CN108881279B - Mobile health medical sensor data privacy protection method - Google Patents

Abstract

The invention relates to a mobile health medical data privacy protection method based on certificateless double-authentication protection aggregate signature. Based on the excellent performance of the certificateless double-authentication protection aggregated signature, the method provided by the invention not only avoids the problems of certificate management, key escrow and re-signature, but also improves the calculation efficiency of the mobile health medical data during the aggregated signature verification, realizes the privacy protection of the mobile health medical data, and can be safely used in open mobile health medical treatment.

Description

Mobile health medical sensor data privacy protection method

Technical Field

The invention belongs to the technical field of information security, and particularly relates to a mobile health medical sensor data privacy protection method based on certificateless double-authentication protection aggregate signature.

Background

In order to solve the problem of key escrow in the identity-based public key cryptosystem, in 2005, huangxin et al publicly proposed a certificateless signature scheme (CLS). Compared with identity-based signatures, CLS does not require certificate management and requires less load, and is therefore more suitable for mobile security application environments with low bandwidth requirements and low energy consumption. Therefore, the IBS can solve the binding problem of the public key and the entity and simplify the management problem of the certificate. Therefore, since the birth of a certificateless digital signature scheme, the method is always a very active research hotspot in cryptography.

In 2014, Poettering and stepila first proposed the concept of dual authentication guard signatures. In the internet of vehicles, the basic idea of the double authentication protection signature is as follows: the signer signs the collision message to generate two signatures, and then sends the two signatures to the verifier respectively; the signature verifier verifies the received signatures respectively. If the signature passes the verification, the verifier can trust that the vehicle user did indeed sign both collision messages and the verifier can extract the signature key from both signatures.

The cloud-based Internet of things health medical system is a health medical informatization ecosystem which takes a medical Internet of things as a core and has high information movement and high information sharing. Under the support of cloud service and the Internet of things, the medical file can be collected and shared throughout the life. The health files of the life of an individual are stored in a cloud network in detail, and doctors and parties can consult the health files in time through computers and mobile phones under the authorization permission. In addition, although the existing health medical data privacy protection method based on the CLS can effectively improve the calculation efficiency of message signature verification, the existing health medical data privacy protection method based on batch verification has the problem of emphasis on signature, and therefore, the existing health medical data privacy protection method based on batch verification cannot be well applied to health medical data privacy protection. Therefore, how to effectively combine the certificateless double-authentication protection aggregate signature with the healthy medical data, so that the medical data is deterred from being illegally tampered, and the authenticity and the credibility of the data are ensured, thereby having long-term research significance.

Disclosure of Invention

In order to solve the above problems in the prior art, the present invention provides a + subject name. The technical problem to be solved by the invention is realized by the following technical scheme: a mobile health medical sensor data privacy protection method based on certificateless double-authentication protection aggregation signature comprises the following steps:

step 1, initializing a system, and establishing a registration system by a management server MS; the parameters in the registration system are as follows: (1) selection of s_MS∈Z_q ^*And generates a public key P_MSpub＝s_MSP；

(2) Disclosing system parameters (P, q, G, P)_MSpub,h₁,h₂)；

(3) Cloud data center random selection s_CDC∈Z_q ^*And generates Q_CDC＝s_CDCP, the main private key of the cloud data center is(Q_CDC,s_CDC)；

Wherein s is_MSTwo secure hash functions h representing the system master private key₁:{0,1}^*×G→G；h₂:{0,1}^*×G→Z_q ^*(ii) a P represents a generator of the multiplicative group G; z_q ^*Represents an integer multiplicative group;

step 2, participant C_iGenerating a partial key and accessing the cloud data center by the management server MS;

step 3, the participant C_iReceiving a message M_i＝(a,p_i) Then, r is randomly selected_i∈Z_q ^*And a time stamp t_iSigning the sensor data, wherein t_iIs a hold message M_i＝(a,p_i) System time of freshness;

step 4, the cloud data center is used for the participant C_iVerifying the validity of the signed sensor data;

step 5, the cloud data center pairs the verified participant C_iAggregating signatures of the sensor data;

step 6, the cloud data center verifies the aggregated signatures in batch;

step 7, participant C_iAnd extracting a re-signing key.

Further, step 2.1, participant C_iSelecting a random number s_i1∈Z_q ^*And generates partial key Q_i1＝s_i1P；

Step 2.2, the management server MS generates part of private key psk_i1＝s_MSh₁(Id_i,Q_i1)；Id_iRepresents participant C_iThe identity of (a);

step 2.3, the management server MS selects the random number w_i∈Z_q ^*And generates

Q_i2＝h₁(Id_i,Q_i1),psk_i2＝s_MSh₁(Id_i,Q_i1),index_is＝w_iQ_i2,index_iv＝w_ipsk_i2；

Step 2.4, the management server MS stores the sequence code sn_i＝(Id_i,Q_i1,Q_i2,index_is,index_iv) The SN is sent through a safety channel_i＝index_ivAnd index_isSent to identity Id_iParticipant C of_i。

Further, step 3.1, the participant C_iReceiving a message M_i＝(a,p_i) Then, r is randomly selected_i∈Z_q ^*And generate R_i＝r_iP；

Step 3.2, the participant C_iRandomly selecting a timestamp t_iAnd generating k_i＝h₂(Id_i||p_i,R_i) And S_i＝psk_Idi+ak_ir_imodq；

Step 3.3, the cloud data center passes through an encryption algorithm Enc_QCDC(SN_i||k_i||t_i)＝SN′_iFor SN_i||k_i||t_iCarrying out encryption;

step 3.4, the participant C_iOutputting a message M_i＝(a,p_i) Signature (R) of_i,S_i,M_i,SN′_i) And uploading the message signature to a cloud data center, and issuing a sensing task by the cloud data center.

Further, step 4.1, the cloud data center receives a signature (R)_i,S_i,M_i,SN′_i) Post-pass decryption algorithm SN_i||k_i||t_i＝Dec_sCDC(SN′_i) Carrying out decryption;

step 4.2, the cloud data center verifies equation k_i＝h₂(p_i||t_i,R_i) And S_iP＝index_ivP_MSpub+ak_iR_iWhether the result is true or not; if the two equations hold at the same time, the signature is valid, otherwise the signature is rejected.

Further, for n participants C₁,Λ,C_nAnd its partial signature set (R)_i,S_i,M_i) When the time T is reached, the cloud data center generates

And

aggregating all received signatures, and outputting an aggregated signature σ ═ (R, S, index)_v)。

Further, the cloud data center verifies the equation SP ═ index_vP_MSpubAnd if the + R is established, accepting the aggregated signature, and if not, rejecting the aggregated signature.

Further, the specific steps of step 7 are: respectively given collision messages M_i1＝(a,p_i1) And M_i2＝(a,p_i2) Signature σ of_i1＝(R_i,S_i1,k_i1,M_i1,SN′_i1),σ_i2＝(R_i,S_i2,k_i2,M_i2,SN′_i2) Then respectively decrypting SN through decryption algorithm_i1||k_i1||t_i＝Dec_sCDC(SN′_i1) And SN_i2||k_i2||t_i＝Dec_sCDC(SN′_i2)；

Finally calculating the signature key

Wherein R is_i＝r_iP,k_i1＝h₂(p_i1||t_i,R_i),k_i2＝h₂(p_i2||t_i,R_i)，

Compared with the prior art, the invention has the beneficial effects that: the method provided by the invention is different from the common certificateless aggregated signature in that after the same signer signs twice, the signature private key can be obtained by utilizing an extraction algorithm, and the method benefits from the excellent performance of certificateless double-authentication protection aggregated signature

Drawings

Fig. 1 is a certificateless dual authentication protected aggregate signature flow diagram for implementing the present invention.

Fig. 2 is a flow diagram of a mobile health medical sensor data privacy protection construction method based on certificateless dual authentication protection aggregate signatures.

Detailed Description

The present invention will be described in further detail with reference to specific examples, but the embodiments of the present invention are not limited thereto.

In the description of the present invention, it is to be understood that the terms "central," "longitudinal," "lateral," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," and the like are used in the orientation or positional relationship indicated in the drawings, which are merely for convenience in describing the invention and to simplify the description, and are not intended to indicate or imply that the referenced device or element must have a particular orientation, be constructed and operated in a particular orientation, and are therefore not to be construed as limiting the invention.

Furthermore, the terms "first," "second," "third," and the like are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicit to a number of indicated technical features. Thus, a feature defined as "first," "second," etc. may explicitly or implicitly include one or more of that feature. In the description of the invention, the meaning of "a plurality" is two or more unless otherwise specified.

The terms "mounted," "connected," and "coupled" are to be construed broadly and may, for example, be fixedly coupled, detachably coupled, or integrally coupled; can be mechanically or electrically connected; they may be connected directly or indirectly through intervening media, or they may be interconnected between two elements. The specific meaning of the above terms in the creation of the present invention can be understood by those of ordinary skill in the art through specific situations.

