CN105100083A - Attribute-based encryption method and attribute-based encryption system capable of protecting privacy and supporting user Undo - Google Patents

Abstract

The invention discloses an attribute-based encryption method and system that protects privacy and supports user revocation. The invention includes eight modules: a system parameter setting module (Setup), a key generation module (KeyGen), an encryption module (Encrypt), and a decryption module (Decrypt), re-encryption module (ReKey), conversion key generation module (TKGen), conversion partial ciphertext module (TK-Encrypt), conversion decryption module (TK-DEcrypt). Moreover, the method provided by the invention can solve the problem of privacy protection in cloud computing, and supports user revocation and safe outsourcing operations on ciphertext. At the same time, it provides a verification function for the converted ciphertext, which ensures that the converted ciphertext is not illegally replaced to cause adverse consequences, and the system has high flexibility.

Description

A privacy-preserving attribute-based encryption method and system that supports user revocation

technical field

The invention belongs to the field of information security, and relates to an attribute-based encryption technology, in particular to an attribute-based encryption method that supports user revocation, protects user privacy, supports data outsourcing, and supports verification of the correctness of converted ciphertexts .

Background technique

Today, in the information age where computers are widely used, due to the vigorous development of network technology and the concept of cloud computing, it has become a trend to store a large amount of information in digital form in public clouds and computer systems. Information is transmitted through public channels, and these systems and public channels are vulnerable to attacks and damage if they are not protected. If the theft of information is not easy to be found, the consequences will be quite serious. With the development of cloud computing technology today, people's concerns about the security of cloud computing data storage and the demand for security measures will become more and more intense. Therefore, it is inevitable to store data in the public cloud in an encrypted form. Tourists without decryption permission only The ciphertext can be intercepted from the public cloud, but the corresponding plaintext cannot be obtained. How to ensure that only users with reasonable permissions can decrypt the ciphertext instead of giving the data owner's own private key or sharing the data with those decryptors who have permission?

The concept of attribute-based encryption was introduced in 2005, and it is attracting more and more attention from all walks of life because of its special application significance and wide range of usage scenarios. The encryption system uses the access control structure to control the decryption ability of users in the system, and has become a one of the most effective ways. Attribute-based encryption (ABE) can well solve the above-mentioned problems of big data in cloud computing. In this encryption system, the encryptor does not need to know the detailed identity information of the decryptor, but has a series of descriptive attributes of the decryptor. This descriptive attribute is more closely related to the user than the detailed identity information. In the attribute-based cryptosystem, the access rules are defined by attributes in the encryption process. When the user's key and the ciphertext "match" under the access rules, the decryption user can decrypt the ciphertext. In order to better represent the flexibility of the system, attribute-based encryption is divided into two categories, namely key-policy attribute-based encryption (KP-ABE) and ciphertext-policy attribute-based encryption (CP-ABE). In KP-ABE, ciphertexts are marked with a set of descriptive attributes, while the user's key is associated with the access policy specified by the authority. In CP-ABE, a user's key is tagged with a set of descriptive attributes, while the ciphertext is associated with an access policy specified by the encryptor.

The CP-ABE mechanism is relatively close to the actual application scenarios. Assume that each user obtains the key from the authorization center according to their own conditions or attributes, and then the encryptor formulates access control for messages, which is more suitable for access control applications, such as access to social networking sites, electronic medical systems, etc. The basic CP-ABE scheme includes four modules: system parameter setting (Setup), key generation (KeyGeneration), encryption (Encryption) and decryption (Decryption).

1. System parameter setting module (Setup)

Input security parameter σ, return system public parameter params and master private key MK.

2. Key generation module (KeyGen)

The authorization center runs the key generation algorithm to generate private keys for users in the system. The authorization center inputs the master private key MK and the user's descriptive attribute set, and calculates the private key SK _L related to the user attribute set. Here L represents the attribute set corresponding to the user.

3. Encryption module (Encryption)

Input system public parameters params, message M, and access policy W, and the encryptor encrypts to obtain a ciphertext CT. Only when the user attribute set L associated with the private key satisfies the access policy W, the user can decrypt the ciphertext CT.

4. Decryption module (Decryption)

The receiver inputs his decryption key SK _L and ciphertext CT, and decrypts to get the message M. Only when the user attribute set L associated with the private key satisfies the access policy W, the user can decrypt the ciphertext CT.

From the above process, it can be seen that although the attribute-based encryption system of the ciphertext policy can provide secure access control in the cloud, the access policy is sent to the recipient together with the ciphertext, and the recipient will access the To obtain relevant and effective information in the policy, any intermediate user can obtain the information of the list of potential recipients through the access policy, thereby leaking the privacy of the user, which is not beneficial to some encryption operators who are engaged in commercial activities or want to protect the access policy things. So it is more practical to construct an attribute-based scheme that hides the access structure.

It can also be seen from the flow of the above CP-ABE scheme that the authorization center is responsible for distributing private keys and managing attributes. In real life, especially in the current era of big data, there are often frequent changes of new and old users in the system, which requires the system to flexibly change the permissions granted to users to ensure the security and flexibility of the system. So constructing a CP-ABE scheme that supports user revocation can greatly improve the flexibility of the system.

In today's era, data in the cloud is increasingly accessed by resource-constrained wireless end users. For wireless users, computing costs and communication costs are the first factors to be considered. The cost of battery consumption and communication caused by a large number of bilinear pairing operations is uneconomical, so outsourcing part of the calculation to the cloud storage provider for operation has great economics and good system scalability and accessibility. In real life, there may be misconduct in the cloud or malicious attacks on the cloud. The correctness of the converted ciphertext cannot be verified, and the ciphertext is illegally replaced, resulting in adverse consequences.

Based on the above analysis, the inventors research and improve the existing attribute-based encryption scheme, so as to improve the flexibility of the system and ensure the privacy of users, which is more practical.

Contents of the invention

Purpose of the invention: To address the above-mentioned defects of attribute-based encryption, provide an attribute-based encryption method that completely hides the access structure, supports user revocation, supports data outsourcing, and supports verification of the correctness of converted ciphertexts, so as to improve the flexibility of the system and ensure that users privacy, reduce the total communication cost of wireless end users, and ensure that the converted ciphertext is not illegally replaced and avoid adverse consequences.

