WO2021109756A1

WO2021109756A1 - Proxy anonymous communication method based on homomorphic encryption scheme

Info

Publication number: WO2021109756A1
Application number: PCT/CN2020/124396
Authority: WO
Inventors: 米波; 龙萍; 黄大荣; 韦天成; 李阳; 吴冰清
Original assignee: 重庆交通大学
Priority date: 2019-12-03
Filing date: 2020-10-28
Publication date: 2021-06-10
Also published as: CN110891066A; CN110891066B

Abstract

Disclosed in the present invention is a proxy anonymous communication method based on a homomorphic encryption scheme. Said method comprises: S1, a sending end performing original encryption on target data to obtain ciphertext data c₁; S2, the sending end sending the ciphertext c₁ to a server; S3, the server performing homomorphic encryption on the ciphertext data c₁ to obtain ciphertext data c₂; S4, the server sending the ciphertext data c₂ to a receiving end; and S5, the receiving end decrypting the ciphertext data c₂ to obtain the ciphertext data c₁. Said method is mainly used for reliable and complete transmission of privacy data (mainly for position data) of participating vehicles in the Internet of Vehicles, and achieves the safe operation of vehicles in the Internet of Vehicles is achieved by improving the security and confidentiality of the position data of the participating vehicles in the Internet of Vehicles, having certain economic benefits and engineering practicability.

Description

Proxy anonymous communication method based on homomorphic encryption scheme

Technical field

The invention relates to the field of communication security, in particular to a proxy anonymous communication method based on a homomorphic encryption scheme.

Background technique

With the specific application of the Internet of Vehicles in the field of smart city transportation, the dynamic location data of the vehicle network is collected, distributed and processed, and the location data information is shared by wireless communication to realize the realization of vehicles and vehicles, vehicles and roads, and vehicles and people. , The information exchange between the car and other infrastructures connects the car to the city network. However, due to the contradiction between the high reliability and high security of wireless communication and Internet of Vehicles applications, the location data shared by vehicles is vulnerable to malicious attacks by attackers. This gives the vehicle seat belts that share location data in the Internet of Vehicles. Here comes the challenge.

In recent years, with the rapid development of vehicular Ad-hoc Network (VANET) and cloud computing, more and more mobile application services for Internet of Vehicles users have emerged. These mobile application services are often provided by different servers. If a vehicle wants to obtain services from these servers, it must provide vehicle-related registration information to different servers. However, in the process of transmitting vehicle data, it is easy to suffer malicious attacks from the attacker's false information.

False information malicious attack is a typical attack in the security of the vehicle ad hoc network. It is mainly an active attack method realized by the attacker by taking advantage of the characteristics of sharing open channels between nodes in VENET. In the malicious attack of false information, once the attacker captures and cracks the frequency band where the shared channel is located, the attacker can pretend to be a normal driving vehicle node and spread false messages to the vehicle network or tamper with, delay forwarding, and discard the location that needs to be forwarded after receiving it. Data information has a very serious impact on road traffic and the personal safety and property of vehicle owners.

At present, data encryption technology has become an important part of ensuring people's lives and work. Modern information uses computers as the carrier, relying on security technology, and uses communication networks to transmit location data. With the increase in network data security incidents in various fields in recent years, data security has attracted more and more attention. An important part of data security is to ensure the concealment of all network participants’ own information in various fields, that is, to ensure that the private data of network participants on the shared network is fully protected and concealed. On the one hand, it is necessary not only to protect their own network addresses. Being leaked, on the other hand, you also need to ensure that your network behavior does not want to be known by a third party (attacker). As a result, an anonymous communication network technology was created, the purpose of which is to ensure that the private data of all anonymous communication network participants are protected, the network addresses and network behaviors of all participants are fully anonymized, and all participants except data in the network are protected. Except for the individual's personal knowledge of his own network behavior, other third parties cannot obtain the identity and location of the participants of the network behavior.