As shown in fig. 1, the method for constructing a certificateless dual authentication protection aggregate signature based on a mobile health medical sensor according to the method for constructing a certificateless dual authentication protection aggregate signature of the present invention comprises the following specific steps:

1. and (3) a parameter generation algorithm: given a security parameter k, the Key Generation Center (KGC) selects two large prime numbers p, q and an elliptic curve E: y²＝x³+ ax + bmod, where a, b ∈ F_p,F_pIs a finite field.

KGC random selection number alpha epsilon Z_q ^*P ∈ G and calculate the master public key P_pubα P, where α is the master private key known only by KGC. P denotes a generator of the multiplicative group G.

KGC selects two secure hash functions h₁:{0,1}^*×G→G；h₂:{0,1}^*×G→Z_q ^*，Z_q ^*Representing an integer multiplicative group. System public key: (P, P, q, E, G, P_pub,h₁,h₂)。

2. And (3) a private key analysis algorithm:

signer C_iRandom selection of s_i1Calculating partial master public key Q_i1＝s_i1P。C_iAsking about the personal identity Id_iPart of the private key of (1).

KGC calculates psk_Idi＝αh₁(Id_i,Q_i1) And by securityChannel distribution part private key psk_IdiTo signer C_iAnd discloses part of the master public key Q_i1。

3. Signature algorithm: signer C_iReceiving message M_i＝(a,p_i) Thereafter, the signature part private key psk is used_IdiThe signature is performed as follows:

(1) signer C_iRandom selection of r_i∈Z_q ^*Calculating R_i＝r_iP。

(2) Signer C_iCalculating k_i＝h₂(Id_i||p_i,R_i) And S_i＝psk_Idi+ak_ir_imodq。

(3) Signer C_iOutputting a message M_iSignature σ of_i＝(k_i,R_i,S_i)。

4. And (3) verification algorithm: verification of equation k_i＝h₂(Id_i||p_i,R_i) And S_iP＝P_pubh₁(Id_i,Q_i1)+ak_iR_iAnd if the two are true, the signature is valid, otherwise, the signature is rejected.

5. And (3) an aggregation algorithm: to obtain information about all messages M_iSignature σ of_iThe aggregator calculates as follows:

σ ═ (R, S) is the final aggregated signature.

6. Batch verification algorithm: order to

Given n signers C₁,...,C_nGenerated group signature σ₁＝(R₁,S₁)，,...,σ_i＝(R_n,S_n) Check whether the following equation holds: SP ═ P_pubAnd H + R, if yes, accepting the signature, otherwise, rejecting the signature.

7. Re-signed signature passwordAnd (3) key extraction algorithm: respectively given collision messages M_i1＝(a,p_i1) And M_i2＝(a,p_i2) Signature σ of_i1＝(K_i1,R_i,S_i1)，,σ_i2＝(K_i2,R_i,S_i2)，

Computing a signature private key

Wherein R is_i＝r_iP,K_i1＝h₂(Id_i||p_i1,R_i),K_i2＝h₂(Id_i||p_i1,R_i)，

According to the method for constructing the certificateless double-authentication protection aggregation signature, the method for constructing the certificateless double-authentication protection aggregation signature is suitable for the mobile health medical sensor, and the protocol can be divided into an initialization stage, a registration stage, a message signature stage, a verification stage, an aggregation stage, a batch verification stage and a signature key extraction stage through re-signature.

As shown in fig. 2, the embodiment provides a mobile health medical sensor data privacy protection method based on certificateless dual authentication protection aggregation signature, which includes the following steps:

step 1, initializing a system, and establishing a registration system by a management server MS; the parameters in the registration system are as follows: (1) selection of s_MS∈Z_q ^*And generates a public key P_MSpub＝s_MSP；

(2) Disclosing system parameters (P, q, G, P)_MSpub,h₁,h₂)；

(3) Cloud data center random selection s_CDC∈Z_q ^*And generates Q_CDC＝s_CDCP, the main private key of the cloud data center is (Q)_CDC,s_CDC)；

Wherein s is_MSSystem of representationsOwner's private key, two secure hash functions h₁:{0,1}^*×G→G；h₂:{0,1}^*×G→Z_q ^*(ii) a P represents a generator of the multiplicative group G; z_q ^*Represents an integer multiplicative group;

step 2, registration phase, participant C_iGenerating a part of keys and accessing the cloud data center by the management server MS;

step 2.1, participant C_iSelecting a random number s_i1∈Z_q ^*And generates partial key Q_i1＝s_i1P；

