WO2016197680A1

WO2016197680A1 - Access control system for cloud storage service platform and access control method therefor

Info

Publication number: WO2016197680A1
Application number: PCT/CN2016/078599
Authority: WO
Inventors: 张鹏; 喻建平; 刘宏伟; 王平
Original assignee: 深圳大学
Priority date: 2015-06-12
Filing date: 2016-04-06
Publication date: 2016-12-15
Also published as: CN105025012A; CN105025012B

Abstract

The present invention relates to the technical field of cloud storage services, and provides an access control system for a cloud storage service platform and an access control method therefor. In the method and system, an authorization center and a data owner are based on a weighted attribute-based encryption mechanism. User data that needs to be uploaded is encrypted and stored in the cloud storage service platform, so as to effectively protect privacy of shared data on the cloud storage service platform and improve security of a cloud storage service. Meanwhile, attributes of users are combined with weights, so as to achieve graded management of the attributes of the users, and enable users with the same attribute but different grades to have different access rights. Further, the authorization center and the data owner separately generate parts of a ciphertext. Access rights of the users are controlled by means of the part of ciphertext of the authorization center, and an access control policy is determined by means of the part of ciphertext of the data owner. When an attribute of a user is changed, the access rights of the user can be cancelled in real time as long as the authorization center updates its part of ciphertext.

Description

Access control system for cloud storage service platform and access control method thereof

Technical field

The invention belongs to the field of cloud storage service technologies, and in particular relates to an access control system and an access control method thereof for a cloud storage service platform, in particular, an Amazon S3 cloud storage service platform.

Background technique

In the cloud storage service platform, because of the data remote hosting technology, the cloud storage service provider is the physical owner of the data, and is not in the same trust domain as the data owner. A cloud storage service provider manages multiple users and their resources. When users access other user resources across borders, they need to adopt certain access control policies to control access to data and services. However, in practice, because the cloud storage service platform adopts the virtualized storage technology, the cloud storage service is loosely coupled with the underlying hardware environment, and the data of different users lacks a fixed security boundary, thereby increasing the cloud storage. The difficulty of the service platform to implement access control on data.

In the prior art, although the data owner can set the read/write attribute of the user data uploaded by it, for example, setting the read/write attribute to public read/private write or public read/public write, to a certain extent Data read and write permissions, but because user data is still stored in clear text on the cloud storage service platform, lack of effective privacy protection mechanism, can not effectively resist the access of illegal users and make user data leak.

Summary of the invention

An object of the present invention is to provide an access control system for a cloud storage service platform, which aims to solve the problem that the existing cloud storage service platform stores user data in a clear text form with poor privacy and security.

The embodiment of the present invention is implemented in this manner, and is an access control system for a cloud storage service platform. The system includes:

The management terminal running by the authorization center is used to generate the system common parameters and upload to the cloud storage server, generate the user private key and secretly distribute it to the data owner and the shared user, and generate the first partial secret of the data to be uploaded by using the weight attribute encryption mechanism. Text

a client running by the data owner and the shared user, generating a second partial ciphertext to be uploaded by using the weight attribute encryption mechanism, combining the first partial ciphertext, the second partial ciphertext, and the data to be uploaded Generating a final ciphertext and uploading the final ciphertext as shared data to the cloud storage service platform, and also for downloading public parameters and sharing data from the cloud storage service platform, and using the public parameters and corresponding users The private key decrypts the downloaded shared data.

Another object of the present invention is to provide an access control method for an access control system for a cloud storage service platform as described above, the method comprising the following steps:

The authorization center runs the management terminal, generates public parameters and a master private key, and uploads the public parameters to the cloud storage service platform.

The data belongs to the main running client, requests authorization from the authorization center and sends data upload request information;

The authorization center runs a management end, verifies the data owner identity and generates a corresponding user private key in combination with the primary private key, and generates a first partial secret to be uploaded based on the weight attribute encryption mechanism according to the data upload request information. And sending the corresponding user private key and the first partial ciphertext to the data owner;

Generating, by the data owner, a second partial ciphertext of the data to be uploaded based on a weight attribute encryption mechanism;

The data owner combines the first partial ciphertext, the second partial ciphertext to generate a final ciphertext, and uploads the final ciphertext as shared data to the cloud storage service platform;

The shared user runs the client and requests authorization from the authorization center;

The authorization center runs a management terminal, verifies the shared user identity, generates a corresponding user private key in combination with the primary private key, and sends a corresponding user private key to the shared user;

The shared user runs a client, and downloads the public parameter and the location from the cloud storage service platform The shared data is described, and the downloaded shared data is decrypted using the public parameters and the corresponding user private key.