At present, the main idea of implementing an anonymous communication mechanism is that the user transmits the data in plaintext to the forwarding server, and the forwarding server anonymizes the data information received to the sender, and then transmits the anonymized data (that is, ciphertext data) to the receiver. Party to ensure the confidentiality of transmitted data. However, the problem with this solution is to anonymize the transmitted data by relying on the forwarding server. The main disadvantage: On the one hand, considering that the forwarding server is reliable, the number of forwarding servers is a key factor. When the number of forwarding servers is small (only one or two), the efficiency of data transmission is reliable and Efficient, but the security of forwarding data in the channel is not guaranteed. Once there are some objective reasons, such as system failure, misoperation, etc., or there is a malicious attacker attacking the forwarding server to make the ciphertext data Man-in-the-middle attacks, etc., seriously affect the confidentiality and availability of data; when the number of forwarding servers is large (three or more), the security of forwarding data in the channel can be guaranteed, but the resulting ciphertext is The forwarding server forwards it many times, but it will reduce the speed and efficiency of the entire network system to transmit data; on the other hand, consider that the forwarding server is unreliable, that is, when the car owner sends his own private information to the forwarding server At that time, the security is no longer guaranteed, and the reliability of the data information received by the later receivers is even lower.

Therefore, how to realize the safe and confidential transmission of anonymous data has become an urgent problem for those skilled in the art.

Summary of the invention

In view of the above-mentioned shortcomings in the prior art, the technical problem to be solved by the present invention is: how to realize the safe and confidential transmission of anonymous data.

To solve the above technical problems, the present invention adopts the following technical solutions:

A proxy anonymous communication method based on a homomorphic encryption scheme, including:

S1. The sender performs original encryption on the target data to obtain ciphertext data c ₁ ;

S2. The sending end sends the ciphertext data c ₁ to the server;

S3. The server _{homomorphically encrypts the ciphertext data c 1} to obtain the ciphertext data c ₂ ;

S4. The server sends the ciphertext data c ₂ to the receiving end;

S5. The receiving end _{decrypts the ciphertext data c 2} to obtain the ciphertext data c ₁ .

Preferably, step S1 includes:

S101. The sending end obtains target data M, M=(m ₁ ,m ₂ ,...,m _t )∈{0,1} ^t , where t represents the number of bits of the character string converted by binary of the target data;

S102. Assign a corresponding safety performance index λ based on the importance of the target data, and set a function parameter τ;

S103. Based on the key generation function KeyGen(1 ^λ , 1 ^τ );

S104. Generate an encryption key K and a decryption key k;

S105: Perform original encryption on the target data based on the encryption key K and the one-way encryption function Encrypt(K, M)=c ₁ _{to obtain ciphertext data c 1} .

Preferably, step S3 includes:

S301: The server receives the ciphertext data c ₁ and sends feedback information to the sending end;

S302, the homomorphic encryption server based on the evaluation function _{Evaluate (K, Π, c 1} ) = c 2 c ₁ to the ciphertext data to obtain the ciphertext data c _2, Π represents the binary circuit evaluation function.

Preferably, step S5 includes:

S501: Perform decryption based on the decryption key k and the decryption function Decrypt(k, c ₂ )=c ₁ to obtain ciphertext data c ₁ .

Preferably, after the ciphertext data c _{1 is} obtained by decryption, the correct decryption feedback information is sent to the server, otherwise, the incorrect decryption information is sent to the server.

Preferably, for any M=(m ₁ ,m ₂ ,...,m _t )∈{0,1} ^t

Pr[Decrypt(k,c ₁ ): (K,k)←KeyGen(1 ^λ ,1 ^τ ),c ₁ ←Encrypt(K,M)]=1;

For each binary circuit ∏, ∏∈c _τ , c _τ represents the set of binary trees composed of all possible calculation combinations with the function parameter τ as the maximum depth of the binary tree;

In summary, compared with the prior art, the technical effects of the present invention include:

1. High reliability and accuracy of private data transmission

Compared with other methods, this method allows the receiver to receive the encrypted ciphertext data c ₁ after decryption, so that the user (sender) prepares to send the data plaintext M to the forwarding server for transmission. The reliability of the transmission process The accuracy is higher. This solution uses the computational difficulty based on approximate-GCD, similar to the difficulty of decomposing an integer into prime numbers. It is easy to verify the factors of the divisor, but it is difficult to solve all the factors related to the divisor p in polynomial time. NP-difficult problem. Based on this, this solution can effectively ensure that the plaintext data information is not easy to crack, thereby ensuring the reliability of the plaintext information.

2. Maintain the privacy of plaintext data

Since the plaintext of the data to be forwarded is transmitted to the forwarding server, an encryption operation is performed first, so that the plaintext M of the data to be forwarded becomes the ciphertext data c ₁ to be forwarded, and then the ciphertext data c _{1 is} passed through The channel is transmitted to the forwarding server. In this process, even if the forwarding server is untrustworthy, the forwarding server can only perform a homomorphic (evaluation) encryption operation _{on the ciphertext data c 1} _{to obtain the ciphertext data c 2} . Therefore, the plaintext M of the transmission data to be forwarded by the user (sender) can be well protected, effectively ensuring the confidentiality of the plaintext of the transmission data to be forwarded, and achieving reliable and safe maintenance of the privacy of the plaintext of the data.

3. The ciphertext is compact

The compactness of the ciphertext basically requires that the size of the ciphertext data (that is, the number of bits of the ciphertext) does not increase with the increase in the complexity of the calculation function (evaluation function). The key generation function KeyGen (1 ^λ , 1 ^τ ) used in this scheme does not rely on the function parameter τ to encrypt the ciphertext. Among them, since the key generation function KeyGen(1 ^λ , 1 ^τ ) is determined according to the security performance index λ, it has nothing to do with the function parameter τ in the key generation function. This means that even if certain parameters of the encryption scheme (such as encryption key size) are allowed to depend on the functional parameter τ, _{the size of the ciphertext data c 2} encrypted by the evaluation function will not increase with the increase of τ. Compared with other methods, this scheme limits the size of ciphertext data well, provides a prerequisite for storing a large amount of ciphertext data on the cloud, and also pave the way for the efficient use of ciphertext space.

4. Strong attack resistance

① Resist ciphertext-only attacks, that is, the attacker only knows multiple ciphertext data c ₂ to attack and crack the Internet of Vehicles system.

In response to this attack method, malicious network attackers need to analyze the previously intercepted ciphertext data c ₂ to find out the statistical rules. For example, the corresponding relationship between the cipher text c ₂ and the cipher text c ₁ is then tested for a forwarded data that has never appeared before (that is, the cipher text data c ₂ ). The challenger and the attacker experiment to determine whether they can get a consistent ciphertext c ₁ , if the ciphertext c ₁ meets the consistency, the attacker can successfully crack, and then the security of the plaintext of the data to be forwarded transmitted to the receiver will be No guarantee; vice versa.

Based on this, because this method is implemented by using a homomorphic encryption scheme, the user first performs an encryption operation on the data plaintext M to be forwarded and transmitted to make it become fresh ciphertext data c ₁ , and then converts the fresh ciphertext data c ₁ It is forwarded to the forwarding server, and the forwarding server uses the evaluation function to _{evaluate and encrypt the fresh ciphertext data c 1} (that is, homomorphic encryption), and then obtain the evaluated ciphertext data c ₂ . In addition, since the encryption functions of the two encryptions are all one-way functions with NP-difficulty, the evaluation ciphertext data c ₂ obtained after the data plaintext M is encrypted twice has a high security strength. At this point, the malicious attacker cannot analyze any valuable law about the plaintext M of the data to be forwarded and transmitted (even if the length of the plaintext data is not known) in the polynomial time _{of the intercepted ciphertext data c 2, that is, this scheme has} Resist ciphertext attacks, that is, it can ensure that the evaluation ciphertext data received by the receiver can better protect the confidentiality of the data plaintext M.

② Defend against known plaintext attacks, that is, the attacker knows multiple plaintexts and their corresponding ciphertext pairs to crack the encryption function. This type of attack is also not feasible, and the reason is similar to the previous ciphertext attack.

Since the evaluation ciphertext data c ₂ received by the receiver is obtained by encrypting the plaintext M of the data to be transmitted and forwarded twice, the security strength is very high, and the difficulty of the encryption function used to evaluate the encryption is equivalent to an approximate-GCD-based NP-difficult problem. Among them, even if the attacker knows _{the data pair of the fresh ciphertext data c 1} and the evaluated ciphertext data c ₁ , but wants to compare the ciphertext data c ₁ and the evaluation ciphertext data c obtained by homomorphic encryption during the evaluation process. ₁ For matching and correspondence in polynomial time, the probability is negligible. Because the evaluation ciphertext data c ₁ is semantically safe, it is very difficult to perform a correct match in polynomial time. Based on this, this solution can resist such attacks and realize the confidentiality of data plaintext.

③ Resist the selected ciphertext attack, that is, the attacker can select a certain number of ciphertexts, and try to decrypt the obtained plain-ciphertext pairs by matching them.

Since the receiver receives the ciphertext data c ₁ , which is obtained by encrypting the plaintext M of the transmission data to be forwarded twice, the attacker wants to _{perform statistical analysis on the fresh ciphertext data c 1} and the evaluated ciphertext data c ₁ to find out which According to the law, try to _{decrypt the message that only knows the ciphertext data c 2} to find its corresponding ciphertext data c ₁ , and further decrypt it to obtain the data plaintext M. Both of these two steps are difficult, and this difficulty is based on the NP-difficult problem of approximate-GCD. From the perspective of computational complexity, it is greater than the polynomial time algorithm, which means that under the condition of limited computer computing power, it takes a long time to complete a successful decryption calculation (ten years or even longer). In short, the program can resist this kind of attack.

④ Resist selected plaintext attacks, that is, the attacker can select a certain number of plaintexts and try to crack through the collected plain-ciphertext matching.

Among them, the encryption operation used for evaluation is based on a homomorphic encryption scheme. After the fresh ciphertext data c ₁ obtained after the data plaintext M to be forwarded and transmitted is encrypted, the homomorphic function is used to encrypt the evaluation ciphertext data c. ₂ , and forward it to the receiver. In this case, a malicious attacker tries to obtain a pair of ciphertext data c ₁ and ciphertext data c ₂ , and realizes the probability of successful cracking through statistical analysis, which is negligible in polynomial time. Therefore, the program can resist such attacks.

5. More efficient in ciphertext space

This scheme has the compactness of the ciphertext, so that the size of the ciphertext does not increase with the complexity of the calculation function. Compared with the existing data encryption scheme, this scheme has undergone two encryption processing, and further optimized processing on the ciphertext space twice. Therefore, both the size of the fresh ciphertext data and the expansion of the estimated ciphertext data size (extension refers to the ratio of the size of the ciphertext data to the size of the underlying plaintext) are very small in this solution.

Description of the drawings

FIG. 1 is a flowchart of a specific implementation manner of a proxy anonymous communication method based on a homomorphic encryption scheme disclosed by the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings.

As shown in Figure 1, the present invention discloses a proxy anonymous communication method based on a homomorphic encryption scheme, including:

S2. The sending end sends the ciphertext data c ₁ to the server;

S4. The server sends the ciphertext data c ₂ to the receiving end;

In the present invention, only the receiving end decrypts ciphertext data c _1, you do not need to decrypt the ciphertext data c ₁ plaintext.

The advantage of this is that the sender can send its own encrypted plaintext data (ie ciphertext data c ₁ ) to the receiver without exposing the content of the plaintext data and the receiver can perform on the basis of the _{ciphertext data c 1} Calculation.

Compared with the prior art, the present invention allows the receiver to receive the encrypted ciphertext data c ₁ after decryption, so that the user (sender) prepares to send the data plaintext M for transmission to the forwarding server during transmission. Higher reliability and accuracy. This solution uses the computational difficulty based on approximate-GCD, similar to the difficulty of decomposing an integer into prime numbers. It is easy to verify the factors of the divisor, but it is difficult to solve all the factors related to the divisor p in polynomial time. NP-difficult problem. Based on this, this solution can effectively ensure that the plaintext data information is not easy to crack, thereby ensuring the reliability of the plaintext information.

During specific implementation, step S1 includes:

Collect basic information about the car owner (including private information such as the owner's identity, phone number, driving habits, etc.) and basic information of the vehicle (model, engine model, fuel volume in the fuel tank, and other private information) through the user's (sender) identity authority. And collect private data information such as the speed and position data of the vehicle through the sensor.

Assign security performance indicators according to the importance of the data to be transmitted.

_{The sender sets the number of digits of the encrypted ciphertext data c 1} according to the degree of confidentiality of the transmitted data. The bit length can be customized. Considering the security, the actual median is more than 20 digits. Generally, the higher the confidentiality, the more digits of the encrypted ciphertext of the forwarding server, and the larger the amount of calculation. If the number of bits is too long, the communication volume will increase, and at the same time _{, the computing resource overhead of forwarding the encrypted ciphertext data c 1} of the forwarding server will increase, but the confidentiality of the plaintext data is high.

S103. Based on the key generation function KeyGen(1 ^λ , 1 ^τ );

S104. Generate an encryption key K and a decryption key k;

The key generation function is a public function between the sender, the forwarding server, and the receiver. After the sending end and the receiving end have negotiated to determine the value of the function parameter τ, the key generation function can be called to generate the decryption key, so there is no need to transmit the decryption key to the forwarding server and the receiving end. The sender only needs to transmit the ciphertext data to the forwarding server.

If the user (sender) directly transmits the plaintext of the data to be forwarded to the forwarding server, the probability of the plaintext of the data to be forwarded being maliciously attacked is very high. In order to ensure that the plaintext of the data to be forwarded is transmitted to the forwarding server before being forwarded The data plaintext of is no longer the original plaintext of data to be forwarded, but the "modified" plaintext of data to be forwarded. In order to realize the encryption processing of the plaintext of the data to be forwarded, the encryption key is a key factor. The determination of the key is to generate the encryption key K and the decryption key k according to the security performance index λ (depending on the length of the plaintext data, the data length of the ciphertext, etc.) through the key generation function.

During specific implementation, step S3 includes:

_{The ciphertext data c 1} to be transmitted and forwarded is transmitted to the forwarding server through the channel, and then after the forwarding server receives the ciphertext data c ₁ , it uses the evaluation function _{to homomorphically encrypt the received ciphertext data c 1} to obtain the ciphertext data c ₂ . In this case, the user (sender) to be forwarded to the security of data transmission plaintext M on the already high (there are two encryption function is protected), and the size of the ciphertext data c ₂ (the number of bits of the ciphertext data c ₂ ) Is also very compact, and the storage space of the _{ciphertext data c 2 is efficiently used.}

During specific implementation, step S5 includes:

In specific implementation, after the ciphertext data c _{1 is} obtained by decryption, the correct decryption feedback information is sent to the server; otherwise, the incorrect decryption information is sent to the server.

The judgment condition for correct decryption is: if the received ciphertext is incorrect, the decryption will fail directly. The reason is that the receiving end uses the decryption key generated by the key generation function to decrypt the received ciphertext data c _2. If it cannot be decrypted correctly, it means that the ciphertext is incorrect. Because the encryption method of the forwarding server encrypts the ciphertext data c ₁ is encryption on the basis of the ciphertext, the technology used is the homomorphic encryption function, which is a one-way difficult function, in simple terms, it is encrypted data The execution is fast, but the decryption operation cannot be achieved without the corresponding decryption key.

The forwarding server transmits the ciphertext data c ₂ encrypted by the evaluation function to the receiving user through the channel. The receiver uses the decryption key generated by the key generation function to decrypt the received ciphertext data c _2. If the ciphertext data c _{2 is} not maliciously tampered with by the attacker, the receiver user can decrypt normally, otherwise The decryption operation cannot be performed. Since the plaintext of the data to be forwarded and transmitted is encrypted using an encryption function to obtain the ciphertext data c ₁ , and the ciphertext data c ₂ is obtained by re-encrypting the _{ciphertext data c 1} using the evaluation function of the forwarding server. Therefore, in order to correctly decrypt the plaintext M of the data to be transmitted and forwarded, the ciphertext data received by the receiver must be required to be complete. At this time, the integrity of the _{ciphertext data c 2} can be verified by whether the receiver can achieve decryption. The process of verifying messages is simplified, and the implementation of this solution is operability.

In specific implementation, for any M=(m ₁ ,m ₂ ,...,m _t )∈{0,1} ^t

Pr[Decrypt(k,c ₁ ): (K,k)←KeyGen(1 ^λ ,1 ^τ ),c ₁ ←Encrypt(K,M)]=1;

For the homomorphic encryption scheme used in the present invention, it is also necessary to consider its correctness and semantic security. If these two conditions are met at the same time, the scheme is safe, reliable, and has good operability.

The semantic security of the homomorphic encryption scheme: only ciphertext data can not be distinguished. Simply put, when a malicious attacker receives ciphertext data, it is impossible to determine whether it is obtained by 0 encryption or 1 encryption. The more formalized expression is:

Homomorphic encryption scheme ε = (KeyGen, Encrypt, Evaluate, Decrypt) For attacker A, the probability of A's advantage in the scheme is

It can be seen from the above formula that it is easy to know that the advantage probability of data being attacked by an attacker is negligible, so the scheme ε is semantically safe.

In summary, compared with the prior art, the present invention uses a homomorphic encryption scheme to encrypt the data plaintext twice, which effectively guarantees the confidentiality of the data plaintext M; when transmitting data, the forwarding server is used for the transmission path. Obfuscation to realize the concealment of the real recipient of the data; by judging whether the real recipient can use the decryption key to decrypt the ciphertext c ₂ , the integrity of the data is checked, which effectively improves the efficiency of data integrity verification.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described with reference to the preferred embodiments of the present invention, those of ordinary skill in the art should understand that the Various changes are made to the above and details without departing from the spirit and scope of the present invention defined by the appended claims.

Claims

A proxy anonymous communication method based on a homomorphic encryption scheme, which is characterized in that it includes:

S1. The sender performs original encryption on the target data to obtain ciphertext data c 1 ;

S2. The sending end sends the ciphertext data c 1 to the server;

S3. The server homomorphically encrypts the ciphertext data c 1 to obtain the ciphertext data c 2 ;

S4. The server sends the ciphertext data c 2 to the receiving end;

S5. The receiving end decrypts the ciphertext data c 2 to obtain the ciphertext data c 1 .
The proxy anonymous communication method based on a homomorphic encryption scheme according to claim 1, wherein step S1 comprises:

S101. The sending end obtains target data M, M=(m 1 ,m 2 ,...,m t )∈{0,1} t , where t represents the number of bits of the character string converted by binary of the target data;

S102. Assign a corresponding safety performance index λ based on the importance of the target data, and set a function parameter τ;

S103. Based on the key generation function KeyGen(1 λ , 1 τ );

S104. Generate an encryption key K and a decryption key k;

S105: Perform original encryption on the target data based on the encryption key K and the one-way encryption function Encrypt(K, M)=c 1 to obtain ciphertext data c 1 .
The proxy anonymous communication method based on a homomorphic encryption scheme according to claim 2, wherein step S3 comprises:

S301: The server receives the ciphertext data c 1 and sends feedback information to the sending end;

S302, the homomorphic encryption server based on the evaluation function Evaluate (K, Π, c 1 ) = c 2 c 1 to the ciphertext data to obtain the ciphertext data c 2, Π represents the binary circuit evaluation function.
The proxy anonymous communication method based on a homomorphic encryption scheme according to claim 3, wherein step S5 comprises:

S501: Perform decryption based on the decryption key k and the decryption function Decrypt(k, c 2 )=c 1 to obtain ciphertext data c 1 .
The proxy anonymous communication method based on a homomorphic encryption scheme according to claim 4, characterized in that after the ciphertext data c 1 is obtained by decryption, correct decryption feedback information is sent to the server, otherwise, error decryption information is sent to the server.
The proxy anonymous communication method based on a homomorphic encryption scheme according to any one of claims 1 to 5, characterized in that,

For any M=(m 1 ,m 2 ,…,m t )∈{0,1} t

Pr[Decrypt(k,c 1 ): (K,k)←KeyGen(1 λ ,1 τ ),c 1 ←Encrypt(K,M)]=1;

For each binary circuit ∏, ∏∈c τ , c τ represents the set of binary trees composed of all possible calculation combinations with the function parameter τ as the maximum depth of the binary tree.