Technical solution: An attribute-based encryption method and system that protects privacy and supports user revocation. The encryption system includes eight modules, specifically:

System parameter setting module: generate system public parameters and send them to other modules; key generation module: generate the user’s private key for decrypting messages according to the user’s attribute set; encryption module: for encrypting messages; decryption module: for Decrypt message; re-encryption module: generate re-encryption key, and update ciphertext and user's private key; conversion key generation module: generate conversion key and restore private key; conversion part of ciphertext module: based on the original ciphertext Generate converted partial ciphertext; conversion and decryption module: used to decrypt the converted ciphertext;

The specific steps of the encryption method are as follows:

Step 1, set system public parameters params and master key MK;

Step 2, generate the user's private key SK _L according to the system public parameters params;

Step 3, encrypt the message M according to the system public parameters params and the selected access strategy to obtain the ciphertext CT;

Step 4, decrypt the ciphertext CT according to the system public parameters params and the user's private key SK _L to obtain the message M;

Step 5, generate a re-encryption key ck _vn according to the system public parameters params and the group private key u _x , obtain the re-encrypted ciphertext CT _vn , and update the partial private key D _2,vn of the authorized user;

Step 6, according to the system public parameters params and the user's private key SK _L , generate a conversion key TK _L and a recovery private key HK _L ;

Step 7: Generate converted ciphertext CT′ according to the system public parameters params, original ciphertext CT and conversion key TK _L ;

Step 8: Decrypt the ciphertext to obtain the message M according to the system public parameters params, the original ciphertext CT, the converted ciphertext CT′ and the restored private key HK _L .

Further, said step 1 also includes:

Step 1-1, select a large prime number p, p factorial method cyclic group G and G _T , bilinear mapping e:G×G→G _T ; select generators g,u,v,d from G;

Step 1-2, the authorization center randomly selects t _i,j ∈ Z _p (i∈[1,n],j∈[1,n _i ]), put

{α,g ^α ,δ}, as its private key; calculate Y=e(g,g) ^α , Define a hash function H: here Represents the set {1,2,...,p-2,p-1};

Steps 1-3, the data owner chooses a random value As the private key SK _DO of the data owner, and calculate its public key Sent to the public area, SK _DO as the private key of the data owner will not be disclosed; here Represents the set {1,2,...,p-2,p-1};

Steps 1-4, the authorization center sets the initial version number vn=0, and selects a random value As the group private key GSK, and send it offline to registered users, calculate sent to the public domain as the group public key;

System public parameters Where (i∈[1,n],j∈[1,n _i ]), the system master key is MK＝{α,g ^α ,δ}, and the private key of the data owner is SK _DO ＝{β};

Among them, in step 1-2, for two different user attribute sets L and L', should satisfy ${\mathrm{\Σ}}_{v_{i,j}\∈L}{t}_{i,j}\≠{\mathrm{\Σ}}_{v_{i,j}\∈L^{\′}}{t}_{i,j}.$

Further, said step 2 also includes:

Step 2-1, input user's attribute set L;

Step 2-2, the authorization center randomly selects r, ${\mathrm{\λ}}_i\∈Z_p^{*},$ and calculate As the user's private key, where t _i,j ∈L _i (i∈[1,n],j∈[1,n _i ]); at the same time, the authorized user calculates And set the version number vn=0; here Represents the set {1,2,...,p-2,p-1};

The private key issued by the authorization center to the user is ${\mathrm{SK}}_L=({\mathrm{D.}}_0,{\{{\mathrm{D.}}_{i,1},{\mathrm{D.}}_{i,2}\}}_{i\∈\[1,\mathrm{no}\],j\∈\[1,{\mathrm{no}}_i\]},{\mathrm{D.}}_2).$

Further, said step 3 also includes:

Step 3-1, the encryptor selects a plaintext message m∈G _T , a random message m′∈G _T , accesses the structure W=[W ₁ ,W ₂ ,...,W _n ], and calculates Here H is G to cryptographic hash function;

Step 3-2, for the message m to be shared, the encryptor randomly selects and calculate $C_0=m\&Center\; Dot;Y^{\mathrm{the\; s}}\·e{(g,g)}^{u_0\mathrm{the\; s}}=m\&Center\; Dot;e{(g,g)}^{\mathrm{\α}\mathrm{the\; s}+u_0\mathrm{the\; s}},C_1=g^{\mathrm{\β}\mathrm{the\; s}},C_2=g^{\mathrm{\δ}\mathrm{the\; s}};$ The encryptor sets the relevant attribute ciphertext part, sets s as the root node of the access structure, sets all child nodes as unmarked, marks the root node as marked, and performs the following operation recursively for each unmarked non-leaf node: The non-leaf node is an "AND" gate, and its child node status is unmarked, and a random value is selected And set the value of the last child node to And mark this node as marked; otherwise, if it is an "or" gate, mark the value of any node under this node as s, and set this node as marked; for leaf nodes, the encryptor performs the following calculation: Step 3-3, for the message m′ to be randomized, the encryptor randomly selects and calculate

$C_3=m^{\′}\&Center\; Dot;Y^{{\mathrm{the\; s}}^{\′}}\&Center\; Dot;e{(g,g)}^{u_0{\mathrm{the\; s}}^{\′}}=m^{\′}\·e{(g,g)}^{{\mathrm{\αs}}^{\′}+u_0{\mathrm{the\; s}}^{\′}},$ C ₄ ＝g ^βs′ , C ₅ ＝g ^δs′ ; the encryptor sets the ciphertext part of the relevant attributes, sets s′ as the root node of the access structure, sets all the child nodes as unmarked, and marks the root node as marked, Recursively perform the following operations for each unmarked non-leaf node: the non-leaf node is an "AND" gate, and its child node status is unmarked, select a random value And set the value of the last child node to And mark this node as marked; otherwise, if it is an "or" gate, mark the value of any node under this node as s′, and set this node as marked; for leaf nodes, the encryptor performs the following calculation: here Represents the set {1,2,...,p-2,p-1};

Step 3-4, the encryptor sets the version number vn=0; the encrypted ciphertext is $CT=\{v\mathrm{no}=0,\hat{c},{\mathrm{CT}}_{ow\mathrm{no}1},{\mathrm{CT}}_{ow\mathrm{no}2}\},{\mathrm{CT}}_{ow\mathrm{no}1}=\{C_0,C_1,C_2,{\left\{C_{i,j,1},C_{i,j,2}\right\}}_{i\∈\[1,\mathrm{no}\],j\∈\[1,{\mathrm{no}}_i\]}\},$ ${\mathrm{CT}}_{ow\mathrm{no}2}=\{C_3,C_4,C_5,{\left\{{\stackrel{\‾}{C}}_{i,j,1},{\stackrel{\‾}{C}}_{i,j,2}\right\}}_{i\∈\[1,\mathrm{no}\],j\∈\[1,{\mathrm{no}}_i\]}\}.$

Further, said step 4 also includes:

Step 5-1, the decryptor checks the version numbers of the private key SK _L and the ciphertext CT, if they are not consistent, apply to the authorization center for updating the private key, if they are consistent, proceed to the following steps;

Step 5-2, if the decryptor does not have the attribute matching the subscript of the access policy, the decryption fails, otherwise the plaintext can be recovered through the following steps;

decryptor calculation $f={\Π}_{i=1}^{\mathrm{no}}e(C_{i,j,2},{\mathrm{D.}}_{i,2}),o={\Π}_{i=1}^{\mathrm{no}}e(C_{i,j,1},{\mathrm{D.}}_{i,1}),$ S=e(C ₁ ,D ₀ ), $B={\Π}_{i=1}^{\mathrm{no}}e(C_1,{\mathrm{D.}}_2),$ calculated $m=\frac{C_0\&Center\; Dot;f}{o\&Center\; Dot;S\&Center\; Dot;B};$ Simultaneous computing $f^{\′}={\Π}_{i=1}^{\mathrm{no}}e({\stackrel{\‾}{C}}_{i,j,2},{\mathrm{D.}}_{i,2}),$ $o^{\′}={\Π}_{i=1}^{\mathrm{no}}e({\stackrel{\‾}{C}}_{i,j,1},{\mathrm{D.}}_{i,1}),$ S'=e(C ₄ ,D ₀ ), $B^{\′}={\Π}_{i=1}^{\mathrm{no}}e(C_4,{\mathrm{D.}}_2),$ calculated Simultaneous verification If so, output message m, otherwise output ⊥.

Further, said step 5 also includes:

Step 5-1, the authorization center receives the user's revocation information and selects a new random value As a new group private key GSK _x , where x is the version number identification at this time, it is sent to legal users in the system through a secure offline channel when they need to access data; here Z _p represents the set {1,2,…, p-1,p};

Step 5-2, the authorization center updates the private key part of the authorized user

Step 5-3, the authorization center calculates the re-encryption key as And send to the cloud storage provider, the cloud storage provider calculates a new ciphertext CT _vn whose version number is vn=x;

For the first part of the ciphertext CT _own1,vn , the following calculations are performed:

${\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; ck</span>}}_{\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; \&delta;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\frac{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}}{\mathrm{<span\; class="notranslate">\; \&delta;</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ;</span>$

Similarly, for the second part of the ciphertext CT _own2,vn , the following calculation is performed:

${\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 3</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 5</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; ck</span>}}_{\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; m</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; \&alpha;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; \&delta;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\frac{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}}{\mathrm{<span\; class="notranslate">\; \&delta;</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; \&alpha;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; ;</span>$

The updated ciphertext CT _vn ={CT _own1,vn ,CT _own2,vn } is as follows:

${\mathrm{<span\; class="notranslate">\; CT</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; ,</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; c</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{<span\; class="notranslate">\; \{</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; \}</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; \&rsqb;</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; \&rsqb;</span>}<span\; class="notranslate">\; \}</span>$

${\mathrm{<span\; class="notranslate">\; CT</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; ,</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; c</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 4</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 5</span>}}<span\; class="notranslate">\; ,</span>{<span\; class="notranslate">\; \{</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; \}</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; \&rsqb;</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; \&rsqb;</span>}<span\; class="notranslate">\; \}</span><span\; class="notranslate">\; .</span>$

Further, said step 6 also includes:

Step 6-1, the authorization center selects a random value Take the system public parameter params and the user's private key ${\mathrm{SK}}_L=({\mathrm{D.}}_0,\&ForAll;v_{i\&Element;\&lsqb;1,\mathrm{no}\&rsqb;,j\&Element;\&lsqb;1,{\mathrm{no}}_i\&rsqb;}\&Element;L:\{{\mathrm{D.}}_{i,1},{\mathrm{D.}}_{i,2}\},{\mathrm{D.}}_2)$ as input, and computes the transformation key as ${\mathrm{TK}}_L=\{{{\mathrm{D.}}_0}^{\&prime;}={{\mathrm{D.}}_0}^{\frac{1}{z}},{{\mathrm{D.}}_2}^{\&prime;}={{\mathrm{D.}}_2}^{\frac{1}{z}},{\left\{{{\mathrm{D.}}_{i,1}}^{\&prime;}={{\mathrm{D.}}_{i,1}}^{\frac{1}{z}},{{\mathrm{D.}}_{i,2}}^{\&prime;}={{\mathrm{D.}}_{i,2}}^{\frac{1}{z}}\right\}}_{i\&Element;\&lsqb;1,\mathrm{no}\&rsqb;,j\&Element;\&lsqb;1,{\mathrm{no}}_i\&rsqb;}\},$ And save HK _L =z as the recovery key to the user, where Z _p represents the set {1,2,...,p-1,p}.

Further, said step 7 also includes:

Step 7-1, the cloud storage provider sends the ciphertext CT={CT _own1 ,CT _own2 } and the conversion key TK _L ={D ₀ ′,D ₂ ′,{D _i,1 ′,D _i,2 ′} _i∈[1,n] } as input, calculate the converted part of the ciphertext as follows:

${\mathrm{<span\; class="notranslate">\; K</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; =</span>\frac{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\frac{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}{\mathrm{<span\; class="notranslate">\; z</span>}}}$

${\mathrm{<span\; class="notranslate">\; K</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; =</span>\frac{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 4</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 4</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\frac{{\mathrm{<span\; class="notranslate">\; \&alpha;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}{\mathrm{<span\; class="notranslate">\; z</span>}}}$

The output converted ciphertext is as follows: ${\mathrm{CT}}^{\&prime;}=\{v\mathrm{no},K^{\&prime;}=\hat{c},K_1=C_0,K_{ow\mathrm{no}1}^{\&prime;},K_2=C_3,K_{ow\mathrm{no}2}^{\&prime;}\}.$

Said step 8 also includes:

Step 8-1, the decryptor checks as follows, if K ₁ ≠C ₀ , K ₂ ≠C ₃ , then output ⊥; otherwise continue to the following steps;

Step 8-2, if the decryptor does not have the attribute matching the subscript of the access policy, the decryption will fail, otherwise the plaintext can be recovered through the following steps; 6 The decryptor calculates m=K ₁ /K′ _own1 ^z , m′= K ₂ /K′ _own2 ^z , and verify K′=u ^H(m) v ^H(m′) d to correctly decrypt the ciphertext CT to get the message m; otherwise, the algorithm fails and outputs ⊥.

The mathematical knowledge used in the present invention illustrates:

1. Bilinear Pairing

Briefly introduce the basic definition of a bilinear map and the properties it needs to satisfy.

Let G, G _T be two multiplicative cyclic groups of order p, where p is a prime number and g is a generator of G. Define the bilinear mapping on two groups as: e:G×G→G _T , and satisfy the following properties:

(1) Bilinearity: e(g ^a ,g ^b )=e(g,g) ^ab holds for all g∈G,a,b∈Z _p .

(2) Non-degenerate: e(g,g)≠1.

(3) Computability: There exists an efficient algorithm to compute e(g,g), which holds for all g∈G.

2. Access Structure

Let {P ₁ , P ₂ ,...,P _n } be a set of n participants. set up Represents the set composed of a subset of the participant set, B, C represent the subset of the participant set, for all B, C: If B∈A and So Then A is said to be a monotonic access structure. The subset of participants belonging to A is called the authorized set, and the subset of participants not belonging to A is called the non-authorized set.

3. Decision Bilinear DH (Decisional Bilinear Diffie-Hellman) difficult problem assumption

Given a cyclic group G of order p, where p is a prime number and g is a generator of G. Then the DBDH problem on the group G is: given that t ₁ , t ₂ , t ₃ , and z are randomly selected from Z _p , they can be distinguished with non-negligible probability $(A,B,C,Z)=(g^{t_1},g^{t_2},g^{t_3},e{\left(g,g\right)}^{t_1{t}_2{t}_3})$ and $(A,B,C,Z)=(g^{t_1},g^{t_2},g^{t_3},e{\left(g,g\right)}^z)$ These two tuples. Here Z _p represents the set {1,2,...,p-1,p}.

Beneficial effect: Compared with the prior art, compared with the common attribute-based encryption method, the attribute-based encryption method provided by the present invention supports user revocation and improves the flexibility of the system. In addition, the encryption scheme can completely hide the access structure to protect the user's privacy, and prevent malicious users from obtaining the attribute values needed to decrypt the user through the access policy, thereby obtaining the user's private information. The encryption scheme also supports data outsourcing and verifies the correctness of converted ciphertexts, thereby reducing the total communication cost of users at the wireless end, and ensuring that the converted ciphertexts are not illegally replaced and avoid adverse consequences. Therefore, the attribute-based encryption method provided by the present invention is a safe, effective and flexible attribute-based encryption method.

Description of drawings

Fig. 1 is the working schematic diagram of encryption system of the present invention;

Fig. 2 is a flowchart of the encryption method of the present invention.

Detailed ways

The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments.

The specific process of the present invention will be described below in conjunction with the accompanying drawings.

As shown in Figure 1, a kind of ABE system provided by the present invention includes following eight modules:

1. System parameter setting module (Setup): input security parameter κ, return system public parameter params and master key MK.

2. Key generation module (KeyGen): The authorization center runs a key generation algorithm to generate a private key for the user. The authorization center inputs the system public parameters params, a descriptive attribute set L, and calculates the private key SK _L associated with the user and the attribute set L.

3. Encryption module (Encrypt): Input the system public parameters params, message m, access policy W, and the encryptor encrypts to obtain a ciphertext CT. Only when the user attribute set L associated with the private key satisfies the access policy and passes the verification of the correctness of the ciphertext, the user can decrypt the ciphertext CT.

4. Decryption module (Decrypt): The receiver inputs the decryption key SK _L and the ciphertext CT, and decrypts to obtain the message m.

5. Re-encryption module (ReKey): the authorization center generates a re-encryption key ck _vn according to the system public parameters params, master key MK, and group private key u _x , obtains the re-encrypted ciphertext CT _vn , and updates the authorization The user's partial private key D _2,vn .

6. Conversion key generation module (TKGen): the authorization center generates conversion key TK _L and recovery private key HK _{L according to the system public parameters params and the user's private key SK L .}

7. Convert partial ciphertext module (TK-Encrypt): The system publicizes parameters params, original ciphertext CT and conversion key TK _L to generate converted ciphertext CT′.

8. Transformation and decryption module (TK-DEcrypt): The authorization center decrypts the ciphertext to obtain the message M according to the system public parameters params, the original ciphertext CT, the converted ciphertext CT′ and the restored private key HK _L .

Each module of the encryption system will be specifically described below in conjunction with the flow chart of the method.

As shown in Figure 2, the execution flow of an attribute-based encryption method provided by the present invention is specifically as follows:

The system parameter setting module A of the system specifically includes the following operations, characterized in that the step 1 includes:

Choose a large prime number p, p factorial method cyclic groups G and G _T , bilinear mapping e:G×G→G _T . Select generators g,u,v,d from G.

Authorization center randomly selects t _i,j ∈ Z _p (i∈[1,n],j∈[1,n _i ]), takes {α,g ^α ,δ} as its private key. Calculate Y=e(g,g) ^α , define a hash function here Denotes the set {1,2,...,p-2,p-1}.

The data owner chooses a random value As the private key SK _DO of the data owner, and calculate its public key Send to the public area, SK _DO as the private key of the data owner will not be disclosed. here Denotes the set {1,2,...,p-2,p-1}.

The authorization center sets the initial version number vn=0, and selects a random value as the group private key GSK, and (i∈[1,n],j∈[1,n _i ]), the system master key is MK={α,g ^α ,δ}, and the private key of the data owner is SK _DO ={β}.

In steps 1-3, for two different user attribute sets L and L', it should satisfy ${\mathrm{\&Sigma;}}_{v_{i,j}\&Element;L}{t}_{i,j}\&NotEqual;{\mathrm{\&Sigma;}}_{v_{i,j}\&Element;L^{\&prime;}}{t}_{i,j}.$

The key generation module B specifically includes the following operations:

The user's attribute set is L.

The authorization center randomly selects $r,{\mathrm{\&lambda;}}_i\&Element;Z_p^{*},$ and calculate ${\mathrm{D.}}_0=g^{\frac{\mathrm{\&alpha;}-\mathrm{\&gamma;}}{\mathrm{\&beta;}}},{\mathrm{D.}}_{i,1}=g^{r+{\mathrm{\&lambda;}}_i{t}_{i,j}},{\mathrm{D.}}_{i,2}=g^{{\mathrm{\&lambda;}}_i}$ do

is the user's private key, where t _i,j ∈L _i (i∈[1,n],j∈[1,n _i ]). Simultaneous calculations for authorized users

And set the version number vn=0. here Denotes the set {1,2,...,p-2,p-1}.

The private key issued by the authorization center to the user is ${\mathrm{SK}}_L=({\mathrm{D.}}_0,{\left\{{\mathrm{D.}}_{i,1},{\mathrm{D.}}_{i,2}\right\}}_{i\&Element;\&lsqb;1,\mathrm{no}\&rsqb;,j\&Element;\&lsqb;1,{\mathrm{no}}_i\&rsqb;},{\mathrm{D.}}_2).$

The encryption module C specifically includes the following operations:

The encryptor chooses a plaintext message m∈G _T , a random message m′∈G _T , accesses the structure W=[W ₁ ,W ₂ ,...,W _n ], and calculates Here H is G to cryptographic hash function.

For the message m to be shared, the encryptor randomly selects and calculate C ₁ =g ^βs , C ₂ =g ^δs . The encryptor sets the relevant attribute ciphertext part, sets s as the root node of the access structure, sets all child nodes as unmarked, marks the root node as marked, and performs the following operation recursively for each unmarked non-leaf node: The non-leaf node is an "AND" gate, and its child node status is unmarked, and a random value is selected And set the value of the last child node to and mark this node as marked. On the contrary, if it is an "or" gate, mark the value of any node under this node as s, and set this node as marked. For leaf nodes, the encryptor performs the following calculations:

For the message m′ to be randomized, the encryptor randomly selects and calculate C ₄ =g ^βs' , C ₅ =g ^δs' . The encryptor sets the ciphertext part of the relevant attributes, sets s′ as the root node of the access structure, sets all child nodes as unmarked, and marks the root node as marked, and performs the following operation recursively for each unmarked non-leaf node : The non-leaf node is an "AND" gate, and its child node status is unmarked, choose a random value And set the value of the last child node to and mark this node as marked. On the contrary, if it is an "or" gate, mark the value of any node under this node as s', and set this node as marked. For leaf nodes, the encryptor performs the following calculations: here Denotes the set {1,2,...,p-2,p-1}.

The encryptor sets the version number vn=0. The encrypted ciphertext is ${\mathrm{CT}}_{ow\mathrm{no}1}=\{C_0,C_1,C_2,{\left\{C_{i,j,1},C_{i,j,2}\right\}}_{i\&Element;\&lsqb;1,\mathrm{no}\&rsqb;,j\&Element;\&lsqb;1,{\mathrm{no}}_i\&rsqb;}\},{\mathrm{CT}}_{ow\mathrm{no}2}=\{C_3,C_4,C_5,{\left\{{\stackrel{\&OverBar;}{C}}_{i,j,1},{\stackrel{\&OverBar;}{C}}_{i,j,2}\right\}}_{i\&Element;\&lsqb;1,\mathrm{no}\&rsqb;,j\&Element;\&lsqb;1,{\mathrm{no}}_i\&rsqb;}\}.$

The decryption module D specifically includes the following operations:

The decryptor checks the version numbers of the private key SK _L and the ciphertext CT, if they are inconsistent, apply to the authorization center for updating the private key, if they are consistent, continue to the following steps.

If the decryptor does not have the attribute matching the subscript of the access policy, the decryption will fail. Otherwise, the plaintext can be recovered through the following steps.

decryptor calculation $f={\&Pi;}_{i=1}^{\mathrm{no}}e(C_{i,j,2},{\mathrm{D.}}_{i,2}),o={\&Pi;}_{i=1}^{\mathrm{no}}e(C_{i,j,1},{\mathrm{D.}}_{i,1}),$ S=e(C ₁ ,D ₀ ), $B={\&Pi;}_{i=1}^{\mathrm{no}}e(C_1,{\mathrm{D.}}_2),$ calculated $m=\frac{C_0\&Center\; Dot;f}{o\&Center\; Dot;S\&CenterDot;B}.$ Simultaneous computing $f^{\&prime;}={\&Pi;}_{i=1}^{\mathrm{no}}e({\stackrel{\&OverBar;}{C}}_{i,j,2},{\mathrm{D.}}_{i,2}),$ $o^{\&prime;}={\&Pi;}_{i=1}^{\mathrm{no}}e({\stackrel{\&OverBar;}{C}}_{i,j,1},{\mathrm{D.}}_{i,1}),$ S'=e(C ₄ , D ₀ ), $B^{\&prime;}={\&Pi;}_{i=1}^{\mathrm{no}}e(C_4,{\mathrm{D.}}_2),$ calculated Simultaneous verification If so, output message m, otherwise output ⊥.

The re-encryption module E specifically includes the following operations:

The authorization center receives the user's revocation information and selects a new random value As a new group private key GSK _x , where x is the current version number identification, it is sent to legitimate users in the system through a secure offline channel when they need to access data. Here Z _p represents the set {1,2,...,p-1,p}.

The authorization center updates the private key part of the authorized user

The authorization center calculates the re-encryption key as And send it to the cloud storage provider, and the cloud storage provider calculates a new ciphertext CT _vn whose version number is vn=x.

For the first part of the ciphertext CT _own1,vn , the following calculations are performed:

${\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; ck</span>}}_{\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; \&delta;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\frac{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}}{\mathrm{<span\; class="notranslate">\; \&delta;</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; .</span>$

Similarly, for the second part of the ciphertext CT _own2,vn , the following calculation is performed:

${\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 3</span>}}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 5</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; ck</span>}}_{\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; m</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; \&alpha;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; \&delta;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\frac{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}}{\mathrm{<span\; class="notranslate">\; \&delta;</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; \&alpha;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; .</span>$

The updated ciphertext CT _vn ={CT _own1,vn ,CT _own2,vn } is as follows:

${\mathrm{<span\; class="notranslate">\; CT</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; ,</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; c</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{<span\; class="notranslate">\; \{</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; \}</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; \&rsqb;</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; \&rsqb;</span>}<span\; class="notranslate">\; \}</span>$

${\mathrm{<span\; class="notranslate">\; CT</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; ,</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; c</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 4</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 5</span>}}<span\; class="notranslate">\; ,</span>{<span\; class="notranslate">\; \{</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; \}</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; \&rsqb;</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; \&rsqb;</span>}<span\; class="notranslate">\; \}</span>$

The conversion key generation module F specifically includes the following operations:

Authorization center chooses random value Take the system public parameter params and the user's private key for the recovery key to the user. Here Z _p represents the set {1,2,...,p-1,p}.

The conversion part of the ciphertext module specifically includes the following operations:

The cloud storage provider sends the ciphertext CT={CT _own1 ,CT _own2 } and the conversion key TK _L ={D ₀ ′,D ₂ ′,{D _i,1 ′,D _i,2 ′} _{i∈[1, n]} } as input, calculate the converted part of the ciphertext as follows:

${\mathrm{<span\; class="notranslate">\; K</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; =</span>\frac{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\frac{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}{\mathrm{<span\; class="notranslate">\; z</span>}}}$

${\mathrm{<span\; class="notranslate">\; K</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; =</span>\frac{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 4</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 4</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\frac{{\mathrm{<span\; class="notranslate">\; \&alpha;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}{\mathrm{<span\; class="notranslate">\; z</span>}}}$

The output converted ciphertext is as follows: ${\mathrm{CT}}^{\&prime;}=\{v\mathrm{no},K^{\&prime;}=\hat{c},K_1=C_0,K_{ow\mathrm{no}1}^{\&prime;},K_2=C_3,K_{ow\mathrm{no}2}^{\&prime;}\}.$

The conversion and decryption module specifically includes the following operations:

The decryptor checks as follows, if K ₁ ≠C ₀ , K ₂ ≠C ₃ , then output ⊥. Otherwise continue with the steps below.

If the decryptor does not have the attribute matching the subscript of the access policy, the decryption will fail. Otherwise, the plaintext can be recovered through the following steps. The decryptor calculates m=K ₁ /K' _own1 ^z , m'=K ₂ /K' _own2 ^z , and verifies K'=u ^H(m) v ^H(m') d to correctly decrypt the ciphertext CT to get the message m . Otherwise, the algorithm fails and outputs ⊥.

The basic principles, main advantages and operation steps of the present invention have been set forth and illustrated above.

The situation where the above-mentioned ABE system is applied to cloud computing will be described below.

According to the steps of the present invention, when user A wants to store data in the public cloud, the authorization center runs an algorithm to obtain the public parameter params, and user A formulates an access strategy to encrypt the data to be stored under the public parameter params. When a user B wants to access the user's encrypted data, he first applies for a private key from the authorization center according to his own attributes. If the attribute set of user B satisfies the access policy formulated by the encryptor and passes the correctness verification of the ciphertext, B can Use your own private key and public parameter params to decrypt the ciphertext to get the plaintext. Assuming that the original users C and D in the system leave their jobs, the authorization center needs to re-encrypt the ciphertext of the decryption authority owned by C and D to ensure system security, and update the private keys for other users in the system. Because this scheme can completely hide the access policy, even if the decryptor can decrypt it, he will not know the specific value of the access policy, thereby protecting the user's privacy. In addition, this solution also supports data outsourcing, and provides the correctness verification function for the converted ciphertext, thereby reducing the total communication cost of the wireless end user, and ensuring that the converted ciphertext is not illegally replaced and avoids adverse consequences. Improved system flexibility.

Those of ordinary skill in the art should understand that the present invention is not limited by the above examples, and the description of the above examples is only to illustrate the basic principles and characteristics of the present invention, and other advantages and deformations can be easily imagined on the basis of the above examples. Within the scope of not departing from the gist of the present invention, those skilled in the art can obtain the technical solutions through various equivalent replacements according to the above specific examples, but these technical solutions should be included in the scope of the claims of the present invention and their equivalents. within range.

Claims (9)

1. An attribute-based encryption method and system that protects privacy and supports user revocation, is characterized in that: the encryption system includes eight modules, specifically: System parameter setting module: generate system public parameters and send them to other modules; Key generation module: generate the user's private key for decrypting messages according to the user's attribute set; Encryption module: used to encrypt messages; Decryption module: used to decrypt messages; Re-encryption module: generate a re-encryption key, and update the ciphertext and the user's private key; Conversion key generation module: generate conversion key and recover private key; Convert partial ciphertext module: generate converted partial ciphertext based on the original ciphertext; Conversion and decryption module: used to decrypt the converted ciphertext; The specific steps of the encryption method are as follows: Step 1, set system public parameters params and master key MK; Step 2, generate the user's private key SK _L according to the system public parameters params; Step 3, encrypt the message M according to the system public parameters params and the selected access strategy to obtain the ciphertext CT; Step 4, decrypt the ciphertext CT according to the system public parameters params and the user's private key SK _L to obtain the message M; Step 5, generate a re-encryption key ck _vn according to the system public parameters params and the group private key u _x , obtain the re-encrypted ciphertext CT _vn , and update the partial private key D _2,vn of the authorized user; Step 6, according to the system public parameters params and the user's private key SK _L , generate a conversion key TK _L and a recovery private key HK _L ; Step 7: Generate converted ciphertext CT′ according to the system public parameters params, original ciphertext CT and conversion key TK _L ; Step 8: Decrypt the ciphertext to obtain the message M according to the system public parameters params, the original ciphertext CT, the converted ciphertext CT′ and the restored private key HK _L . 2. A privacy-protecting attribute-based encryption method and system that supports user revocation according to claim 1, characterized in that: said step 1 also includes: Step 1-1, select a large prime number p, p factorial method cyclic group G and G _T , bilinear mapping e:G×G→G _T ; select generators g,u,v,d from G; Step 1-2, the authorization center randomly selects t _i,j ∈ Z _p (i∈[1,n],j∈[1,n _i ]), take {α,g ^α ,δ} as its private key; calculate Y=e(g,g) ^α , define a hash function here Represents the set {1,2,...,p-2,p-1}; Steps 1-3, the data owner chooses a random value As the private key SK _DO of the data owner, and calculate its public key Sent to the public area, SK _DO as the private key of the data owner will not be disclosed; here Represents the set {1,2,...,p-2,p-1}; Steps 1-4, the authorization center sets the initial version number vn=0, and selects a random value As the group private key GSK, and send it offline to registered users, calculate sent to the public domain as the group public key; System public parameters $param\mathrm{the\; s}:\{Y,p,G,G_T,e,g,u,v,d,g^{\mathrm{\&delta;}},g^{\mathrm{\&beta;}},g^{\frac{1}{\mathrm{\&beta;}}},\left\{T_{i,j}\right\}\},$ Where (i∈[1,n],j∈[1,n _i ]), the system master key is MK＝{α,g ^α ,δ}, and the private key of the data owner is SK _DO ＝{β}; Among them, in step 1-2, for two different user attribute sets L and L', should satisfy ${\mathrm{\&Sigma;}}_{v_{i,j}\&Element;L}{t}_{i,j}\&NotEqual;{\mathrm{\&Sigma;}}_{v_{i,j}\&Element;L^{\&prime;}}{t}_{i,j}.$ 3. An attribute-based encryption method and system that protects privacy and supports user revocation according to claim 1, characterized in that: said step 2 also includes: Step 2-1, input user's attribute set L; Step 2-2, the authorization center randomly selects $r,{\mathrm{\&lambda;}}_i\&Element;Z_p^{*},$ and calculate ${\mathrm{D.}}_0=g^{\frac{\mathrm{\&alpha;}-\mathrm{\&gamma;}}{\mathrm{\&beta;}}},$ ${\mathrm{D.}}_{i,1}=g^{r+{\mathrm{\&lambda;}}_i{t}_{i,j}},$ As the user's private key, where t _i,j ∈L _i (i∈[1,n],j∈[1,n _i ]); at the same time, the authorized user calculates And set the version number vn=0; here Represents the set {1,2,...,p-2,p-1}; The private key issued by the authorization center to the user is ${\mathrm{SK}}_L=({\mathrm{D.}}_0,{\{{\mathrm{D.}}_{i,1},{\mathrm{D.}}_{i,2}\}}_{i\&Element;\&lsqb;1,\mathrm{no}\&rsqb;,j\&Element;\&lsqb;1,{\mathrm{no}}_i\&rsqb;},{\mathrm{D.}}_2).$ 4. An attribute-based encryption method and system that protects privacy and supports user revocation according to claim 1, characterized in that: said step 3 also includes: Step 3-1, the encryptor selects a plaintext message m∈G _T , a random message m′∈G _T , accesses the structure W=[W ₁ ,W ₂ ,...,W _n ], and calculates Here H is G to cryptographic hash function; Step 3-2, for the message m to be shared, the encryptor randomly selects and calculate $C_0=m\&CenterDot;Y^{\mathrm{the\; s}}\&Center\; Dot;e{(g,g)}^{u_0\mathrm{the\; s}}=m\&CenterDot;e{(g,g)}^{\mathrm{\&alpha;}\mathrm{the\; s}+u_0\mathrm{the\; s}},$ C ₁ ＝g ^βs , C ₂ ＝g ^δs ; the encryptor sets the ciphertext part of the relevant attributes, sets s as the root node of the access structure, sets all child nodes as unmarked, and marks the root node as marked, for each The unmarked non-leaf nodes recursively perform the following operations: the non-leaf nodes are "AND" gates, and the state of their child nodes is unmarked, and a random value is selected And set the value of the last child node to And mark this node as marked; otherwise, if it is an "or" gate, mark the value of any node under this node as s, and set this node as marked; for leaf nodes, the encryptor performs the following calculation: Step 3-3, for the message m′ to be randomized, the encryptor randomly selects and calculate $C_3=m^{\&prime;}\&CenterDot;Y^{{\mathrm{the\; s}}^{\&prime;}}\&CenterDot;e{(g,g)}^{u_0{\mathrm{the\; s}}^{\&prime;}}=m^{\&prime;}\&Center\; Dot;e{(g,g)}^{{\mathrm{\&alpha;s}}^{\&prime;}+u_0{\mathrm{the\; s}}^{\&prime;}},$ C ₄ ＝g ^βs′ , C ₅ ＝g ^δs′ ; the encryptor sets the relevant attribute ciphertext part, sets s′ as the root node of the access structure, sets all child nodes as unmarked, and marks the root node as marked, Recursively perform the following operations for each unmarked non-leaf node: the non-leaf node is an "AND" gate, and its child node status is unmarked, select a random value And set the value of the last child node to And mark this node as marked; otherwise, if it is an "or" gate, mark the value of any node under this node as s′, and set this node as marked; for leaf nodes, the encryptor performs the following calculation: here Represents the set {1,2,...,p-2,p-1}; Step 3-4, the encryptor sets the version number vn=0; the encrypted ciphertext is $CT=\{v\mathrm{no}=0,\hat{c},{\mathrm{CT}}_{ow\mathrm{no}1},{\mathrm{CT}}_{ow\mathrm{no}2}\},$ ${\mathrm{CT}}_{ow\mathrm{no}1}=\{C_0,C_1,C_2,{\left\{C_{i,j,1},C_{i,j,2}\right\}}_{i\&Element;\&lsqb;1,\mathrm{no}\&rsqb;,j\&Element;\&lsqb;1,{\mathrm{no}}_i\&rsqb;}\},$ ${\mathrm{CT}}_{ow\mathrm{no}2}=\{C_3,C_4,C_5,{\left\{{\stackrel{\&OverBar;}{C}}_{i,j,1},{\stackrel{\&OverBar;}{C}}_{i,j,2}\right\}}_{i\&Element;\&lsqb;1,\mathrm{no}\&rsqb;,j\&Element;\&lsqb;1,{\mathrm{no}}_i\&rsqb;}\}.$ 5. An attribute-based encryption method and system that protects privacy and supports user revocation according to claim 1, characterized in that: said step 4 also includes: Step 5-1, the decryptor checks the version numbers of the private key SK _L and the ciphertext CT, if they are not consistent, apply to the authorization center for updating the private key, if they are consistent, proceed to the following steps; Step 5-2, if the decryptor does not have the attribute matching the subscript of the access policy, the decryption fails, otherwise the plaintext can be recovered through the following steps; decryptor calculation $f={\&Pi;}_{i=1}^{\mathrm{no}}e(C_{i,j,2},{\mathrm{D.}}_{i,2}),$ $o={\&Pi;}_{i=1}^{\mathrm{no}}e(C_{i,j,1},{\mathrm{D.}}_{i,1}),$ S=e(C ₁ ,D ₀ ), $B={\&Pi;}_{i=1}^{\mathrm{no}}e(C_1,{\mathrm{D.}}_2),$ calculated $m=\frac{C_0\&Center\; Dot;f}{o\&Center\; Dot;S\&Center\; Dot;B};$ Simultaneous computing $f^{\&prime;}={\&Pi;}_{i=1}^{\mathrm{no}}e({\stackrel{\&OverBar;}{C}}_{i,j,2},{\mathrm{D.}}_{i,2}),$ $o^{\&prime;}={\&Pi;}_{i=1}^{\mathrm{no}}e({\stackrel{\&OverBar;}{C}}_{i,j,1},{\mathrm{D.}}_{i,1}),$ S'=e(C ₄ ,D ₀ ), $B^{\&prime;}={\&Pi;}_{i=1}^{\mathrm{no}}e(C_4,{\mathrm{D.}}_2),$ calculated Simultaneous verification If so, output message m, otherwise output ⊥. 6. An attribute-based encryption method and system that protects privacy and supports user revocation according to claim 1, characterized in that: said step 5 also includes: Step 5-1, the authorization center receives the user's revocation information and selects a new random value As a new group private key GSK _x , where x is the version number identification at this time, it is sent to legal users in the system through a secure offline channel when they need to access data; here Z _p represents the set {1,2,…, p-1,p}; Step 5-2, the authorization center updates the private key part of the authorized user Step 5-3, the authorization center calculates the re-encryption key as And send to the cloud storage provider, the cloud storage provider calculates a new ciphertext CT _vn whose version number is vn=x; For the first part of the ciphertext CT _own1,vn , the following calculations are performed: ${\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; ck</span>}}_{\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; \&delta;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\frac{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}}{\mathrm{<span\; class="notranslate">\; \&delta;</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ;</span>$ Similarly, for the second part of the ciphertext CT _own2,vn , the following calculation is performed: ${\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 3</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 5</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; ck</span>}}_{\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; m</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; \&alpha;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; \&delta;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\frac{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}}{\mathrm{<span\; class="notranslate">\; \&delta;</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; \&alpha;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; x</span>}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; ;</span>$ The updated ciphertext CT _vn ={CT _own1,vn ,CT _own2,vn } is as follows: ${\mathrm{<span\; class="notranslate">\; CT</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; ,</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; c</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{<span\; class="notranslate">\; \{</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; \}</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; \&rsqb;</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; \&rsqb;</span>}<span\; class="notranslate">\; \}</span>$ ${\mathrm{<span\; class="notranslate">\; CT</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; ,</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; c</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; v</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 4</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 5</span>}}<span\; class="notranslate">\; ,</span>{<span\; class="notranslate">\; \{</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; \}</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; \&rsqb;</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; \&lsqb;</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; \&rsqb;</span>}<span\; class="notranslate">\; \}</span><span\; class="notranslate">\; .</span>$ 7. An attribute-based encryption method and system that protects privacy and supports user revocation according to claim 1, wherein the step 6 further comprises: Step 6-1, the authorization center selects a random value Take the system public parameter params and the user's private key ${\mathrm{SK}}_L=({\mathrm{D.}}_0,\&ForAll;v_{i\&Element;\&lsqb;1,\mathrm{no}\&rsqb;,j\&Element;\&lsqb;1,{\mathrm{no}}_i\&rsqb;}\&Element;L:\{{\mathrm{D.}}_{i,1},{\mathrm{D.}}_{i,2}\},{\mathrm{D.}}_2)$ as input, and computes the transformation key as ${\mathrm{TK}}_L=\{{{\mathrm{D.}}_0}^{\&prime;}={{\mathrm{D.}}_0}^{\frac{1}{z}},{{\mathrm{D.}}_2}^{\&prime;}={{\mathrm{D.}}_2}^{\frac{1}{z}},{\left\{{{\mathrm{D.}}_{i,1}}^{\&prime;}={{\mathrm{D.}}_{i,1}}^{\frac{1}{z}},{{\mathrm{D.}}_{i,2}}^{\&prime;}={{\mathrm{D.}}_{i,2}}^{\frac{1}{z}}\right\}}_{i\&Element;\&lsqb;1,\mathrm{no}\&rsqb;,j\&Element;\&lsqb;1,{\mathrm{no}}_i\&rsqb;}\},$ And save HK _L =z as the recovery key to the user, where Z _p represents the set {1,2,...,p-1,p}. 8. An attribute-based encryption method and system that protects privacy and supports user revocation according to claim 1, characterized in that: said step 7 also includes: Step 7-1, the cloud storage provider sends the ciphertext CT={CT _own1 ,CT _own2 } and the conversion key TK _L ={D ₀ ′,D ₂ ′,{D _i,1 ′,D _i,2 ′} _i∈[1,n] } as input, calculate the converted part of the ciphertext as follows: ${\mathrm{<span\; class="notranslate">\; K</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; =</span>\frac{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\frac{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}{\mathrm{<span\; class="notranslate">\; z</span>}}}$ ${\mathrm{<span\; class="notranslate">\; K</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; =</span>\frac{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 4</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 4</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; e</span>}<span\; class="notranslate">\; (</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; C</span>}}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; e</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{\frac{{\mathrm{<span\; class="notranslate">\; \&alpha;s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}{\mathrm{<span\; class="notranslate">\; z</span>}}}$ The output converted ciphertext is as follows: ${\mathrm{CT}}^{\&prime;}=\{v\mathrm{no},K^{\&prime;}=\hat{c},K_1=C_0,K_{ow\mathrm{no}1}^{\&prime;},K_2=C_3,K_{ow\mathrm{no}2}^{\&prime;}\}.$ 9. An attribute-based encryption method and system that protects privacy and supports user revocation according to claim 1, wherein the step 8 further comprises: Step 8-1, the decryptor checks as follows, if K ₁ ≠C ₀ , K ₂ ≠C ₃ , then output ⊥; otherwise continue to the following steps; Step 8-2, if the decryptor does not have the attribute matching the subscript of the access policy, the decryption will fail, otherwise the plaintext can be recovered through the following steps; 6 The decryptor calculates m=K ₁ /K′ _own1 ^z , m′= K ₂ /K′ _own2 ^z , and verify K′=u ^H(m) v ^H(m′) d to correctly decrypt the ciphertext CT to get the message m; otherwise, the algorithm fails and outputs ⊥.