Step 2.2, the management server MS generates part of private key psk_i1＝s_MSh₁(Id_i,Q_i1)；Id_iRepresents participant C_iThe identity of (a);

step 2.3, the management server MS selects the random number w_i∈Z_q ^*And generates

Q_i2＝h₁(Id_i,Q_i1),psk_i2＝s_MSh₁(Id_i,Q_i1),index_is＝w_iQ_i2,index_iv＝w_ipsk_i2；

Step 2.4, the management server MS stores the sequence code sn_i＝(Id_i,Q_i1,Q_i2,index_is,index_iv) The SN is sent through a safety channel_i＝index_ivAnd index_isSent to identity Id_iParticipant C of_i。

Step 3, message signing phase, participant C_iReceiving a message M_i＝(a,p_i) Then, r is randomly selected_i∈Z_q ^*And a time stamp t_iSigning the sensor data, wherein t_iIs a hold message M_i＝(a,p_i) System time of freshness;

step 3.1, participant C_iReceiving a message M_i＝(a,p_i) Then, r is randomly selected_i∈Z_q ^*And generate R_i＝r_iP；

Step 3.2, participant C_iRandomly selecting a timestamp t_iAnd generating k_i＝h₂(Id_i||p_i,R_i) And S_i＝psk_Idi+ak_ir_imodq；

Step 3.3, the cloud data center passes through an encryption algorithm Enc_QCDC(SN_i||k_i||t_i)＝SN_i' Pair SN_i||k_i||t_iCarrying out encryption;

step 3.4, participant C_iOutputting a message M_i＝(a,p_i) Signature (R) of_i,S_i,M_i,SN′_i) And uploading the message signature to a cloud data center, and issuing a sensing task by the cloud data center.

Step 4, in the verification stage, the cloud data center is used for the participant C_iVerifying the validity of the signed sensor data;

step 4.1, the cloud data center receives the signature (R)_i,S_i,M_i,SN′_i) Post-pass decryption algorithm SN_i||k_i||t_i＝Dec_sCDC(SN′_i) Carrying out decryption;

step 4.2, the cloud data center verifies equation k_i＝h₂(p_i||t_i,R_i) And S_iP＝index_ivP_MSpub+ak_iR_iWhether the result is true or not; if the two equations hold at the same time, the signature is valid, otherwise the signature is rejected.

Step 5, aggregation stage, wherein the cloud data center pairs the verified participants C_iAggregating signatures of the sensor data;

the specific steps of the step 5 are as follows: for n participants C₁,Λ,C_nAnd its partial signature set (R)_i,S_i,M_i) When the time T is reached, the cloud data center generates

And

aggregating all received signatures, and outputting an aggregated signature σ ═ (R, S, index)_v)。

Step 6, in a batch verification stage, the cloud data center performs batch verification on the aggregated signature; cloud data center verification equation SP ═ index_vP_MSpubAnd if the + R is established, the aggregated signature is accepted, otherwise, the aggregated signature is rejected.

Step 7, during the stage of re-signing and extracting the signature key, participant C_iAnd extracting a re-signing key.

Respectively given collision messages M_i1＝(a,p_i1) And M_i2＝(a,p_i2) Signature σ of_i1＝(R_i,S_i1,k_i1,M_i1,SN′_i1),σ_i2＝(R_i,S_i2,k_i2,M_i2,SN′_i2) Then respectively decrypting SN through decryption algorithm_i1||k_i1||t_i＝Dec_sCDC(SN′_i1) And SN_i2||k_i2||t_i＝Dec_sCDC(SN′_i2)；

Finally calculating the signature key

Wherein R is_i＝r_iP,k_i1＝h₂(p_i1||t_i,R_i),k_i2＝h₂(p_i2||t_i,R_i)，

The foregoing is a more detailed description of the invention in connection with specific preferred embodiments and it is not intended that the invention be limited to these specific details. For those skilled in the art to which the invention pertains, several simple deductions or substitutions can be made without departing from the spirit of the invention, and all shall be considered as belonging to the protection scope of the invention.

