ¹ ' respectively: Among them, H() is the hash function; S23: Repeat S21-S22 until the linked list corresponding to the file identifier to be shared is traversed, and the final shared set is the ciphertext to be shared. 4. The method of claim 1, wherein the ciphertext to be shared is re-encrypted using the user's private key and then stored in the server, including: S25, decrypt the ciphertext to be shared to obtain the keyword set of keyword w ^1. For each w ¹ in the keyword set, perform S26-S28 respectively; S26, find the latest updated file identifier id ¹ ' corresponding to w ¹ in the ID status table; S27, use K _σ',1 to generate the ciphertext index L ¹ corresponding to the (w ¹ , id ¹ ) pair, and use K _{σ', 2} , w ¹ , and id ¹ to calculate the file identifier ciphertext C _w ¹ , K _{σ ', 1} , K _{σ', 2} are the two private keys and master keys that constitute the user's master key, id ¹ is the identifier of the file to be shared, and the ID status table is updated to correspond to w ¹ and id ¹ ; S28, depending on whether id ¹ ' is empty, calculate the keyword dimension linked list I _w ¹ corresponding to w ¹ in each case, and obtain the ^ciphertext (L ¹ , I _w ¹ , R _w ¹ , C _w ¹ ) corresponding to w 1, L ¹ is the end node pointer of the linked list corresponding to the file identifier to be shared, R _w ¹ is a random string of keywords; S29: Store the set of ciphertexts (L ¹ , I _w ¹ , R _w ¹ , C _w ¹ ) corresponding to each w ¹ in the server. 5. The method according to claim 4, characterized in that when id ¹ ' is empty, I _w ¹ is: When id ¹ 'is not empty, I _w ¹ is: L ¹ '←F(K _σ'，1 ,w ¹ ||id ¹ ') J _w ¹ '←F(K _σ'，2 ,w ¹ ||id ¹ ') Among them, H() is the hash function, F() is the pseudo-random function, L ¹ ' is the previous node pointer of the file identifier dimension linked list, and J _w ¹ ' is the value of the last updated ciphertext. 6. The method of claim 1, wherein the server uses a bidirectional index linked list structure to copy the re-encrypted ciphertext to be shared to the user ciphertext database. S5 includes: S51, the server extracts the ciphertext at position L ² in the user ciphertext database. The ciphertext includes the keyword dimension linked list I _w ² , the keyword random string R _w ² and the file identifier ciphertext C _w ² . L ² is Pointer to the end node of the linked list corresponding to the keyword to be searched; S52, the server adds C _w ² to the search result set, and calculates the previous node pointer L ² ' of the file identifier dimension linked list and the corresponding auxiliary positioning parameter J _w ² based on I _w ² , R _w ² and J _w ² ', update L ² and J _w ² to L ² ' and J _w ² ' respectively: Among them, H() is the hash function, J _w ² is the corresponding auxiliary positioning parameter of L ² ; S53: Repeat S51-S52 until the keyword corresponding linked list is traversed, and the final set of search results is the ciphertext corresponding to the search trapdoor. 7. The method according to any one of claims 1-6, characterized in that the method also includes a ciphertext update stage: Based on the pair of keyword w ³ - file identifier id ³ to be updated (w ³ , id ³ ), the data owner searches for the latest updated file identifier id ³ ' corresponding to w ³ and finds the latest updated keyword corresponding to id ³ w ³ '; Use K _σ,1 to generate the ciphertext index L ³ corresponding to the (w ³ , id ³ ) pair, and use K _{σ, 2} , w ³ , id ³ to calculate the file identifier ciphertext C _w ³ and keyword ciphertext C _id ³ ; K _σ,1 and K _σ,2 are the two keys that constitute the data owner’s master key; Depending on whether w ³ ' is empty, calculate and update the file identifier dimension linked list I id ³ corresponding to _id ³ in each case; According to whether id ³ ' is empty, calculate and update the keyword dimension linked list I w ³ corresponding to _w ³ in each case; Send the ciphertext (L ³ , I _w ³ , R _w ³ , C _w ³ , I _id ³ , R _id ³ , C _id ³ ) to the server, causing the server to store the ciphertext in the owner ciphertext database, R _w ³ and R _id ³ are respectively the keyword random value and the file identifier random value of length λ. 8. The method according to claim 7, characterized in that when w ³ ' is empty, I _id ³ is: When w ³ ' is not empty, I _id ³ is: L ³ '←F(K _σ，1 ,w ³ '||id ³ ) J _id ³ '←F(K _σ,2 ,id ³ ||w ³ ') When id ³ ' is empty, I _w ³ is: When id ³ 'is not empty, I _w ³ is: L ³ '←F(K _σ'，1 ,w ³ ||id ³ ') J _w ³ '←F(K _σ'，2 ,w ³ ||id ³ ') Among them, H() is the hash function, F() is the pseudo-random function, L ³ ' is the previous node pointer of the file identifier dimension linked list corresponding to the keyword to be updated, J _w ³ ' is the previous update key value of text. 9. A dynamic searchable symmetric encryption system that supports ciphertext sharing, which is characterized by including data owners, servers and data users; Ciphertext sharing stage: The data owner calculates the linked list pointer corresponding to the file identifier to be shared, generates a sharing ticket including the file identifier to be shared, the linked list pointer and the decryption key and sends it to the data user; the data user uses the sharing ticket to The server obtains the ciphertext to be shared corresponding to the file identifier to be shared, uses the user's private key to re-encrypt the ciphertext to be shared, and then stores it in the server; the server stores the re-encrypted ciphertext to be shared in the user ciphertext database, where, The ciphertext to be shared is uploaded by the data owner to the owner ciphertext database of the server; Keyword search stage: The data user uses the keyword to be searched and the user's private key to calculate the search trapdoor and sends it to the server; the server searches for the ciphertext corresponding to the search trapdoor from the user's ciphertext database and returns it to the data user , where the plaintext content corresponding to the ciphertext is the file identifier corresponding to the keyword to be searched. 10. A computer-readable storage medium with a computer program stored thereon, characterized in that when the program is executed by a processor, it implements the dynamically programmable method of supporting ciphertext sharing as described in any one of claims 1-8. Search for symmetric encryption methods.