CN108989049B - Agent re-encryption system and method without bilinear pairing - Google Patents

Abstract

The invention discloses a proxy re-encryption system without bilinear pairing, which comprises: the system comprises a system parameter setting module, a key generation module, an encryption module, an agent re-encryption key generation module, an agent re-encryption module and a decryption module. The invention applies the non-bilinear pairing method to the proxy re-encryption method, allows the cloud storage platform to forward the data encrypted by the data owner to the data encrypted by the data sharer under the authorization of the data owner, so that the data sharer can decrypt the data by directly downloading the re-encrypted ciphertext from the cloud storage, a large amount of resources are saved in the process, and the cloud storage platform cannot obtain any information of the data.

Description

Agent re-encryption system and method without bilinear pairing

Technical Field

The invention relates to the technical field of cloud computing, in particular to a proxy re-encryption system without bilinear pairing and an encryption method.

Background

In recent years, with the development and application of cloud computing technology and the deepening of the process of interconnection of everything, data security in cloud storage has received wide attention. In order to share the encrypted data in the cloud storage to other users, the data owner downloads the encrypted data from the cloud storage and then re-encrypts the data to the sharer, which consumes a lot of network and computing resources.

In order to improve the calculation efficiency, the proxy re-encryption algorithm can be adopted to analyze the encrypted data, but the conventional proxy re-encryption method usually adopts a bilinear pairing method, which has the obvious disadvantages of large calculation amount and low encryption speed, greatly reduces the calculation efficiency, cannot meet the requirements of the current big data era, and greatly reduces the practicability.

Therefore, it is an urgent need to solve the above-mentioned problems by those skilled in the art to provide a bilinear pairing-free proxy re-encryption system and method that is computationally efficient and ensures the inextensibility of the ciphertext.

Disclosure of Invention

In view of the above, the present invention provides a bilinear pairing-free proxy re-encryption system and encryption method, which combine a bilinear pairing-free proxy re-encryption scheme with a certificateless signature scheme, solve the problem of low efficiency of proxy re-encryption based on bilinear pairing, greatly improve the computation efficiency while ensuring the security of ciphertext attack selection, and ensure the inextensibility of ciphertext.

In order to achieve the purpose, the invention adopts the following technical scheme:

a bilinear pairing-free proxy re-encryption system comprising: the system comprises a system parameter setting module, a key generation module, an encryption module, an agent re-encryption key generation module, an agent re-encryption module and a decryption module; wherein the content of the first and second substances,

the system parameter setting module is used for generating a system master key and a system public parameter, sending the system master key to the encryption module, and sending the system public parameter to the key generation module, the encryption module, the proxy re-encryption key generation module, the proxy re-encryption module and the decryption module;

the key generation module is used for generating a public key, a private key and identity information of each user, sending the public key of each user to the encryption module and the proxy re-encryption key generation module, and sending the private key of each user to the proxy re-encryption key generation module and the decryption module;

the encryption module is used for generating an original ciphertext of a plaintext message to be sent and sending the original ciphertext to the proxy re-encryption module and the decryption module;

the agent re-encryption key generation module generates an agent re-encryption key according to the generated agent re-encryption key and sends the agent re-encryption key to the agent re-encryption module;

the proxy re-encryption module carries out signature authentication on the original ciphertext sent by the encryption module and the proxy re-encryption key sent by the proxy re-encryption key generation module according to the system public parameters sent by the system parameter setting module and the user identity information sent by the key generation module, and sends the proxy re-encryption ciphertext to the decryption module after the authentication is successful;

the decryption module is used for judging whether the received ciphertext is the original ciphertext or the proxy re-encrypted ciphertext and recovering corresponding plaintext information.

The private key of the user generated by the key generation module comprises a private key of a client and a private key of an acceptor, and the identity information of the user comprises identity information of the client and identity information of the acceptor.

The invention also discloses a proxy re-encryption method without bilinear pairing, which comprises the following steps:

s1, setting a system public parameter par and a system master key mk;

s2, generating identity id of the client according to the system public parameter par_iID of recipient_jSecret value x_iPublic key pk_iPrivate key sk of the client_iAnd the private key sk of the acceptor_j；

S3, according to the system public parameter par, identity id of the principal_iAnd the public key pk_iEncrypting and signing to obtain an original ciphertext c_i；

S4, according to the system public parameter par, the private key sk of the client_iAnd the private key sk of the acceptor_jGenerating proxy re-encryption key rk_ij；

S5, according to the system public parameter par, original ciphertext c_iIdentity id of the principal_iID of recipient_jAnd proxy re-encryption key rk_ijPerforming signature authentication, and generating a proxy re-encryption ciphertext c after the authentication is successful_j,

S6, judging whether the received ciphertext is the original ciphertext or the proxy re-encrypted ciphertext, and decrypting to recover the corresponding plaintext information m.