Claims (6)

1. A mobile health medical sensor data privacy protection method is characterized by comprising the following steps: the method comprises the following steps:

step 1, initializing a system, and establishing a registration system by a management server MS; the parameters in the registration system are as follows: (1) selection of s_MS∈Z_q ^*And generates a public key P_MSpub＝s_MSP；

(2) Disclosing system parameters (P, q, G, P)_MSpub,h₁,h₂)；

(3) Cloud data center random selection s_CDC∈Z_q ^*And generates Q_CDC＝s_CDCP, the main private key of the cloud data center is (Q)_CDC,s_CDC)；

Wherein s is_MSTwo secure hash functions h representing the system master private key₁:{0,1}^*×G→G；h₂:{0,1}^*×G→Z_q ^*(ii) a P represents a generator of the multiplicative group G; z_q ^*Represents an integer multiplicative group;

step 2, participant C_iGenerating a partial key and accessing the cloud data center by the management server MS;

step 3, the participant C_iReceiving a message M_i＝(a,p_i) Then, r is randomly selected_i∈Z_q ^*And a time stamp t_iSigning the sensor data, wherein t_iIs a hold message M_i＝(a,p_i) System time of freshness;

step 4, the cloud data center is used for the participant C_iVerifying the validity of the signed sensor data;

step 5, the cloud data center pairs the verified participant C_iAggregating signatures of the sensor data;

step 6, the cloud data center verifies the aggregated signatures in batch;

step 7, addingAnd C_iExtracting a re-signed signature key;

the specific steps of the step 7 are as follows: firstly, collision messages M are respectively specified_i1＝(a,p_i1) And M_i2＝(a,p_i2) Signature σ of_i1＝(R_i,S_i1,k_i1,M_i1,SN′_i1),σ_i2＝(R_i,S_i2,k_i2,M_i2,SN′_i2) Then respectively decrypted by a decryption algorithm

And

finally calculating the signature key

Wherein R is_i＝r_iP,k_i1＝h₂(p_i1||t_i,R_i),k_i2＝h₂(p_i2||t_i,R_i)，

2. The method of claim 1, wherein: the specific steps of the step 2 are as follows: step 2.1, participant C_iSelecting a random number s_i1∈Z_q ^*And generates partial key Q_i1＝s_i1P；

Step 2.2, the management server MS generates part of private key psk_i1＝s_MSh₁(Id_i,Q_i1)；Id_iRepresents participant C_iThe identity of (a);

step 2.3, the management server MS selects the random number w_i∈Z_q ^*And generates

Q_i2＝h₁(Id_i,Q_i1),psk_i2＝s_MSh₁(Id_i,Q_i1),index_is＝w_iQ_i2,index_iv＝w_ipsk_i2；

Step 2.4, the management server MS stores the sequence code sn_i＝(Id_i,Q_i1,Q_i2,index_is,index_iv) The SN is sent through a safety channel_i＝index_ivAnd index_isSent to identity Id_iParticipant C of_i。

3. The method of claim 2, wherein: the specific steps of the step 3 are as follows: step 3.1, the participant C_iReceiving a message M_i＝(a,p_i) Then, r is randomly selected_i∈Z_q ^*And generate R_i＝r_iP；

Step 3.2, the participant C_iRandomly selecting a timestamp t_iAnd generating k_i＝h₂(Id_i||p_i,R_i) And

step 3.3, the cloud data center passes through an encryption algorithm

For SN_i||k_i||t_iCarrying out encryption;

step 3.4, the participant C_iOutputting a message M_i＝(a,p_i) Signature (R) of_i,S_i,M_i,SN′_i) And uploading the message signature to a cloud data center, and issuing a sensing task by the cloud data center.

4. The method of claim 3, wherein: the specific steps of the step 4 are as follows: step 4.1, the cloud data center receives the signature(R_i,S_i,M_i,SN′_i) Post-pass decryption algorithm

Carrying out decryption;

step 4.2, the cloud data center verifies equation k_i＝h₂(p_i||t_i,R_i) And S_iP＝index_ivP_MSpub+ak_iR_iWhether the result is true or not; if the two equations hold at the same time, the signature is valid, otherwise the signature is rejected.

5. The method of claim 4, wherein: the specific steps of the step 5 are as follows: for n participants C₁,Λ,C_nAnd its partial signature set (R)_i,S_i,M_i) When the time T is reached, the cloud data center generates

And

aggregating all received signatures, and outputting an aggregated signature σ ═ (R, S, index)_v)。

6. The method of claim 5, wherein: the specific steps of the step 6 are as follows: the cloud data center verification equation SP is index_vP_MSpubAnd if the + R is established, accepting the aggregated signature, and if not, rejecting the aggregated signature.

Images