CN105100083A - Attribute-based encryption method and attribute-based encryption system capable of protecting privacy and supporting user Undo - Google Patents

Abstract

The invention discloses an attribute-based encryption method and an attribute-based encryption system capable of protecting privacy and supporting user Undo. The attribute-based encryption system comprises eight modules including a Setup module, a KeyGen module, an Encrypt module, a Decrypt module, a ReKey module, a TKGen module, a TK-Encrypt module and a TK-Decrypt module. Moreover, the method provided by the invention can solve the problem of privacy protection in cloud computation, and support user Undo and safe outsourcing operations to a ciphertext. Meanwhile, a function of authentication to transformed ciphertext is provided, illegal substitution of the transformed ciphertext and adverse consequences caused by illegal substitution are prevented, and system flexibility is high.

Description

A kind of secret protection and support user cancel based on encryption attribute method and system

Technical field

The invention belongs to information security field, relate to a kind of encryption technology based on attribute, specifically a kind of user of support cancel, protection privacy of user, supported data outsourcing support the encryption method based on attribute of correctness of checking conversion ciphertext.

Background technology

Today, in the information age that computer is widely used, flourish due to network technology, the concept of cloud computing is in addition suggested in succession, and bulk information is stored in public high in the clouds and computer system has in digital form become a kind of trend.Information be conveyed through common signal channel, and these systems and common signal channel when in the air standby be very fragile, than being easier under attack and destroying, if stolen being not easy of information is found, consequence is quite serious.In today of the development of cloud computing technology, the demand of people to the worry of cloud computing data storage safety and safety measure can be further strong, so it is a kind of inevitable for data being stored in an encrypted form public high in the clouds, do not have the visitor of decrypted rights can only intercept ciphertext from public high in the clouds, and corresponding plaintext can not be obtained.Can does how about guarantee only have the user of reasonable authority decrypting ciphertext instead of provide the private key of data owner oneself or data owner and share data have authority deciphering person to those one by one?

Within 2005, the concept based on encryption attribute is introduced into, the application value special because of it and the popularity of use scenes are being subject to all circles and are more and more attracting attention, this encryption system utilizes access control structure to carry out the decryption capabilities of user in control system, and becomes one of the most effective approach.Encryption system (ABE) based on attribute can solve the problem of above-mentioned large data in cloud computing well.In this encryption system, encipherer need not know the detailed identification information of deciphering person, but has grasped a series of description attribute of deciphering person, and this description attribute is tightr than contacting of detailed identification information and user.Based in the cryptographic system of attribute, be use attribute definition access rule in ciphering process, when phase " is mated " under this access rule for key and the ciphertext of user, decrypted user just can decrypting ciphertext.In order to better represent the flexibility of system, the encryption based on attribute is divided into two classes, i.e. the encryption based on attribute (KP-ABE) of key strategy and the encryption based on attribute (CP-ABE) of Ciphertext policy.In KP-ABE, ciphertext is marked by multitude of descriptive property set, and the access strategy that the key of user and authorization center are specified is associated.In CP-ABE, the key of user is marked by multitude of descriptive property set, and the access strategy that ciphertext and encipherer specify is associated.

CP-ABE mechanism is comparatively close to the application scenarios in reality.Suppose that each user obtains key according to self-condition or attribute from authorization center, then encipherer formulates the access control to message, is more suitable for the application of access control class, as the access, electronic medical system etc. of social network sites.Basic CP-ABE scheme comprises system parameter setting (Setup), secret generating (KeyGeneration), encryption (Encryption) and deciphering (Decryption) four modules.

1. system parameter setting module (Setup)

Input security parameter σ, the open parameter p arams and main private key MK of retrieval system.

2. key production module (KeyGen)

It is that in system, user generates private key that authorization center runs key schedule.Authorization center inputs main private key MK, the descriptive attributes collection of user, calculates the private key SK that user property set is relevant _l.Here L represents the property set corresponding with user.

3. encrypting module (Encryption)

Input system open parameter p arams, message M, and access strategy W, encipherer's encryption obtains a ciphertext CT.Only have when the user property collection L be associated with private key meets access strategy W time, user could decrypting ciphertext CT.

4. deciphering module (Decryption)

Recipient inputs his decruption key SK _land ciphertext CT, deciphering obtains message M.Only have when the user property collection L be associated with private key meets access strategy W time, user could decrypting ciphertext CT.

As can be seen from above-mentioned flow process; although the encryption system based on attribute of Ciphertext policy can provide safe access control beyond the clouds; but access strategy sends to recipient together with ciphertext; recipient can decipher and will obtain relevant effective information from access strategy; any intermediate user can obtain the information of the list of potential recipient by access strategy; thus revealed the privacy of user, this is engaged in business activity to some or wishes that the encipherer protected access strategy is not the favourable thing of part.So the scheme based on attribute of a structure hiding access structure has more realistic meaning.

It can also be seen that from the flow process of above-mentioned CP-ABE scheme, authorization center is responsible for distribution private key and management attribute.In actual life, especially in present large data age, the regular change of Chang Huicun old and new users in systems in which, this with regard to the authority that requires system to change flexibly to authorize user to ensure fail safe and the flexibility of system.So the CP-ABE scheme that structure one support user cancels can improve the flexibility of system greatly.

In this day and age, the data grows in high in the clouds is accessed by resource-constrained wireless side user manyly, wireless user is sayed, calculation cost and communication cost are the factors first needing to consider, and the cost expending with communicate of traditional battery brought based on a large amount of Bilinear map computings of encryption attribute scheme in decryption oprerations is uneconomic, is contracted out to cloud and stores provider so part is calculated and carry out operating very large economy, the well system expandability and access property.May exist in actual life high in the clouds misdeed or to high in the clouds malicious attack, conversion ciphertext correctness cannot verify to there is ciphertext and illegally replaced thus cause adverse consequences.

Based on above analysis, the present inventor carries out Improvement to the existing encipherment scheme based on attribute, thus improves the flexibility of system, and ensure that the privacy of user, has more realistic meaning.

Summary of the invention

Goal of the invention: for the above-mentioned defect based on encryption attribute, a kind of completely hiding access structure is provided, supports that user cancels, supported data outsourcing also supports that the encryption method based on attribute of the correctness of ciphertext is changed in checking, the flexibility of raising system, ensure the privacy of user, reduce total communications cost of the user of wireless side, after ensure that conversion, ciphertext is not illegally replaced and avoids causing adverse consequences.

Technical scheme: a kind of secret protection and support user cancel based on encryption attribute method and system, this encryption system comprises eight modules, is specially:

System parameter setting module: the open parameter of generation system, and send to other modules; Key production module: the private key for decrypt generating user according to the community set of user; Encrypting module: for encrypting messages; Deciphering module: for decrypt; Re-encryption module: generate re-encrypted private key, and upgrade the private key of ciphertext and user; Transition key generation module: T.G Grammar key and recovery private key; Conversion portion ciphertext module: the part ciphertext on original ciphertext basis after T.G Grammar; Conversion deciphering module: for deciphering the ciphertext after conversion;

These encryption method concrete steps are as follows:

Step 1, the open parameter p arams and master key MK of initialization system;

Step 2, according to the open parameter p arams of described system, generates the private key SK of user _l;

Step 3, to be encrypted message M according to the open parameter p arams of described system and selected access strategy and to obtain ciphertext CT;

Step 4, discloses the private key SK of parameter p arams and user according to described system _lciphertext CT is decrypted and obtains message M;

Step 5, according to the open parameter p arams of described system and group private key u _xgenerate re-encrypted private key ck _vn, obtain the ciphertext CT after re-encryption _vn, and upgrade the part private key D of authorized user _{2, vn};

Step 6, discloses the private key SK of parameter p arams and user according to described system _l, T.G Grammar cipher key T K _lwith recovery private key HK _l;

Step 7, according to described system open parameter p arams, original cipher text CT and transition key TK _l, the ciphertext CT ' after T.G Grammar;

Step 8, according to the ciphertext CT ' after described system open parameter p arams, original cipher text CT, conversion and recovery private key HK _l, message M is obtained to decrypt ciphertext.

Further, described step 1 also comprises:

Step 1-1, chooses Big prime p, p factorial method cyclic group G and G _t, bilinear map e:G × G → G _t; Generator g is selected, u, v, d from G;

Step 1-2, authorization center Stochastic choice t _i,j∈ Z _p(i ∈ [1, n], j ∈ [1, n _i]),

{ α, g ^α, δ }, as its private key; Calculate Y=e (g, g) ^α, define a hash function H: here expression set 1,2 ..., p-2, p-1};

Step 1-3, data owner selects random value as the private key SK of data owner _dO, and calculate its PKI be sent to public domain, SK _dOprivate key as data owner is not revealed; Here expression set 1,2 ..., p-2, p-1};

Step 1-4, authorization center arranges initial version vn=0, and selects random value as group private key GSK, and the user of registration will be sent under its line, calculate public domain is sent to as group PKI;

The open parameter of system wherein (i ∈ [1, n], j ∈ [1, n _i]), system master key is MK={ α, g ^α, δ }, the private key of data owner is SK _dO={ β };

Wherein, in step 1-2, for two different user property collection L and L ', should meet ${\mathrm{\Σ}}_{v_{i,j}\∈L}{t}_{i,j}\≠{\mathrm{\Σ}}_{v_{i,j}\∈L^{\′}}{t}_{i,j}.$

Further, described step 2 also comprises:

Step 2-1, the property set L of input user;

Step 2-2, authorization center random selecting r, ${\mathrm{\λ}}_i\∈Z_p^{*},$ And calculate as the private key of user, wherein t _i,j∈ L _i(i ∈ [1, n], j ∈ [1, n _i]); The user authorized is calculated simultaneously and version number vn=0 is set; Here expression set 1,2 ..., p-2, p-1};

The private key that authorization center is presented to user is ${\mathrm{SK}}_L=(D_0,{\{D_{i,1},D_{i,2}\}}_{i\∈\[1,n\],j\∈\[1,n_i\]},D_2).$

Further, described step 3 also comprises:

Step 3-1, encipherer selects clear-text message m ∈ G _t, a random message m ' ∈ G _t, access structure W=[W ₁, W ₂..., W _n], and calculate here H is that G arrives cryptographic Hash function;

Step 3-2, for the message m will carrying out sharing, encipherer's random selecting and calculate $C_0=m\·Y^s\·e{(g,g)}^{u_{0}s}=m\·e{(g,g)}^{\mathrm{\α}s+u_{0}s},C_1=g^{\mathrm{\β}s},C_2=g^{\mathrm{\δ}s};$ Encipherer arranges relevant properties cipher text part, if s is the root node of access structure, it is unmarked for setting all childs, mark root node is for mark, for each unlabelled non-leaf nodes recursively carries out following computing: non-leaf nodes is AND gate, and its child state is unmarked, select random value and the value arranging last child is and mark this node for mark; If otherwise OR-gate, the value marking the arbitrary node under this node is s, and arranges this node for mark; For leaf node, encipherer calculates as follows: step 3-3, for will random message m ', encipherer's random selecting and calculate

$C_3=m^{\′}\·Y^{s^{\′}}\·e{(g,g)}^{u_0{s}^{\′}}=m^{\′}\·e{(g,g)}^{{\mathrm{\αs}}^{\′}+u_0{s}^{\′}},$ C ₄=g ^{β s '}, C ₅=g ^{δ s '}; Encipherer arranges relevant properties cipher text part, if the root node that s ' is access structure, it is unmarked for setting all childs, mark root node is for mark, for each unlabelled non-leaf nodes recursively carries out following computing: non-leaf nodes is AND gate, and its child state is unmarked, select random value and the value arranging last child is and mark this node for mark; If otherwise OR-gate, the value marking the arbitrary node under this node is s ', and arranges this node for mark; For leaf node, encipherer calculates as follows: here expression set 1,2 ..., p-2, p-1};

Step 3-4, encipherer arranges version number vn=0; Encrypting the ciphertext obtained is $CT=\{vn=0,\hat{c},{\mathrm{CT}}_{own1},{\mathrm{CT}}_{own2}\},{\mathrm{CT}}_{own1}=\{C_0,C_1,C_2,{\left\{C_{i,j,1},C_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\},$ ${\mathrm{CT}}_{own2}=\{C_3,C_4,C_5,{\left\{{\stackrel{\‾}{C}}_{i,j,1},{\stackrel{\‾}{C}}_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\}.$

Further, described step 4 also comprises:

Step 5-1, deciphering person checks private key SK _lwith the version number of ciphertext CT, if inconsistent, upgrade private key to authorization center application, if unanimously, then continue step below;

Step 5-2, if deciphering person does not have the attribute mated with access strategy subscript, then deciphers failure, otherwise can recover expressly by step below;

Deciphering person calculates $F={\Π}_{i=1}^{n}e(C_{i,j,2},D_{i,2}),O={\Π}_{i=1}^{n}e(C_{i,j,1},D_{i,1}),$ S＝e(C ₁,D ₀)， $B={\Π}_{i=1}^{n}e(C_1,D_2),$ Calculate $m=\frac{C_0\·F}{O\·S\·B};$ Calculate simultaneously $F^{\′}={\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,2},D_{i,2}),$ $O^{\′}={\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,1},D_{i,1}),$ S′＝e(C ₄,D ₀)， $B^{\′}={\Π}_{i=1}^{n}e(C_4,D_2),$ Calculate simultaneous verification if then output message m, otherwise export ⊥.

Further, described step 5 also comprises:

Step 5-1, authorization center receives the information that user cancels, and selects new random value as new group private key GSK _x, wherein x is that now version number identifies, and sends to them when the validated user in system needs visit data by the line lower channel of safety; Here Z _pexpression set 1,2 ..., p-1, p};

Step 5-2, authorization center upgrades the private component of authorized user

Step 5-3, authorization center calculates re-encrypted private key and is and sending to cloud to store provider, cloud stores the new ciphertext CT that provider's calculated version number is vn=x _vn;

For the Part I CT of ciphertext _{own1, vn}, calculate as follows:

$C_{0,vn}=C_0\·e(C_2,{\mathrm{ck}}_{vn})=m\·e{(g,g)}^{\mathrm{\α}s+u_{0}s}\·e(g^{\mathrm{\δ}s},g^{\frac{u_x-u_0}{\mathrm{\δ}}})=m\·e{(g,g)}^{\mathrm{\α}s+u_{x}s};$

Similarly, for the Part II CT of ciphertext _{own2, vn}, calculate as follows:

$C_{3,vn}=C_3\·e(C_5,{\mathrm{ck}}_{vn})=m^{\′}\·e{(g,g)}^{{\mathrm{\αs}}^{\′}+u_0{s}^{\′}}\·e(g^{{\mathrm{\δs}}^{\′}},g^{\frac{u_x-u_0}{\mathrm{\δ}}})=m\·e{(g,g)}^{{\mathrm{\αs}}^{\′}+u_x{s}^{\′}};$

Ciphertext CT after renewal _vn={ CT _{own1, vn}, CT _{own2, vn}as follows:

${\mathrm{CT}}_{own1,vn}=\{vn=x,\hat{c},C_{0,vn},C_1,C_2,{\left\{C_{i,j,1},C_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\}$

${\mathrm{CT}}_{own2,vn}=\{vn=x,\hat{c},C_{3,vn},C_4,C_5,{\left\{{\stackrel{\‾}{C}}_{i,j,1},{\stackrel{\‾}{C}}_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\}.$

Further, described step 6 also comprises:

Step 6-1, authorization center selects random value with the private key of system common parameter params and user ${\mathrm{SK}}_L=(D_0,\∀v_{i\∈\[1,n\],j\∈\[1,n_i\]}\∈L:\{D_{i,1},D_{i,2}\},D_2)$ As input, and calculate transition key and be ${\mathrm{TK}}_L=\{{D_0}^{\′}={D_0}^{\frac{1}{z}},{D_2}^{\′}={D_2}^{\frac{1}{z}},{\left\{{D_{i,1}}^{\′}={D_{i,1}}^{\frac{1}{z}},{D_{i,2}}^{\′}={D_{i,2}}^{\frac{1}{z}}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\},$ And preserve HK _l=z as recovery key to user, wherein, Z _pexpression set 1,2 ..., p-1, p}.

Further, described step 7 also comprises:

Step 7-1, cloud stores provider by ciphertext CT={CT _own1, CT _own2and transition key TK _l={ D ₀', D ₂', { D _{i, 1}', D _{i, 2}' _{i ∈ [1, n]}as input, the part ciphertext calculated after conversion is as follows:

$K_{own1}^{\′}=\frac{{\Π}_{i=1}^{n}e(C_{i,j,1},D_{i,1}^{\′})\·e(C_1,D_0^{\′})\·e(C_1,D_2^{\′})}{{\Π}_{i=1}^{n}e(C_{i,j,2},D_{i,2}^{\′})}=e{(g,g)}^{\frac{\mathrm{\α}s+u_{0}s}{z}}$

$K_{own2}^{\′}=\frac{{\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,1},D_{i,1}^{\′})\·e(C_4,D_0^{\′})\·e(C_4,D_2^{\′})}{{\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,2},D_{i,2}^{\′})}=e{(g,g)}^{\frac{{\mathrm{\αs}}^{\′}+u_0{s}^{\′}}{z}}$

After exporting conversion, ciphertext is as follows: ${\mathrm{CT}}^{\′}=\{vn,K^{\′}=\hat{c},K_1=C_0,K_{own1}^{\′},K_2=C_3,K_{own2}^{\′}\}.$

Described step 8 also comprises:

Step 8-1, it is as follows that deciphering person carries out inspection, if k ₁≠ C ₀, K ₂≠ C ₃, then ⊥ is exported; Otherwise the step continued below;

Step 8-2, if deciphering person does not have the attribute mated with access strategy subscript, then deciphers failure, otherwise can recover expressly by step below; 6 deciphering persons calculate m=K ₁/ K ' _own1 ^z, m '=K ₂/ K ' _own2 ^z, and verify K '=u ^{h (m)}v ^{h (m ')}d carrys out correct decrypting ciphertext CT and obtains message m; Otherwise algorithm failure also exports ⊥.

The mathematical knowledge explanation that the present invention is used:

1, Bilinear map (BilinearPairing)

The character that the basic definition briefly introducing bilinear map need meet with it.

Make G, G _tbe the multiplication loop group on two p rank, wherein p is prime number, and g is the generator of G.The bilinear map defined on two groups is: e:G × G → G _t, and meet character below:

(1) bilinearity: e (g ^a, g ^b)=e (g, g) ^ab, to all g ∈ G, a, b ∈ Z _pall set up.

(2) non-degeneracy: e (g, g) ≠ 1.

(3) computability: there is efficient algorithm to calculate e (g, g), all sets up all g ∈ G.

2, access structure (AccessStructure)

If { P ₁, P ₂..., P _nit is the set of n participant.If represent the set that the subset gathered by participant is formed, B, C represent the subset that participant gathers, for all B, C: if B ∈ A and so then say that A is a dull access structure.The subset belonging to the participant of A is called authorization set, and the subset not belonging to the participant of A is called unauthorized collection.

3, the supposition of bilinearity DH (DecisionalBilinearDiffie-Hellman) difficult problem is judged

Given p rank cyclic group G, wherein p is prime number, and g is the generator of G.DBDH problem then on group G is: known t ₁, t ₂, t ₃, z is from Z _prandom selecting, distinguish with the probability of can not ignore $(A,B,C,Z)=(g^{t_1},g^{t_2},g^{t_3},e{\left(g,g\right)}^{t_1{t}_2{t}_3})$ With $(A,B,C,Z)=(g^{t_1},g^{t_2},g^{t_3},e{\left(g,g\right)}^z)$ These two tuples.Here Z _pexpression set 1,2 ..., p-1, p}.

Beneficial effect: compared with prior art, a kind of encryption method based on attribute provided by the present invention, compared with the common encryption method based on attribute, supports user and cancels, improve the flexibility of system.In addition, this encipherment scheme reaches hides access structure completely to protect the privacy of user, prevents the user of malice from obtaining the property value needed for decrypted user by access strategy, thus obtains the privacy information of user.The also supported data outsourcing of this encipherment scheme, and the correctness supporting checking conversion ciphertext, thus reduce total communications cost of the user of wireless side, and after ensure that conversion, ciphertext is not illegally replaced and avoids causing adverse consequences.Therefore a kind of encryption method based on attribute provided by the present invention is a kind of safe and effective flexibly based on the encryption method of attribute.

Accompanying drawing explanation

Fig. 1 is the operating diagram of encryption system of the present invention;

Fig. 2 is the flow chart of encryption method of the present invention.

Embodiment

Below in conjunction with the drawings and specific embodiments, illustrate the present invention further.

Below in conjunction with accompanying drawing, detailed process of the present invention is described.

As shown in Figure 1, a kind of ABE system provided by the invention comprises following eight modules:

1. system parameter setting module (Setup): input security parameter κ, the open parameter p arams and master key MK of retrieval system.

2. key production module (KeyGen): authorization center is run key schedule and generated private key for user.The open parameter p arams of authorization center input system, a descriptive attributes collection L, calculates the private key SK that user is associated with property set L _l.

3. encrypting module (Encrypt): the open parameter p arams of input system, message m, access strategy W, encipherer's encryption obtains a ciphertext CT.To only have when the user property collection L be associated with private key meets access strategy and by ciphertext verification of correctness, user could decrypting ciphertext CT.

4. deciphering module (Decrypt): recipient inputs decruption key SK _land ciphertext CT, deciphering obtains message m.

5. re-encryption module (ReKey): authorization center is according to described system open parameter p arams, master key MK, group private key u _xgenerate re-encrypted private key ck _vn, obtain the ciphertext CT after re-encryption _vn, and upgrade the part private key D of authorized user _{2, vn}.

6. transition key generation module (TKGen): authorization center discloses the private key SK of parameter p arams and user according to system _l, T.G Grammar cipher key T K _lwith recovery private key HK _l.

7. conversion portion ciphertext module (TK-Encrypt): system open parameter p arams, original cipher text CT and transition key TK _l, the ciphertext CT ' after T.G Grammar.

8. change deciphering module (TK-DEcrypt): authorization center is according to the ciphertext CT ' after system open parameter p arams, original cipher text CT, conversion and recover private key HK _l, message M is obtained to decrypt ciphertext.

The modules of flow chart to this encryption system below in conjunction with this method is specifically described.

As shown in Figure 2, a kind of execution of the encryption method based on attribute flow process provided by the invention is specific as follows:

The system parameter setting modules A of this system specifically comprises following operation, it is characterized in that described step 1 comprises:

Choose Big prime p, p factorial method cyclic group G and G _t, bilinear map e:G × G → G _t.Generator g is selected, u, v, d from G.

Authorization center Stochastic choice t _i,j∈ Z _p(i ∈ [1, n], j ∈ [1, n _i]), { α, g ^α, δ }, as its private key.Calculate Y=e (g, g) ^α, define a hash function here expression set 1,2 ..., p-2, p-1}.

Data owner selects random value as the private key SK of data owner _dO, and calculate its PKI be sent to public domain, SK _dOprivate key as data owner is not revealed.Here expression set 1,2 ..., p-2, p-1}.

Authorization center arranges initial version vn=0, and selects random value as group private key GSK, and (i ∈ [1, n], j ∈ [1, n _i]), system master key is MK={ α, g ^α, δ }, the private key of data owner is SK _dO={ β }.

In step 1-3, for two different user property collection L and L ', should meet ${\mathrm{\Σ}}_{v_{i,j}\∈L}{t}_{i,j}\≠{\mathrm{\Σ}}_{v_{i,j}\∈L^{\′}}{t}_{i,j}.$

Key production module B specifically comprises following operation:

The property set of user is L.

Authorization center random selecting $r,{\mathrm{\λ}}_i\∈Z_p^{*},$ And calculate $D_0=g^{\frac{\mathrm{\α}-\mathrm{\γ}}{\mathrm{\β}}},D_{i,1}=g^{r+{\mathrm{\λ}}_i{t}_{i,j}},D_{i,2}=g^{{\mathrm{\λ}}_i}$ Do

For the private key of user, wherein t _i,j∈ L _i(i ∈ [1, n], j ∈ [1, n _i]).The user authorized is calculated simultaneously

and version number vn=0 is set.Here expression set 1,2 ..., p-2, p-1}.

The private key that authorization center is presented to user is ${\mathrm{SK}}_L=(D_0,{\left\{D_{i,1},D_{i,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]},D_2).$

Encrypting module C specifically comprises following operation:

Encipherer selects clear-text message m ∈ G _t, a random message m ' ∈ G _t, access structure W=[W ₁, W ₂..., W _n], and calculate here H is that G arrives cryptographic Hash function.

For the message m will carrying out sharing, encipherer's random selecting and calculate c ₁=g ^{β s}, C ₂=g ^{δ s}.Encipherer arranges relevant properties cipher text part, if s is the root node of access structure, it is unmarked for setting all childs, mark root node is for mark, for each unlabelled non-leaf nodes recursively carries out following computing: non-leaf nodes is AND gate, and its child state is unmarked, select random value and the value arranging last child is and mark this node for mark.If otherwise OR-gate, the value marking the arbitrary node under this node is s, and arranges this node for mark.For leaf node, encipherer calculates as follows:

For will random message m ', encipherer's random selecting and calculate c ₄=g ^{β s '}, C ₅=g ^{δ s '}.Encipherer arranges relevant properties cipher text part, if the root node that s ' is access structure, it is unmarked for setting all childs, mark root node is for mark, for each unlabelled non-leaf nodes recursively carries out following computing: non-leaf nodes is AND gate, and its child state is unmarked, select random value and the value arranging last child is and mark this node for mark.If otherwise OR-gate, the value marking the arbitrary node under this node is s ', and arranges this node for mark.For leaf node, encipherer calculates as follows: here expression set 1,2 ..., p-2, p-1}.

Encipherer arranges version number vn=0.Encrypting the ciphertext obtained is ${\mathrm{CT}}_{own1}=\{C_0,C_1,C_2,{\left\{C_{i,j,1},C_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\},{\mathrm{CT}}_{own2}=\{C_3,C_4,C_5,{\left\{{\stackrel{\‾}{C}}_{i,j,1},{\stackrel{\‾}{C}}_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\}.$

Deciphering module D specifically comprises following operation:

Deciphering person checks private key SK _lwith the version number of ciphertext CT, if inconsistent, upgrade private key to authorization center application, if unanimously, then continue step below.

If deciphering person does not have the attribute mated with access strategy subscript, then decipher failure, otherwise can be recovered expressly by step below.

Deciphering person calculates $F={\Π}_{i=1}^{n}e(C_{i,j,2},D_{i,2}),O={\Π}_{i=1}^{n}e(C_{i,j,1},D_{i,1}),$ S＝e(C ₁,D ₀)， $B={\Π}_{i=1}^{n}e(C_1,D_2),$ Calculate $m=\frac{C_0\·F}{O\·S\·B}.$ Calculate simultaneously $F^{\′}={\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,2},D_{i,2}),$ $O^{\′}={\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,1},D_{i,1}),$ S′＝e(C ₄,D ₀)， $B^{\′}={\Π}_{i=1}^{n}e(C_4,D_2),$ Calculate simultaneous verification if then output message m, otherwise export ⊥.

Re-encryption module E specifically comprises following operation:

Authorization center receives the information that user cancels, and selects new random value as new group private key GSK _x, wherein x is that now version number identifies, and sends to them when the validated user in system needs visit data by the line lower channel of safety.Here Z _pexpression set 1,2 ..., p-1, p}.

Authorization center upgrades the private component of authorized user

Authorization center calculates re-encrypted private key and sending to cloud to store provider, cloud stores the new ciphertext CT that provider's calculated version number is vn=x _vn.

For the Part I CT of ciphertext _{own1, vn}, calculate as follows:

$C_{0,vn}=C_0\·e(C_2,{\mathrm{ck}}_{vn})=m\·e{(g,g)}^{\mathrm{\α}s+u_{0}s}\·e(g^{\mathrm{\δ}s},g^{\frac{u_x-u_0}{\mathrm{\δ}}})=m\·e{(g,g)}^{\mathrm{\α}s+u_{x}s}.$

Similarly, for the Part II CT of ciphertext _{own2, vn}, calculate as follows:

$C_{3,vn}=C_3\·e(C_5,{\mathrm{ck}}_{vn})=m^{\′}\·e{(g,g)}^{{\mathrm{\αs}}^{\′}+u_0{s}^{\′}}\·e(g^{{\mathrm{\δs}}^{\′}},g^{\frac{u_x-u_0}{\mathrm{\δ}}})=m\·e{(g,g)}^{{\mathrm{\αs}}^{\′}+u_x{s}^{\′}}.$

Ciphertext CT after renewal _vn={ CT _{own1, vn}, CT _{own2, vn}as follows:

${\mathrm{CT}}_{own1,vn}=\{vn=x,\hat{c},C_{0,vn},C_1,C_2,{\left\{C_{i,j,1},C_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\}$

${\mathrm{CT}}_{own2,vn}=\{vn=x,\hat{c},C_{3,vn},C_4,C_5,{\left\{{\stackrel{\‾}{C}}_{i,j,1},{\stackrel{\‾}{C}}_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\}$

Transition key generation module F specifically comprises following operation:

Authorization center selects random value with the private key of system common parameter params and user for recovering key to user.Here Z _pexpression set 1,2 ..., p-1, p}.

Conversion portion ciphertext module specifically comprises following operation:

Cloud stores provider by ciphertext CT={CT _own1, CT _own2and transition key TK _l={ D ₀', D ₂', { D _{i, 1}', D _{i, 2}' _{i ∈ [1, n]}as input, the part ciphertext calculated after conversion is as follows:

$K_{own1}^{\′}=\frac{{\Π}_{i=1}^{n}e(C_{i,j,1},D_{i,1}^{\′})\·e(C_1,D_0^{\′})\·e(C_1,D_2^{\′})}{{\Π}_{i=1}^{n}e(C_{i,j,2},D_{i,2}^{\′})}=e{(g,g)}^{\frac{\mathrm{\α}s+u_{0}s}{z}}$

$K_{own2}^{\′}=\frac{{\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,1},D_{i,1}^{\′})\·e(C_4,D_0^{\′})\·e(C_4,D_2^{\′})}{{\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,2},D_{i,2}^{\′})}=e{(g,g)}^{\frac{{\mathrm{\αs}}^{\′}+u_0{s}^{\′}}{z}}$

After exporting conversion, ciphertext is as follows: ${\mathrm{CT}}^{\′}=\{vn,K^{\′}=\hat{c},K_1=C_0,K_{own1}^{\′},K_2=C_3,K_{own2}^{\′}\}.$

Conversion deciphering module specifically comprises following operation:

It is as follows that deciphering person carries out inspection, if k ₁≠ C ₀, K ₂≠ C ₃, then ⊥ is exported.Otherwise the step continued below.

If deciphering person does not have the attribute mated with access strategy subscript, then decipher failure, otherwise can be recovered expressly by step below.Deciphering person calculates m=K ₁/ K ' _own1 ^z, m '=K ₂/ K ' _own2 ^z, and verify K '=u ^{h (m)}v ^{h (m ')}d carrys out correct decrypting ciphertext CT and obtains message m.Otherwise algorithm failure also exports ⊥.

More than set forth and describe general principle of the present invention, major advantage and operating procedure.

Below the situation be applied in cloud computing ABE system as above is described.

According to step of the present invention, when data will be stored into public high in the clouds by user A time, authorization center executing arithmetic obtains common parameter params, and user A formulates an access strategy W and is encrypted the data that will store under common parameter params.When certain user B wants the data of accessing this user encryption, he first according to self attributes to authorization center application private key, if when the community set of user B meets the access strategy and verification of correctness by ciphertext that encipherer formulates, B can utilize the private key of oneself, common parameter params is decrypted ciphertext and obtains expressly.Supposing the system Central Plains has user C, D to leave office, and authorization center needs to carry out re-encryption to ensure security of system to the ciphertext of the decrypted rights that C, D have, and is that in system, other users upgrade private key.Because this programme can hide access strategy completely, therefore namely deciphering person allows to decipher the occurrence of also not knowing access strategy, thus protects the privacy of user.In addition, supported data outsourcing is gone back in this programme support, and provides the verification of correctness function to conversion ciphertext, thus reduces total communications cost of the user of wireless side, and after ensure that conversion, ciphertext is not illegally replaced and avoids causing adverse consequences, improves the flexibility of system.

Those of ordinary skill in the art should understand, and the present invention does not limit by above-mentioned example, and the description of above-mentioned example, just for general principle of the present invention and feature are described, the basis of above-mentioned example can be associated other advantage and distortion easily.Not deviating from the scope of present inventive concept, the technical scheme that those of ordinary skill in the art can be obtained by various equivalent replacement according to above-mentioned instantiation, but within these technical schemes scope that all should be included in claim of the present invention and equivalent scope thereof.

Claims (9)

1. secret protection and support user cancel based on an encryption attribute method and system, it is characterized in that: this encryption system comprises eight modules, is specially:

System parameter setting module: the open parameter of generation system, and send to other modules;

Key production module: the private key for decrypt generating user according to the community set of user;

Encrypting module: for encrypting messages;

Deciphering module: for decrypt;

Re-encryption module: generate re-encrypted private key, and upgrade the private key of ciphertext and user;

Transition key generation module: T.G Grammar key and recovery private key;

Conversion portion ciphertext module: the part ciphertext on original ciphertext basis after T.G Grammar;

Conversion deciphering module: for deciphering the ciphertext after conversion;

These encryption method concrete steps are as follows:

Step 1, the open parameter p arams and master key MK of initialization system;

Step 2, according to the open parameter p arams of described system, generates the private key SK of user _l;

Step 3, to be encrypted message M according to the open parameter p arams of described system and selected access strategy and to obtain ciphertext CT;

Step 4, discloses the private key SK of parameter p arams and user according to described system _lciphertext CT is decrypted and obtains message M;

Step 5, according to the open parameter p arams of described system and group private key u _xgenerate re-encrypted private key ck _vn, obtain the ciphertext CT after re-encryption _vn, and upgrade the part private key D of authorized user _{2, vn};

Step 6, discloses the private key SK of parameter p arams and user according to described system _l, T.G Grammar cipher key T K _lwith recovery private key HK _l;

Step 7, according to described system open parameter p arams, original cipher text CT and transition key TK _l, the ciphertext CT ' after T.G Grammar;

Step 8, according to the ciphertext CT ' after described system open parameter p arams, original cipher text CT, conversion and recovery private key HK _l, message M is obtained to decrypt ciphertext.

2. a kind of secret protection according to claim 1 and support user cancel based on encryption attribute method and system, it is characterized in that: described step 1 also comprises:

Step 1-1, chooses Big prime p, p factorial method cyclic group G and G _t, bilinear map e:G × G → G _t; Generator g is selected, u, v, d from G;

Step 1-2, authorization center Stochastic choice t _i,j∈ Z _p(i ∈ [1, n], j ∈ [1, n _i]), { α, g ^α, δ }, as its private key; Calculate Y=e (g, g) ^α, define a hash function here expression set 1,2 ..., p-2, p-1};

Step 1-3, data owner selects random value as the private key SK of data owner _dO, and calculate its PKI be sent to public domain, SK _dOprivate key as data owner is not revealed; Here expression set 1,2 ..., p-2, p-1};

Step 1-4, authorization center arranges initial version vn=0, and selects random value as group private key GSK, and the user of registration will be sent under its line, calculate public domain is sent to as group PKI;

The open parameter of system $params:\{Y,p,G,G_T,e,g,u,v,d,g^{\mathrm{\δ}},g^{\mathrm{\β}},g^{\frac{1}{\mathrm{\β}}},\left\{T_{i,j}\right\}\},$ Wherein (i ∈ [1, n], j ∈ [1, n _i]), system master key is MK={ α, g ^α, δ }, the private key of data owner is SK _dO={ β };

Wherein, in step 1-2, for two different user property collection L and L ', should meet ${\mathrm{\Σ}}_{v_{i,j}\∈L}{t}_{i,j}\≠{\mathrm{\Σ}}_{v_{i,j}\∈L^{\′}}{t}_{i,j}.$

3. a kind of secret protection according to claim 1 and support user cancel based on encryption attribute method and system, it is characterized in that: described step 2 also comprises:

Step 2-1, the property set L of input user;

Step 2-2, authorization center random selecting $r,{\mathrm{\λ}}_i\∈Z_p^{*},$ And calculate $D_0=g^{\frac{\mathrm{\α}-\mathrm{\γ}}{\mathrm{\β}}},$ $D_{i,1}=g^{r+{\mathrm{\λ}}_i{t}_{i,j}},$ as the private key of user, wherein t _i,j∈ L _i(i ∈ [1, n], j ∈ [1, n _i]); The user authorized is calculated simultaneously and version number vn=0 is set; Here expression set 1,2 ..., p-2, p-1};

The private key that authorization center is presented to user is ${\mathrm{SK}}_L=(D_0,{\{D_{i,1},D_{i,2}\}}_{i\∈\[1,n\],j\∈\[1,n_i\]},D_2).$

4. a kind of secret protection according to claim 1 and support user cancel based on encryption attribute method and system, it is characterized in that: described step 3 also comprises:

Step 3-1, encipherer selects clear-text message m ∈ G _t, a random message m ' ∈ G _t, access structure W=[W ₁, W ₂..., W _n], and calculate here H is that G arrives cryptographic Hash function;

Step 3-2, for the message m will carrying out sharing, encipherer's random selecting and calculate $C_0=m\·Y^s\·e{(g,g)}^{u_{0}s}=m\·e{(g,g)}^{\mathrm{\α}s+u_{0}s},$ C ₁=g ^{β s}, C ₂=g ^{δ s}; Encipherer arranges relevant properties cipher text part, if s is the root node of access structure, it is unmarked for setting all childs, mark root node is for mark, for each unlabelled non-leaf nodes recursively carries out following computing: non-leaf nodes is AND gate, and its child state is unmarked, select random value and the value arranging last child is and mark this node for mark; If otherwise OR-gate, the value marking the arbitrary node under this node is s, and arranges this node for mark; For leaf node, encipherer calculates as follows:

Step 3-3, for will random message m ', encipherer's random selecting and calculate $C_3=m^{\′}\·Y^{s^{\′}}\·e{(g,g)}^{u_0{s}^{\′}}=m^{\′}\·e{(g,g)}^{{\mathrm{\αs}}^{\′}+u_0{s}^{\′}},$ C ₄=g ^{β s '}, C ₅=g ^{δ s '}; Encipherer arranges relevant properties cipher text part, if the root node that s ' is access structure, it is unmarked for setting all childs, mark root node is for mark, for each unlabelled non-leaf nodes recursively carries out following computing: non-leaf nodes is AND gate, and its child state is unmarked, select random value and the value arranging last child is and mark this node for mark; If otherwise OR-gate, the value marking the arbitrary node under this node is s ', and arranges this node for mark; For leaf node, encipherer calculates as follows: here expression set 1,2 ..., p-2, p-1};

Step 3-4, encipherer arranges version number vn=0; Encrypting the ciphertext obtained is $CT=\{vn=0,\hat{c},{\mathrm{CT}}_{own1},{\mathrm{CT}}_{own2}\},$ ${\mathrm{CT}}_{own1}=\{C_0,C_1,C_2,{\left\{C_{i,j,1},C_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\},$ ${\mathrm{CT}}_{own2}=\{C_3,C_4,C_5,{\left\{{\stackrel{\‾}{C}}_{i,j,1},{\stackrel{\‾}{C}}_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\}.$

5. a kind of secret protection according to claim 1 and support user cancel based on encryption attribute method and system, it is characterized in that: described step 4 also comprises:

Step 5-1, deciphering person checks private key SK _lwith the version number of ciphertext CT, if inconsistent, upgrade private key to authorization center application, if unanimously, then continue step below;

Step 5-2, if deciphering person does not have the attribute mated with access strategy subscript, then deciphers failure, otherwise can recover expressly by step below;

Deciphering person calculates $F={\Π}_{i=1}^{n}e(C_{i,j,2},D_{i,2}),$ $O={\Π}_{i=1}^{n}e(C_{i,j,1},D_{i,1}),$ S＝e(C ₁,D ₀)， $B={\Π}_{i=1}^{n}e(C_1,D_2),$ Calculate $m=\frac{C_0\·F}{O\·S\·B};$ Calculate simultaneously $F^{\′}={\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,2},D_{i,2}),$ $O^{\′}={\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,1},D_{i,1}),$ S′＝e(C ₄,D ₀)， $B^{\′}={\Π}_{i=1}^{n}e(C_4,D_2),$ Calculate simultaneous verification if then output message m, otherwise export ⊥.

6. a kind of secret protection according to claim 1 and support user cancel based on encryption attribute method and system, it is characterized in that: described step 5 also comprises:

Step 5-1, authorization center receives the information that user cancels, and selects new random value as new group private key GSK _x, wherein x is that now version number identifies, and sends to them when the validated user in system needs visit data by the line lower channel of safety; Here Z _pexpression set 1,2 ..., p-1, p};

Step 5-2, authorization center upgrades the private component of authorized user

Step 5-3, authorization center calculates re-encrypted private key and is and sending to cloud to store provider, cloud stores the new ciphertext CT that provider's calculated version number is vn=x _vn;

For the Part I CT of ciphertext _{own1, vn}, calculate as follows:

$C_{0,vn}=C_0\·e(C_2,{\mathrm{ck}}_{vn})=m\·e{(g,g)}^{\mathrm{\α}s+u_{0}s}\·e(g^{\mathrm{\δ}s},g^{\frac{u_x-u_0}{\mathrm{\δ}}})=m\·e{(g,g)}^{\mathrm{\α}s+u_{x}s};$

Similarly, for the Part II CT of ciphertext _{own2, vn}, calculate as follows:

$C_{3,vn}=C_3\·e(C_5,{\mathrm{ck}}_{vn})=m^{\′}\·e{(g,g)}^{{\mathrm{\αs}}^{\′}+u_0{s}^{\′}}\·e(g^{{\mathrm{\δs}}^{\′}},g^{\frac{u_x-u_0}{\mathrm{\δ}}})=m\·e{(g,g)}^{{\mathrm{\αs}}^{\′}+u_x{s}^{\′}};$

Ciphertext CT after renewal _vn={ CT _{own1, vn}, CT _{own2, vn}as follows:

${\mathrm{CT}}_{own1,vn}=\{vn=x,\hat{c},C_{0,vn},C_1,C_2,{\left\{C_{i,j,1},C_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\}$

${\mathrm{CT}}_{own2,vn}=\{vn=x,\hat{c},C_{3,vn},C_4,C_5,{\left\{{\stackrel{\‾}{C}}_{i,j,1},{\stackrel{\‾}{C}}_{i,j,2}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\}.$

7. a kind of secret protection according to claim 1 and support user cancel based on encryption attribute method and system, it is characterized in that: described step 6 also comprises:

Step 6-1, authorization center selects random value with the private key of system common parameter params and user ${\mathrm{SK}}_L=(D_0,\∀v_{i\∈\[1,n\],j\∈\[1,n_i\]}\∈L:\{D_{i,1},D_{i,2}\},D_2)$ As input, and calculate transition key and be ${\mathrm{TK}}_L=\{{D_0}^{\′}={D_0}^{\frac{1}{z}},{D_2}^{\′}={D_2}^{\frac{1}{z}},{\left\{{D_{i,1}}^{\′}={D_{i,1}}^{\frac{1}{z}},{D_{i,2}}^{\′}={D_{i,2}}^{\frac{1}{z}}\right\}}_{i\∈\[1,n\],j\∈\[1,n_i\]}\},$ And preserve HK _l=z as recovery key to user, wherein, Z _pexpression set 1,2 ..., p-1, p}.

8. a kind of secret protection according to claim 1 and support user cancel based on encryption attribute method and system, it is characterized in that: described step 7 also comprises:

Step 7-1, cloud stores provider by ciphertext CT={CT _own1, CT _own2and transition key TK _l={ D ₀', D ₂', { D _{i, 1}', D _{i, 2}' _{i ∈ [1, n]}as input, the part ciphertext calculated after conversion is as follows:

$K_{own1}^{\′}=\frac{{\Π}_{i=1}^{n}e(C_{i,j,1},D_{i,1}^{\′})\·e(C_1,D_0^{\′})\·e(C_1,D_2^{\′})}{{\Π}_{i=1}^{n}e(C_{i,j,2},D_{i,2}^{\′})}=e{(g,g)}^{\frac{\mathrm{\α}s+u_{0}s}{z}}$

$K_{own2}^{\′}=\frac{{\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,1},D_{i,1}^{\′})\·e(C_4,D_0^{\′})\·e(C_4,D_2^{\′})}{{\Π}_{i=1}^{n}e({\stackrel{\‾}{C}}_{i,j,2},D_{i,2}^{\′})}=e{(g,g)}^{\frac{{\mathrm{\αs}}^{\′}+u_0{s}^{\′}}{z}}$

After exporting conversion, ciphertext is as follows: ${\mathrm{CT}}^{\′}=\{vn,K^{\′}=\hat{c},K_1=C_0,K_{own1}^{\′},K_2=C_3,K_{own2}^{\′}\}.$

9. a kind of secret protection according to claim 1 and support user cancel based on encryption attribute method and system, it is characterized in that: described step 8 also comprises:

Step 8-1, it is as follows that deciphering person carries out inspection, if k ₁≠ C ₀, K ₂≠ C ₃, then ⊥ is exported; Otherwise the step continued below;

Step 8-2, if deciphering person does not have the attribute mated with access strategy subscript, then deciphers failure, otherwise can recover expressly by step below; 6 deciphering persons calculate m=K ₁/ K ' _own1 ^z, m '=K ₂/ K ' _own2 ^z, and verify K '=u ^{h (m)}v ^{h (m ')}d carrys out correct decrypting ciphertext CT and obtains message m; Otherwise algorithm failure also exports ⊥.