Preferably, in the above method for proxy re-encryption without bilinear pairing, S1 specifically includes the following steps:

s11, giving a security parameter k, selecting a prime number q with the length of k bits, wherein G is a q-order subgroup of Zq, and G is a generator of G;

s12, selecting four habaThe hip functions H1, H2, H3, and H4, H1: {0, 1} → Zq @, H2: {0,1}ⁿ⁰×{0，1}ⁿ¹×G→Zq*,H3：G→{0，1}ⁿ⁰⁺ⁿ¹H4: {0, 1 }. xg → Zq; where no, n1 is the security parameter, and the plaintext space is {0, 1}ⁿ⁰；

S13, randomly selecting a system master key mk, enabling mk to belong to Zq, calculating Z-mk-g, and keeping a system master key mk secret;

s14, and disclosing system parameters par { q, G, G, z, H1, H2, H3, H4, n0 and n1 }.

Preferably, in the above method for proxy re-encryption without bilinear pairing, S2 specifically includes the following steps:

s21, inputting system public parameter par, and giving the identity id of the client_iPublic key pk of the client_iAnd the private key sk of the principal_i；

S22, randomly selecting x_iLet x be_i∈Zq*；

S23, setting public key pk of trustee_i＝gx_iSetting the private key sk of the client_i＝x_i。

Preferably, in the above method for proxy re-encryption without bilinear pairing, S3 specifically includes the following steps:

s31, inputting system public parameter par, plaintext information m and identity id of client_iAnd the public key pk of the principal_i；

S32, random selection

Calculate t ═ H2(m, r, pk)_i),c1＝pk_i ^t；

S33, calculating

S34, selecting public and private key pair (spk) needing signature_i，ssk_i) Randomly select u_iE.g. Zq, calculating U_i＝g×u_i，D_i＝u_i+mk×H4(id_i，U_i)，X_i＝x_i×g，spk_i＝(X_i，U_i)，ssk_i＝(x_i， D_i)，c₃＝ssk_i；

S35, running a signature algorithm, and randomly selecting an integer e_iE.g. Zq, calculate E_i＝e_i×g，f_i＝H1 (E_i||X_i||id_i||m)，h_i＝e/(x_i+f_i+D_i)，v_i＝x_i/(x_i+f_i+D_i) To obtain a signature S_i＝(f_i，h_i， v_i)；

S36, outputting original ciphertext c_i＝(c₁，c₂，c₃，S_i)。

Preferably, in the above method for proxy re-encryption without bilinear pairing, S4 specifically includes the following steps:

s41, inputting private key sk of consignor_i＝x_iAnd the private key sk of the acceptor_j＝x_j；

S42, generating a proxy re-encryption key rk_ij＝sk_j/sk_i＝x_j/x_imod q。

Preferably, in the above method for proxy re-encryption without bilinear pairing, S5 specifically includes the following steps:

s51, inputting system public parameter par and original ciphertext c_iIdentity id of the principal_iIdentity id of the recipient_jAnd proxy re-encryption key rk_ij；

S52, signature verification, calculation of a_i＝H4(id_i,U_i) Inspection h_i×(U_i+X_i+a_i*Z+f_i*g)＝E_iAnd v_i×(U_i+X_i+a_i*Z+f_i*g)＝X_iJudging whether the two formulas are true, if not, outputting T, and if true, performing the next step;

s53, calculating

S54, selecting public and private key pair (spk) needing signature_j，ssk_j) Randomly select u_jE.g. Zq, calculating U_j＝g×u_j，D_j＝u_j+mk×H4(id_j，U_j)，X_j＝x_j×g，spk_j＝(X_j，U_j)，ssk_j＝(x_j， D_j)，c₃’＝ssk_j；

S55、c₄＝pk_i；

S56, running a signature algorithm, and randomly selecting an integer e_jE.g. Zq, calculate E_j＝e_j×g，f_j＝H1 (E_j||X_j||id_j||m)，h_j＝e/(x_j+f_j+D_j)，v_j＝x_j/(x_j+f_j+D_j) To obtain a signature S_j＝(f_j，h_j， v_j)；

S57, outputting proxy re-encrypted ciphertext c_j＝(c₁’,c₂,c₃’,c₄,s_j)。

Preferably, in the above method for proxy re-encryption without bilinear pairing, S6 specifically includes the following steps:

s61, judging whether the form of the ciphertext is the original ciphertext or the re-encrypted ciphertext;

s62, if the ciphertext is the original ciphertext, carrying out signature verification and calculating a_i＝H4(id_i,U_i) Inspection h_i×(U_i+X_i+a_i*Z+f_i*g)＝E_iAnd v_i×(U_i+X_i+a_i*Z+f_i*g)＝X_iJudging whether the two formulas are true, if not, outputting T, and if true, performing the next step;

s63, checking

Whether or not it is true, ifIf not, outputting the T, and if yes, performing the next step;

s64, calculating

Outputting a plaintext message m;

s65, if the ciphertext is the re-encrypted ciphertext, the signature verification is carried out, and a is calculated_j＝H4(id_j,U_j) Inspection h_j×(U_j+X_j+a_j*Z+f_j*g)＝E_jAnd v_j×(U_j+X_j+a_j*Z+f_j*g)＝X_jJudging whether the two formulas are true, if not, outputting T, and if true, performing the next step;

s66, test c₁’＝c4^H2(m,r,c4)If the T value is not true, outputting T, and if the T value is true, performing the next step;

s67, calculating

Outputting the plaintext message m.

Through the technical scheme, compared with the prior art, the invention has the following beneficial effects: the invention adopts an encryption method without bilinear pairing and a certificate-free signature authentication mechanism, greatly improves the calculation efficiency and protects the accuracy of information while ensuring the attack security of ciphertext selection; the performance is excellent, and the method is convenient to apply in an open network environment.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the provided drawings without creative efforts.

FIG. 1 is a schematic diagram of a proxy re-encryption system without bilinear pairing according to the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

The embodiment of the invention discloses a proxy re-encryption system without bilinear pairing, which comprises: the system comprises a system parameter setting module 1, a key generation module 2, an encryption module 3, an agent re-encryption key generation module 4, an agent re-encryption module 5 and a decryption module 6; wherein the content of the first and second substances,

the system parameter setting module 1 is used for generating a system master key and a system public parameter, sending the system master key to the encryption module 3, and sending the system public parameter to the key generation module 2, the encryption module 3, the proxy re-encryption key generation module 4, the proxy re-encryption module 5 and the decryption module 6;

the key generation module 2 is used for generating a public key, a private key and identity information of a consignor and a public key, a private key and identity information of an acceptor, sending the public key of the consignor and the public key of the acceptor to the encryption module 3 and the proxy re-encryption key generation module 4, and sending the private key of the consignor and the private key of the acceptor to the proxy re-encryption key generation module 4 and the decryption module 6;

the encryption module 3 encrypts and signs the plaintext message to be sent through the system public parameters sent by the system parameter setting module 1, the public keys of the principal and the acceptor sent by the key generation module 2 and the identity information of the principal and the acceptor, generates an original ciphertext of the plaintext message to be sent, and sends the original ciphertext to the proxy re-encryption module 5 and the decryption module 6;

the proxy re-encryption key generation module 4 generates a proxy re-encryption key through the system public parameters sent by the system parameter setting module 1, the private key of the entrusting party and the private key of the accepting party sent by the user key generation module 2, and sends the proxy re-encryption key to the proxy re-encryption module 5;

the proxy re-encryption module 5 performs signature authentication through the system public parameters sent by the system parameter setting module 1, the identity information sent by the key generation module 2, the original ciphertext sent by the encryption module 3 and the proxy re-encryption key sent by the proxy re-encryption key generation module 4, generates a proxy re-encryption ciphertext after authentication is successful, and sends the ciphertext to the decryption module 6;

the decryption module 6 is used for judging whether the received ciphertext is an original ciphertext or an agent re-encrypted ciphertext and recovering corresponding plaintext information;

if the ciphertext is the original ciphertext, performing signature verification according to the system public parameter, the identity information of the entrusting party and the user private key of the entrusting party, and recovering the plaintext message after the verification is successful;

if the ciphertext is the proxy re-encrypted ciphertext, signature verification is carried out through the system public parameters, the private key of the accepting party and the identity information of the accepting party, and the plaintext message is recovered after verification is successful.