In the access control system and the access control method for the cloud storage service platform provided by the embodiment of the present invention, the authorization center and the data owner are based on the weight attribute encryption mechanism, and the user data to be uploaded is encrypted and stored on the cloud storage service platform. Therefore, effective privacy protection can be implemented for the shared data on the cloud storage service platform, and the security of the cloud storage service is improved. At the same time, because the attributes of the user are combined with the weights, the hierarchical management of the user attributes is implemented, so that users of different levels of the same attribute have different access rights. In addition, the system adopts the ciphertext segmentation method, that is, the authorization center and the data owner respectively generate partial ciphertexts, control the user access rights through the authorization center ciphertext, and formulate the access control policy through the data owner ciphertext, when the user attributes When a change occurs, the authorization center can update the ciphertext of its own part to realize the real-time revocation of the user's access rights.

DRAWINGS

1 is a structural diagram of an access control system for a cloud storage service platform provided by the present invention;

2 is a flowchart of an access control method of an access control system for a cloud storage service platform provided by the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

In order to solve the problems existing in the prior art, the access control system and the access control method for the cloud storage service platform proposed by the present invention are based on a weight attribute encryption mechanism, and the user data to be uploaded is encrypted and stored on the cloud storage service platform. .

FIG. 1 shows the structure of an access control system for a cloud storage service platform provided by the present invention, and only parts related to the present invention are shown for convenience of explanation.

The access control system for the cloud storage service platform provided by the present invention comprises: a management terminal 11 operated by an authorization center, configured to generate system public parameters and upload to the cloud storage server, generate a user private key and secretly distribute to the data owner and share The user generates the first partial ciphertext to be uploaded by using the weight attribute encryption mechanism; the client 12 run by the data owner and the shared user generates the second partial ciphertext to be uploaded by using the weight attribute encryption mechanism, in combination with the first Part of the ciphertext, the second part of the ciphertext and the data to be uploaded to generate the final ciphertext and upload the final ciphertext as shared data to the cloud storage service platform, and also used to download public parameters and share data from the cloud storage service platform, and use the public The parameter and the corresponding user private key decrypt the downloaded shared data.

In the present invention, the data owner and the shared user are respectively the running main body of the client 12, and the authorization center is the running main body of the management terminal 11. The data owner refers to the provider of shared data on the cloud storage service platform, and the shared user refers to downloading the shared data from the cloud storage service platform, and the authorization center refers to the cloud storage service in addition to the data owner and the shared user. A trusted third party that interacts with the platform. It should be understood that the purpose of defining the data owner and the shared user is to distinguish that the function of the main body running the client 12 during the running of the system is to upload data or download data, so that the data owner in a certain running process of the system can It is another shared user in the running process. Similarly, the shared user in a certain running process of the system can be the data owner in another running process.

In the present invention, the management terminal 11 can also be used to maintain basic information of the user, provide functions such as adding, deleting, and searching for the user, and can modify user information such as attributes and weights. The client 12 can also be used to guide the user to log in to the system based on the identity information provided by the user and the login information distributed by the authorization center.

In the present invention, when the cloud storage service platform is the Amazon S3 cloud storage service platform, the management terminal 11 and the client terminal 12 can respectively implement the aws-java-sdk interface provided by Amazon to implement the relationship with the Amazon S3 cloud storage service platform. Communication.

The working principle of the access control system for the cloud storage service platform of the present invention is: after the system is established, the authorization center runs the management terminal 11, generates public parameters and a master private key, and uploads the public parameters to the cloud storage service platform. When the first user needs to upload the shared data, the data belongs to the main running client 12, and the first user logs in to the client 12 from the data owner according to the identity information and the login information. Afterwards, the authorization center According to the attribute of the data owner, the weighting attribute encryption mechanism generates a first part of the ciphertext to be uploaded, and sends the first part of the ciphertext to the data owner. The data owner generates the second part of the ciphertext to be uploaded, and then combines the first part of the ciphertext and the second part of the ciphertext to generate the final ciphertext and uploads the final ciphertext as the shared data to the cloud storage service platform. When the second user reads the shared data uploaded by the first user from the cloud storage service platform, the shared user runs the client 12, and the second user logs in to the client 12 from the shared user according to the identity information and the login information. After that, the shared user obtains the user private key, downloads the public parameter and the shared data from the cloud storage service platform, and decrypts the downloaded shared data by using the public parameter and the corresponding user private key, if the attribute of the shared user is not revoked by the authorization center. In accordance with the access control policy formulated by the data owner, the shared user can successfully decrypt the shared data.

