CN108768639B - Public key order-preserving encryption method - Google Patents

Abstract

The invention discloses a public key order-preserving encryption scheme, and belongs to the field of cloud storage management. The invention comprises the following steps: firstly, the user generates a private key s and calculates a corresponding public key y, and the public parameter param is { g, p }. Next, the original plaintext is divided to obtain D ═ D₁,D₂,…,D_mMapping the data in non-uniform distribution to the plaintext buckets in uniform distribution by using a mapping method

To hide the distribution rule of the plaintext; the data owner then uses public key y to implement bucket-to-bucket cryptographic mapping, each bucket

Corresponding to different encryption functions Enc_iAnd noise is added to realize the one-to-many mapping idea, so that the uncertainty of the ciphertext value is increased. Finally, after the data user obtains the ciphertext c, the plaintext value can be calculated according to the ciphertext c by using the private key s. The method is suitable for database storage, and can ensure that the ciphertext keeps the order rule of the plaintext, thereby carrying out quick ciphertext retrieval.

Description

Public key order-preserving encryption method

Technical Field

The invention relates to cryptography, belongs to the field of cloud storage management, and particularly relates to a public key order-preserving encryption method.

Background

The order-preserving encryption becomes an important tool for constructing a searchable encryption system, and the efficient range query operation is allowed to be carried out on the ciphertext, which is very consistent with the requirements on operation safety and confidentiality in a cloud environment. The ope (order Preserving encryption) algorithm proposed by Rakesh Agrawal maps the non-uniformly distributed plaintext data to the uniformly distributed ciphertext intervals, thereby achieving the purpose of hiding the data distribution characteristics and Preserving the plaintext sequence. The calculationThe characteristic of order preservation defined by the method is as follows: when the plaintext x₁，x₂Satisfy x₁＜x₂The corresponding ciphertext Enc (x)₁)＜Enc(x₂). That is, the ith plaintext value is mapped into the ith ciphertext block.

Basic database query operations include precision value query, range query and aggregation query, the precision value query requires that an encryption system is deterministic, such as AES and the like, and in the encryption systems, the same plaintext always generates the same ciphertext; for aggregated queries that are to operate with SUM and AVG, a homomorphic encryption algorithm may be used to perform the averaging operation; based on the definition of the order preserving property, in the present invention, the operation of performing the range query on the encrypted data is mainly performed.

The OPE algorithm allows direct comparison of ciphertext, so that the results of range queries and MAX, MIN, COUNT queries can be derived directly from encrypted data, while the OPE algorithm has the following properties^[4]：

(1) The ciphertext obtained by using the Order Preserving Encryption (OPE) is subjected to query operation, so that a correct result can be obtained, and the query result is not subjected to false alarm and is not subjected to any answer tuple missing. The query result obtained by using the order-preserving property of the OPE algorithm is better than those of some ciphertext query systems^[5]The resulting expansion set is a clear improvement, and these expansion subsets require a rather complex post-processing step to filter the extra data tuples.

(2) The OPE algorithm can solve the problem of data updating, and data updating and inserting do not need to change the ciphertext value of original data in the operation database.

(3) The OPE algorithm can be well integrated with existing database systems, and its original design objective includes the ability to integrate with existing database indexing structures (e.g., B-trees). In fact, storing the encrypted data may make the database transparent to the application.

Agrawal et al in 2004 proposed the first complete order-preserving encryption scheme in which encryption algorithms were implemented by mapping known distributions into fixed or randomly selected distributions, assuming that the initial distribution of the plaintext was known. This design seems to achieve some level of clear text frequency hiding, but no formal security proof is provided in the text. The first form of security proof of order-preserving encryption is given in the search tree-based order-preserving encryption regime proposed by boldyeva et al in 2009. They introduced the concept of indiscriminate-OCPA under an ordered chosen plaintext attack, while also proving that none of the stateless solutions can implement this concept, and proposed an encryption scheme that satisfies a random order-preserving function with weak security, which only requires storing a key at the client. Subsequently, boldyeva et al have demonstrated that a random order-preserving function can achieve secure window unidirectionality, and have proposed an encryption scheme that can achieve IND-OCPA security, but in this scheme, the relevant content of the plaintext needs to be known in advance.

Wang et al in 2012 considered that the distribution rule of ciphertext in the deterministic encryption system can be expressed as a relevance score, and a searchable system under order-preserving encryption is established by using the relevance score as an index. In this paper authors strengthen the security of the OPE algorithm and propose "One-to-Man OPE" to answer keyword search requests, they have established a possible encryption scheme to hide the distribution features of the plaintext.

In 2013, Popa RA et al propose an mOPE (secure Order-Preserving Encoding) algorithm, which is the only ideal and safe OPE model at present, and simultaneously meets the safety requirement of IND-OCPA, and in the model, only the Order of plaintext is shown in a ciphertext. The mpope model creates a balanced search tree composed of ciphertexts, and requires an interactive encryption protocol, when a new cipher text is generated, the original cipher text value is changed, and a user can directly change part of the cipher text in a database through udfs (user Define functions). However, once each pair of databases is modified, the sequence of the stored information needs to be changed, which greatly affects the performance of the databases.

Dongxi Liu et al in the same year propose a non-linear order-preserving encryption system, which can improve the response to the ciphertext database sequential search request. The constitution can ensure the uniform distribution of the ciphertext under the condition that the plaintext is repeated in a large quantity, and realizes the programmability of the basic index expression, so that the distribution characteristic of the plaintext can be hidden. The encryption scheme proposed by Liu is well suited for long-term databases without being limited to the data characteristics (e.g., distribution characteristics, range, etc.) of the stored data. But the encryption system can reveal part of plaintext information while ensuring efficiency and achieving programmability.

Teranishi et al proposed another nonlinear OPE algorithm in 2014, which inserts a random-sized interval into the ciphertext and proves that the method has strong security compared with a random order preserving function which is indistinguishable in part of plaintext. But since this algorithm is stateless, IND-OCPA security is still not achieved.

Kerschbaum et al eliminates the need for a separate server, but also stores the information linearly in different amounts of plaintext. In addition, they reduce the probability of mutation in the N numbers to be ignored, and at the same time, reduce the interaction frequency between the client and the server from a logarithmic level to a constant level, and the encryption cost of the order-preserving encryption system is generally constant.

To date, the proposed order-preserving encryption scheme has been deterministic, and Hildenbrand et al introduced a random order-preserving encryption scheme that divides the plaintext field into disjoint sets of data and ensures that the order of the data in each set is constant, with different sets of data being encrypted using different keys. But the IND-OCPA security is not satisfied since this scheme is also stateless. In 2015, Ke Li et al propose a one-to-many mapping OPE algorithm, which divides a ciphertext interval into a plurality of buckets, determines the optimal size of the bucket by a minimum entropy method, and realizes region estimation through correlation marks.

Zheli Liu et al divides the plaintext into disjoint intervals, and each interval is encrypted with a different mapping function, which can only ensure that the known plaintext attack resistance is satisfied under certain conditions. Therefore, how to design a ciphertext search which can resist ciphertext attack only and plaintext attack selection and achieve high efficiency is the key of the research of the scheme.

Disclosure of Invention

The invention aims to: the scheme not only can ensure that a user can adopt the idea of the public key to carry out order-preserving encryption, but also can meet the requirement of resisting the attack of selecting the plaintext.

The invention includes a public key order-preserving encryption method, which mainly comprises the following steps:

and (3) key generation: randomly selecting a number s as a private key, and calculating a public key y ═ g^smod q, the public parameter shares param for all users.

Encryption: inputting public parameter param, dividing plain text buckets, selecting random number for each bucket

Computing ciphertext

And (3) decryption: and inputting the ciphertext c and the private key s, determining the barrel i where the ciphertext is located, and calculating to obtain a plaintext.

Due to the adoption of the technical scheme, the invention has the beneficial effects that:

1) the original symmetrical order-preserving encryption is changed, and the order-preserving encryption scheme is constructed by using the public key idea, so that the management of the secret keys is greatly simplified, a large number of symmetrical secret keys do not need to be distributed in advance, and the storage space is saved.

2) The invention adopts a very effective segmentation algorithm, can convert the data set with non-uniform distribution into the data set with uniform distribution through the mapping function, and achieves the purpose of hiding the plaintext distribution rule.

3) The invention adopts a nonlinear mapping rule to realize order-preserving encryption, divides the divided data into a plurality of barrels, each barrel corresponds to an encryption function, each data in the barrel is randomly mapped into a corresponding ciphertext barrel, and the uncertainty of the ciphertext is increased by the one-to-many mapping mode, so that the same plaintext is encrypted with different results, and the frequency information of the ciphertext is hidden.

Drawings

The invention will be described by way of specific examples and figures, in which:

FIG. 1 is a flow diagram of an encryption operation in accordance with an embodiment of the present invention;

FIG. 2 is a flowchart of a decryption operation in accordance with an embodiment of the present invention;

fig. 3 is a schematic system configuration diagram of embodiment 1 of the present invention.

Detailed Description

In order to make the technical solution and the applicability of the present invention clearer, the present invention will be described in more detail with reference to the following detailed embodiment examples and the accompanying drawings.

Examples 1

Referring to fig. 3, the specific implementation steps include that the user selects a private key and calculates a corresponding public key, the data owner encrypts the private key, and the data user decrypts the private key, which is described as follows:

(1) key generation

(1.1) the user himself selects a private key s e {1, …, p-2}, and calculates the corresponding public key y ═ g^smod q；

(1.2) param ═ { g, p } as a public parameter. Wherein p is a large prime number, q is p-1, and g is

The generation element of (a) is generated,

representing a set of positive integers modulo p.

(2) Encryption

(2.1) for a set of plaintext D ═ D₁,D₂,…,D_mAnd expanding the data into a plaintext bucket set by using a segmentation algorithm

(2.2) randomly selecting two numbers for each bucket

Computing

Where y is a public key, define

And

(2.3) calculation of

And

and will be

And the data is safely sent to the data user.

(3) Decryption

(3.1) after obtaining the ciphertext c, the data user uses index (c)₃) To determine c₃The barrel i is located;

(3.2) utilization of relationships

And

determining (a)_i,b_i)；

(3.3) according to

And calculating to obtain an expanded plaintext bucket value, and determining the plaintext value through reflection.

The foregoing is a detailed description of the invention only, and any feature disclosed in this specification (including any accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise, i.e. each feature is simply an example of a generic series of equivalent or similar features unless expressly stated otherwise. The invention extends to any novel feature or any novel combination of features disclosed in this specification, and to any novel method or process steps or any novel combination of features disclosed.

Claims (3)

1. A public key order-preserving encryption method is characterized by comprising the following steps:

and (3) key generation: randomly selecting a number s (s is more than or equal to 1 and less than or equal to p-2) as a private key, and calculating a public key y which is g^smod q, public parameter share param { g, p } for all users; wherein p is a large prime number, q is p-1, and g is

The generation element of (a) is generated,

a set of positive integers representing modulo p;

and (3) encryption process: the data owner divides the plaintext into several buckets D ═ D₁,D₂,…,D_mAnd obtaining an expanded plaintext barrel through a segmentation algorithm

Re-use of cryptographic functions

Mapping to a corresponding ciphertext range C ═ { C ═ C₁,C₂,…,C_m}, each bucket

Corresponding to different encryption functions Enc_iDefinition of clear text bucket

Has a range of (l)_i,h_i) Ciphertext interval C_i＝(l’_i,h’_i) For each bucket, the data owner chooses two random numbers

And (3) calculating:

the ciphertext of which is

Wherein noise is

The random number of (1);

and (3) decryption process: after receiving the ciphertext c, the data user determines that the bucket i is the index (c)₃) Combining the private keys s and

it can be calculated that:

using the obtained parameter (a)_i,b_i) According to

And calculating to obtain plaintext content.

2. The method of claim 1, wherein a public key encryption sort retention algorithm is implemented as compared to other symmetric sort retention encryption algorithms. A bucket-to-bucket nonlinear encryption algorithm Enc (m) is adopted_i)＝a_im_i+b_i+noise_iOn the premise of order preservationThe security of the encryption algorithm and the high efficiency of searching are ensured;

for a plaintext interval D, the extended bucket interval set obtained after the division algorithm is

Defining intervals

And has a_i,h_iE.g. Z, any two adjacent intervals

And

satisfies the relation l_i+1＝h_i(ii) a The corresponding encrypted ciphertext interval is C_i＝(l’_i,h’_i)；

In the current environment, assuming a plain text x, the interval index is defined as index (x) i, and the extended bucket interval range is defined as range (i)_i,h_i) The ciphertext range has a range (i) ═ l_i,h_i) The range value of the barrel interval is taken as a secret parameter to be safely transmitted to a data user;

the original plaintext, after undergoing the segmentation algorithm, produces uniformly distributed data intervals, also represented in the form of a plurality of buckets, defining each bucket

Has a non-linear relationship of

Data owner a selects two random numbers for each bucket

Computing

And

a value of (d); by a_i,b_iRespectively replace

And

so for any interval

In other words, Enc is mapped by non-linearity_iThen, the interval value obtained was (l)_min,h_max) The specific calculation is as follows:

meanwhile, in order to ensure that the order of the ciphertext is consistent with the order of the plaintext, the corresponding ciphertext interval C_i＝(l’_i,h’_i) Comprises the following steps:

thus for one

The corresponding ciphertext value is as follows, wherein noise E is E (0, a)_i/2)：

E(x)＝h’_i-1+Enc_i(x)＝h’_i-1+(a_i·x+b_i+noise)

Data owner computing

And

and will be

And (4) safely sending the E (x) to a data user, and sending the E (x) to a cloud server for storage.

3. The method as claimed in claim 2, wherein a non-linear mapping rule is used to implement order preserving encryption, the partitioned data is divided into a plurality of buckets, each bucket corresponds to an encryption function, each data in a bucket is randomly mapped into a corresponding ciphertext interval, the uncertainty of the ciphertext is increased by the one-to-many mapping mode, the same plaintext is encrypted with different results, and the concealment of ciphertext frequency is ensured, that is, an attacker cannot obtain the plaintext through a statistical ciphertext information attack algorithm.

Images