The embodiment of the invention discloses a proxy re-encryption method without bilinear pairing, which comprises the following steps:

s1, setting a system public parameter par and a system master key mk;

s2, generating the identity id of the client according to the system public parameter par_iID of the recipient_jSecret value x_iPublic key pk_iPrivate key sk of the client_iAnd the private key sk of the acceptor_j；

S3, according to the system public parameter par, identity id of the principal_iAnd the public key pk_iEncrypting and signing to obtain an original ciphertext c_i；

S4, according to the system public parameter par, the private key sk of the client_iAnd the private key sk of the acceptor_jGenerating proxy re-encryption key rk_ij；

S5, according to the system public parameter par, original ciphertext c_iIdentity id of the principal_iID of recipient_jAnd proxy re-encryption key rk_ijPerforming signature authenticationAfter successful authentication, generating proxy re-encrypted ciphertext c_j,

S6, judging whether the received ciphertext is the original ciphertext or the proxy re-encrypted ciphertext;

if the ciphertext is the original ciphertext c_iAccording to the system public parameter par, identity id of the client_iPrivate key sk of the client_iSignature verification is carried out, and the plaintext message m is recovered after the verification is successful;

if the ciphertext is the proxy re-encrypted ciphertext c_jThen, the parameter par and the private key sk of the acceptor are disclosed through the system_jAnd identity id of the recipient_jAnd (5) signature verification is carried out, and the plaintext message m is recovered after the verification is successful.

Wherein the content of the first and second substances,

s1 specifically includes the following steps:

s11, giving a security parameter k, selecting a prime number q with the length of k bits, wherein G is a q-order subgroup of Zq, G is a generator of G, and Zq is an integer set;

s12, selecting four hash functions H1, H2, H3 and H4, H1: {0, 1} → Zq @, H2: {0,1}ⁿ⁰×{0，1}ⁿ¹×G→Zq*,H3：G→{0，1}ⁿ⁰⁺ⁿ¹H4: {0, 1 }. times G → Zq, where no, n1 is a parameter determined by the security parameter k, and the plaintext space is {0, 1}ⁿ⁰；

S13, randomly selecting a system master key mk, enabling mk to belong to Zq, calculating Z-mk-g, and keeping a system master key mk secret;

s14, and disclosing system parameters par { q, G, G, Z, H1, H2, H3, H4, n0 and n1 }.

S2 specifically includes the following steps:

s21, inputting system public parameter par, and giving the identity id of the client_iPublic key pk of the client_iAnd the private key sk of the principal_i；

S22, randomly selecting x_iLet x be_i∈Zq*；

S23, setting public key pk of trustee_i＝gx_iSetting the private key sk of the client_i＝x_i。

S3 specifically includes the following steps:

s31, inputting system public parameter par, plaintext information m and identity id of client_iAnd the public key pk of the principal_i；

S32, random selection

Calculate t ═ H2(m, r, pk)_i),c₁＝pk_i ^t；

S33, calculating

S34, selecting public and private key pair (spk) needing signature_i，ssk_i) Randomly select u_iE.g. Zq, calculating U_i＝g×u_i，D_i＝u_i+mk×H4(id_i，U_i)，X_i＝x_i×g，spk_i＝(X_i，U_i)，ssk_i＝(x_i， D_i)，c₃＝ssk_i，ssk_iSigning a private key for the principal;

s35, running a signature algorithm, and randomly selecting an integer e_iE.g. Zq, calculate E_i＝e_i×g，f_i＝H1 (E_i||X_i||id_i||m)，h_i＝e/(x_i+f_i+D_i)，v_i＝x_i/(x_i+f_i+D_i) To obtain a signature S_i＝(f_i，h_i， v_i)；

S36, outputting original ciphertext c_i＝(c₁，c₂，c₃，S_i)。

S4 specifically includes the following steps:

s41, inputting private key sk of consignor_i＝x_iAnd the private key sk of the acceptor_j＝x_j；

S42, generating a proxy re-encryption key rk_ij＝sk_j/sk_i＝x_j/x_imod q。

S5 specifically includes the following steps:

s51, inputting system public parameter par and original ciphertext c_iIdentity id of the principal_iIdentity id of the recipient_jAnd proxy re-encryption key rk_ij；

S52, signature verification, calculation of a_i＝H4(id_i,U_i) Inspection h_i×(U_i+X_i+a_i*Z+f_i*g)＝E_iAnd v_i×(U_i+X_i+a_i*Z+f_i*g)＝X_iJudging whether the two formulas are true, if not, outputting T, and if true, performing the next step;

s53, calculating

S54, selecting public and private key pair (spk) needing signature_j，ssk_j) Randomly select u_jE.g. