WO2022223036A1 - 一种加密数据共享的方法、装置、设备及可读介质 - Google Patents

一种加密数据共享的方法、装置、设备及可读介质 Download PDF

Info

Publication number
WO2022223036A1
WO2022223036A1 PCT/CN2022/088569 CN2022088569W WO2022223036A1 WO 2022223036 A1 WO2022223036 A1 WO 2022223036A1 CN 2022088569 W CN2022088569 W CN 2022088569W WO 2022223036 A1 WO2022223036 A1 WO 2022223036A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
key
owner
proxy
user
Prior art date
Application number
PCT/CN2022/088569
Other languages
English (en)
French (fr)
Inventor
麻付强
Original Assignee
山东英信计算机技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 山东英信计算机技术有限公司 filed Critical 山东英信计算机技术有限公司
Priority to US18/265,329 priority Critical patent/US20240039709A1/en
Publication of WO2022223036A1 publication Critical patent/WO2022223036A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key
    • H04L9/0836—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key using tree structure or hierarchical structure
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the present application relates to the technical field of data sharing, and in particular, to a method, apparatus, device, and readable medium for encrypted data sharing.
  • cloud service providers may steal users' private data without users' permission.
  • cryptography as the core technology to ensure the security of the cloud computing platform, plays an increasingly important role in the cloud computing environment.
  • the key management system KMS related to cryptography is the basis for ensuring the security of the cloud computing platform, and provides services such as key security custody and cryptographic operations. Users can use the key management system to focus more on business functions such as data encryption and decryption, data transmission, and electronic signatures in the cloud computing environment, without spending a lot of money to ensure the security of their own keys.
  • the data storage in the cloud computing platform often uses the key of the key management system for encrypted storage.
  • the data stored by users in cloud computing is not only used by themselves, but sometimes needs to be shared with others. How to safely and efficiently share files with other users without revealing their private keys has become a research hotspot on cloud computing platforms.
  • the proxy server does not have the functions of key storage, update, and destruction.
  • the encrypted data sharing schemes based on proxy re-encryption in cloud computing systems are all located in the trusted third-party key generation center, which only has the function of generating keys, and does not have the safe storage, update, destruction, and execution of keys. and other functions, resulting in the risk of key leakage during use.
  • the key transmission between different services only adopts SSL transmission encryption, which cannot guarantee the security of the key transmission.
  • SSL transmission encryption Once the key leaves the key management system, it is in an insecure state, and the key is leaked during use, which not only causes the data protected by the key to be in an insecure state, but also may cause the key management system to be under attack.
  • Existing cloud computing platforms include identity authentication and access control services, computing services, storage services, network services, and key management system services.
  • the key management system only supports key generation, storage, update, destruction, simple encryption and decryption operations, etc., and does not have support for proxy re-encryption functions.
  • the embodiments of the present application provide, in a first aspect, a method for sharing encrypted data, including the following steps: receiving a data sharing request sent by a data owner, and generating a public key of the data owner according to the identity of the data owner in the shared data request and the private key of the data owner; generate the public key of the data user according to the identity of the data user in the shared data request, and generate the proxy re-encryption key based on the public key of the data user and the private key of the data owner; based on the public key of the data owner
  • the key encrypts the shared data, and uploads the encrypted data to the data processing center for storage; in response to receiving the data user's request to obtain the shared data, obtain the corresponding proxy re-encryption key and the corresponding encrypted data based on the request to obtain the shared data, Re-encrypt the encrypted data based on the proxy re-encryption key to obtain re-encrypted data; and obtain the data user's private key of the data user,
  • the method of encrypting data sharing further comprises performing the following steps at the key management system: encrypting or decrypting at least one user key based on the project key, the user key including the data owner key and/or the data user encryption or decryption of at least one proxy re-encryption key based on a shared project key; encryption or decryption of at least one proxy master key and corresponding at least one proxy public parameter based on a parameter key; and, encryption or decryption based on the system master key Decrypt all project keys, all shared project keys, and all parameter keys.
  • receiving a data sharing request sent by a data owner includes: receiving a login request from the data owner by the cloud computing system, and performing identity authentication on the data owner based on the login request; in response to the data owner's identity verification passing , assigning an authorization token to the data owner; and, receiving, by the key management system, a data sharing request from the data owner.
  • generating the data owner's public key and the data owner's private key according to the identity of the data owner in the shared data request includes: judging whether the data owner creates a corresponding project key, and responding to the data owner's failure to Create the corresponding project key, create the corresponding project key; determine whether the data owner creates the corresponding parameter key, and create the corresponding parameter key in response to the data owner not creating the corresponding parameter key; determine the data owner Whether to create the corresponding proxy master key and corresponding proxy public parameters, in response to the data owner not creating the corresponding proxy master key and corresponding proxy public parameters, create the corresponding proxy master key and corresponding proxy public parameters; based on data The identity of the owner creates the public key of the data owner, and generates the private key of the data owner based on the public key of the data owner, the corresponding agent master key and the corresponding public parameters of the agent; based on the project key, the data owner public key and The private key of the data owner is encrypted and stored in the key management system; the corresponding
  • generating the data user public key according to the identity of the data user in the shared data request, and generating the proxy re-encryption key based on the data user public key and the data owner private key includes: obtaining the data owner a corresponding proxy master key and a corresponding proxy public parameter; and generating a proxy re-encryption key based on the data user public key, the data owner private key, the corresponding proxy master key and the corresponding proxy public parameter.
  • obtaining a corresponding proxy re-encryption key and corresponding encrypted data based on the request for obtaining shared data includes: in response to receiving a request for obtaining shared data from a user, by: The data processing center obtains the corresponding encrypted data based on the request for obtaining the shared data, and obtains the corresponding proxy re-encryption key from the key management system; the key management system determines whether the user is a data user specified by the data owner of the shared data and, when the user is a data user specified by the data owner of the shared data, the corresponding proxy re-encryption key is sent to the data processing center.
  • any two of the client of the data owner, the client of the data user, the key management system and the data processing center perform bidirectional authentication through their respective security interfaces, and perform data transmission based on SGX technology .
  • the method for encrypted data sharing further includes: the data user updates the shared data, and uses the updated data as new shared data to share the data with a new data owner.
  • the embodiments of the present application provide an apparatus for sharing encrypted data, including: a first module configured to receive a data sharing request sent by a data owner, The identity identifier generates the public key of the data owner and the private key of the data owner; the second module is configured to generate the public key of the data user according to the identity of the data user in the shared data request, and based on the public key of the data user and the the data owner private key generates the proxy re-encryption key; the third module is configured to encrypt the shared data based on the data owner public key, and upload the encrypted data to the data processing center for storage; and the fourth module, is configured to obtain a corresponding proxy re-encryption key and corresponding encrypted data based on the request for obtaining shared data in response to receiving a request for obtaining shared data from a data user, and re-encrypt the encrypted data based on the proxy re-encryption key to obtain re-encrypting the data; and, a fifth module, configured to
  • the embodiments of the present application further provide a computer device, including: at least one processor; and a memory, where computer-readable instructions are stored in the memory, and when the computer-readable instructions are executed by the at least one processor, the at least one processor The processor performs the steps of the method for encrypting data sharing in any of the foregoing embodiments.
  • the embodiments of the present application provide one or more non-volatile computer-readable storage media storing computer-readable instructions.
  • the computer-readable instructions are executed by one or more processors, one or more Each processor executes the steps of the method for encrypting data sharing in any of the foregoing embodiments.
  • FIG. 1 is a schematic flowchart of a method for sharing encrypted data according to one or more embodiments
  • FIG. 2 is a system schematic diagram of a method for encrypted data sharing according to one or more embodiments
  • FIG. 3 is a schematic diagram of an apparatus for sharing encrypted data according to one or more embodiments
  • FIG. 4 is a schematic diagram of a computer device in accordance with one or more embodiments.
  • FIG. 5 is a schematic diagram of a computer-readable storage medium in accordance with one or more embodiments.
  • an embodiment of the present application provides a method for sharing encrypted data.
  • Figure 1 shows a schematic diagram of an embodiment of a method for encrypted data sharing.
  • the method for encrypting data sharing may include the following steps:
  • FIG. 2 shows a system schematic diagram of an embodiment of the method for sharing encrypted data provided by the present application.
  • the system involved in the embodiment of the method for encrypted data sharing may include a data owner client 100, a data user client 200, a key management system 300, a data processing center 400, a data storage center 500, an identity Authentication and access control system 600 .
  • Keys in the key management system include symmetric keys, asymmetric keys, short secrets, certificates and other secrets.
  • the key management system includes functions such as key generation, storage, update, destruction, and the realization of the user's proxy re-encryption key generation.
  • the key management system has a key generation function based on user identification (identity ID).
  • the key management system also includes a secure data transmission channel function based on SGX (Software Guard Extensions).
  • the key management system further includes an identity-based proxy re-encryption key generation module, a proxy re-encryption key temporary storage module, and a proxy re-encryption key destruction module.
  • the method of encrypting data sharing further comprises performing, at the key management system, the step of encrypting or decrypting at least one user key based on the project key, the user key including the data owner key and/or the data user key; encrypt or decrypt at least one proxy re-encryption key based on shared project key; encrypt or decrypt at least one proxy master key and corresponding at least one proxy public parameter based on parameter key; encrypt or decrypt all based on system master key Project Key, All Shared Project Key, and All Parameter Key.
  • the system master key encrypts project keys, shared project keys, and parameter keys.
  • the project key encrypts the user key, where the project key is only allowed access to users with access rights according to the access policy.
  • the shared project key encrypts the proxy re-encryption key, where the project key allows all users who access the key management system to access, so the proxy re-encryption key is the shared part of the key management system.
  • the parameter key encrypts the agent master key and the agent public key, and the parameter key is only allowed to be accessed by users with access rights according to the access policy. Since the user ID is bound in the authorization token, each user can only create his own private key.
  • multiple project keys, multiple shared keys, and multiple parameter keys can be encrypted.
  • Multiple user keys can be encrypted under each project key.
  • Multiple proxy re-encryption keys can be created per shared key project.
  • Multiple agent master keys can be encrypted under each parameter key, and multiple agents expose parameters.
  • each user can create multiple proxy master keys and multiple proxy public parameters according to different data, so as to ensure that the user has a public public key and multiple different user private keys, which can be different Data encryption to achieve secure isolation between different data.
  • the same proxy master key and proxy public parameters are used between the data owner and the data user to ensure the normal execution of proxy re-encryption.
  • the user keys of the data owner and the data user can be encrypted with the same project key under the same project, or encrypted with different project keys under different project keys.
  • receiving the data sharing request sent by the data owner includes: receiving, by the cloud computing system, the login request of the data owner, and performing identity authentication on the data owner based on the login request; in response to the data owner's identity verification being passed, An authorization token is allocated to the data owner; the data sharing request from the data owner is received by the key management system.
  • the data owner when logging in to the cloud computing system, the data owner first obtains an authorization token for accessing other services in the cloud computing system through identity authentication and authentication of the access control service.
  • a secure interface is used between the data owner's client and the key management system to achieve two-way security authentication, to ensure the credibility of both platforms, to determine the session key, and to establish a secure transmission channel.
  • the two-way authentication method using a secure interface between the two includes establishing a trusted transmission channel using a public key certificate known to both parties, or using Intel's software protection extension SGX technology to implement two-way security authentication and establish a secure session key.
  • the data owner uses the session key to send the access request to the key management system, and the key management system verifies the access rights in the authorization token of the data owner through the access control policy.
  • generating the data owner public key and the data owner private key according to the identity of the data owner in the shared data request includes: judging whether the data owner has created a corresponding project key, and if the data owner has not created Corresponding project key, create the corresponding project key; determine whether the data owner has created the corresponding parameter key, if the data owner has not created the corresponding parameter key, create the corresponding parameter key; determine whether the data owner has created the corresponding parameter key
  • the corresponding proxy master key and corresponding proxy public parameters if the data owner has not created the corresponding proxy master key and corresponding proxy public parameters, create the corresponding proxy master key and corresponding proxy public parameters;
  • the identity identifier creates the public key of the data owner, and generates the private key of the data owner based on the public key of the data owner, the corresponding agent master key and the corresponding public parameters of the agent; based on the project key, the public key of the data owner and the data owner are paired
  • the private key is encrypted and stored in the key management system; the corresponding proxy
  • the key management system extracts the data encryption key command from the data owner's access request. As shown in Figure 2, firstly confirm whether the project group to which the data owner belongs has created a project key. If the project key does not exist, the key management system creates the project key. If it exists, check whether the parameter key has been created. If it does not exist, create a parameter key. Then confirm whether to create the corresponding proxy master key and corresponding proxy public parameters. If not present, create the corresponding proxy master key and corresponding proxy public parameters. The key management system then creates the data owner's private key based on the data owner's identity ID and the proxy master key and proxy public parameters. The public key is the data owner ID. The public and private keys of the data owner are encrypted with the project key as a pair of keys and stored in the key management system. There is a corresponding relationship between the ID and private key of the data owner, the master key of the agent and the public parameters of the agent.
  • judging whether the data owner has created a corresponding project key, and if the data owner has not created a corresponding project key, creating a corresponding project key includes: judging whether the data owner has created a corresponding project key , and in response to the data owner not creating the corresponding item key, create the corresponding item key. Determine whether the data owner has created the corresponding parameter key, and if the data owner has not created the corresponding parameter key, create the corresponding parameter key, including: judging whether the data owner has created the corresponding parameter key, and responding to the data owner The corresponding parameter key is not created, and the corresponding parameter key is created. Determine whether the data owner has created the corresponding proxy master key and corresponding proxy public parameters.
  • create the corresponding proxy master key and corresponding proxy public parameters including: judging whether the data owner creates the corresponding proxy master key and the corresponding proxy public parameter, and in response to the data owner not creating the corresponding proxy master key and the corresponding proxy public parameter, creating the corresponding proxy master key and Corresponds to proxy public parameters.
  • generating the public key of the data user according to the identity of the data user in the shared data request, and generating the proxy re-encryption key based on the public key of the data user and the private key of the data owner includes: obtaining the data owner The corresponding proxy master key and the corresponding proxy public parameters; the proxy re-encryption key is generated based on the public key of the data user, the private key of the data owner, the corresponding proxy master key and the corresponding proxy public parameters.
  • the data owner needs to share the encrypted data, and the key management system extracts the set ID of the data user contained in the data owner's request.
  • the key management system creates a proxy re-encryption key based on the ID (public key) used by the data, the private key of the data owner, the proxy master key, and the proxy public parameters.
  • the ID set of the user is stored in the key management system as a part of the metadata of the key of the data owner.
  • encrypting the shared data based on the public key of the data owner and uploading the encrypted data to a data processing center for storage includes: encrypting the shared data based on the public key of the data owner, wherein the signature of the encrypted data is verified
  • Hash value and HMAC Hash-based Message Authentication Code, hash operation message authentication code
  • the key management system encrypts the key of the data owner by using the session key, and sends it to the security interface of the client of the data owner through the security interface.
  • the data owner receives the key sent by the key management system through the secure interface.
  • the data owner encrypts the data using the public key (identity ID) and public parameters in the key.
  • the data owner attaches the data owner information to the encrypted data.
  • the data owner calculates the hash value of the data and appends it to the encrypted data.
  • the data owner encrypts the hash value of the data by using the private key as the key of the message authentication code, and attaches it to the encrypted data as the HMAC value.
  • the storage data format is identity ID + encrypted data + Hash value + HMAC value.
  • the data owner uploads the stored data to the data processing center.
  • the data processing center sends the stored data to the storage center for data storage.
  • the data storage center returns a successful message to the data processing center for storage.
  • the data processing center
  • obtaining a corresponding proxy re-encryption key and corresponding encrypted data based on the request for obtaining shared data includes: in response to receiving a request for obtaining shared data from a user, by: The data processing center obtains the corresponding encrypted data based on the request for obtaining the shared data, and obtains the corresponding proxy re-encryption key from the key management system; the key management system determines whether the user is a data user specified by the data owner of the shared data ; If the user is a data user specified by the data owner of the shared data, send the corresponding proxy re-encryption key to the data processing center.
  • an authorization token for accessing other services in the cloud computing system is obtained.
  • the data user requests the shared encrypted data from the data processing center.
  • the data processing center verifies the authorization token of the data user to confirm that the data user has the right to access the data processing center.
  • the data processing center initiates an access request to the key management center to obtain the proxy re-encryption key.
  • a secure interface is used between the data processing center and the key management system to realize two-way security authentication, to ensure the credibility of both platforms, to determine the session key, and to establish a secure transmission channel.
  • the two-way authentication method using a secure interface between the two includes establishing a trusted transmission channel by using public key certificates known to each other by both parties, or using intel's (Intel) software protection extension SGX technology to achieve two-way security authentication, and establish a secure session key.
  • intel intel's
  • the key management system determines whether the user is a data user specified by the data owner of the shared data. If the user is a data user specified by the data owner of the shared data, the corresponding proxy re-encryption key Sending to the data processing center includes: determining whether the user is a data user specified by the data owner of the shared data by the key management system, and resetting the corresponding agent in response to the user being a data user specified by the data owner of the shared data. The encryption key is sent to the data processing center.
  • the data processing center uses the session key to send the access request to the key management system, and the key management system verifies the access rights in the authorization token of the data processing center through the access control policy, and confirms that the data processing center has the right to access the key management system .
  • the key management system reads the request to obtain the proxy re-encryption key command in the access request of the data processing center.
  • the key management system uses the system master key to decrypt the shared project key, and the shared project key checks whether there is a proxy re-encryption key shared by the data owner to the data user under the encrypted key. If it does not exist, an error is reported and a message that the data user does not have permission to use the shared data is returned to the data processing center.
  • proxy re-encryption key check whether the data consumer under the key management system has a key, which has the same proxy master key and proxy public parameters as the proxy re-encryption key. If the corresponding key does not exist, the corresponding private key of the data user is created according to the proxy master key and proxy public parameters corresponding to the proxy re-encryption key and the public key (identity ID) of the data user. And the public key and private key are stored as a pair of keys encrypted with the project key respectively. The re-encryption key is re-encrypted by the session key encryption agent and returned to the data processing center through a secure interface.
  • the data processing center obtains encrypted data from the data storage center.
  • the data storage center returns the encrypted data to the data processing center.
  • the data processing center re-encrypts the data according to the proxy re-encryption key and the encrypted data, and generates data encrypted by the public key of the data user.
  • the data processing center sends the re-encrypted data to the data consumer client.
  • the re-encrypted data includes the data user identity ID, the data owner identity ID, the encrypted data, and the Hash value (hash value) of the data.
  • a data consumer requests a key to decrypt the shared encrypted data from the key management system.
  • the data user accesses the key management system through the client, and a secure interface is used between the data user's client and the key management system to achieve two-way security authentication to ensure the credibility of both platforms, determine the session key, and establish a secure transmission channel .
  • the two-way authentication method using a secure interface between the two includes establishing a trusted transmission channel using a public key certificate known to both parties, or using Intel's software protection extension SGX technology to implement two-way security authentication and establish a secure session key.
  • the data user uses the session key to send the access request to the key management system, and the key management system verifies the access rights in the authorization token of the data user through the access control policy, and confirms that the user has the right to access the key management system.
  • the key management system reads the request to use the encryption key in the access request of the data user.
  • the system master key of the key management system decrypts the project key, and the project key decrypts the corresponding key of the data user.
  • the key management system encrypts the corresponding key of the data user through the session key, and returns it to the data user client through the secure interface.
  • the data consumer receives the key sent by the key management system through a secure interface.
  • the data consumer decrypts the encrypted data using the private key and public parameters in the key.
  • the data user obtains the plaintext of the data shared by the data owner.
  • any two of the data owner's client, the data user's client, the key management system and the data processing center perform mutual authentication through their respective security interfaces, and perform data transmission based on SGX technology .
  • the communication between the key management system, the data storage service, and the client is generally considered to be unreliable, and there is a threat in the transmission of the key between any two.
  • Intel has developed a software extension protection instruction set (SGX technology) integrated in the CPU.
  • SGX technology is used to protect the security of users' programs and data.
  • Software developers can use special instructions and software to put application code into a trusted computing environment enclave for execution in a hardware system that supports SGX.
  • An enclave can provide an isolated trusted execution environment to protect application data from snooping and tampering.
  • the method further includes: the data user updates the shared data, and uses the updated data as new shared data to share the data with a new data owner.
  • the data user can change the content of the data, recalculate the Hash value, use the private key of the data user to generate the HMAC value, and splicing it into stored data.
  • the encrypted data uploaded by the data user and the encrypted data of the original data owner are different data.
  • the set of sharer identity IDs created in the key management system may be changed into a policy matrix based on identity attributes.
  • the key management system creates a proxy re-encryption key and the corresponding public-private key pair for it, and saves it in the key management system.
  • identity-based keys can be created directly for use by both data users and data owners.
  • symmetric encryption is used for the shared data
  • asymmetric encryption is used for the symmetric key.
  • the HAMC encryption in this article is encrypted using the owner's private key. Therefore, operations such as data update and deletion in the data processing center need to verify that the original data is consistent with the HAMC value before the operation can be performed.
  • the HMAC key is only owned by the data owner, the data on the cloud can only be updated and deleted by the data owner.
  • the key management system is used as the key generation and storage center, the key is stored in the key management system, and the user does not need to save the private key, which ensures the security of the key. At the same time, there are identity authentication and access control components in the system to ensure the security of the system.
  • (3) SGX technology is used to establish a secure transmission interface at both ends of key transmission to ensure secure transmission of keys in an untrusted network environment.
  • the key management system is used as the key generation and storage center, the key is stored in the key management system, and the user does not need to save the private key, which ensures the security of the key.
  • the signature verification of encrypted data adopts the combination of Hash value and HMAC value to prevent data from being illegally tampered with.
  • FIG. 3 shows a schematic diagram of an apparatus for sharing encrypted data provided by the present application.
  • the device for encrypted data sharing includes the following modules: a first module S11, configured to receive a data sharing request sent by a data owner, and generate a data owner according to the identity of the data owner in the shared data request the public key of the data owner and the private key of the data owner; the second module S12 is configured to generate the public key of the data user according to the identity of the data user in the shared data request, and based on the public key of the data user and the private key of the data owner The key generation agent re-encryption key; the third module S13, configured to encrypt the shared data based on the public key of the data owner, and upload the encrypted data to the data processing center for storage; and the fourth module S14, configured To obtain a corresponding proxy re-encryption key and corresponding encrypted data based on the request for obtaining shared data in response
  • FIG. 4 shows a schematic diagram of an embodiment of a computer device provided by the present application.
  • the computer equipment includes the following means: at least one processor S21; and a memory S22, the memory S22 stores computer-readable instructions S23, and when the computer-readable instructions S23 are executed by the at least one processor S21, causes the at least one processing
  • the device S21 executes the steps of the method for encrypting data sharing in any one of the foregoing embodiments.
  • an embodiment of the present application further provides one or more non-volatile computer-readable storage media S31 storing computer-readable instructions S32, and the computer-readable instructions S32 are stored by one or more non-volatile computer-readable storage media S31.
  • one or more processors are caused to execute the steps of the method for encrypting data sharing in any one of the foregoing embodiments.
  • the method for encrypted data sharing disclosed according to the embodiments of the present application may also be implemented as computer-readable instructions executed by a processor, and the computer-readable instructions may be stored in a non-volatile computer-readable storage medium.
  • the achievable functions in the encrypted data sharing method disclosed in any embodiment of the present application are implemented.
  • the above-mentioned method steps and system units can also be implemented by a controller and a non-volatile computer-readable storage medium for storing computer-readable instructions for enabling the controller to implement the functions of the above-mentioned steps or units.
  • functions may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.
  • the computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or may be used to carry or store instructions in the form of or data structures and any other medium that can be accessed by a general purpose or special purpose computer or a general purpose or special purpose processor. Also, any connection is properly termed a computer-readable medium.
  • coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave are used to send software from a website, server, or other remote source
  • coaxial cable Cable, fiber optic cable, twisted pair, DSL or wireless technologies such as infrared, radio and microwave are all included in the definition of medium.
  • magnetic disks and optical disks include compact disks (CDs), laser disks, optical disks, digital versatile disks (DVDs), floppy disks, blu-ray disks, where disks usually reproduce data magnetically, while optical disks reproduce data optically with lasers . Combinations of the above should also be included within the scope of computer-readable media.
  • the storage medium can be a read-only memory, a magnetic disk or an optical disk, and the like.

Abstract

本申请公开了一种加密数据共享的方法、装置、设备及可读介质，加密数据共享的方法包括：接收数据拥有者发送的共享数据请求，生成数据拥有者公钥和数据拥有者私钥；生成数据使用者公钥，并基于数据使用者公钥和数据拥有者私钥生成代理重加密密钥；基于数据拥有者公钥对共享数据进行加密，并将加密数据上传到数据处理中心；基于共享数据请求获取对应的代理重加密密钥和对应的加密数据，基于代理重加密密钥对加密数据进行重加密以得到重加密数据；获取数据使用者的数据使用者私钥，并基于数据使用者私钥对重加密数据进行解密以得到共享数据。

Description

一种加密数据共享的方法、装置、设备及可读介质
相关申请的交叉引用
本申请要求于2021年4月23日提交中国专利局，申请号为CN202110442814.0，申请名称为“一种加密数据共享的方法、装置、设备及可读介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据共享技术领域，尤其涉及一种加密数据共享的方法、装置、设备及可读介质。
背景技术
随着云计算的发展，用户不再直接控制云平台的硬件资源，而是直接使用云计算环境中的服务，即用户的数据和程序运行在云计算环境中。用户失去了对云计算平台的直接控制，导致云平台中数据的管理权属于服务提供商所有。因此在云计算环境中，用户数据和程序的安全性越来越重要。
由于云服务提供商提供的数据存储和数据处理服务并不能完全值得信任，云服务提供商可能会在未经用户允许的情况下，擅自窃取用户的隐私数据。为了保障云计算环境中数据传输、数据存储、用户访问、业务操作等安全，密码技术作为保证云计算平台安全的核心技术在云计算环境中发挥越来越重要的作用。与密码技术相关的密钥管理系统KMS是保证云计算平台安全的基础，提供密钥的安全托管及密码运算等服务。用户可以通过密钥管理系统，更加专注于云计算环境中的数据加解密、数据传输、电子签名等业务功能，而无需花费大量成本保证自身密钥的安全性。
因此云计算平台中数据存储常常采用密钥管理系统的密钥进行加密存储。但是云计算中用户存储的数据不仅仅是自己使用，有时候需要分享给其他人使用。如何保证不泄露自己私钥的前提下，安全高效地将文件分享给其他用户，成为云计算平台的研究热点。
现有代理重加密系统中，代理服务器不具有密钥存储、更新、销毁等功能。现在云 计算系统中基于代理重加密的加密数据共享方案，都是居于可信第三方密钥生成中心，其自身只具有密钥的产生功能，不具有密钥的安全存储、更新、销毁、执行等功能，导致密钥在使用过程中存在泄露风险。
现有的云计算系统中，不同服务之间密钥传输仅仅采用SSL传输加密，无法保证密钥传输的安全性。密钥一旦离开密钥管理系统就处于不安全状态，密钥在使用过程中泄露，不仅导致密钥所保护的数据处于不安全状态，同时还可能导致密钥管理系统处于被攻击的状态。
现有云计算平台包括身份认证与访问控制服务、计算服务、存储服务、网络服务、密钥管理系统服务等。目前密钥管理系统仅支持密钥的生成、存储、更新、销毁、简单加解密运算等，不具有对代理重加密功能的支持。
发明内容
本申请实施例在第一方面提供了一种加密数据共享的方法，包括以下步骤：接收数据拥有者发送的共享数据请求，并根据共享数据请求中数据拥有者的身份标识生成数据拥有者公钥和数据拥有者私钥；根据共享数据请求中数据使用者的身份标识生成数据使用者公钥，并基于数据使用者公钥和数据拥有者私钥生成代理重加密密钥；基于数据拥有者公钥对共享数据进行加密，并将加密数据上传到数据处理中心进行存储；响应于接收到数据使用者获取共享数据请求，基于获取共享数据请求获取对应的代理重加密密钥和对应的加密数据，基于代理重加密密钥对加密数据进行重加密以得到重加密数据；以及，获取数据使用者的数据使用者私钥，并基于数据使用者私钥对重加密数据进行解密以得到共享数据。
在一些实施方式中，加密数据共享的方法还包括在密钥管理系统执行以下步骤：基于项目密钥加密或解密至少一个用户密钥，用户密钥包括数据拥有者密钥和/或数据使用者密钥；基于共享项目密钥加密或解密至少一个代理重加密密钥；基于参数密钥加密或解密至少一个代理主密钥和对应的至少一个代理公开参数；以及，基于系统主密钥加密或解密全部项目密钥、全部共享项目密钥和全部参数密钥。
在一些实施方式中，接收数据拥有者发送的共享数据请求，包括：由云计算系统接收数据拥有者的登录请求，并基于登录请求对数据拥有者进行身份认证；响应于数据拥有者身份验证通过，向数据拥有者分配授权令牌；以及，由密钥管理系统接收数据拥有者的数据共享请求。
在一些实施方式中，根据共享数据请求中数据拥有者的身份标识生成数据拥有者公钥和数据拥有者私钥，包括：判断数据拥有者是否创建对应的项目密钥，响应于数据拥有者未创建对应的项目密钥，创建对应的项目密钥；判断数据拥有者是否创建对应的参数密钥，响应于数据拥有者未创建对应的参数密钥，创建对应的参数密钥；判断数据拥有者是否创建对应的代理主密钥和对应的代理公开参数，响应于数据拥有者未创建对应的代理主密钥和对应的代理公开参数，创建对应的代理主密钥和对应代理公开参数；基于数据拥有者的身份标识创建数据拥有者公钥，并基于数据拥有者公钥、对应的代理主密钥和对应的代理公开参数生成数据拥有者私钥；基于项目密钥对数据拥有者公钥和数据拥有者私钥进行加密，并存储在密钥管理系统中；基于参数密钥对对应的代理主密钥和对应的代理公开参数进行加密，并存储在密钥管理系统中；以及，由密钥管理系统存储系统主密钥，并基于系统主密钥对项目密钥、共享项目密钥和参数密钥进行加密，并存储在密钥管理系统中。
在一些实施方式中，根据共享数据请求中数据使用者的身份标识生成数据使用者公钥，并基于数据使用者公钥和数据拥有者私钥生成代理重加密密钥，包括：获取数据拥有者对应的代理主密钥和对应的代理公开参数；以及，基于数据使用者公钥、数据拥有者私钥、对应的代理主密钥和对应的代理公开参数生成代理重加密密钥。
在一些实施方式中，响应于接收到数据使用者获取共享数据请求，基于获取共享数据请求获取对应的代理重加密密钥和对应的加密数据，包括：响应于接收到用户获取共享数据请求，由数据处理中心基于获取共享数据请求，获取对应的加密数据，并从密钥管理系统获取对应的代理重加密密钥；由密钥管理系统判断用户是否为共享数据的数据拥有者规定的数据使用者；以及，在用户为共享数据的数据拥有者规定的数据使用者时，将对应的代理重加密密钥发送给数据处理中心。
在一些实施方式中，数据拥有者的客户端、数据使用者的客户端、密钥管理系统和数据处理中心中任意两者之间通过各自的安全接口进行双向认证，并基于SGX技术进行数据传输。
在一些实施方式中，加密数据共享的方法还包括：数据使用者对共享数据进行更新，并将更新后的数据作为新的共享数据以新的数据拥有者进行数据共享。
本申请实施例在第二方面，提供了一种加密数据共享的装置，包括：第一模块，被配置为用于接收数据拥有者发送的共享数据请求，并根据共享数据请求中数据拥有者的身份标识生成数据拥有者公钥和数据拥有者私钥；第二模块，被配置为用于根据共享数据请求中数据使用者的身份标识生成数据使用者公钥，并基于数据使用者公钥和数据拥 有者私钥生成代理重加密密钥；第三模块，被配置为用于基于数据拥有者公钥对共享数据进行加密，并将加密数据上传到数据处理中心进行存储；以及第四模块，被配置为用于响应于接收到数据使用者获取共享数据请求，基于获取共享数据请求获取对应的代理重加密密钥和对应的加密数据，基于代理重加密密钥对加密数据进行重加密以得到重加密数据；以及，第五模块，被配置为用于获取数据使用者的数据使用者私钥，并基于数据使用者私钥对重加密数据进行解密以得到共享数据。
本申请实施例在第三方面，还提供了一种计算机设备，包括：至少一个处理器；以及存储器，存储器存储有计算机可读指令，计算机可读指令被至少一个处理器执行时，使得至少一个处理器执行前述任意一个实施例中加密数据共享的方法的步骤。
本申请实施例在第四方面，提供了一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行前述任意一个实施例中加密数据共享的方法的步骤。
附图说明
为了更清楚地说明本申请实施例或有关的技术方案，下面将对实施例或有关的技术方案的描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的实施例。
图1为根据一个或多个实施例中的加密数据共享的方法的流程示意图；
图2为根据一个或多个实施例中的加密数据共享的方法的系统示意图；
图3为根据一个或多个实施例中的加密数据共享的装置的示意图；
图4为根据一个或多个实施例中的计算机设备的示意图；
图5为根据一个或多个实施例中的计算机可读存储介质的示意图。
具体实施方式
为使本申请的技术方案和优点更加清楚明白，以下结合具体实施例，并参照附图，对本申请实施例进一步详细说明。
需要说明的是，本申请实施例中所有使用“第一”和“第二”的表述均是为了区分两个相同名称非相同的实体或者非相同的参量，可见“第一”“第二”仅为了表述的方便，不应理解为对本申请实施例的限定，后续实施例对此不再一一说明。
在第一方面，本申请实施例提供了一种加密数据共享的方法。图1示出的是加密数据共享的方法的实施例的示意图。如图1所示，加密数据共享的方法可以包括如下步骤：
S01、接收数据拥有者发送的共享数据请求，并根据共享数据请求中数据拥有者的身份标识生成数据拥有者公钥和数据拥有者私钥；
S02、根据共享数据请求中数据使用者的身份标识生成数据使用者公钥，并基于数据使用者公钥和数据拥有者私钥生成代理重加密密钥；
S03、基于数据拥有者公钥对共享数据进行加密，并将加密数据上传到数据处理中心进行存储；
S04、响应于接收到数据使用者获取共享数据请求，基于获取共享数据请求获取对应的代理重加密密钥和对应的加密数据，基于代理重加密密钥对加密数据进行重加密以得到重加密数据；
S05、获取数据使用者的数据使用者私钥，并基于数据使用者私钥对重加密数据进行解密以得到共享数据。
图2示出的是本申请提供的加密数据共享的方法的实施例的系统示意图。如图2所示，加密数据共享的方法的实施例涉及的系统可以包括数据拥有者客户端100、数据使用者客户端200、密钥管理系统300、数据处理中心400、数据存储中心500、身份认证与访问控制系统600。密钥管理系统中密钥包括对称密钥、非对称密钥、短秘密、证书等秘密。密钥管理系统包括密钥的生成、存储、更新、销毁以及实现用户的代理重加密密钥产生等功能。密钥管理系统具有根据用户身份标识(身份ID)的密钥生成功能。密钥管理系统还包括基于SGX(Software Guard Extensions，软件防护扩展)的安全数据传输通道功能。密钥管理系统还包括基于身份的代理重加密密钥生成模块，代理重加密密钥的临时存储模块，代理重加密密钥销毁模块。
在一些实施例中，加密数据共享的方法还包括在密钥管理系统执行以下步骤：基于项目密钥加密或解密至少一个用户密钥，用户密钥包括数据拥有者密钥和/或数据使用者密钥；基于共享项目密钥加密或解密至少一个代理重加密密钥；基于参数密钥加密或解密至少一个代理主密钥和对应的至少一个代理公开参数；基于系统主密钥加密或解密全部项目密钥、全部共享项目密钥和全部参数密钥。
在本实施例中，根据密钥管理系统的分级管理规则，系统主密钥加密项目密钥、共享项目密钥、参数密钥。项目密钥加密用户密钥，其中项目密钥根据访问策略只允许有访问权限的用户访问。共享项目密钥加密代理重加密密钥，其中项目密钥允许有访问密 钥管理系统的所有用户访问，所以代理重加密密钥为密钥管理系统中共享部分。参数密钥加密代理主密钥和代理公开密钥，参数密钥根据访问策略只允许有访问权限的用户访问。其中由于用户ID在授权令牌中绑定，因此每个用户只能创建属于自己的私钥。密钥管理系统中根据策略不同，可以加密多个项目密钥，多个共享密钥，多个参数密钥。每个项目密钥下可以加密多个用户密钥。每个共享密钥项目可以创建多个代理重加密密钥。每个参数密钥下可以加密多个代理主密钥，多个代理公开参数。为了保证数据的安全性，每个用户可以根据数据的不同创建多个代理主密钥和多个代理公开参数，这样保证用户拥有一个公开的公钥，多个不同的用户私钥，可以为不同数据加密，实现不同数据间的安全隔离。同时针对同一个加密数据，数据拥有者和数据使用者之间使用相同的代理主密钥和代理公开参数，保证代理重加密的正常执行。数据拥有者和数据使用者的用户密钥可以在同一个项目下，用同一个项目密钥加密；也可以在不同的项目密钥下面，用不同的项目密钥加密。
在一些实施例中，接收数据拥有者发送的共享数据请求包括：由云计算系统接收数据拥有者的登录请求，并基于登录请求对数据拥有者进行身份认证；响应于数据拥有者身份验证通过，向数据拥有者分配授权令牌；由密钥管理系统接收数据拥有者的数据共享请求。
在本实施例中，数据拥有者在登录云计算系统时，首先通过身份认证与访问控制服务的身份验证，获得访问云计算系统中其他服务的授权令牌。数据拥有者访问密钥管理系统，数据拥有者的客户端和密钥管理系统之间利用安全接口实现双向安全认证，确保双方平台的可信性，确定会话密钥，建立安全传输通道。两者之间利用安全接口实现双向认证方法包括，利用双方互相已知的公钥证书建立可信的传输通道，或者intel的软件防护扩展SGX技术实现双向安全认证，并建立安全的会话密钥。数据拥有者利用会话密钥将访问请求发送到密钥管理系统，密钥管理系统通过访问控制策略验证数据拥有者的授权令牌中的访问权限。
在一些实施例中，根据共享数据请求中数据拥有者的身份标识生成数据拥有者公钥和数据拥有者私钥，包括：判断数据拥有者是否创建对应的项目密钥，若是数据拥有者未创建对应的项目密钥，创建对应的项目密钥；判断数据拥有者是否创建对应的参数密钥，若是数据拥有者未创建对应的参数密钥，创建对应的参数密钥；判断数据拥有者是否创建对应的代理主密钥和对应的代理公开参数，若是数据拥有者未创建对应的代理主密钥和对应的代理公开参数，创建对应的代理主密钥和对应代理公开参数；基于数据拥有者的身份标识创建数据拥有者公钥，并基于数据拥有者公钥、对应的代理主密钥和对 应的代理公开参数生成数据拥有者私钥；基于项目密钥对数据拥有者公钥和数据拥有者私钥进行加密，并存储在密钥管理系统中；基于参数密钥对对应的代理主密钥和对应的代理公开参数进行加密，并存储在密钥管理系统中，由密钥管理系统存储系统主密钥，并基于系统主密钥对项目密钥、共享项目密钥和参数密钥进行加密，并存储在密钥管理系统中心。
在本实施例中，密钥管理系统提取数据拥有者的访问请求中创建数据加密密钥命令。如图2所示，首先确认数据拥有者所在项目组是否已经创建项目密钥。如果项目密钥不存在，则密钥管理系统创建项目密钥。若存在，在确认是否已经创建参数密钥。如不存在，则创建参数密钥。然后确认是否创建相应的代理主密钥和对应的代理公开参数。如果不存在，创建相应的代理主密钥和对应的代理公开参数。然后密钥管理系统根据数据拥有者的身份ID和代理主密钥和代理公开参数创建数据拥有者的私钥。其中公钥为数据拥有者ID。将数据拥有者的公钥和私钥作为一对密钥利用项目密钥加密，存储在密钥管理系统中。数据拥有者的ID和私钥和代理主密钥和代理公开参数存在对应关系。
在一些实施例中，判断数据拥有者是否创建对应的项目密钥，若是数据拥有者未创建对应的项目密钥，创建对应的项目密钥，包括：判断数据拥有者是否创建对应的项目密钥，响应于数据拥有者未创建对应的项目密钥，创建对应的项目密钥。判断数据拥有者是否创建对应的参数密钥，若是数据拥有者未创建对应的参数密钥，创建对应的参数密钥，包括：判断数据拥有者是否创建对应的参数密钥，响应于数据拥有者未创建对应的参数密钥，创建对应的参数密钥。判断数据拥有者是否创建对应的代理主密钥和对应的代理公开参数，若是数据拥有者未创建对应的代理主密钥和对应的代理公开参数，创建对应的代理主密钥和对应代理公开参数，包括：判断数据拥有者是否创建对应的代理主密钥和对应的代理公开参数，响应于数据拥有者未创建对应的代理主密钥和对应的代理公开参数，创建对应的代理主密钥和对应代理公开参数。
在一些实施例中，根据共享数据请求中数据使用者的身份标识生成数据使用者公钥，并基于数据使用者公钥和数据拥有者私钥生成代理重加密密钥，包括：获取数据拥有者对应的代理主密钥和对应的代理公开参数；基于数据使用者公钥、数据拥有者私钥、对应的代理主密钥和对应的代理公开参数生成代理重加密密钥。
在本实施例中，数据拥有者需要将加密数据进行分享，密钥管理系统提取数据拥有者请求中包含的数据使用者的集合ID。密钥管理系统根据数据使用的ID(公钥)、数据拥有者的私钥、代理主密钥、代理公开参数创建代理重加密密钥。此时，数据拥有者的密钥和数据使用者的集合ID存在对应关系，使用者的ID集合作为数据拥有者的密钥的 元数据的一部分存储在密钥管理系统中。
在一些实施例中，基于数据拥有者公钥对共享数据进行加密，并将加密数据上传到数据处理中心进行存储，包括：基于数据拥有者公钥对共享数据进行加密，其中加密数据的签名验证采用Hash值和HMAC(Hash-based Message Authentication Code，哈希运算消息认证码)值相结合的方式，防止数据被非法篡改。
在本实施例中，密钥管理系统利用会话密钥加密数据拥有者的密钥，通过安全接口发送到数据拥有者客户端的安全接口上。数据拥有者通过安全接口接收密钥管理系统发送来的密钥。数据拥有者使用公钥(身份ID)和密钥中的公开参数对数据进行加密。数据拥有者将数据所有者信息附加到加密数据上。数据拥有者计算数据的Hash值附加到加密数据上。数据拥有者利用私钥作为消息认证码的密钥加密数据的Hash值，作为HMAC值附加到加密数据上。存储数据格式为身份ID+加密数据+Hash值+HMAC值。数据拥有者将存储数据上传到数据处理中心。数据处理中心将存储数据发送到存储中心进行数据存储。数据存储中心返回给数据处理中心存储成功消息。数据处理中心返回给客户端存储成功消息。
在一些实施例中，响应于接收到数据使用者获取共享数据请求，基于获取共享数据请求获取对应的代理重加密密钥和对应的加密数据，包括：响应于接收到用户获取共享数据请求，由数据处理中心基于获取共享数据请求，获取对应的加密数据，并从密钥管理系统获取对应的代理重加密密钥；由密钥管理系统判断用户是否为共享数据的数据拥有者规定的数据使用者；若是用户为共享数据的数据拥有者规定的数据使用者，将对应的代理重加密密钥发送给数据处理中心。
在本实施例中，数据使用者在登录云计算系统时，首先通过身份认证与访问控制服务的身份验证，获得访问云计算系统中其他服务的授权令牌。数据使用者向数据处理中心请求共享加密数据。数据处理中心验证数据使用者的授权令牌，确认数据使用者具有访问数据处理中心的权限。数据处理中心向密钥管理中心发起获取代理重加密密钥的访问请求。数据处理中心和密钥管理系统之间利用安全接口实现双向安全认证，确保双方平台的可信性，确定会话密钥，建立安全传输通道。两者之间利用安全接口实现双向认证方法包括，利用双方互相已知的公钥证书建立可信的传输通道，或者利用intel(英特尔)的软件防护扩展SGX技术实现双向安全认证，并建立安全的会话密钥。
在一些实施例中，由密钥管理系统判断用户是否为共享数据的数据拥有者规定的数据使用者，若是用户为共享数据的数据拥有者规定的数据使用者，将对应的代理重加密密钥发送给数据处理中心，包括：由密钥管理系统判断用户是否为共享数据的数据拥有 者规定的数据使用者，响应于用户为共享数据的数据拥有者规定的数据使用者，将对应的代理重加密密钥发送给数据处理中心。
数据处理中心利用会话密钥将访问请求发送到密钥管理系统，密钥管理系统通过访问控制策略验证数据处理中心的授权令牌中的访问权限，确认数据处理中心具有访问密钥管理系统的权限。密钥管理系统读取数据处理中心的访问请求中请求获取代理重加密密钥命令。密钥管理系统利用系统主密钥解密共享项目密钥，共享项目密钥查看其加密的密钥下面是否有数据拥有者分享给数据使用者的代理重加密密钥。如果不存在，报错并返回数据使用者没有权限使用共享数据的消息给数据处理中心。如果存在代理重加密密钥，则查看密钥管理系统下数据使用者是否具有密钥，此密钥与代理重加密密钥具有相同代理主密钥和代理公开参数。如果不存在相应的密钥，则根据代理重加密密钥对应的代理主密钥和代理公开参数以及数据使用者的公钥(身份ID)创建数据使用者对应的私钥。并将公钥和私钥作为一对密钥分别用项目密钥加密进行存储。通过会话密钥加密代理重加密密钥，通过安全接口返回给数据处理中心。
数据处理中心从数据存储中心获取加密数据。数据存储中心将加密数据返回给数据处理中心。数据处理中心根据代理重加密密钥和加密数据重新加密数据，生成数据使用者公钥加密的数据。数据处理中心将重加密数据发送给数据使用者客户端。重加密数据包括数据使用者身份ID、数据拥有者身份ID、加密数据、数据的Hash值(哈希值)。
数据使用者向密钥管理系统请求解密共享加密数据的密钥。数据使用者通过客户端访问密钥管理系统，数据使用者的客户端和密钥管理系统之间利用安全接口实现双向安全认证，确保双方平台的可信性，确定会话密钥，建立安全传输通道。两者之间利用安全接口实现双向认证方法包括，利用双方互相已知的公钥证书建立可信的传输通道，或者intel的软件防护扩展SGX技术实现双向安全认证，并建立安全的会话密钥。数据使用者利用会话密钥将访问请求发送到密钥管理系统，密钥管理系统通过访问控制策略验证数据使用者的授权令牌中的访问权限，确认用户具有访问密钥管理系统的权限。密钥管理系统读取数据使用者的访问请求中请求使用加密密钥命令。密钥管理系统的系统主密钥解密项目密钥，项目密钥解密数据使用者相应的密钥。密钥管理系统通过会话密钥加密数据使用者相应的密钥，通过安全接口返回给数据使用者客户端。
在一些实施例中，数据使用者通过安全接口接收密钥管理系统发送来的密钥。数据使用者使用密钥中的私钥和公开参数对加密数据进行解密。数据使用者获得数据拥有者分享数据的明文。
在一些实施例中，数据拥有者的客户端、数据使用者的客户端、密钥管理系统和数 据处理中心中任意两者之间通过各自的安全接口进行双向认证，并基于SGX技术进行数据传输。
在本实施例中，在密钥管理系统、数据存储服务、客户端之间的通信一般认为是不可靠的，密钥在任意两者之间传输存在威胁。为此英特尔公司开发了一项集成于CPU的软件扩展防护指令集(SGX技术)。SGX技术用来保护用户的程序和数据的安全。软件开发者可以在支持SGX的硬件系统中，使用特殊指令和软件将应用程序代码放入一个可信计算环境enclave中执行。enclave可以提供一个隔离的可信执行环境保护应用程序的数据不被窥探和篡改。
在本申请的一些实施例中，还包括：数据使用者对共享数据进行更新，并将更新后的数据作为新的共享数据以新的数据拥有者进行数据共享。
在本实施例中，数据使用者可以更改数据的内容，重新计算Hash值，使用数据使用者的私钥生成HMAC值，拼接成存储数据。将存储数据上传到数据处理中心，数据处理中心存储到数据存储中心。此时，数据使用者上传的加密数据和原始数据拥有者的加密数据为不同数据。
在一些实施例中，为了扩大保护范围和实用范围可以将根据密钥管理系统中创建分享者身份ID集合也可以改成基于身份属性的策略矩阵。将策略矩阵作为代理重加密的访问权限，同时将策略矩阵作为代理重加密密钥的元数据的组成部分。只要数据使用者通过基于身份数据的策略矩阵，那么密钥管理系统就为其创建代理重加密密钥和相应的公私钥对，保存在密钥管理系统中。
在一些实施例中，为了方便整个系统的使用，有时候数据使用者和数据拥有者属于同一个项目组，具有相同的访问权限。因此在密钥管理系统中，可以直接创建基于身份的密钥，供数据使用者和数据拥有者共同使用。
在一些实施例中，对于分享的数据过大的情况，将分享数据采用对称加密，将对称密钥采用非对称加密。对对称密钥进行代理重加密操作。本文中的HAMC加密采用的是使用拥有者的私钥进行加密的。因此在数据处理中心进行数据更新、删除等操作需要验证原始数据与HAMC值一致才能进行操作。但是由于HMAC的密钥只有数据拥有者拥有，因此云上的数据也只有数据拥有者才能进行更新、删除操作。
前述的一个或多个实施例，具有以下一项或更多的优点：
(1)通过代理重加密技术实现对加密数据的共享问题，用户密钥、代理重加密密钥都存储在密钥管理系统中，密钥在不同服务之间采用SGX技术进行数据传输，能够极大提高云计算环境中用户数据的安全保护能力。
(2)采用密钥管理系统作为密钥的产生与存储中心，将密钥存储在密钥管理系统中，用户自己不需要保存私钥，保证了密钥的安全性。同时系统中有身份认证与访问控制组件，保证系统的安全性。
(3)在密钥传输两端采用SGX技术建立安全传输接口，保证密钥在不可信网络环境中实现安全传输。
(4)采用密钥管理系统作为密钥的产生与存储中心，将密钥存储在密钥管理系统中，用户自己不需要保存私钥，保证了密钥的安全性。同时系统中存在身份认证与访问控制组件，保证系统的安全性。
(5)将代理重加密的密钥功能集成到密钥管理系统中，丰富其使用范围。
对加密数据的签名验证采用Hash值和HMAC值相结合的方式，防止数据被非法篡改。
(6)重新构造密钥管理系统的存储方式，添加了共享项目密钥和参数密钥，使得密钥管理系统更加灵活方便。
(7)采用基于身份ID的密钥构造方法，不需要采用公钥证书，不需要单独生成用户公钥。
需要特别指出的是，上述加密数据共享的方法的各个实施例中的各个步骤均可以相互交叉、替换、增加、删减，因此，这些合理的排列组合变换之于加密数据共享的方法也应当属于本申请的保护范围，并且不应将本申请的保护范围局限在实施例之上。
在第二方面，本申请实施例提供了一种加密数据共享的装置。图3示出的是本申请提供的加密数据共享的装置的示意图。如图3所示，加密数据共享的装置包括如下模块：第一模块S11，被配置为用于接收数据拥有者发送的共享数据请求，并根据共享数据请求中数据拥有者的身份标识生成数据拥有者公钥和数据拥有者私钥；第二模块S12，被配置为用于根据共享数据请求中数据使用者的身份标识生成数据使用者公钥，并基于数据使用者公钥和数据拥有者私钥生成代理重加密密钥；第三模块S13，被配置为用于基于数据拥有者公钥对共享数据进行加密，并将加密数据上传到数据处理中心进行存储；以及第四模块S14，被配置为用于响应于接收到数据使用者获取共享数据请求，基于获取共享数据请求获取对应的代理重加密密钥和对应的加密数据，基于代理重加密密钥对加密数据进行重加密以得到重加密数据；第五模块S15，被配置为用于获取数据使用者的数据使用者私钥，并基于数据使用者私钥对重加密数据进行解密以得到共享数据。
在第三方面，本申请实施例提供了一种计算机设备。图4示出的是本申请提供的计算机设备的实施例的示意图。如图4所示，计算机设备包括如下装置：至少一个处理器 S21；以及存储器S22，存储器S22存储有计算机可读指令S23，计算机可读指令S23被至少一个处理器S21执行时，使得至少一个处理器S21执行前述任意一个实施例中加密数据共享的方法的步骤。
在第四方面，如图5所示，本申请实施例还提供了一个或多个存储有计算机可读指令S32的非易失性计算机可读存储介质S31，计算机可读指令S32被一个或多个处理器执行时，使得一个或多个处理器执行前述任意一个实施例中加密数据共享的方法的步骤。
需要说明的是，本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，可以通过计算机可读指令来指令相关硬件来完成，加密数据共享的方法的计算可读指令可存储于一计算机可读存储介质中，该计算机可读指令在被执行时，可实现前述任意一个实施例中加密数据共享的方法的步骤。其中，计算机可读指令的存储介质可为磁碟、光盘、只读存储记忆体(ROM)或随机存储记忆体(RAM)等。上述计算机可读指令的实施例，可以达到与之对应的前述任意方法实施例相同或者相类似的效果。
此外，根据本申请实施例公开的加密数据共享的方法还可以被实现为由处理器执行的计算机可读指令，该计算机可读指令可以存储在非易失性计算机可读存储介质中。在该计算机可读指令被处理器执行时，实现本申请任一实施例公开的加密数据共享的方法中可实现的功能。
此外，上述方法步骤以及系统单元也可以利用控制器以及用于存储使得控制器实现上述步骤或单元功能的计算机可读指令的非易失性计算机可读存储介质实现。
本领域技术人员还将明白的是，结合这里的公开所描述的各种示例性逻辑块、模块、电路和算法步骤可以被实现为电子硬件、计算机软件或两者的组合。为了清楚地说明硬件和软件的这种可互换性，已经就各种示意性组件、方块、模块、电路和步骤的功能对其进行了一般性的描述。这种功能是被实现为软件还是被实现为硬件取决于具体应用以及施加给整个系统的设计约束。本领域技术人员可以针对每种具体应用以各种方式来实现的功能，但是这种实现决定不应被解释为导致脱离本申请实施例公开的范围。
在一个或多个示例性设计中，功能可以在硬件、软件、固件或其任意组合中实现。如果在软件中实现，则可以将功能作为一个或多个指令或代码存储在计算机可读介质上或通过计算机可读介质来传送。计算机可读介质包括计算机存储介质和通信介质，该通信介质包括有助于将计算机程序从一个位置传送到另一个位置的任何介质。存储介质可以是能够被通用或专用计算机访问的任何可用介质。作为例子而非限制性的，该计算机可读介质可以包括RAM、ROM、EEPROM、CD-ROM或其它光盘存储设备、磁盘存储设备或其它磁性存储设备，或者是可以用于携带或存储形式为指令或数据结构的所需程 序代码并且能够被通用或专用计算机或者通用或专用处理器访问的任何其它介质。此外，任何连接都可以适当地称为计算机可读介质。例如，如果使用同轴线缆、光纤线缆、双绞线、数字用户线路(DSL)或诸如红外线、无线电和微波的无线技术来从网站、服务器或其它远程源发送软件，则上述同轴线缆、光纤线缆、双绞线、DSL或诸如红外线、无线电和微波的无线技术均包括在介质的定义。如这里所使用的，磁盘和光盘包括压缩盘(CD)、激光盘、光盘、数字多功能盘(DVD)、软盘、蓝光盘，其中磁盘通常磁性地再现数据，而光盘利用激光光学地再现数据。上述内容的组合也应当包括在计算机可读介质的范围内。
以上是本申请公开的示例性实施例，但是应当注意，在不背离权利要求限定的本申请实施例公开的范围的前提下，可以进行多种改变和修改。根据这里描述的公开实施例的方法权利要求的功能、步骤和/或动作不需以任何特定顺序执行。此外，尽管本申请实施例公开的元素可以以个体形式描述或要求，但除非明确限制为单数，也可以理解为多个。
应当理解的是，在本文中使用的，除非上下文清楚地支持例外情况，单数形式“一个”旨在也包括复数形式。还应当理解的是，在本文中使用的“和/或”是指包括一个或者一个以上相关联地列出的项目的任意和所有可能组合。
上述本申请实施例公开实施例序号仅仅为了描述，不代表实施例的优劣。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
所属领域的普通技术人员应当理解：以上任何实施例的讨论仅为示例性的，并非旨在暗示本申请实施例公开的范围(包括权利要求)被限于这些例子；在本申请实施例的思路下，以上实施例或者不同实施例中的技术特征之间也可以进行组合，并存在如上的本申请实施例的不同方面的许多其它变化，为了简明它们没有在细节中提供。因此，凡在本申请实施例的精神和原则之内，所做的任何省略、修改、等同替换、改进等，均应包含在本申请实施例的保护范围之内。

Claims (11)

  1. 一种加密数据共享的方法，其特征在于，包括以下步骤：
    接收数据拥有者发送的共享数据请求，并根据所述共享数据请求中所述数据拥有者的身份标识生成数据拥有者公钥和数据拥有者私钥；
    根据所述共享数据请求中数据使用者的身份标识生成数据使用者公钥，并基于所述数据使用者公钥和所述数据拥有者私钥生成代理重加密密钥；
    基于所述数据拥有者公钥对共享数据进行加密，并将加密数据上传到数据处理中心进行存储；
    响应于接收到数据使用者获取共享数据请求，基于所述获取共享数据请求获取对应的代理重加密密钥和对应的加密数据，并基于所述代理重加密密钥对所述加密数据进行重加密以得到重加密数据；以及
    获取所述数据使用者的数据使用者私钥，并基于所述数据使用者私钥对所述重加密数据进行解密以得到共享数据。
  2. 根据权利要求1所述的加密数据共享的方法，其特征在于，还包括在密钥管理系统执行以下步骤：
    基于项目密钥加密或解密至少一个用户密钥，所述用户密钥包括数据拥有者密钥和/或数据使用者密钥；
    基于共享项目密钥加密或解密至少一个代理重加密密钥；
    基于参数密钥加密或解密至少一个代理主密钥和对应的至少一个代理公开参数；以及
    基于系统主密钥加密或解密全部所述项目密钥、全部所述共享项目密钥和全部所述参数密钥。
  3. 根据权利要求1或2所述的加密数据共享的方法，其特征在于，所述接收数据拥有者发送的共享数据请求，包括：
    由云计算系统接收数据拥有者的登录请求，并基于所述登录请求对所述数据拥有者进行身份认证；
    响应于所述数据拥有者身份验证通过，向所述数据拥有者分配授权令牌；以及
    由所述密钥管理系统接收所述数据拥有者的数据共享请求。
  4. 根据权利要求2所述的加密数据共享的方法，其特征在于，所述根据所述共享数据请求中所述数据拥有者的身份标识生成数据拥有者公钥和数据拥有者私钥，包括：
    判断所述数据拥有者是否创建对应的项目密钥，响应于所述数据拥有者未创建对应的项目密钥，创建对应的项目密钥；
    判断所述数据拥有者是否创建对应的参数密钥，响应于所述数据拥有者未创建对应的参数密钥，创建对应的参数密钥；
    判断所述数据拥有者是否创建对应的代理主密钥和对应的代理公开参数，响应于所述数据拥有者未创建对应的代理主密钥和对应的代理公开参数，创建对应的代理主密钥和对应代理公开参数；
    基于所述数据拥有者的身份标识创建数据拥有者公钥，并基于所述数据拥有者公钥、所述对应的代理主密钥和所述对应的代理公开参数生成数据拥有者私钥；
    基于所述项目密钥对所述数据拥有者公钥和所述数据拥有者私钥进行加密，并存储在密钥管理系统中；
    基于所述参数密钥对所述对应的代理主密钥和所述对应的代理公开参数进行加密，并存储在所述密钥管理系统中；以及
    由密钥管理系统存储所述系统主密钥，并基于所述系统主密钥对所述项目密钥、所述共享项目密钥和所述参数密钥进行加密，并存储在所述密钥管理系统中。
  5. 根据权利要求2所述的加密数据共享的方法，其特征在于，所述根据所述共享数据请求中所述数据拥有者的身份标识生成数据拥有者公钥和数据拥有者私钥，包括：
    判断所述数据拥有者是否创建对应的项目密钥，响应于已创建对应的项目密钥，判断所述数据拥有者是否创建对应的参数密钥，响应于所述数据拥有者未创建对应的参数密钥，创建对应的参数密钥；
    判断所述数据拥有者是否创建对应的代理主密钥和对应的代理公开参数，响应于所述数据拥有者未创建对应的代理主密钥和对应的代理公开参数，创建对应的代理主密钥和对应代理公开参数；
    基于所述数据拥有者的身份标识创建数据拥有者公钥，并基于所述数据拥有者公钥、所述对应的代理主密钥和所述对应的代理公开参数生成数据拥有者私钥；
    基于所述项目密钥对所述数据拥有者公钥和所述数据拥有者私钥进行加密，并存储在密钥管理系统中；
    基于所述参数密钥对所述对应的代理主密钥和所述对应的代理公开参数进行加密，并存储在所述密钥管理系统中；以及
    由密钥管理系统存储所述系统主密钥，并基于所述系统主密钥对所述项目密钥、所述共享项目密钥和所述参数密钥进行加密，并存储在所述密钥管理系统中。
  6. 根据权利要求1-5任意一项所述的加密数据共享的方法，其特征在于，所述根据所述共享数据请求中数据使用者的身份标识生成数据使用者公钥，并基于所述数据使用者公钥和所述数据拥有者私钥生成代理重加密密钥，包括：
    获取所述数据拥有者对应的代理主密钥和对应的代理公开参数；以及
    基于所述数据使用者公钥、所述数据拥有者私钥、所述对应的代理主密钥和所述对应的代理公开参数生成代理重加密密钥。
  7. 根据权利要求1-6任意一项所述的加密数据共享的方法，其特征在于，所述响应于接收到数据使用者获取共享数据请求，基于所述获取共享数据请求获取对应的代理重加密密钥和对应的加密数据，包括：
    响应于接收到用户获取共享数据请求，由数据处理中心基于所述获取共享数据请求，获取对应的加密数据，并从密钥管理系统获取对应的代理重加密密钥；
    由所述密钥管理系统判断所述用户是否为所述共享数据的数据拥有者规定的数据使用者；以及
    响应于所述用户为所述共享数据的数据拥有者规定的数据使用者，将所述对应的代理重加密密钥发送给所述数据处理中心。
  8. 根据权利要求1-7任意一项所述的加密数据共享的方法，其特征在于，所述数据拥有者的客户端、所述数据使用者的客户端、所述密钥管理系统和所述数据处理中心中任意两者之间通过各自的安全接口进行双向认证，并基于SGX技术进行数据传输。
  9. 一种加密数据共享的装置，其特征在于，包括：
    第一模块，被配置为用于接收数据拥有者发送的共享数据请求，并根据所述共享数据请求中所述数据拥有者的身份标识生成数据拥有者公钥和数据拥有者私钥；
    第二模块，被配置为用于根据所述共享数据请求中数据使用者的身份标识生成数据使用者公钥，并基于所述数据使用者公钥和所述数据拥有者私钥生成代理重加密密钥；
    第三模块，被配置为用于基于所述数据拥有者公钥对共享数据进行加密，并将加密数据上传到数据处理中心进行存储；
    第四模块，被配置为用于响应于接收到数据使用者获取共享数据请求，基于所述获取共享数据请求获取对应的代理重加密密钥和对应的加密数据，基于所述代理重加密密钥对所述加密数据进行重加密以得到重加密数据；以及
    第五模块，被配置为用于获取所述数据使用者的数据使用者私钥，并基于所述数据使用者私钥对所述重加密数据进行解密以得到共享数据。
  10. 一种计算机设备，其特征在于，包括：
    至少一个处理器；以及
    存储器，所述存储器存储有计算机可读指令，所述计算机可读指令被所述至少一个处理器执行时，使得所述至少一个处理器执行如权利要求1-8任意一项所述方法的步骤。
  11. 一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，其特征在于，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行如权利要求1-8任意一项所述方法的步骤。
PCT/CN2022/088569 2021-04-23 2022-04-22 一种加密数据共享的方法、装置、设备及可读介质 WO2022223036A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/265,329 US20240039709A1 (en) 2021-04-23 2022-04-22 Method and apparatus for sharing encrypted data, and device and readable medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110442814.0 2021-04-23
CN202110442814.0A CN113360886B (zh) 2021-04-23 2021-04-23 一种加密数据共享的方法、装置、设备及可读介质

Publications (1)

Publication Number Publication Date
WO2022223036A1 true WO2022223036A1 (zh) 2022-10-27

Family

ID=77525393

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/088569 WO2022223036A1 (zh) 2021-04-23 2022-04-22 一种加密数据共享的方法、装置、设备及可读介质

Country Status (3)

Country Link
US (1) US20240039709A1 (zh)
CN (1) CN113360886B (zh)
WO (1) WO2022223036A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113360886B (zh) * 2021-04-23 2023-02-28 山东英信计算机技术有限公司 一种加密数据共享的方法、装置、设备及可读介质
CN114679340B (zh) * 2022-05-27 2022-08-16 苏州浪潮智能科技有限公司 一种文件共享方法、系统、设备及可读存储介质
CN115952552B (zh) * 2023-03-15 2023-05-12 北京和升达信息安全技术有限公司 远程数据销毁方法、系统及设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106850656A (zh) * 2017-02-27 2017-06-13 淮阴工学院 一种云环境下多用户文件共享控制方法
CN109039614A (zh) * 2018-09-17 2018-12-18 杭州弗兰科信息安全科技有限公司 一种基于optimal ate的代理重加密方法
CN109347832A (zh) * 2018-10-24 2019-02-15 中国银行股份有限公司 一种动态数据共享方法、终端设备及代理服务器
WO2019103360A1 (ko) * 2017-11-21 2019-05-31 순천향대학교 산학협력단 Ｉｏｔ 경량단말 환경에서 프록시 재암호화 기반의 데이터 관리 방법 및 시스템
CN112364376A (zh) * 2020-11-11 2021-02-12 贵州大学 一种属性代理重加密医疗数据共享方法
CN113360886A (zh) * 2021-04-23 2021-09-07 山东英信计算机技术有限公司 一种加密数据共享的方法、装置、设备及可读介质

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103647642B (zh) * 2013-11-15 2016-07-06 河海大学 一种基于证书代理重加密方法及系统
CN104539610B (zh) * 2014-12-25 2017-10-27 华中科技大学 一种提高外包加密数据共享功能的代理重加密方法
EP3257221B1 (en) * 2015-02-13 2022-03-09 Yoti Holding Limited Digital identity
CN105978689B (zh) * 2016-06-28 2019-12-24 电子科技大学 一种抗密钥泄漏的云数据安全共享方法
CN107302524B (zh) * 2017-06-02 2020-10-09 西安电子科技大学 一种云计算环境下的密文数据共享系统
CN110958219B (zh) * 2019-10-21 2021-01-26 武汉大学 一种面向医疗云共享数据的sm2代理重加密方法与装置
CN112532580B (zh) * 2020-10-23 2022-09-06 暨南大学 一种基于区块链及代理重加密的数据传输方法及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106850656A (zh) * 2017-02-27 2017-06-13 淮阴工学院 一种云环境下多用户文件共享控制方法
WO2019103360A1 (ko) * 2017-11-21 2019-05-31 순천향대학교 산학협력단 Ｉｏｔ 경량단말 환경에서 프록시 재암호화 기반의 데이터 관리 방법 및 시스템
CN109039614A (zh) * 2018-09-17 2018-12-18 杭州弗兰科信息安全科技有限公司 一种基于optimal ate的代理重加密方法
CN109347832A (zh) * 2018-10-24 2019-02-15 中国银行股份有限公司 一种动态数据共享方法、终端设备及代理服务器
CN112364376A (zh) * 2020-11-11 2021-02-12 贵州大学 一种属性代理重加密医疗数据共享方法
CN113360886A (zh) * 2021-04-23 2021-09-07 山东英信计算机技术有限公司 一种加密数据共享的方法、装置、设备及可读介质

Also Published As

Publication number Publication date
CN113360886A (zh) 2021-09-07
US20240039709A1 (en) 2024-02-01
CN113360886B (zh) 2023-02-28

Similar Documents

Publication Publication Date Title
US11196729B2 (en) Methods and systems for distributing encrypted cryptographic data
US8059818B2 (en) Accessing protected data on network storage from multiple devices
US10546141B2 (en) Network system, and methods of encrypting data, decrypting encrypted data in the same
US8625802B2 (en) Methods, devices, and media for secure key management in a non-secured, distributed, virtualized environment with applications to cloud-computing security and management
US9332002B1 (en) Authenticating and authorizing a user by way of a digital certificate
WO2022223036A1 (zh) 一种加密数据共享的方法、装置、设备及可读介质
CN108701094B (zh) 在基于云的应用中安全地存储和分发敏感数据
US20100017599A1 (en) Secure digital content management using mutating identifiers
TW201814496A (zh) 資料儲存方法、資料獲取方法、裝置及系統
KR20230041971A (ko) 분산적 컴퓨터 네트워크 상에서 안전한 데이터 전송을 위한 방법, 장치 및 컴퓨터 판독가능 매체
KR20090084545A (ko) Ｃｅ 장치 관리 서버, ｃｅ 장치 관리 서버를 이용한ｄｒｍ 키 발급 방법, 및 그 방법을 실행하기 위한프로그램 기록매체
EP4096147A1 (en) Secure enclave implementation of proxied cryptographic keys
EP4096160A1 (en) Shared secret implementation of proxied cryptographic keys
US11804957B2 (en) Exporting remote cryptographic keys
WO2022227799A1 (zh) 设备注册方法及装置、计算机设备、存储介质
US9092780B2 (en) User-mediator monitoring and controlling access to electronic content
KR20140033573A (ko) 퍼블릭 클라우드 스토리지 서비스를 위한 데이터 위임 및 엑세스 방법
US20240012933A1 (en) Integration of identity access management infrastructure with zero-knowledge services
JP2016038845A (ja) 利用者認証システム、認証サーバ、利用者認証方法、プログラム
Fernando et al. Information Security
Kowalski CRYPTOBOX V2.
Raghunathan A security model for mobile agent environments using X. 509 proxy certificates
em Nuvens Vitor Hugo Galhardo Moia
Dočár Bezpečnostní řešení pro cloudové technologie

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22791141

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18265329

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22791141

Country of ref document: EP

Kind code of ref document: A1