WO2023134576A1

WO2023134576A1 - Data encryption method, attribute authorization center, and storage medium

Info

Publication number: WO2023134576A1
Application number: PCT/CN2023/071009
Authority: WO
Inventors: 夏云浩; 张金鑫; 马致原; 刘晖
Original assignee: 中兴通讯股份有限公司
Priority date: 2022-01-17
Filing date: 2023-01-06
Publication date: 2023-07-20
Also published as: CN116484392A

Abstract

A data encryption method, an attribute authorization center, and a storage medium. The data encryption method is applied to the attribute authorization center in an attribute-based encryption system, and comprises: obtaining a system public key and a system master key (S100); obtaining a user private key of an access user according to the system public key, the system master key, obtained key generation information and identity identification information of the access user, wherein the identity identification information is independently bound to the access user, and the key generation information is associated with the access user (S200); and when it is determined that a case in which a plaintext to be encrypted of the access user is encrypted to obtain a ciphertext exists, decrypting the ciphertext according to the user private key of the access user to obtain a plaintext to be encrypted (S300).

Description

Data encryption method, attribute authorization center and storage medium

Cross References to Related Applications

This application is based on a Chinese patent application with application number 202210049415.2 and a filing date of January 17, 2022, and claims the priority of this Chinese patent application. The entire content of this Chinese patent application is hereby incorporated by reference into this application.

technical field

The embodiments of the present application relate to the technical field of information security, and in particular to a data encryption method, an attribute authorization center, and a computer-readable storage medium.

Background technique

Key leakage is an urgent problem to be solved in the current Attribute Based Encryption (ABE) system. Since ABE is a broadcast encryption method, users with the same attribute share the same private key, so there may be malicious users who deliberately disclose their own private key. In this case, it is impossible to accurately find out which user is the malicious user who deliberately caused the key leakage, so the loopholes of the ABE system cannot be effectively corrected, resulting in a decrease in the security performance of the ABE system.

Contents of the invention

The following is an overview of the topics described in detail in this article. This summary is not intended to limit the scope of the claims.

Embodiments of the present application provide a data encryption method, an attribute authorization center, and a computer-readable storage medium, which can improve the security performance of an attribute encryption system.

In the first aspect, the embodiment of this application provides a data encryption method, which is applied to the attribute authorization center in the attribute encryption system, including: obtaining the system public key and the system master key; Key, the obtained key generation information and the identity information of the access user to obtain the user private key of the access user, wherein the identity information is bound to the access user alone, and the key generation information is associated with The visiting user; when it is determined that the plaintext to be encrypted by the visiting user is encrypted to obtain a ciphertext, according to the user private key of the visiting user, decrypt the ciphertext to obtain the to-be-encrypted plaintext Encrypt plaintext.

In the second aspect, the embodiment of the present application also provides an attribute authorization center, including: a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the computer program, the The data encryption method as described in the first aspect above.

In a third aspect, the embodiment of the present application further provides a computer-readable storage medium storing computer-executable instructions, and the computer-executable instructions are used to execute the data encryption method described in the first aspect above.

Additional features and advantages of the application will be set forth in the description which follows, and, in part, will be obvious from the description, or may be learned by practice of the application. The objectives and other advantages of the application will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

The accompanying drawings are used to provide a further understanding of the technical solution of the present application, and constitute a part of the specification, and are used together with the embodiments of the present application to explain the technical solution of the present application, and do not constitute a limitation to the technical solution of the present application.

Fig. 1 is a schematic diagram of an attribute authorization center for implementing a data encryption method provided by an embodiment of the present application;

FIG. 2 is a flowchart of a data encryption method provided by an embodiment of the present application;

Fig. 3 is a flow chart of obtaining a system public key and a system master key in a data encryption method provided by an embodiment of the present application;

Fig. 4 is a flow chart of obtaining the user private key of the accessing user in the data encryption method provided by one embodiment of the present application;

Fig. 5 is a flow chart of obtaining the user private key of the accessing user in the data encryption method provided by another embodiment of the present application;

Fig. 6 is a schematic diagram of encrypting the plaintext to be encrypted by the visiting user to obtain the ciphertext in the data encryption method provided by one embodiment of the present application;

Fig. 7 is a schematic diagram of encrypting the plaintext to be encrypted by the visiting user in the data encryption method provided by another embodiment of the present application to obtain the ciphertext;

Fig. 8 is a flowchart of a data encryption method provided by another embodiment of the present application;

Fig. 9 is a flow chart of tracking the identities of multiple accessing users in the data encryption method provided by an embodiment of the present application;

Fig. 10 is a flow chart of tracking the identities of multiple accessing users in the data encryption method provided by another embodiment of the present application;

Fig. 11 is a schematic diagram of an attribute authorization center provided by another embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present application, not to limit the present application.

It should be noted that although the functional modules are divided in the schematic diagram of the device, and the logical sequence is shown in the flowchart, in some cases, it can be executed in a different order than the module division in the device or the flowchart in the flowchart. steps shown or described. The terms "first", "second" and the like in the specification and claims and the above drawings are used to distinguish similar objects, and not necessarily used to describe a specific sequence or sequence.

This application provides a data encryption method, an attribute authorization center, and a computer-readable storage medium. When the system public key, the system master key, and the key generation information associated with the accessing user are obtained, the accessing user's The user's private key is embedded with the identity information that is uniquely bound to the accessing user, and then data encryption is performed according to the user's private key of the accessing user. When a malicious user illegally discloses its user's private key and causes key leakage, the attribute authorization center can Through the stored identity information, it can be accurately found out which user is the malicious user who intentionally leaked the key, so as to further revoke the malicious user's authority, thereby effectively correcting the loopholes of the attribute encryption system and improving the security performance of the attribute encryption system.

The embodiments of the present application will be further described below in conjunction with the accompanying drawings.

Referring to FIG. 1 , FIG. 1 is a schematic diagram of an attribute authorization center 110 for implementing a data encryption method provided by an embodiment of the present application.

In the example of FIG. 1 , the attribute authorization center 110 is a part of the attribute encryption system 100, which is applied in the application field of data security encryption in cloud computing, wherein, based on the attribute encryption mechanism of the attribute encryption system 100, relevant access users can The data is shared securely with specified users on the server. The key and ciphertext of the access user are associated with the descriptive attribute set and the access policy. Only when the relevant attribute set and the access policy match, a key can decrypt a specific ciphertext. Attribute-based encryption can be divided into two categories, namely Key Policy Attribute Based Encryption (KP-ABE) and Ciphertext Policy Attribute Based Encryption (CP-ABE) , where, in KP-ABE, the access user's key is associated with the access policy specified by the authorizing party, and the ciphertext is marked by a descriptive attribute set, while in CP-ABE, the access user's key is identified by the descriptive attribute set Tokens, the ciphertext is associated with the access policy specified by the encryptor. In the above application scenarios, the attribute authorization center 110 in the attribute encryption system 100 can define related attributes in the system, distribute user private keys, and cooperate with data encryption processing.

It should be noted that the attribute authorization center 110 has a storage function and can record related key parameters. Based on this feature, the embodiment of the present application uses the attribute authorization center 110 to further ascertain the identity of the user who maliciously disclosed the key .

The attribute authorization center 110 in the attribute encryption system 100 may respectively include a memory and a processor, where the memory and the processor may be connected through a bus or in other ways.

As a non-transitory computer-readable storage medium, memory can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory may include memory located remotely from the processor, which remote memory may be connected to the processor through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The attribute authorization center 110 and the application scenarios in the attribute encryption system 100 described in the embodiment of this application are to illustrate the technical solution of the embodiment of the application more clearly, and do not constitute a limitation to the technical solution provided by the embodiment of the application. A skilled person may know that with the evolution of the attribute authorization center 110 in the attribute encryption system 100 and the emergence of new application scenarios, the technical solution provided by the embodiment of the present application is also applicable to similar technical problems.

Those skilled in the art can understand that the attribute authorization center 110 shown in FIG. layout of the components.

In the attribute authorization center 110 shown in FIG. 1 , the attribute authorization center 110 can call the data encryption program stored therein to cooperate with the implementation of the data encryption method.

Based on the structure of the above-mentioned attribute authorization center 110, various embodiments of the data encryption method of the present application are proposed. In order to more clearly explain the working principle and process of the present application, on the basis of KP-ABE and CP-ABE, the following implementations Examples are Key Tracing Key Policy Attribute based Encryption (Key Tracing Key Policy Attribute based Encryption, KT-KP-ABE) and Key Tracing Ciphertext Policy Attribute based Encryption (Key Tracing Ciphertext Policy Attribute based Encryption, The case of KT-CP-ABE) will be described separately.

As shown in Figure 2, Figure 2 is a flow chart of a data encryption method provided by an embodiment of the present application, which can be but not limited to be applied to the attribute authorization center as shown in the embodiment of Figure 1, the data encryption method includes but is not limited to the steps S100 to S300.

Step S100: Obtain a system public key and a system master key.

In one embodiment, by obtaining the system public key and the system master key, the initial key parameters of the attribute authority center are determined, so as to further determine the access user's key according to the determined system public key and system master key, Among them, the system public key can be shared with the access users by the attribute authorization center, and the system master key is kept private and confidential by the attribute authorization center. Generally speaking, the system public key and the system master key can be calculated according to specific algorithms. The following will give A specific example is given to illustrate.

In the example of FIG. 3 , step S100 includes but not limited to step S110 .

Step S110: Initialize the input security parameters to obtain the system public key and system master key.

In one embodiment, by setting corresponding security parameters in advance and inputting them into the attribute authorization center for initialization processing, the system public key and system master key are converted to obtain the system public key and system master key based on this method. key, which can well characterize the characteristics of security parameters under attribute encryption, and meet the requirements of attribute encryption. The initialization processing method includes but not limited to bilinear mapping, etc. Those skilled in the art can also set the initialization processing accordingly according to the actual application scenario. way, which is not limited in this embodiment.

Specific examples are given below to illustrate the working principles and processes of the above-mentioned embodiments.

Example one:

The calculation method adapted to KT-KP-ABE and KT-CP-ABE at the same time is explained. Based on Setup(1 ^λ )→(PP,MSK), a security parameter λ is input to construct a bilinear map and other related parameters , and finally output the system public key PP and system master key MSK. PP is shared by the attribute authorization center with the access user, and MSK is kept private and confidential by the attribute authorization center. The specific initialization algorithm is shown in the following example.

Setup(1 ^λ )→(PP,MSK): Input a security parameter λ, the calculation steps include but not limited to:

1) Define two multiplicative cyclic groups G ₁ and G ₂ of prime number p order, and define g as the generator of G ₁ , and define a bilinear map

G ₁ ×G ₁ →G ₂ ;

2) Define hash function H ₁ : {0,1} ^* → G ₁ ;

3) For each attribute in the attribute set {A _i }, select a random number

(this parameter is a constant/random number), and calculate

4) Select

(this parameter is a constant/random number), calculate

5) Define the Lagrangian interpolation function

Among them, i∈Z _p (this parameter is a constant/random number), S is a set of elements in Z _p ;

6) According to the above calculation steps, output:

System master key MSK={t _i ,y,u};

system public key

Step S200: According to the system public key, the system master key, the obtained key generation information and the identity information of the access user, the user private key of the access user is obtained, wherein the identity information is separately bound to the access user, and the key generation information Associated with the visiting user.

In one embodiment, based on the determined system public key and system master key, as well as the key generation information and identity information associated with the access user, the user private key of the access user can be accurately calculated, and through the The user's private key is embedded with the identity information that is uniquely bound to the access user. Since the attribute authorization center stores the identity information of the access user, when a malicious user illegally discloses its user private key and causes key leakage, the attribute authorization center can Accurately find malicious users through stored identity information.

It is understandable that since different accessing users have different identity information, it is impossible for other users to use the identity information to obtain the key. The corresponding malicious user leaks the key, so as to accurately determine the malicious user who leaked the key.

It should be noted that the identity information can be presented in various forms, and those skilled in the art can set it according to the actual application scenario, which is not limited in this embodiment.

In the example of FIG. 4 , when the key generation information is an access control structure associated with an accessing user, step S200 includes but is not limited to steps S210 to S220.

Step S210: Perform key generation processing on the system public key, the system master key and the obtained access control structure to obtain the first attribute private key;

Step S220: Insert the identity information of the visiting user into the first attribute private key to obtain the user private key of the visiting user.

In one embodiment, based on the access control structure associated with the accessing user, combined with the system public key and the system master key to perform key generation processing, the first attribute private key can be accurately obtained, and the first attribute private key is authorized by the attribute. The center keeps private and confidential. In this case, by inserting the identity information of the access user into the first attribute private key, the user private key of the access user is obtained, so that the attribute authorization center can store the identity information of the access user, so that In the case of a possible key leak, the malicious user can be accurately found through the stored identity information.

It should be noted that in this scenario, based on the access control structure associated with the access user, the user private key of the access user is finally obtained, which is an encryption method involving KT-KP-ABE.

Example two:

For KT-KP-ABE, based on KeyGeneration(PP,MSK,id,γ)→(SK _id ), input the access user’s identity information id, access control structure γ, and the generated system public key PP and system master key MSK, finally output the traceable user private key SK _id , the calculation steps include but not limited to:

1) The access control structure in this scheme adopts the access tree, wherein, define p _x as the polynomial of each node x in the tree structure; for the root node root in the access tree structure, define p _root (0)=y, for To visit non-root nodes in the tree structure, define p _x (0)=p _parent(x) ^(index(x)) .

2) In order to achieve the purpose of tracking malicious users, a unique identification information H ₁ (id) ^u is inserted into the attribute private key to reveal the identity of the user.

3) According to the above calculation steps, output the user's private key

In the example of FIG. 5 , when the key generation information is an attribute set associated with the accessing user, step S200 includes but not limited to steps S230 to S240.

Step S230: Perform key generation processing on the system public key, the system master key and the acquired attribute set to obtain the second attribute private key;

Step S240: Insert the identity information of the visiting user into the second attribute private key to obtain the user private key of the visiting user.

In one embodiment, based on the attribute set associated with the accessing user, combined with the system public key and the system master key to perform key generation processing, the second attribute private key can be accurately obtained, and the second attribute private key is maintained by the attribute authorization center. Private and confidential, in this case, by inserting the identity information of the access user into the second attribute private key, the user private key of the access user is obtained, so that the attribute authorization center can store the identity information of the access user, so that In the event of key leaks, malicious users can be accurately found through the stored identity information.

It should be noted that in this scenario, based on the attribute set associated with the access user, the user private key of the access user is finally obtained, which is an encryption method involving KT-CP-ABE.

Example three:

For KT-CP-ABE, based on KeyGeneration(PP,MSK,id,{A _i })→(SK _id ), input the access user’s identity information id, attribute set {A _i } and the generated system public key PP and the system master key MSK, and finally output the traceable user private key SK _id , the calculation steps include but are not limited to:

1) In order to achieve the purpose of tracking malicious users, a unique identification information H ₁ (id) ^u is inserted into the attribute private key to reveal the identity of the user.

2) According to the above calculation steps, output the user's private key

It should be noted that, for the convenience of description, the output user private key is D _id , but the D _id calculated here is SK _id . It does not affect the expression of its meaning, and in order to avoid ambiguity, similar situations in the following embodiments are also identified as such, and in order to avoid redundancy, details will not be repeated below.

Step S300: When it is determined that the plaintext to be encrypted of the visiting user is encrypted to obtain the ciphertext, according to the user private key of the visiting user, the ciphertext is decrypted to obtain the plaintext to be encrypted.

In one embodiment, when the system public key, system master key, and key generation information associated with the access user are obtained, by embedding the identity uniquely bound to the access user in the user private key of the access user information, and then perform data encryption processing according to the user's private key of the accessing user. When a malicious user illegally discloses his user's private key to cause key leakage, the attribute authorization center can accurately find out which user is the intentional user through the stored identity information. Malicious users who cause key leaks can further revoke the malicious user's authority, thereby effectively correcting the loopholes in the attribute encryption system and improving the security performance of the attribute encryption system.

In the example of FIG. 6 , "encrypt the plaintext to be encrypted by the visiting user to obtain ciphertext" in step S300 includes, but is not limited to, step S310.

Step S310: According to the system public key and the attribute set of the visiting user, encrypt the plaintext to be encrypted of the visiting user to obtain the ciphertext.

In one embodiment, since the system public key is shared by the attribute authorization center with the access user, when the key generation information is the access control structure associated with the access user, the access user can further Input the attribute set to the system public key, and then make it encrypt the plaintext to be encrypted by the accessing user according to the system public key and the attribute set of the accessing user, and obtain the relevant ciphertext accurately and reliably. It can be understood that the situation is Corresponds to the encryption method of KT-KP-ABE.

Example four:

For KT-KP-ABE, based on Encrypt(M,PP,{A _i })→(CT), input the plaintext M to be encrypted, system public key PP, attribute set {A _i }, and finally output the encrypted ciphertext CT, the calculation steps of the encryption algorithm include but are not limited to:

For the plaintext M to be encrypted, select the attribute set {A _i }, select

(This parameter is a constant/random number), the following information is calculated by the data owner:

C ₀ = MY ^s ;

C _1,i = U _i ^s ;

C _2,i =T _i ^s ;

Finally, the generated ciphertext is CT={C ₀ , C _1,i ,C _2,i }.

Then, based on Decrypt(CT,SK _id )→(M), input the ciphertext CT and the traceable private key SK _id , and finally output the decrypted plaintext M, that is, the shared user uses his own private key to decrypt a ciphertext , the calculation steps of the decryption algorithm include but are not limited to:

1) Define the recursive function DecryptNode(x, D _id , CT), which takes node x on the access control tree structure γ, user private key D _id and ciphertext CT as input.

2) If x is a leaf node, the calculation is as follows:

3) If x is a non-leaf node, first define z as a child node of x, then call DecryptNode(z,D _id ,CT) and express the result as F _z , the calculation is as follows:

i=index(z),S _x, ＝{index(z):z∈S _x }

4) Calculated by calling the function DecryptNode(x, D _id , CT):

Compute the plaintext:

The correctness proof of the calculated plaintext results is as follows:

It can be understood that, to calculate the value of F _root , the value of the leaf node satisfying the access control tree structure must be obtained. Whether x is a leaf node or not,

Heng established. Therefore, the value of the root node F _root can be calculated as:

p _root (0) = y;

C ₀ = MY ^s ;

Therefore, the calculation correctness of the plaintext M can be proved.

In the example of FIG. 7 , "encrypt the plaintext to be encrypted by the visiting user to obtain ciphertext" in step S300 includes, but is not limited to, step S320.

Step S320: According to the system public key and the access control structure of the access user, encrypt the plaintext to be encrypted by the access user to obtain the cipher text.

In one embodiment, since the system public key is shared by the attribute authorization center with the access user, when the key generation information is the attribute set associated with the access user, the access user can further Enter the access control structure to the system public key, and then make it encrypt the plaintext to be encrypted by the access user according to the system public key and the access control structure of the access user, and obtain the relevant ciphertext accurately and reliably. It is understandable that in this case It is the encryption method corresponding to KT-CP-ABE.

Example five:

For KT-CP-ABE, based on Encrypt(M,PP,{A _i })→(CT), input the plaintext M to be encrypted, system public key PP, access control structure γ, and finally output the encrypted ciphertext CT, The calculation steps of the encryption algorithm include but are not limited to:

For the plaintext M to be encrypted, select the access control structure γ, and randomly select a secret number

(this parameter is a constant/random number), and a LSSSΠ access structure

make

is a (m×n) matrix, and the function ρ _(.) associates attributes to

line. where ρ _(.) is constrained to be a single mapping function, which means that a single attribute is at most

associated with a row. Cryptoman randomly chooses a vector

This vector will be used to share the value of the encrypted exponent s. make

in

representative matrix

The i-th row in . select

(This parameter is a constant/random number), then the data owner calculates the following information:

C ₀ = MY ^s ;

Finally, the generated ciphertext is CT={C ₀ ,C _1,i ,C _2,i ,C _3,i }.

The proof of correctness is as follows:

If there exists such a constant {ω _i ∈ Z _p } _i∈I , and {λ _i } is an effective sharing of any secret s according to LSSSΠ, then ∑ _{i ∈ I} ω _i λ _i =s.

Therefore, the calculation correctness of the plaintext M can be proved.

In addition, in order to prove the security of the above-mentioned KT-KP-ABE and KT-CP-ABE schemes, relevant examples are given below for illustration.

Example six:

The improved decision bilinear Diffie-Hellman correlation problem is used to prove the security of the KT-KP-ABE scheme.

The basis of the theorem is: if the Diffie-Hellman related problems cannot be successfully solved in polynomial time, then the KT-KP-ABE scheme is safe for choosing ciphertext attacks, where polynomial time is a technical term in the field, and in computational complexity theory , which means that the computational time {\displaystyle m(n)} of a problem is not greater than a polynomial multiple of the problem size {\displaystyle n}. Any abstract machine has a complexity class, which includes Solve the problem.

To be proved: If there is an attack game in which the attacker can win the proposed KT-KP-ABE scheme with a non-negligible advantage σ in polynomial time, then we can try to construct a simulator that can solve this problem with an advantage of σ/2.

Among them, the construction process of the attack game in which the challenger and the attacker participate is as follows:

Init: The attacker selects a challenging attribute set A ^* .

Setup: The challenger simulates and constructs an attack environment as follows:

1) Define two multiplicative cyclic groups G ₁ and G ₂ of prime number p order, and define g as the generator of G ₁ ;

2) Define a bilinear map

G ₁ ×G ₁ →G ₂ ;

3) Define hash function H ₁ : {0,1} ^* → G ₁ ;

4) Randomly select μ∈{0,1}, a,b,c,z∈Z _p , let

The attacker defines an attribute set {A _l } and plays a challenge game in it, and the identity information of the attacker is represented by id.

The simulator randomly selects u, α _i , β _i ∈ Z _p , and sets the public parameters as follows:

According to the above calculation steps, we get:

system public key

The system master key is MSK={a,u,t _i }.

The challenger transmits the system public key PP to the attacker and keeps the system master key MSK.

Query Phase 1: The attacker can ask the challenger the following queries:

Key Generation Query: The attacker submits a key generation query to the access control structure γ. In this scheme, access control structure adopts access tree. Among them, p _x is defined as the polynomial of each node x in the tree structure.

For the root node root in the access tree structure, define p _root (0)=a; for non-root nodes in the access tree structure, define p _x (0)=p _parent(x) ^(index(x)) . The identity information of the attacker is represented by id, and the key structure of the attacker is as follows:

The challenger discloses the D _id to the attacker.

Decryption query: The attacker submits a decryption query request for the ciphertext CT={C ₀ ,C _1,i ,C _2,i }, and the simulator runs the decryption algorithm Decrypt(CT,PP,D _id )→(M):

The plaintext M is then sent to the attacker.

Challenge phase: After the attacker completes the query phase 1, he selects two plaintexts M ₀ and M ₁ of the same size and returns them to the challenger. Among them, M ₀ and M ₁ cannot appear in the previous decryption query. Then the challenger encrypts with the challenge attribute set A ^* selected by the attacker in advance

where μ∈{0,1} is random. ciphertext

is constructed as follows:

The generated ciphertext is

After the encryption is complete, the ciphertext is transmitted to the attacker.

And C _o is:

Therefore, it can be concluded that:

When μ=0, the ciphertext

When μ=1, the ciphertext

make

calculate

When μ=0,

At this time the ciphertext

It shows that this is a correct and legal ciphertext.

Inquiry Phase 2: Repeat the operation of Inquiry Phase 1, and the attacker continues to send a limited number of private key generation inquiries and decryption inquiries to the challenger.

Guessing phase: the attacker submits a guess value μ ^* , only when μ ^* =μ, the attacker can win the game. Based on the above description, the advantage of the attacker in this attack game is defined as

Discuss the advantages of simulators by distinguishing the following two tuple cases: (A=g ^a , B=g ^b , C=g ^c ,

), (A=g ^a , B=g ^b , C=g ^c ,

).

When μ = 1, the ciphertext is random, and the attacker cannot obtain any useful information about μ ₁ , in this case:

And because when μ ₁ ^* ≠μ ₁ , the simulator outputs μ′=1, in this case:

When μ = 0, the ciphertext is correct and legal. According to the above assumptions, the attacker has a non-negligible advantage σ to break the proposed scheme. in this case:

And because when μ ₁ ^* =μ ₁ , the simulator outputs μ′=0, in this case:

To sum up, the advantages of the simulator to solve the problems described above are:

It can be proved that the simulator can solve the above problems with the advantage of σ/2, so the KT-KP-ABE scheme is safe for choosing ciphertext attacks.

Example seven:

The improved decision bilinear Diffie-Hellman correlation problem is used to prove the security of the KT-CP-ABE scheme.

The basis theorem is: if the Diffie-Hellman related problems cannot be successfully solved in polynomial time, then the KT-KP-ABE scheme is safe for choosing ciphertext attacks.

To be proved: If there is an attack game in which the attacker can win the proposed KT-CP-ABE scheme with a non-negligible advantage σ in polynomial time, then we can try to construct a simulator that can solve this problem with an advantage of σ/2.

Init: The attacker chooses a challenging access control structure γ ^* .

2) Define a bilinear map

G ₁ ×G ₁ →G ₂ ;

3) Define hash function H ₁ : {0,1} ^* → G ₁ ;

4) Randomly select μ∈{0,1}, a,b,c,z∈Z _p , let

According to the above calculation steps, we get:

system public key

The system master key is MSK={a,u,t _i }.

Query Phase 1: The attacker can ask the challenger the following queries:

Key Generation Query: The attacker submits a key generation query for user attribute _Ai . The identity information of the attacker is represented by id, and the key structure of the attacker is as follows:

The challenger discloses the D _id to the attacker.

Decryption query: the attacker submits a decryption query request for the ciphertext CT={C ₀ ,C _1,i ,C _2,i ,C _3,i }, and the simulator runs the decryption algorithm Decrypt(CT,PP,D _id )→ (M):

The plaintext M is then sent to the attacker.

Challenge phase: After the attacker completes the query phase 1, he selects two plaintexts M ₀ and M ₁ of the same size and returns them to the challenger. Among them, M ₀ and M ₁ cannot appear in the previous decryption query. The challenger then visits the

Ask Control Structure | ^* Encryption

where μ∈{0,1} is random. ciphertext

is constructed as follows:

Generated ciphertext

And C _o is:

Therefore, it can be concluded that:

When μ=0, the ciphertext

When μ=1, the ciphertext

make

When μ=0,

At this time the ciphertext

It shows that this is a correct and legal ciphertext.

Discuss the advantages of simulators by distinguishing between the following two tuple cases: (A=g ^a , B=g ^b , C=g ^c ,

), (A=g ^a , B=g ^b , C=g ^c ,

).

It can be proved that the simulator can solve the above problems with the advantage of σ/2, so the KT-CP-ABE scheme is safe for choosing ciphertext attacks.

In the example in FIG. 8, when there are multiple accessing users, the data encryption method in this embodiment of the present application further includes but is not limited to step S400.

Step S400: Perform identity tracking on multiple visiting users according to the identification information of the multiple visiting users, the user's private key and the key generation information associated with the visiting users.

In an embodiment, when determining the identity information of each access user, the user private key, and the key generation information associated with the access user, it may be based on the identity information of each access user, the user private key, and the key generation information associated with the access user. According to the discriminative calculation of the key generation information, the corresponding discriminant parameters can be obtained, so as to accurately check the identity of the user through the discriminant parameters, and realize the identity tracking of the accessing user. It is understandable that the same can be done for each accessing user. The discriminant calculation is used to realize identity tracking until the corresponding malicious user is found.

In the example of FIG. 9 , step S400 includes but not limited to steps S410 to S420.

Step S410: Process the identity information of multiple access users, user private keys, and key generation information associated with the access users, and generate a key leakage tracking list carrying multiple sets of data verification information, wherein a set of data verification information Including an access user's identity information and user's private key;

Step S420: Tracing the identity of each accessing user according to the key leakage tracking list.

In one embodiment, since the key leakage tracking list contains multiple sets of data verification information, and each set of data verification information includes an access user's identity information and user private key, it can be confirmed by querying the key leakage tracking list The corresponding relationship between the identity information of each accessing user and the user's private key. When a malicious user leaks the key, the attribute authorization center can search for the identity information corresponding to the user's private key to find out the leaked key. purpose of malicious users of the key.

A specific example is given below to illustrate the working principle of the above-mentioned embodiment.

Example eight:

If the number of users in the attribute encryption system is relatively small, the attribute authorization center can build a data list as a key leakage tracking list to record the identity information of the accessing user and the corresponding user private key, as shown in Table 1 and As shown in Table 2, wherein, Table 1 is the identity information of the visiting user and the corresponding user private key in the KT-KP-ABE scheme, and Table 2 is the identity information and the corresponding user private key of the visiting user in the KT-CP-ABE scheme. The corresponding user private key. When the private key is leaked, the attribute authorization center can trace the identity of the malicious user by searching the identity information corresponding to the user's private key.

Table 1 The identity information of the access user and the corresponding user private key in the KT-KP-ABE scheme

Table 2 The identity information of the access user and the corresponding user private key in the KT-CP-ABE scheme

In the example of FIG. 10 , step S400 includes but not limited to steps S430 to S440.

Step S430: Determine key leakage tracking conditions according to the identification information of multiple access users, user private keys, and key generation information associated with the access users;

Step S440: Tracing the identity of each accessing user according to key leakage tracking conditions.

In one embodiment, since the key leakage tracking conditions are relatively intuitive and clear, the key leakage tracking conditions are determined according to the identification information of multiple access users, the user private key, and the key generation information associated with the access users, so that When a malicious user leaks the key, the attribute authorization center can determine whether the identity information corresponding to the accessing user corresponds by calculating the key leak tracking condition, so as to achieve the purpose of finding out the malicious user who leaked the key.

Example nine:

If a suspicious user is considered to be a malicious user who illegally exposed the private key, the attribute authority can be determined by verifying an equation.

In the proposed KT-KP-ABE scheme, the attribute authorization center verifies the equation

Whether it is established.

The proof of correctness is as follows:

In the proposed KT-CP-ABE scheme, the attribute authorization center verifies the equation

Whether it is established.

The proof of correctness is as follows:

Since the parameters involved in the calculation process are known to the attribute authorization center, the attribute authorization center can verify the above calculation equation to confirm whether the suspicious user is a traitor who leaked the private key.

Example ten:

If the number of users is relatively large, the attribute authorization center can follow the following process to track:

In the proposed KT-KP-ABE scheme, the attribute authority center calculates the value of each attribute A _i

When a key leak occurs, the property authority tries a value

and calculate

When x=i, the identity of the malicious user will be detected accurately. Since the number of attributes is much smaller than the number of users in the attribute encryption system, the attribute authorization center finds the corresponding value that satisfies x=i

Doesn't require much computation.

The proof of correctness is as follows:

In the proposed KT-CP-ABE scheme, the attribute authorization center calculates the value of each attribute A _i

When a key leak occurs, the property authority tries a value

and calculate

When x=i, the identity of the malicious user will be detected accurately. Since the number of attributes is much smaller than the number of users in the system, the attribute authorization center finds the corresponding value that satisfies x=i

Doesn't require much computation.

The proof of correctness is as follows:

Since the parameters involved in the above calculation process are known to the attribute authorization center, the attribute authorization center can accurately find out the identity of the malicious user.

In addition, for the advantages of KT-KP-ABE and KT-CP-ABE in the embodiment of the present application compared with related technologies, the following is carried out in combination with the specific comparison results between KT-KP-ABE, KT-CP-ABE and related technologies Example illustration.

It is understandable that in attribute-based cryptosystems, bilinear pairing operations and exponential operations occupy more computing resources than other operations. Therefore, reducing the number of bilinear pairing operations and exponential operations can greatly improve the efficiency of the algorithm. For this reason, the KT-KP-ABE scheme and the KT-CP-ABE scheme proposed in the embodiment of the application are related to The [1] scheme, [2] scheme and [3] scheme in the technology compare the access structure, encryption and decryption calculation consumption, user private key size and ciphertext size. Among them, "Exp" is set as the consumption of an exponential operation, "Pair" is the consumption of a bilinear pairing operation, "n" is the number of attributes involved in encryption, and "|p|" is the size of each private key| D _id |, the scheme comparison results are shown in Table 3 below.

Table 3 Comparison results of calculation parameters of KT-KP-ABE, KT-CP-ABE and related technologies

From the comparison results in Table 3, it can be seen that the calculation consumption of the encryption algorithm proposed by the embodiment of the present application is significantly lower than that of other schemes, and less bilinear pairing operations are used in the decryption algorithm. In terms of calculation consumption, the KT-KP-ABE and KT-CP-ABE of the embodiment of the present application have higher efficiency due to the reduced number of bilinear pairing operations and exponential operations.

In addition to the higher efficiency of encryption and decryption algorithms, KT-KP-ABE and KT-CP-ABE also have better performance in terms of private key and ciphertext size. Since the attribute authorization center must generate and store the private keys of all users in order to trace the identity of malicious users when the key is leaked, reducing the size of the attribute private key can reduce the storage and computing burden of the entire attribute encryption system, according to the above scheme. The key generation algorithm in the construction is described and analyzed, the size of each private key is |D _id |=|p|, therefore, the total size of all attribute private keys is n|p|, according to the encryption algorithm in the previous embodiment Descriptive analysis, it can be calculated that the sizes of the ciphertexts in KT-KP-ABE and KT-CP-ABE are (2n+1)|p| and (3n+1)|p| respectively. It can be seen from the comparison that KT- The size of the user's private key in KP-ABE and KT-CP-ABE is relatively small, which will reduce the heavy burden on the key distribution and storage of the attribute authority. Moreover, the ciphertext sizes in KT-KP-ABE and KT-CP-ABE are relatively smaller. To sum up, the above comparison results show that from the perspective of overall efficiency, the KT-KP-ABE and KT-CP-ABE of the embodiment of the present application have lower computational cost and better performance, both can utilize the attribute The fine-grained data access control advantages of encryption can also meet the needs of different users to be distinguished through their unique private keys.

In addition, referring to FIG. 11 , an embodiment of the present application also provides an attribute authorization center, which includes: a memory, a processor, and a computer program stored on the memory and operable on the processor.

The processor and memory can be connected by a bus or other means.

The non-transitory software programs and instructions required to realize the data encryption methods of the above-mentioned embodiments are stored in the memory, and when executed by the processor, the data encryption methods of the above-mentioned embodiments are executed, for example, the above-described execution in FIG. 2 Method steps S100 to S300, method steps S110 in FIG. 3 , method steps S210 to S220 in FIG. 4 , method steps S230 to S240 in FIG. 5 , method steps S310 in FIG. 6 , method steps S120 in FIG. 7 , Method step S400 in FIG. 8 , method steps S410 to S420 in FIG. 9 or method steps S430 to S440 in FIG. 10 .

The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, an embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by a processor or a controller, for example, by the above-mentioned Execution by a processor in the device embodiment can cause the above-mentioned processor to execute the data encryption method in the above-mentioned embodiment, for example, execute the above-described method steps S100 to S300 in FIG. 2 , method steps S110 in FIG. 3 , and Method steps S210 to S220 in 4, method steps S230 to S240 in FIG. 5, method steps S310 in FIG. 6, method steps S120 in FIG. 7, method steps S400 in FIG. 8, method steps S410 in FIG. 9 to S420 or the method steps S430 to S440 in FIG. 10 .

The embodiment of this application includes a data encryption method applied to the attribute authorization center in the attribute encryption system, including: obtaining the system public key and the system master key; generating information and accessing the The user's identity information is obtained from the user's private key of the accessing user. The identity information is bound to the accessing user alone, and the key generation information is associated with the accessing user; In the case of , according to the user private key of the accessing user, the ciphertext is decrypted to obtain the plaintext to be encrypted. According to the solution provided by the embodiment of this application, when the system public key, the system master key, and the key generation information associated with the access user are obtained, by embedding the user private key of the access user, it is uniquely bound to the access user The identity information of the user, and then encrypt the data according to the user's private key of the accessing user. When a malicious user illegally discloses the user's private key and the key is leaked, the attribute authorization center can accurately find out which The user is a malicious user who deliberately leaks the key, so as to further revoke the authority of the malicious user, thereby effectively correcting the loopholes of the attribute encryption system and improving the security performance of the attribute encryption system.

Those skilled in the art can understand that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware and an appropriate combination thereof. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit . Such software may be distributed on computer readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As known to those of ordinary skill in the art, the term computer storage media includes both volatile and nonvolatile media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules, or other data. permanent, removable and non-removable media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tape, magnetic disk storage or other magnetic storage devices, or can Any other medium used to store desired information and which can be accessed by a computer. Furthermore, as is well known to those of ordinary skill in the art, communication media typically embody computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .

The above is a specific description of several implementations of the present application, but the application is not limited to the above-mentioned implementations, and those skilled in the art can also make various equivalent deformations or replacements without violating the essence of the application. Equivalent modifications or replacements are all within the scope defined by the claims of the present application.

Claims

A data encryption method applied to an attribute authorization center in an attribute encryption system, comprising:

Obtain the system public key and system master key;

According to the system public key, the system master key, the obtained key generation information and the identity information of the access user, the user private key of the access user is obtained, wherein the identity information is separately bound to the an access user, the key generation information is associated with the access user;

When it is determined that the plaintext to be encrypted of the accessing user is encrypted to obtain a ciphertext, according to the user private key of the accessing user, the ciphertext is decrypted to obtain the plaintext to be encrypted.
The data encryption method according to claim 1, wherein there are multiple access users; the method further comprises:

Perform identity tracking on the plurality of access users according to the identity information of the plurality of access users, the user private key, and the key generation information associated with the access users.
The data encryption method according to claim 2, wherein, according to the identity information of multiple access users, the user private key, and the key generation information associated with the access user, the Identity tracking of multiple said access users, including:

processing the identity information of multiple access users, the user private key, and the key generation information associated with the access users to generate a key leakage tracking list carrying multiple sets of data verification information, Wherein, a set of the data verification information includes the identity information of the accessing user and the user private key;

Perform identity tracking on each of the accessing users according to the key leakage tracking list.
The data encryption method according to claim 2, wherein, according to the identity information of multiple access users, the user private key, and the key generation information associated with the access user, the Identity tracking of multiple said access users, including:

determining key leakage tracking conditions according to the identity information of multiple access users, the user private key, and the key generation information associated with the access users;

Perform identity tracking on each of the accessing users according to the key leakage tracking conditions.
The data encryption method according to claim 1, wherein the key generation information is an access control structure associated with the accessing user; Key generation information and the identity information of the access user to obtain the user private key of the access user, including:

performing key generation processing on the system public key, the system master key, and the acquired access control structure to obtain a first attribute private key;

inserting the identity information of the visiting user into the first attribute private key to obtain the user private key of the visiting user.
The data encryption method according to claim 5, wherein said encrypting the plaintext to be encrypted by the accessing user to obtain the ciphertext comprises:

According to the system public key and the attribute set of the accessing user, encrypt the plaintext to be encrypted of the accessing user to obtain ciphertext.
The data encryption method according to claim 1, wherein the key generation information is a set of attributes associated with the accessing user; the key obtained according to the system public key, the system master key, and the Generate information and the identity information of the access user to obtain the user private key of the access user, including:

performing key generation processing on the system public key, the system master key, and the acquired attribute set to obtain a second attribute private key;

inserting the identity information of the visiting user into the second attribute private key to obtain the user private key of the visiting user.
The data encryption method according to claim 7, wherein said encrypting the plaintext to be encrypted by the accessing user to obtain the ciphertext comprises:

According to the system public key and the access control structure of the access user, encrypt the plaintext to be encrypted of the access user to obtain ciphertext.
The data encryption method according to claim 1, wherein said obtaining the system public key and the system master key comprises:

Initialize the input security parameters to obtain the system public key and system master key.
An attribute authorization center, comprising: a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein, when the processor executes the computer program, any one of claims 1 to 9 is realized. The data encryption method described in the item.
A computer-readable storage medium storing computer-executable instructions for executing the data encryption method according to any one of claims 1-9.