In the access control system for the cloud storage service platform provided by the present invention, the authorization center and the data owner are based on the weight attribute encryption mechanism, and the user data to be uploaded is encrypted and stored on the cloud storage service platform, thereby being able to store the cloud storage. The shared data on the service platform implements effective privacy protection and improves the security of the cloud storage service. At the same time, because the attributes of the user are combined with the weights, the hierarchical management of the user attributes is implemented, so that users of different levels of the same attribute have different access rights, and the attributes are used to describe the information elements of the user, such as students in the campus network. With attributes such as department, student type, grade, and major, the teacher has attributes such as department, title, and teaching age, thus achieving more flexible and meticulous access control while ensuring safety. In addition, the system adopts the ciphertext segmentation method, that is, the authorization center and the data owner respectively generate partial ciphertexts, control the user access rights through the authorization center ciphertext, and formulate the access control policy through the data owner ciphertext, when the user attributes When a change occurs, the authorization center can update the ciphertext of its own part to realize the real-time revocation of the user's access rights.

FIG. 2 is a flowchart of an access control method of an access control system for a cloud storage service platform provided by the present invention, including the following steps:

S1: The authorization center runs the management terminal, generates public parameters and a master private key, and uploads the public parameters to the cloud storage service platform.

Further, the step of generating the public parameter and the primary private key (ie, the step of system initialization) may specifically be:

Enter the safety parameter λ, the bilinear group whose construction order is prime p and generator is g

Defining bilinear mapping

The attribute space U={U ₁ ,...,U _m } is defined. The minimum weight of each attribute in the attribute space U is 1. The maximum weight corresponding to each attribute is L ₁ ,...,L _m , and is selected at the same time. random number

The calculation public parameter PK and the master private key MK are respectively:

PK={G ₀ ,g,h=g ^β ,e(g,g) ^α }

MK={g ^α ,β}

S2: The data belongs to the main running client, requests authorization from the authorization center and sends data upload request information.

S3: The authorization center runs the management end, verifies the data owner identity and generates the corresponding user private key in combination with the primary private key, and generates the first partial ciphertext to be uploaded based on the weight attribute encryption mechanism according to the data upload request information, and the corresponding user is The private key and the first part of the ciphertext are sent to the data owner.

Further, the step of generating a corresponding user private key in combination with the primary private key (ie, the step of generating a key) may specifically: input a primary private key MK, and define a weight attribute set.

Defining a hash function

Then choose a random number for each user

Then select a random number for each weight attribute j∈S

And set the weight ω' _j , and then generate the user private key SK as:

Further, the step of generating the first partial ciphertext of the data to be uploaded based on the weight attribute encryption mechanism (ie, the step of encrypting) may specifically be: constructing the first authorization tree

And according to the public parameter PK and the first authorization tree

Calculate the first part of the ciphertext.

Among them, remember the first authorization tree

Threshold for the node x K _x, Q _x the polynomial for each selected node, the degree of the polynomial d _{_x} = k _x -1, if the x node is a leaf node, there d _x = 0. First authorization tree

The construction method is: starting from the root node R, randomly selected

Set q _R (0)=s ₁ , randomly select d _R sub-nodes to completely define the polynomial q _R ; for other nodes x, set q _x (0)=q _parent (index(x)), randomly select d _x Child nodes to fully define the polynomial q _x . Then the first part of the ciphertext CT ₁ can be expressed as:

Where U represents the first authorization tree

Set of leaf nodes, attributes u∈U, ω _u represents the authority to set properties of u minimum weight value, L _u denotes authority set attribute u of the maximum weight value, q _u (0) indicates that the property attribute value corresponding to u (Also the output value of the polynomial when the input is 0).

S4: The data owner generates a second part of the ciphertext to be uploaded based on the weight attribute encryption mechanism.

In the present invention, the step may specifically be: constructing a second authorization tree

And according to the public parameter PK and the second authorization tree

Calculate the second part of the ciphertext.

Similarly, remember the second authorization tree

Threshold tree structure for node x K _x, Q _x the polynomial for each selected node, the degree of the polynomial d _{_x} = k _x -1, if the x node is a leaf node, there d _x = 0. Second authorization tree

The construction method is: starting from the root node R, randomly selected

Set q _R (0)=s ₂ , randomly select d _R sub-nodes to completely define the polynomial q _R ; for other nodes x, set q _x (0)=q _parent (index(x)), randomly select d _x Child nodes to fully define the polynomial q _x . Then the second part of the ciphertext CT ₂ can be expressed as:

Where Y represents the second authorization tree

The set of middle leaf nodes, the attribute y∈Y, ω _y represents the minimum weight value of the data owner setting attribute y, L _y represents the maximum weight value of the data owner setting attribute y, and q _y (0) represents the attribute y corresponding to The attribute value, ω _l represents the current weight of the attribute y.

S5: The data owner combines the first part of the ciphertext and the second part of the ciphertext to generate the final ciphertext and uploads the final ciphertext as shared data to the cloud storage service platform.

If the data to be uploaded (ie, plaintext) is M, the final ciphertext CT generated by combining the first partial ciphertext CT ₁ and the second partial ciphertext CT ₂ can be expressed as:

S6: The shared user runs the client and requests authorization from the authorization center.

S7: The authorization center runs the management terminal, verifies the shared user identity and generates a corresponding user private key in combination with the primary private key, and sends the corresponding user private key to the shared user. The step of generating the corresponding user private key in combination with the primary private key is the same as the step of generating the key in step S3, and details are not described herein.

S8: The shared user runs the client, downloads the public parameter and the shared data from the cloud storage service platform, and decrypts the downloaded shared data by using the corresponding user private key.

Further, the step of decrypting the downloaded shared data by using the public parameter and the corresponding user private key may include the following steps:

S81: input shared data CT, corresponding user private key SK, and first authorization tree

Second authorization tree

One of the nodes x.

S82: If the weight attribute of the shared user satisfies the first authorization tree

Then calculate the intermediate parameter A _i as:

The first decoded information A ₁ corresponding to the first partial ciphertext is obtained as follows:

Where x is the input node, i is the attribute value corresponding to node x, i=att(x), ω _i is the weight value of node x that the shared user has input, and ω _i ' is the node x that the authorization center has input. The minimum weight value.

In the present invention, whether the weight attribute of the shared user satisfies the first authorization tree

Means: a. If the input node x is a leaf node, if i ∈ S and ω _i ≥ ω _i ', then the weight attribute of the shared user is considered to satisfy the first authorization tree

in case

Or i∈S and ω _i <ω _i ', it is considered that the weight attribute of the shared user does not satisfy the first authorization tree

b. If the input node x is a non-leaf node, and all the node sets under the node x are {z}, then when at least one group of nodes in the {z} meets the threshold condition, the weight attribute of the shared user is considered to satisfy the first authorization. Tree

When each group of nodes in {z} does not satisfy the threshold condition, it is considered that the weight attribute of the shared user does not satisfy the first authorization tree.

And if the shared user's weight attribute does not satisfy the first authorization tree

Then returns null.

S83: If the weight attribute of the shared user satisfies the second authorization tree

And the weight value ω _i of the node x that the shared user has input is equal to the minimum weight value ω _i ” of the node x that the data owner owns the input, then the intermediate parameter B _i is calculated as:

If the shared user's weight attribute satisfies the second authorization tree

And the weight value ω _i of the node x that the shared user has input is greater than the minimum weight value ω _i ′ of the node x that the data owner owns the input, then the intermediate parameter K _i and the intermediate parameter B _i ' are calculated as:

The second decoding information A ₂ corresponding to the second partial ciphertext is obtained as follows:

In the present invention, whether the weight attribute of the shared user satisfies the second authorization tree

Means: a. If the input node x is a leaf node, ω _i ” is the minimum weight value of the node x that the data owner owns the input, and if i ∈ S, and ω _i ≥ ω _i ”, the weight of the shared user is considered Attribute satisfies the second authorization tree

in case

Or i∈S and ω _i <ω _i ”, it is considered that the weight attribute of the shared user does not satisfy the second authorization tree

b. If the input node x is a non-leaf node, and all the node sets under the node x are {z}, then when at least one group of nodes in the {z} meets the threshold condition, the weight attribute of the shared user is considered to satisfy the second authorization. Tree

And when each group of nodes in {z} does not satisfy the threshold condition, it is considered that the weight attribute of the shared user does not satisfy the second authorization tree.

And if the weight attribute of the shared user does not satisfy the second authorization tree

Then returns null.

S84: Combine the first decoding information and the second decoding information to obtain a plaintext M, which is expressed as:

The following is an analysis of the security of the access control method for the above-mentioned access control system for the cloud storage service platform:

1. Security under direct attack:

If the attacker's attribute does not satisfy the access tree and it wants to decrypt the downloaded shared data, it must be able to calculate

To establish such a match, the adversary can only use the known information, that is, the partial private key D=g ^(α+r)/β containing ^α and the ciphertext containing s ₁ and s ₂

with

Establish pairing:

to get

Must be known

And the adversary is not satisfied with the access tree.

with

The correct key could not be obtained and the value could not be calculated. Therefore, the adversary cannot decrypt.

2. Anti-collusion safety:

The method includes a key generation algorithm of the user. When decrypting, the system first runs the algorithm to allocate a random number r to the user, and generates a partial private key D=g ^{(α+r)/β of the user} . In the decryption algorithm, the parameter D=g ^(α+r)/β is implanted with a random value, and different users cannot collude to recover the message.

The following is an analysis of the efficiency of the above access control method for the access control system of the cloud storage service platform:

Assume

with

Represents an exponent or multiplication operation on a group, and C _e represents a bilinear pairing operation.

Represents the modulo prime number p integer group on the finite field, n represents the number of attributes in the system, and S' represents the attribute set that satisfies the access structure defined by the licensor.

It is the encryption party that sets the attribute set related to the ciphertext.

Indicates that the licensor sets a set of attributes related to the ciphertext.

Is the attribute set of user u, ω _i represents the maximum weight of attribute i in the system,

Is the weight of the encryption attribute setting attribute i in the cipher text.

Is the weight of the attribute i owned by the user u in the system.

Indicates the weight of the attribute i in the ciphertext. L _* is the bit length of the element on *, and |*| is the number of elements on *. A comparative analysis between the above method and the existing access control methods BSW07 and CP-WABE is shown below:

From the comparison analysis of the above table, it can be seen that: 1) Weight mechanism: The invention and the CP-WABE scheme introduce the concept of weight, realize the hierarchical processing of attributes, and can complete more detailed access control. However, the ciphertext length and the encryption and decryption time are related to the weight level, and the communication and computational consumption are increased compared with the BSW07 scheme in which the weight is not implemented. 2) Revocation mechanism: CP-WABE does not have the ability to revoke, and the BSW07 scheme can be revoked by time stamping. The invention adopts ciphertext segmentation to achieve revocation. When the attribute changes, the authorization center only needs to update some of its own ciphertext to realize real-time revocation of user rights. In general, the present invention implements attribute grading processing, and also introduces a new revocable mechanism, at the same time, the computing performance is more prominent, and the computing power allocation is reasonable.

In the access control system and the access control method for the cloud storage service platform provided by the present invention, the authorization center and the data owner are based on the weight attribute encryption mechanism, and the user data to be uploaded is encrypted and stored on the cloud storage service platform. Therefore, effective privacy protection can be implemented for the shared data on the cloud storage service platform, and the security of the cloud storage service is improved. At the same time, because the attributes of the user are combined with the weights, the hierarchical management of the user attributes is implemented, so that users of different levels of the same attribute have different access rights, and the attributes are used to describe the information elements of the user, such as students in the campus network. With attributes such as department, student type, grade, and major, the teacher has attributes such as department, title, and teaching age, thus achieving more flexible and meticulous access control while ensuring safety. In addition, the system uses dense The text segmentation method, that is, the authorization center and the data owner respectively generate a partial ciphertext, control the user access authority through the authorization center ciphertext, and formulate an access control policy through the data owner ciphertext, and only need to authorize when the user's attribute changes. The center updates its own ciphertext to achieve real-time revocation of user access rights.

A person of ordinary skill in the art can understand that all or part of the steps in implementing the above embodiments may be controlled by a program to control related hardware, and the program may be stored in a computer readable storage medium, the storage. Media, such as ROM/RAM, disk, CD, etc.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. Within the scope.

Claims

An access control system for a cloud storage service platform, characterized in that the system comprises:

The management terminal running by the authorization center is used to generate the system common parameters and upload to the cloud storage server, generate the user private key and secretly distribute it to the data owner and the shared user, and generate the first partial secret of the data to be uploaded by using the weight attribute encryption mechanism. Text

a client running by the data owner and the shared user, generating a second partial ciphertext to be uploaded by using the weight attribute encryption mechanism, combining the first partial ciphertext, the second partial ciphertext, and the data to be uploaded Generating a final ciphertext and uploading the final ciphertext as shared data to the cloud storage service platform, and also for downloading public parameters and sharing data from the cloud storage service platform, and using the public parameters and corresponding users The private key decrypts the downloaded shared data.
The access control system for a cloud storage service platform according to claim 1, wherein the management terminal is further configured to maintain basic information of the user; the client is further configured to use the identity information provided by the user. The login information distributed by the authorization center guides the user to log in to the system.
The access control system for a cloud storage service platform according to claim 1, wherein the cloud storage service platform is an Amazon S3 cloud storage service platform.
An access control method for an access control system for a cloud storage service platform according to any one of claims 1 to 3, wherein the method comprises the following steps:

The authorization center runs the management terminal, generates public parameters and the master private key, and uploads the public parameters to the cloud storage service platform;

The data belongs to the main running client, requests authorization from the authorization center and sends data upload request information;

The authorization center runs the management end, verifies the data owner identity and generates a corresponding user private key in combination with the primary private key, and generates a first partial ciphertext to be uploaded based on the weight attribute encryption mechanism according to the data upload request information. Sending the corresponding user private key and the first partial ciphertext to the data owner;

Generating, by the data owner, a second partial ciphertext of the data to be uploaded based on a weight attribute encryption mechanism;

The data owner combines the first partial ciphertext and the second partial ciphertext to generate a final ciphertext and Uploading the final ciphertext as shared data to the cloud storage service platform;

The shared user runs the client and requests authorization from the authorization center;

The authorization center runs the management terminal, verifies the shared user identity, generates a corresponding user private key in combination with the primary private key, and sends the corresponding user private key to the shared user;

The shared user runs the client, downloads the public parameter and the shared data from the cloud storage service platform, and decrypts the downloaded shared data by using a corresponding user private key.
The access control method for the access control system of the cloud storage service platform according to claim 4, wherein the step of generating the public parameter and the master private key is specifically:

Enter the safety parameter λ, the bilinear group whose construction order is prime p and generator is g
Defining bilinear mapping
Defining the attribute space U={U 1 ,..., U m }, the minimum weight of each attribute in the attribute space U is 1, and the maximum weight corresponding to each attribute is L 1 ,...,L m , Simultaneous selection of random numbers
The calculation public parameter PK and the master private key MK are respectively:

PK={G 0 ,g,h=g β ,e(g,g) α }

MK = {g α , β}.
The access control method for the access control system of the cloud storage service platform according to claim 5, wherein the step of generating the corresponding user private key in combination with the primary private key is specifically:

Enter the master private key MK to define a weight attribute set
Defining a hash function
Then choose a random number for each user
Then select a random number for each weight attribute j∈S
And set the weight ω' j , and then generate the user private key SK as:
The access control method for the access control system of the cloud storage service platform according to claim 6, wherein the step of generating the first partial ciphertext of the data to be uploaded based on the weight attribute encryption mechanism is specifically:

Constructing a first authorization tree
And according to the public parameter PK and the first authorization tree
The first partial ciphertext CT 1 is calculated, and the first partial ciphertext CT 1 is expressed as:

Among them, random selection
U represents the first authorization tree
Set of leaf nodes, attributes u∈U, ω u represents the authority attribute setting weight values weight the minimum of u, L u denotes the authority attribute is provided largest weight value of u, q u (0) indicates the attribute u The corresponding attribute value.
The access control system for an access control system for a cloud storage service platform according to claim 7, wherein the second partial ciphertext CT 2 is expressed as:

Among them, random selection
Y represents the second authorization tree
a set of medium leaf nodes, the attribute y∈Y, ω y represents the minimum weight value of the data owner setting attribute y, L y represents the maximum weight value of the data owner setting attribute y, and q y (0) represents the attribute. The attribute value corresponding to y, ω l represents the current weight of the attribute y.
The access control system for the access control system of the cloud storage service platform according to claim 8, wherein if the data to be uploaded is M, the final ciphertext CT is expressed as:
The access control method for the access control system of the cloud storage service platform according to claim 9, wherein the step of decrypting the downloaded shared data by using a corresponding user private key comprises the following steps:

A21: input shared data CT, corresponding user private key SK, and first authorization tree
And second authorization tree
One of the nodes x;

A22: If the weight attribute of the shared user satisfies the first authorization tree
The first portion of the first ciphertext corresponding to the decoded information A 1 is:

A23: If the weight attribute of the shared user satisfies the second authorization tree
Then, the second decoding information A 2 corresponding to the second partial ciphertext is:

A24: binding the first decoded information A 1 and A 2 of the second decoded information to obtain the plaintext M, expressed as: