WO2016197770A1

WO2016197770A1 - Access control system and access control method thereof for cloud storage service platform

Info

Publication number: WO2016197770A1
Application number: PCT/CN2016/081388
Authority: WO
Inventors: 喻建平; 张鹏; 连景钗; 王廷
Original assignee: 深圳大学
Priority date: 2015-06-12
Filing date: 2016-05-09
Publication date: 2016-12-15
Also published as: CN104917772A; CN104917772B

Abstract

The invention relates to the field of information security in cloud services. Provided are an access control system and access control method thereof for a cloud storage service platform. The system and method are based on a weighted attribute encryption scheme, and adopt multi-authority attribute-based encryption to encrypt data and store the encrypted data in a cloud storage service platform so as to increase security of a cloud storage service. The invention combines an attribute with a weight to realize a ranking management of a user attribute, so that users having a same attribute but at different ranks have different access authorities, thereby realizing a more flexible and precise access control. Moreover, the system and method adopt multi-authority attribute-based encryption to prevent a single authentication center from having over-centralized authority, thereby increasing the security of the cloud storage service. The system and method are particularly suitable to be deployed in an OSS platform, thereby ensuring confidentiality of data stored therein by a user, and implementing a more precise access control over data sharing.

Description

Access control system of cloud storage service platform and access control method thereof

Technical field

The invention belongs to the field of cloud service information security, and in particular relates to an access control system of a cloud storage service platform and an access control method thereof.

Background technique

In the cloud storage service platform, because of the data remote hosting technology, the cloud service provider is the physical owner of the data, but not in the same trust domain as the data owner. A cloud storage service provider manages multiple users and their resources. When users access other user resources across borders, they need to adopt certain access control policies to control access to data and services. However, in practice, because the cloud storage service platform adopts the virtualized storage technology, the cloud storage service is loosely coupled with the underlying hardware environment, and the data of different users lacks a fixed security boundary, thereby increasing the cloud storage. The difficulty of the service platform to implement access control on data.

In the prior art, although the data owner can set the read/write attribute of the user data uploaded by it, for example, setting the read/write attribute to public read/private write or public read/public write, to a certain extent Data read and write permissions, but because user data is still stored in clear text on the cloud storage service platform, lack of effective privacy protection mechanism, can not effectively resist the access of illegal users and make user data leak.

Summary of the invention

An object of the present invention is to provide an access control system for a cloud storage service platform, which aims to solve the problem that the existing cloud storage service platform stores user data in a clear text form with poor privacy and security.

The embodiment of the present invention is implemented as an access control system of a cloud storage service platform, The system includes:

The authentication center is configured to generate a global public key, a global master key, and a user public key, and then upload the global public key to the cloud;

At least one attribute authority for managing respective attribute sets, and generating an organization public key and an organization key, and then uploading the organization public key to the cloud, and also for utilizing the attribute list submitted by each user Generating, by the global public key, the user public key, and the institution key, a user private key corresponding to the user;

a user terminal, configured to download the organization public key and the global public key from the cloud, and combine the user private key generated by the attribute authorization mechanism to implement encrypted upload of user data or decryption of shared data. download.

Another object of the present invention is to provide an access control method for an access control system of a cloud storage service platform as described above, the method comprising the following steps:

The authentication center registers each user terminal and each attribute authorization authority, and generates a global public key, a global master key, and a user public key, and then uploads the global public key to the cloud, and sends the user public key to the corresponding attribute authority. The global master key is saved by the certification center;

The attribute authority manages the respective attribute sets, and generates an organization public key and an organization key, and then uploads the institution public key to the cloud, and the institution key is saved by the attribute authorization authority;

After the user terminal logs in to the system, downloading the organization public key and the global public key from the cloud, and issuing a user private key acquisition request and an attribute list to the corresponding attribute authority;

After receiving the user private key obtaining request, the corresponding attribute authority generates a user private key corresponding to the user by using the global public key, the user public key, and the institution key according to the attribute list. And sent to the corresponding user terminal;

The user terminal implements encrypted uploading of user data or decryption downloading of shared data according to the organization public key, the global public key, and the user private key.

The access control system and the access control method of the cloud storage service platform proposed by the embodiment of the present invention are based on a weight attribute encryption mechanism, and adopt multi-institution attribute-based encryption technology to add user data to be uploaded. The security is stored on the cloud storage service platform, thereby realizing effective privacy protection for the shared data on the cloud storage service platform and improving the security of the cloud storage service. At the same time, because the attributes of the user are combined with the weights, the hierarchical management of the user attributes is realized, so that users of different levels of the same attribute have different access rights, thereby achieving more flexible and detailed access control while ensuring security. . In addition, the system and method adopt multi-institution attribute-based encryption technology, which avoids the problem that the power of a single authentication center is too concentrated, and further improves the security of data storage. The system and method are particularly suitable for deployment on the OSS platform, which can ensure the confidentiality of data stored by the user on the OSS platform, and implement fine-grained access control for the data sharing range.

DRAWINGS

1 is a structural diagram of an access control system of a cloud storage service platform provided by the present invention;

2 is a flowchart of an access control method of an access control system of a cloud storage service platform provided by the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

In order to solve the problems existing in the prior art, the access control system and the access control method of the cloud storage service platform proposed by the present invention are based on a weight attribute encryption mechanism, and use multi-institution attribute-based encryption technology to encrypt and store user data to be uploaded. Go to the cloud storage service platform.

1 is a diagram showing the structure of an access control system of a cloud storage service platform provided by the present invention. For the convenience of description, only parts related to the present invention are shown.

In detail, the access control system of the cloud storage service platform provided by the present invention includes: an authentication center 1 for generating a global public key, a global master key, and a user public key, and then uploading the global public key to the cloud, the global master key Saved by the Certification Authority 1 itself; at least one attribute authority 2 for managing each Attribute collection, and generate the organization public key and organization key, and then upload the organization public key to the cloud, the organization key is saved by the attribute authority 2, and is also used to use the global public key according to the attribute list submitted by each user. The user public key and the organization key generate a user private key corresponding to the user; the user terminal 3 is configured to download the organization public key and the global public key from the cloud, and combine the corresponding user private key generated by the attribute authority 2 to implement the user data. Encrypted upload or decrypted download of shared data.

In the present invention, the user terminal 3 can be further divided into a data owner and a shared user. Among them, the data owner is the owner of the data file, can create, update, delete data, and at the same time want to encrypt the user data and upload it to the cloud to achieve data sharing; the shared user is the party who wants to download the shared data from the cloud.

It should be understood that the purpose of defining the data owner and the shared user is to distinguish that the function of the user terminal 3 during a certain running process of the system is to upload data or download data, so that the data owner in a certain running process of the system may be another time. The shared user in the running process, similarly, the shared user in a certain running process of the system may be the data owner in another running process.

In the present invention, both the authentication center 1 and the attribute authorization authority 2 belong to an authorization authority, and the authorization authority refers to another party that interacts with the cloud in addition to the user terminal 3, and mainly completes distribution of the end user private key, user registration, information and The management of the end user's private key is also responsible for the dynamic management of the user's attribute information, for example, dynamic update, addition or deletion of the user or its attributes.

In the present invention, a cloud is a cloud service provider or a data sharing center, which is always online and provides a user data storage service.

In the present invention, when the cloud is an Open Storage Service (OSS) platform provided by Alibaba Cloud Computing Co., Ltd., the cloud and the user terminal 3, the attribute authority 2, and the authentication center 1 are limited by Alibaba Cloud Computing. The development interface of the OSS platform provided by the company communicates with aliyun-sdk-oss-2.0.0.jar.

Further, in the present invention, the authentication center 1 is also used to accept registration of each user terminal 3 and each attribute authority 2, and the user terminal 3 and the attribute authority 2 log in to the system based on the login information obtained by registration.

The working principle of the access control system of the cloud storage service platform of the present invention is:

After the system is established, the authentication center 1 registers each user terminal 3 and each attribute authority 2, and generates a global public key, a global master key, and a user public key, and then uploads the global public key to the cloud, and sends the user public key to the corresponding Attribute Authorization Agency 2. Thereafter, each attribute authority 2 manages the respective attribute sets, that is, sets the attribute values and their weight values in the respective managed attribute sets, and generates the institution public key and the institution key, and then uploads the organization public key to the cloud. The attribute set may be, for example, a student department, a student category, a grade, a professional, and the like in the campus network, and the teacher has a collection of attributes such as a department, a title, and a teaching age.

The user terminal 3 logs in to the system according to the login information obtained by the registration, and then downloads the organization public key and the global public key from the cloud, and issues a user private key acquisition request and an attribute list to the corresponding attribute authority 2. After receiving the user private key acquisition request, the corresponding attribute authority 2 generates a user private key corresponding to the user by using the global public key, the user public key, and the organization key according to the attribute list, and sends the file to the corresponding file by FTP. User terminal 3. After obtaining the organization public key, the global public key, and the user private key, the user terminal 2 can perform an operation of encrypting uploading or decrypting the download according to requirements.

When the user terminal 2 uploads user data to the cloud as a data owner, the user terminal 2 inputs the input according to the global public key, the set of all attribute authorization mechanisms 2 participating in the encryption, the corresponding set of the organization public key, and the access control policy. The plaintext is encrypted, and the encrypted ciphertext is uploaded to the cloud for other users to download.

When the user terminal 2 shares the data stored in the cloud as the shared user, the user terminal 2 downloads the shared data from the cloud, and then decrypts the downloaded shared data according to the global public key and the user private key, if the attribute of the user terminal 2 is not Undoing and conforming to the access control policy established by the data owner can successfully decrypt the shared data.

FIG. 2 is a flowchart of an access control method of an access control system of a cloud storage service platform provided by the present invention, including the following steps:

S1: The authentication center registers each user terminal and each attribute authorization authority, and generates a global public key, a global master key, and a user public key, and then uploads the global public key to the cloud, and sends the user public key to the corresponding attribute authority. The global master key is saved by the certificate authority. The global master key is the master of the entire system. Key,

Further, step S1 may further include:

Step S11: The authentication center selects a multiplicative group whose order is prime p

with

g is a multiplicative group

Generator, defining a bilinear map

Select random number

For the integer group {0,...,p-1}, select a hash function at the same time

Step S12: the certification center according to the formula

The global public key GPK is calculated, and the global master key GMK is calculated according to the formula GMK=(β, g ^α ).

Step S13: The authentication center receives the registration information sent by each user terminal and each attribute authorization authority. After the verification is passed, each attribute authority is assigned a unique identifier aid, and each user terminal is assigned a unique identifier uid, and then the authentication center is Each user terminal selects a corresponding random number

According to the formula

The corresponding user public key PK _{uid is} calculated, and the user public key PK _{uid is} sent to the corresponding attribute authority, and the global public key GPK is uploaded to the cloud.

S2: The attribute authority manages the respective attribute sets, and generates the organization public key and the organization key, and then uploads the organization public key to the cloud, and the organization key is saved by the attribute authorization authority.

Further, step S2 may further include:

Step S21: The attribute authority AA _aid manages the attribute set S _aid and assigns a weight to the weight attribute in the attribute set S _aid .

Step S22: The attribute authority AA _aid selects a random number

According to the formula

Calculate the organization key SK _aid and according to the formula

Calculate the organization public key PK _aid , and then upload the organization public key PK _aid to the cloud.

S3: After the user terminal logs in to the system, the organization public key and the global public key are downloaded from the cloud, and the user private key acquisition request and the attribute list are sent to the corresponding attribute authority. The attribute list is a set of attributes. For example, the attribute set may be a student faculty, a student category, a grade, a professional, and the like in the campus network, and the teacher has a set of attributes such as a department, a title, and a teaching age.

S4: after receiving the user private key acquisition request, the corresponding attribute authority receives the attribute list, The user private key corresponding to the user is generated by using the global public key, the user public key, and the organization key, and sent to the corresponding user terminal.

Assume that the attribute list of the user terminal uid received by the attribute authority AA _aid is S _{uid, aid} , and the attribute list S _{uid, aid} contains the set of attributes held by the user terminal uid in the attribute authority AA _aid , then step S4 It can also include:

Step S41: The attribute authority AA _aid selects a random number

And select a random number for any attribute x∈S _{uid, aid}

If the attribute x is a weight attribute, the attribute authority AA _aid sets the weight w _x ∈[1,n] corresponding to the attribute x.

Step S42: The attribute authority AA _{aid is} expressed according to the calculated user private key SK _{uid, aid} , as:

Where K _{uid, aid} , K' _{uid, aid} , K _{x, uid} , and K' _{x, uid} are all the multiplicative groups

The upper element, r _x is the integer group

Random number on.

Step S43: The attribute authority AA _aid sends the user private key SK _{uid, aid} to the user terminal uid.

S5: The user terminal implements encrypted uploading of user data or decryption and downloading of shared data according to the organization public key, the global public key, and the user private key.

In one case, when the user terminal is the owner of the data, the step S5 is to perform the step of encrypting and uploading the user data, which may specifically include:

Step S51: input plaintext M (ie, user data to be uploaded by the data owner), global public key GPK, set I _AA of all attribute authorization institutions participating in encryption, and a set of corresponding public keys of the institution

And access control strategies.

In the tree structure of the access control policy, the leaf node corresponds to the weight of the attribute, the root node corresponds to the threshold, and the threshold of the node x in the tree structure of the access control policy is k _x , select the polynomial q _x for each node, and the degree of the polynomial d _x =k _x -1. This polynomial selection is in a top-down manner, and the access control strategy is constructed by selecting a random number from the root node.

Set q _r (0)=s. For any node x, the corresponding value is a form of d _x degree polynomial q _x , set q _x (0)=q _parent (index(x)), index(x) is the index value of attribute x, q _parent Is the function expression corresponding to the father node of the attribute x, and then randomly select other d _x points to completely define q _x .

Step S52: The user terminal utilizes the global public key GPK, the set of all attribute authorization mechanisms participating in the encryption, I _AA , and the corresponding set of institutional public keys.

And the access control policy, encrypting the ciphertext M, calculating the ciphertext CT, and then uploading the ciphertext CT to the cloud.

If Y is defined as the set of leaf nodes of the access control policy, the attribute of the leaf node y∈Y is defined as att(y), and the weight of the weight attribute att(y)(y∈Y) is w _y , then the ciphertext is M performs encryption, and the step of calculating the ciphertext CT can be expressed as:

Where C is the calculation of the message, I _A is the attribute set of the attribute authority A, C' and C" are the calculations of the root node, and C _y and C' _y are the calculations of the corresponding attribute values, C _y,j For the calculation of the attribute corresponding weight, q _y (0) is the attribute value corresponding to the attribute y, and w _j is the weight value of the attribute.

In another case, when the user terminal is the shared user, the step S5 is to perform the step of decrypting and downloading the shared data, which may include:

Step S53: The user terminal downloads the ciphertext CT (that is, the shared data that the shared user wants to read) from the cloud, and inputs the global public key GPK and the corresponding user key.

Access control policy Γ, and a node x in the access control policy 并, and define n _A =|I _AA |. Where n _A represents the number of attributes included in the attribute authority AA.

Step S54: The user terminal invokes a predefined recursive function DecryptNode (CT, SK, x), if the attribute set of the user terminal

After satisfying the access control policy, the decryption information A is calculated as:

Where q _x (0) is the attribute value corresponding to the attribute x.

In the present invention, the attribute set of the user terminal

Whether to meet the access control strategy means:

And w _i =w _x , then the attribute set is considered

Meet the access control strategyΓ; if

And w _i =w _j >w _x , then the attribute set is considered

Meet the access control strategyΓ; if

or

But w _i <w _x , then the attribute set

Returns null if the access control policy is not met.

In the present invention, the recursive function DecryptNode(CT, SK, x) is defined as follows:

a, if

And w _i =w _x , then define:

Where C _x and C' _{x are} from ciphertext, K _{i, uid} and K' _{i, and uid is} derived from the user key r _i being a random number identifying the user i.

b, if

And w _i =w _j >w _x , then define:

Among them, C _{x, j} comes from the information in the ciphertext.

Step S55: Obtained by the polynomial interpolation theorem

After calculation

And combined with the following formula to obtain

Step S56: The user terminal calculates the plaintext M, which is expressed as:

The following is an analysis of the security of the access control method of the above-mentioned cloud storage service platform access control system:

First, security analysis

Theory 1. Security under direct attack

If the attacker's weight attribute set does not satisfy the access control policy, the attacker must be known

In order to decrypt the ciphertext. Obtained in the user's attribute private key

Combine C'=g ^s with ciphertext, C"=g ^βs to establish pairing

The attacker must remove

Can get

The attacker cannot calculate the correct attribute key without satisfying the access control policy, that is, it cannot be calculated.

Therefore, an attacker cannot decrypt the ciphertext.

Theory 2, anti-collusion safety

In the present invention, the user needs to register with the authentication center, and the authentication center assigns a global unique identifier uid to each user, and generates a random number u _uid , which is calculated.

As the user's public key.

Each user uid to request attributes key before AA _aid requires authentication authority attribute its legitimacy, users submit a certificate, AA _aid validity of the user certificate, if they issue the relevant legal property keys. In the user key,

K _{x, aid} and K' _{x, aid} are both embedded with the random number u _uid and the random number r _x . Correspondingly, different users in the decryption algorithm cannot collude to recover messages, and have good anti-collusion attack security.

Theory 3, multi-authority agency security

According to the decryption algorithm, if the user wants to decrypt the ciphertext, the attribute key SK _{uid, aid} from each AA _aid is required. If the authentication center is attacked by the attacker, it only leaks the system's global master key, and only the global master key cannot decrypt any ciphertext. Similarly, if the attribute authority is attacked by the attacker, the attacker can only obtain the attribute key managed by the attribute organization, and cannot decrypt the attribute privilege of multiple attribute authorization agencies. The system can resist n _A -1 attribute authorization. Institutional complicity. Therefore, compared with the weight attribute-based access control scheme of a single authority, the scheme does not require the certification center to be completely trusted, and the risk of the single authorization center is distributed to multiple attribute authorization agencies to share the security of the system.

Second, efficiency analysis

Table 1 below shows a comparative analysis of the encryption mechanism and access structure flexibility between the solution of the present invention and other existing typical attribute-based encryption schemes:

Table I:

Define |p| to represent a group

with

The length of the upper element. |A _k | indicates the size of the collection managed by the attribute authority, |A _u | indicates the size of the user attribute set, |A _c | indicates the minimum attribute set size that satisfies the access structure, and W _m is the maximum weight value allowed by the system, A _w The number of weight attributes. Table 2 below shows a comparative analysis of the storage overhead of the multi-agency mechanism between the solution of the present invention and other existing typical attribute-based encryption schemes:

Table II:

As can be seen from the above comparison, the M.Chase and M.Chase and Chow schemes do not support complex ciphertext rules and are not suitable for cloud storage environments. The K.Yang solution and the solution of the present invention are based on CP-ABE, at the cost of increasing the complexity of a certain system, in exchange for supporting a more flexible access control strategy, and at the same time, the security is enhanced, and the N-1 attribute authority can be resisted. Collusion. Compared with the K.Yang scheme, the solution of the present invention supports attribute weights, and can formulate more complicated ciphertext rules; the authority key is shortened by a certain length, and if the attributes in the policy do not contain weights, the ciphertext length is shortened by nearly half. When the four-level weight is supported, the ciphertext length is equivalent; the decryption phase only requires two bilinear pairing operations, and the efficiency is doubled.

In summary, the access control system and the access control method of the cloud storage service platform proposed by the present invention are based on a weight attribute encryption mechanism, and the user data to be uploaded is encrypted and stored in the cloud storage service by using a multi-institution attribute-based encryption technology. On the platform, effective privacy protection can be realized for the shared data on the cloud storage service platform, and the security of the cloud storage service is improved. At the same time, because the attributes of the user are combined with the weights, the hierarchical management of the user attributes is implemented, so that users of different levels of the same attribute have different access rights, and the attributes are used to describe the information elements of the user, such as students in the campus network. With attributes such as department, student type, grade, and major, the teacher has attributes such as department, title, and teaching age, thus achieving more flexible and meticulous access control while ensuring safety. In addition, the system and method adopt multi-institution attribute-based encryption technology, which avoids the problem that the power of a single authentication center is too concentrated, and further improves the security of data storage. The system and method are particularly suitable for deployment on the OSS platform, and are implemented in the Java language under the Windows platform, and have universality, and can download, upload, encrypt and decrypt the cloud files of the OSS platform, and can effectively ensure the user is stored in the OSS platform. The confidentiality of the data, while implementing fine-grained access control for the data sharing scope.

A person of ordinary skill in the art can understand that all or part of the steps in implementing the above embodiments may be controlled by a program to control related hardware, and the program may be stored in a computer readable storage medium, the storage. Media, such as ROM/RAM, disk, CD, etc.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. Within the scope.

Claims

An access control system for a cloud storage service platform, characterized in that the system comprises:

The authentication center is configured to generate a global public key, a global master key, and a user public key, and then upload the global public key to the cloud;

At least one attribute authority for managing respective attribute sets, and generating an organization public key and an organization key, and then uploading the organization public key to the cloud, and also for utilizing the attribute list submitted by each user Generating, by the global public key, the user public key, and the institution key, a user private key corresponding to the user;

a user terminal, configured to download the organization public key and the global public key from the cloud, and combine the user private key generated by the attribute authorization mechanism to implement encrypted upload of user data or decryption of shared data. download.
The access control system of the cloud storage service platform according to claim 1, wherein the cloud is an open storage service platform, and the cloud is between the cloud and the user terminal, the attribute authorization authority, and the authentication center. The communication is realized through the development interface aliyun-sdk-oss-2.0.0.jar.
An access control method for an access control system of a cloud storage service platform according to claim 1 or 2, wherein the method comprises the following steps:

The authentication center registers each user terminal and each attribute authorization authority, and generates a global public key, a global master key, and a user public key, and then uploads the global public key to the cloud, and sends the user public key to the corresponding attribute authority. The global master key is saved by the certification center;

The attribute authority manages the respective attribute sets, and generates an organization public key and an organization key, and then uploads the institution public key to the cloud, and the institution key is saved by the attribute authorization authority;

After the user terminal logs in to the system, downloading the organization public key and the global public key from the cloud, and issuing a user private key acquisition request and an attribute list to the corresponding attribute authority;

After receiving the user private key obtaining request, the corresponding attribute authority generates a user private key corresponding to the user by using the global public key, the user public key, and the institution key according to the attribute list. And sent to the corresponding user terminal;

The user terminal implements encrypted uploading of user data or decryption downloading of shared data according to the organization public key, the global public key, and the user private key.
The access control method of the access control system of the cloud storage service platform according to claim 3, wherein the authentication center registers each user terminal and each attribute authority, and generates a global public key, a global master key, and a user. The public key, after the global public key is uploaded to the cloud, the step of sending the user public key to the corresponding attribute authority includes the following steps:

The certification center selects the multiplicative group of prime p
with
g is a multiplicative group
The generator, defining the bilinear map e:
Select random number

For the integer group {0,...,p-1}, select a hash function H at the same time:

Certification Center according to the formula
Calculating the global public key GPK, and calculating the global master key GMK according to the formula GMK=(β, g α );

The authentication center receives the registration information sent by each user terminal and each attribute authorization authority. After the verification is passed, each attribute authority is assigned a unique identifier aid, and each user terminal is assigned a unique identifier uid, and then the authentication center is each user. The terminal selects the corresponding random number
According to the formula
The corresponding user public key PK uid is calculated, and the user public key PK uid is sent to the corresponding attribute authority, and the global public key GPK is uploaded to the cloud.
The access control system for an access control system of a cloud storage service platform according to claim 4, wherein the attribute authority manages respective attribute sets, and generates an organization public key and an organization key, and then the institution The step of uploading the public key to the cloud includes the following steps:

The attribute authority AA aid manages the attribute set S aid and assigns a weight to the weight attribute in the attribute set S aid ;

Attribute authority AA aid selects random number
According to the formula
Calculate the organization key SK aid and according to the formula
The organization public key PK aid is calculated, and then the organization public key PK aid is uploaded to the cloud.
The access control method of the access control system of the cloud storage service platform according to claim 5, The corresponding attribute authority receives the user private key acquisition request, and generates, according to the attribute list, the global public key, the user public key, and the organization key to generate a corresponding to the user. The user private key and the step of sending it to the corresponding user terminal includes the following steps:

Attribute authority AA aid selects random number
And select a random number for any attribute x∈S uid, aid
If the attribute x is a weight attribute, the attribute authority AA aid sets the weight corresponding to the attribute x w x ∈ [1, n];

The attribute authority AA aid is expressed according to the calculation user private key SK uid, aid , as:

Where K uid, aid , K' uid, aid , K x, uid , and K' x, uid are all the multiplicative groups
The upper element, r x is the integer group
Random number on;

The attribute authority AA aid sends the user private key SK uid, aid to the user terminal uid.
The access control system of the access control system of the cloud storage service platform according to claim 6, wherein when the user terminal is the data owner, the user terminal is based on the public key of the organization and the global public The key and the user private key, the encrypted upload of the user data or the decrypted download of the shared data includes the following steps:

Input plaintext M, global public key GPK, set of all attribute authority participating in encryption I AA , corresponding set of institutional public keys
And access control strategiesΓ;

The user terminal utilizes the global public key GPK, the set of all attribute authority participating in the encryption, I AA , and the corresponding set of institutional public keys.
And the access control policy, encrypting the ciphertext M, calculating the ciphertext CT, and then uploading the ciphertext CT to the cloud.
The access control system of the access control system of the cloud storage service platform according to claim 7, wherein the step of encrypting the ciphertext M and calculating the ciphertext CT is as follows:

Where Y is the set of leaf nodes of the access control policy, the attribute of the leaf node y∈Y is att(y), the weight of the weight attribute att(y) is w y , C is the calculation of the message, and I A is The attribute set of the attribute authority A, C' and C" are the calculations for the root node, C y and C' y are the calculations of the corresponding attribute values, and C y, j are the calculations of the attribute corresponding weights, q y (0) For the attribute value corresponding to the attribute y, w j is the weight value of the attribute.
The access control method of the access control system of the cloud storage service platform according to claim 6, wherein when the user terminal is a shared user, the user terminal is based on the institution public key and the global public key. And the user private key, the step of implementing encrypted upload of user data or decryption downloading of shared data includes the following steps:

The user terminal downloads the ciphertext CT from the cloud, and inputs the global public key GPK and the corresponding user key.
Accessing a control node Γ, and a node x in the access control policy 并, and defining n A =|I AA |, the n A representing the number of attributes included in the attribute authority AA;

The user terminal invokes a predefined recursive function DecryptNode(CT, SK, x) if the attribute set of the user terminal
After satisfying the access control policy, the decryption information A is calculated as:

Where q x (0) is the attribute value corresponding to the attribute x;

Obtained by the polynomial interpolation theorem
After calculation
And combined with the following formula to obtain

The user terminal calculates the plaintext M, which is expressed as: