CN108512662A - The hiding multimachine structure encryption method of support policy on a kind of lattice - Google Patents

Abstract

The invention discloses the multimachine structure encryption methods that support policy on a kind of lattice is hidden, and it includes following steps：When S1, system initialization, common parameter and main system private key are generated；S2, user are the property set application key of oneself, and attribute mechanism generates private key according to common parameter, main system private key and the property set of user for it；S3, access structure is converted to corresponding access tree to realize hiding completely for access strategy；S4, data owner generate ciphertext data, then upload to Cloud Server and stored according to system common parameter, plaintext and the access tree being converted；S5, user send access request to Cloud Server, obtain the ciphertext data being stored in Cloud Server；The ciphertext data obtained from Cloud Server are decrypted in the private key that S6, user are obtained using dependence mechanism, obtain the plaintext of data owner and carry out relevant subsequent operation.Its advantage is that：The efficiency of system can be improved and quantum attack, the privacy of effective protection user can be resisted.

Description

A Multi-Agent Encryption Method Supporting Policy Hiding in Lattice

technical field

The invention relates to the technical fields of cloud environment and cryptography, in particular to a multi-mechanism encryption method supporting policy hiding on a grid.

Background technique

With the development of information technology, there are more and more private and enterprise data, presenting the form of big data, which promotes the development of cloud computing, and people are more and more inclined to store data in the cloud, which is convenient and saves costs and resources, especially For some small and medium enterprises. However, while bringing convenience, there are also some problems, especially the cloud storage security incidents that have occurred continuously in recent years. People store data in the cloud. These data will inevitably contain users’ private information, and users will lose access to sensitive data. Cloud servers may access the data they are interested in out of curiosity or commercial interests, and illegal users may also spy on or tamper with users' privacy. Therefore, before the user stores the data in the cloud, it is an effective method to encrypt the data. In 2005, Sahai and Waters proposed the attribute-based encryption (ABE) scheme, which quickly became a research hotspot among scholars and one of the hot topics in cryptography research in recent years. Associated with a series of attributes, if and only if the user's attributes meet the access structure set by the data owner, the user can decrypt the shared data. Nowadays, attribute-based encryption is considered as a promising cryptographic primitive in terms of information security and flexible access control. However, in cloud storage, data owners outsource their data to cloud servers. When formulating access policies and generating ciphertexts, the access rules are usually released together with the ciphertexts. Therefore, any user in the system who tries to decrypt can launch some sensitive data. Information (even to introduce possible recipients), so that the user's personal data is at a high risk of leakage (for example, the ciphertext issued for the merchant can analyze its potential profit model, or the ciphertext issued for the patient in the personal health record system Analyze their personal private information, etc.), therefore, in order to prevent the disclosure of private information, it is often necessary to hide the access policy during encryption. At the same time, most of the lattice-based encryption methods are managed by a single trusted organization, which is not safe enough to meet the actual application needs. In addition, the new cryptographic scheme based on lattice theory has the advantages of parallelism, simple operation, and resistance to quantum attacks, and has become a new research hotspot in the post-quantum era. Therefore, based on lattice ciphers and encryption algorithms that support policy hiding, it is of great significance to design a multi-institutional encryption method that supports policy hiding on a lattice.

Contents of the invention

The purpose of the present invention is to provide a multi-organization encryption method that supports policy hiding on a grid, which can improve the efficiency of the system and can resist quantum attacks, effectively protect the privacy of users, increase the flexibility of the system, and prevent the security of the system from being breached by a single organization Sexually threatened issues.

In order to achieve the above object, the present invention is achieved through the following technical solutions:

A multi-institutional encryption method that supports policy hiding on a grid is characterized in that it includes the following steps:

S1. When the system is initialized, public parameters and the system master private key are generated;

S2. The user applies for a key for his own attribute set, and the attribute agency generates a private key for him according to the public parameters, the system master private key and the user's attribute set;

S3. Transform the access structure into a corresponding access tree to completely hide the access strategy;

S4. The data owner generates ciphertext data according to the system public parameters, plaintext and converted access tree, and then uploads it to the cloud server for storage;

S5. The user sends an access request to the cloud server to obtain the ciphertext data stored in the cloud server;

S6. The user uses the private key obtained from the attribute organization to decrypt the ciphertext data obtained from the cloud server, obtains the plaintext of the data owner, and performs related follow-up operations.

The above-mentioned multi-institutional encryption method supporting policy hiding on lattice, wherein, the process of step S1 is specifically:

Input security parameters λ, n, m, q, where λ is the input parameter of the algorithm in the initialization stage is an integer, n and m are related parameters, and q is a prime number;

Run the trapdoor generation algorithm to generate a uniform random matrix He case Geki Then choose a uniform random vector Output public parameter PP={A,u}, system master private key MSK={T _A }, where, and are finite fields, u ₁ , u ₂ ,..., u _n are the elements of vector u;

Described trapdoor generating algorithm refers to that for prime number q=poly(n), n is a positive integer, and the existence probability polynomial time algorithm TrapGen(q, n) generates uniform random matrix and Among them, m≥5n log q, A in above is statistically uniform, T _A is the lattice the trapdoor base of Among them, O represents the time complexity.

The above-mentioned multi-institutional encryption method supporting policy hiding on the lattice, wherein, the specific process in the step S2 is:

Input system public parameter PP, master private key MSK, user attribute set A _u , the system uses (k,n′)Shamir threshold secret sharing mechanism to calculate k divisions of random vector u, that is, k is the threshold value and also the attribute mechanism The number of , n' is the number of parts to divide the random vector u; and then divide the k random vectors Send them to k attribute agencies AA _i respectively, and then attribute agency AA _i manages n _i attribute values a _i,j ∈ A′ _i , where A′ _i is a set of possible values for each attribute, use (t _{i ,} n _i ) The Shamir threshold secret sharing mechanism divides the random vector u′ _i , where u′ _i is the vector component of u, t _i is the threshold value, and n _i random vectors are obtained to share u″ _i,j (i=1 ,2,...,k,j=1,2,...,n _i ), choose two uniform random matrices Calculation matrix F _i,j ＝A|A _1,i +H(u″ _i,j )·A _2,i , where H(·) is a full second-rank differential encoding function;

The user requests the key from the attribute agency, and the two interact. The attribute agency AA _i runs the left sampling algorithm to calculate the vector: e _i,j ←SampleLeft(A,A _1,i +H(u″ _i,j )·A _{2 ,i,} T _A, u′ _i,j ,σ), and then output the user's private key Among them, when a _i,j ∈ _{A u} ∩A′ _i , the vector e _i,j represents the user's private key; A collection of possible values for each attribute; Possible values for each attribute; σ is a parameter; is a finite field.

The above-mentioned multi-mechanism encryption method supporting policy hiding on the lattice, wherein, the full second-rank differential encoding function refers to a given prime number q, a positive integer n, and a full second-rank differential encoding function can The attribute information of the user above is mapped to an n×n matrix on Z _q ; for the input random vector define a polynomial Let f be an irreducible polynomial of degree n in Z _q [X], then:

Among them, coeffs represents a row vector composed of polynomial coefficients; among them, and Both are finite fields; Z _q [X] is any field; X is the set of x′ ⁱ , X is the domain of definition, and x′ is the independent variable; the meaning of H is mapping, and the random vector u″ _{i, j} is mapped as matrix;

The left sampling algorithm refers to SampleLeft(A,M ₁ ,T _A ,u,σ): Input: a matrix with rank n a matrix grid Geki a vector and a Gaussian parameter Output: Let matrix F ₁ =(A|M ₁ ); the algorithm outputs a vector Wherein, m, m ₁ are all positive integers; M ₁ is a matrix, representing the matrix A _1,i +H(u″ _i,j )·A _2,i in the left sampling operation; ω is an operation parameter; σ is a Gaussian parameter.

The above-mentioned multi-institutional encryption method supporting policy hiding on the lattice, wherein, the process of converting the access structure into an access tree in the step S3 is:

The access structure adopts the form of AND, OR, and threshold of multi-valued attributes. Before encrypting the plaintext, the data owner first converts the access structure W into an access tree Γ. The leaf nodes in the tree represent attributes, and the non-leaf nodes represent operators. , in the access tree, replace the leaf node information with the corresponding value, which does not appear in the access structure in the form of plain text, and the user cannot obtain any information about the data owner and other decryptors when decrypting, so as to realize the policy completely hidden;

The access tree is constructed through the shamir secret sharing mechanism, the root node of the access tree Γ is set as vector s, and the vector is randomly selected at the same time Among them, s ₁ , s ₂ ,...,s _n″ are the components of the random vector s, T is the transpose of the vector, and marked as allocated, and all other nodes are marked as unallocated, and the remaining unallocated non- The leaf nodes perform the following operations:

A. If the operator of the node is ∧, and its child node is unassigned, randomly select the vector Among them, n" is the number of its child nodes, and the n"th child node is assigned a vector and mark those nodes as allocated;

B. If the operator of the node is ∨, and its child nodes are unassigned, set the value of all its child nodes to s, and mark these nodes as allocated;

C. If the operator of the node is of and its child node is unassigned, use the shamir(t,n″) threshold secret sharing mechanism to vector Carry out segmentation, where t is the threshold value, n″ is the number of child nodes, and the lth child node is assigned as a vector Then mark these nodes as allocated; where l is the attribute index of the leaf node in the access tree; is a finite field; where P is a prime number, and the meaning of P is Modulus of operations in the domain.

The above-mentioned multi-institutional encryption method supporting policy hiding on the lattice, wherein, the ciphertext generation process in the step S4 is:

Input system public parameter PP, plaintext b∈{0,1}, access tree Γ converted from access structure W, set parameter K=(k!d!) ² , where Choose a uniform random matrix R∈{-1,1} ^m×m , then choose the noise interference term x∈Z _q and Let the vector z=R ^T x _i,j calculate for each leaf node l: output ciphertext

where k is the number of attribute institutions; among them, A' _i is the set of possible values of each attribute; Z _q and is a finite field; q is a prime number; u, s, s _l are all vectors; is a matrix; a _{i, j} are the possible values of attributes; c ₀ and is the ciphertext component; T represents the transpose operation; R is a randomly selected uniform matrix.

The above-mentioned multi-institutional encryption method supporting policy hiding on the lattice, wherein, the user decryption process in the step S6 is:

Input the public parameter PP, the ciphertext CT and the user's private key SK, if the user's attribute set does not satisfy the access structure W, then output ⊥; otherwise, it can be decrypted successfully, select the minimum attribute set I _A that satisfies the access structure, and calculate the plaintext Among them, L _i and L _l are Lagrange coefficients, if Output 1, otherwise output 0; among them, a _{i, j} are the possible values of attributes; q is a prime number; k is the number of attribute institutions; is a vector; T represents the transpose operation of the vector.

Compared with the prior art, the present invention has the following advantages:

1. Use lattice theory to replace the previous bilinear pairing, which improves the efficiency of the system and can resist quantum attacks;

2. By converting the access structure into an access tree, assign a value to each node in the tree, and then embed the access policy into the ciphertext, to realize the complete hiding of the access policy and fine-grained access control; the attribute-based encryption of the hidden access policy In this scheme, the encryptor can specify the role of the decryptor; in addition, using the fuzziness of attribute-based encryption, using attributes to describe objects can protect the encryptor's sensitive information;

3. Using the Shamir threshold secret sharing mechanism, the three operations of AND, OR, and threshold of the access control strategy are realized through the access tree, which increases the flexibility of the system;

4. A multi-institution attribute-based encryption scheme based on lattice theory, in which multiple attribute institutions manage different attribute sets and distribute keys to users under their authority, avoiding the problem that a single institution is compromised and the security of the system is threatened .

Description of drawings

Fig. 1 is method flowchart of the present invention;

Fig. 2 is a comparison of the present invention and the existing method in the embodiment of the present invention.

Detailed ways

The present invention will be further elaborated below by describing a preferred specific embodiment in detail in conjunction with the accompanying drawings.

As shown in Figure 1, the present invention discloses a multi-mechanism encryption method supporting policy hiding on a grid, which includes the following steps: S1, generating public parameters and system master and private keys during system initialization; S2, users as their own attributes Set the application key, and the attribute organization generates a private key according to the public parameters, the system master private key and the user's attribute set; S3, transform the access structure into a corresponding access tree to realize the complete hiding of the access policy; S4, the data owner Generate ciphertext data according to the system public parameters, plaintext and converted access tree, and then upload it to the cloud server for storage; S5, the user sends an access request to the cloud server to obtain the ciphertext data stored in the cloud server; S6, the user Use the private key obtained from the attribute organization to decrypt the ciphertext data obtained from the cloud server, obtain the plaintext of the data owner and perform related follow-up operations.

The method is further described with an embodiment below:

Assuming that there are k attribute organizations AA _i (i=1,2,...,k) in the system, each attribute organization AA _i uses the left sampling SampleLeft algorithm on the grid to generate private keys for its legitimate users, and at the same time Send the private key to the user through a secure channel; each attribute authority AA _i manages n _i attribute values.

By way of example, the implementation methods of the key processes in the above steps S1, S2, S3, S4 and S6 are given below:

The specific process of step S1 is: input security parameters λ, n, m, q, where λ is the input parameter of the initialization stage algorithm is an integer, n and m are related parameters, and q is a prime number;

Run the trapdoor generation algorithm to generate a uniform random matrix He case Geki Then choose a uniform random vector Output public parameter PP={A,u}, system master private key MSK={T _A }, where, and are all finite fields, u ₁ , u ₂ ,..., u _n are elements of vector u, and λ is an integer;

Described trapdoor generation algorithm refers to for prime number q=poly (n), n is a positive integer, m≥5nlogq, and existence probability polynomial time algorithm TrapGen (q, n) generates uniform random matrix and Among them, A is in above is statistically uniform, T _A is the lattice the trapdoor base of Among them, O represents the time complexity.

The specific process of step S2 is: input the system public parameter PP, the master private key MSK, and the user attribute set A _u , and the system uses the (k,n′)Shamir threshold secret sharing mechanism to calculate k divisions of the random vector u, that is, k is the threshold value is also the number of attribute institutions, n' is the number of shares to divide the random vector u; and then divide the k random vector u Send them to k attribute agencies AA _i respectively, and then attribute agency AA _i manages n _i attribute values a _i,j ∈ A′ _i , where A′ _i is a set of possible values for each attribute, use (t _i ,n _i ) The Shamir threshold secret sharing mechanism divides the random vector u′ _i , and obtains n _i random vectors to share u″ _i,j (i=1,2,...,k,j=1,2,. ..,n _i ), choose two uniform random matrices Calculation matrix F _i,j ＝A|A _1,i +H(u″ _i,j )·A _2,i , where H(·) is a full second-rank differential encoding function;

The user requests the key from the attribute agency, and the two interact. The attribute agency AA _i runs the left sampling algorithm to calculate the vector: e _i,j ←SampleLeft(A,A _1,i +H(u″ _i,j )·A _{2 ,i,} T _A ,u′ _i,j ,σ), and then output the user's private key

Among them, when a _i,j ∈ _{A u} ∩A′ _i , the vector e _i,j represents the user's private key; A collection of possible values for each attribute; Possible values for each attribute; T _A is the lattice The trapdoor basis of , σ is a parameter; is a finite field; A is a uniform random matrix; t _i is a threshold value;

The full two-rank differential coding function refers to a given prime number q, a positive integer n, a full two-rank differential coding function can The attribute information of the user above is mapped to an n×n matrix on Z _q ; for the input random vector define a polynomial Let f be an irreducible polynomial of degree n in Z _q [X], then:

Among them, coeffs represents a row vector composed of polynomial coefficients; among them, and Both are finite fields; Z _q [X] is any field; X is the set of x′ ⁱ , X is the domain of definition, and x′ is the independent variable; the meaning of H is mapping, and the random vector u″ _{i, j} is mapped as matrix;

The left sampling algorithm refers to SampleLeft(A,M ₁ ,T _A ,u,σ): Input: a matrix with rank n a matrix grid Geki a vector and a Gaussian parameter Output: Let matrix F ₁ =(A|M ₁ ); the algorithm outputs a vector Wherein, both m and m ₁ are positive integers; M ₁ is a matrix, representing the matrix A _1,i +H(u″ _i,j )·A _2,i in the left sampling operation; ω is an operation parameter.

In step S3, the process of transforming the access structure into an access tree is as follows: the access structure adopts the form of AND, OR, and threshold of multi-valued attributes. Before encrypting the plaintext, the data owner first converts the access structure W into an access tree Γ, the tree The leaf nodes in the tree represent attributes, and the non-leaf nodes represent operators. In the access tree, the information of the leaf nodes is replaced by the corresponding value, which does not appear in the access structure in the form of plain text, and the user cannot obtain all relevant data when decrypting. any information of the author and other decryptors, so as to realize the complete concealment of the strategy;

The access tree is constructed through the shamir secret sharing mechanism, the root node of the access tree Γ is set as vector s, and the vector is randomly selected at the same time Among them, s ₁ , s ₂ ,...,s _n″ are the components of the random vector s, T is the transpose of the vector, and marked as allocated, and all other nodes are marked as unallocated, and the remaining unallocated non- The leaf nodes perform the following operations:

A. If the operator of the node is ∧, and its child node is unassigned, randomly select the vector Among them, n" is the number of its child nodes, and the n"th child node is assigned a vector and mark those nodes as allocated;

B. If the operator of the node is ∨, and its child nodes are unassigned, set the value of all its child nodes to s, and mark these nodes as allocated;

C. If the operator of the node is of and its child node is unassigned, use the shamir(t,n″) threshold secret sharing mechanism to vector Carry out segmentation, where t is the threshold value, n″ is the number of child nodes, and the lth child node is assigned as a vector Then mark these nodes as allocated; where l is the attribute index of the leaf node in the access tree; is a finite field; where P is a prime number, and the meaning of P is Modulus of operations in the domain.

In step S4, the ciphertext generation process is: input system public parameter PP, plaintext b∈{0,1}, access tree Γ converted from access structure W, set parameter K=(k!d!) ² , where Choose a uniform random matrix R∈{-1,1} ^m×m , then choose the noise interference term x∈Z _q and Let the vector z=R ^T x _i,j calculate for each leaf node l: output ciphertext

where k is the number of attribute institutions; among them, A' _i is the set of possible values of each attribute; Z _q and is a finite field; q is a prime number; u, s, s _l are all vectors; is a matrix; a _{i, j} are the possible values of attributes; c ₀ and is the ciphertext component; T represents the transpose operation; R is a randomly selected uniform matrix.

In step S6, the user’s decryption process is as follows: input the public parameter PP, ciphertext CT and user’s private key SK, if the user’s attribute set does not satisfy the access structure W, then output ⊥; otherwise, it can be successfully decrypted, and select the minimum attribute that satisfies the access structure Set I _A , compute the plaintext Among them, L _i and L _l are Lagrange coefficients, if Output 1, otherwise output 0; among them, a _{i, j} are the possible values of attributes; q is a prime number; k is the number of attribute institutions; is a vector; T represents the transpose operation of the vector.

The method is illustrated below with an example.

N represents the total number of attributes of the system, A _u is the number of user attributes, A _e is the number of encrypted attributes, q, n, m are related parameters, q is a prime number, n is a positive integer, m is an integer, k is The number of attribute organizations, d represents the layering depth of the attribute.

It can be seen from Fig. 2 that the scheme of LIU Ximeng et al. is significantly longer than the scheme of ZHANGGuoyan et al. and the present invention in the above four aspects. Although the length of the user's private key in the present invention is greater than that of ZHANG Guoyan et al.'s scheme, since the user's private key is stored locally, the reduction in system performance can be ignored. Overall, the present invention is superior to the other two schemes in performance.

Although the content of the present invention has been described in detail through the above preferred embodiments, it should be understood that the above description should not be considered as limiting the present invention. Various modifications and alterations to the present invention will become apparent to those skilled in the art upon reading the above disclosure. Therefore, the protection scope of the present invention should be defined by the appended claims.

Claims (7)

1. a multi-organization encryption method supporting strategy hiding on a lattice, is characterized in that, comprises the following steps: S1. When the system is initialized, public parameters and the system master private key are generated; S2. The user applies for a key for his own attribute set, and the attribute agency generates a private key for him according to the public parameters, the system master private key and the user's attribute set; S3. Transform the access structure into a corresponding access tree to completely hide the access strategy; S4. The data owner generates ciphertext data according to the system public parameters, plaintext and converted access tree, and then uploads it to the cloud server for storage; S5. The user sends an access request to the cloud server to obtain the ciphertext data stored in the cloud server; S6. The user uses the private key obtained from the attribute organization to decrypt the ciphertext data obtained from the cloud server, obtains the plaintext of the data owner, and performs related follow-up operations. 2. The multi-organization encryption method supporting policy hiding on the grid as claimed in claim 1, wherein the process of the step S1 is specifically: Input security parameters λ, n, m, q, where λ is the input parameter of the algorithm in the initialization stage is an integer, n and m are related parameters, and q is a prime number; Run the trapdoor generation algorithm to generate a uniform random matrix He case Geki Then choose a uniform random vector Output public parameter PP={A,u}, system master private key MSK={T _A }, where, and are finite fields, u ₁ , u ₂ ,..., u _n are the elements of vector u; Described trapdoor generating algorithm refers to that for prime number q=poly(n), n is a positive integer, and the existence probability polynomial time algorithm TrapGen(q, n) generates uniform random matrix and Among them, m≥5nlogq, A in above is statistically uniform, T _A is the lattice the trapdoor base of Among them, O represents the time complexity. 3. The multi-organization encryption method supporting strategy hiding on the lattice as claimed in claim 2, is characterized in that, the specific process in the described step S2 is: Input system public parameter PP, master private key MSK, user attribute set A _u , the system uses (k,n′)Shamir threshold secret sharing mechanism to calculate k divisions of random vector u, that is, k is the threshold value and also the attribute mechanism The number of , n' is the number of parts to divide the random vector u; and then divide the k random vectors Send them to k attribute agencies AA _i respectively, and then attribute agency AA _i manages n _i attribute values a _i,j ∈ A′ _i , where A′ _i is a set of possible values for each attribute, use (t _i ,n _i ) The Shamir threshold secret sharing mechanism divides the random vector u′ _i , u′ _i is the vector component of u, t _i is the threshold value, and n _i random vectors are obtained to share u″ _i,j (i=1 ,2,...,k,j＝1,2,...,n _i ), choose two uniform random matrices A _1,i , Calculation matrix F _i,j ＝A|A _1,i +H(u″ _i,j )·A _2,i , where H(·) is a full second-rank differential encoding function; The user requests the key from the attribute agency, and the two interact. The attribute agency AA _i runs the left sampling algorithm to calculate the vector: e _i,j ←SampleLeft(A,A _1,i +H(u″ _i,j )·A _{2 ,i} ,T _A ,u′ _i,j ,σ), and then output the user's private key Among them, when a _i,j ∈ _{A u} ∩A′ _i , the vector e _i,j represents the user's private key; A collection of possible values for each attribute; Possible values for each attribute; σ is a parameter; is a finite field. 4. the multi-organization encryption method that supports policy concealment on lattice as claimed in claim 3, is characterized in that: The full two-rank differential coding function refers to a given prime number q, a positive integer n, a full two-rank differential coding function can The attribute information of the user above is mapped to an n×n matrix on Z _q ; for the input random vector define a polynomial Let f be an irreducible polynomial of degree n in Z _q [X], then: Among them, coeffs represents a row vector composed of polynomial coefficients; among them, and Both are finite fields; Z _q [X] is any field; X is the set of x′ ⁱ , X is the domain of definition, and x′ is the independent variable; the meaning of H is mapping, and the random vector u″ _{i, j} is mapped as matrix; The left sampling algorithm refers to SampleLeft(A,M ₁ ,T _A ,u,σ): Input: a matrix with rank n a matrix grid Geki a vector and a Gaussian parameter Output: Let matrix F ₁ =(A|M ₁ ); the algorithm outputs a vector Wherein, m, m ₁ are all positive integers; M ₁ is a matrix, representing the matrix A _1,i +H(u″ _i,j )·A _2,i in the left sampling operation; ω is an operation parameter; σ is a Gaussian parameter. 5. The multi-organization encryption method supporting policy hiding on the grid as claimed in claim 3, wherein, in the step S3, the access structure is converted into an access tree process as follows: The access structure adopts the form of AND, OR, and threshold of multi-valued attributes. Before encrypting the plaintext, the data owner first converts the access structure W into an access tree Γ. The leaf nodes in the tree represent attributes, and the non-leaf nodes represent operators. , in the access tree, replace the leaf node information with the corresponding value, which does not appear in the access structure in the form of plain text, and the user cannot obtain any information about the data owner and other decryptors when decrypting, so as to realize the policy completely hidden; The access tree is constructed through the shamir secret sharing mechanism, the root node of the access tree Γ is set as vector s, and the vector is randomly selected at the same time Among them, s ₁ , s ₂ ,...,s _n ″ are the components of the random vector s, T is the transposition of the vector, and marked as allocated, and all other nodes are marked as unallocated, and the rest of the unallocated non The leaf nodes perform the following operations: A. If the operator of the node is ∧, and its child node is unassigned, randomly select the vector Among them, n" is the number of its child nodes, and the n"th child node is assigned a vector and mark those nodes as allocated; B. If the operator of the node is ∨, and its child nodes are unassigned, set the value of all its child nodes to s, and mark these nodes as allocated; C. If the operator of the node is of and its child node is unassigned, use the shamir(t,n″) threshold secret sharing mechanism to vector Carry out segmentation, where t is the threshold value, n″ is the number of child nodes, and the lth child node is assigned as a vector Then mark these nodes as allocated; where l is the attribute index of the leaf node in the access tree; is a finite field; where P is a prime number, and the meaning of P is Modulus of operations in the domain. 6. The multi-organization encryption method supporting strategy hiding on the lattice as claimed in claim 5, is characterized in that, the ciphertext generation process in the described step S4 is: Input system public parameter PP, plaintext b∈{0,1}, access tree Γ converted from access structure W, set parameter K=(k!d!) ² , where Choose a uniform random matrix R∈{-1,1} ^m×m , then choose the noise interference term x∈Z _q and Let the vector z=R ^T x _i,j calculate for each leaf node l: output ciphertext where k is the number of attribute institutions; among them, A' _i is the set of possible values of each attribute; Z _q and is a finite field; q is a prime number; u, s, s _l are all vectors; is a matrix; a _{i, j} are the possible values of attributes; c ₀ and is the ciphertext component; T represents the transpose operation; R is a randomly selected uniform matrix. 7. The multi-organization encryption method supporting policy hiding on the grid as claimed in claim 6, wherein the user decryption process in the described step S6 is: Input the public parameter PP, the ciphertext CT and the user's private key SK, if the user's attribute set does not satisfy the access structure W, then output ⊥; otherwise, it can be decrypted successfully, select the minimum attribute set I _A that satisfies the access structure, and calculate the plaintext Among them, L _i and L _l are Lagrange coefficients, if Output 1, otherwise output 0; among them, a _{i, j} are the possible values of attributes; q is a prime number; k is the number of attribute institutions; is a vector; T represents the transpose operation of the vector.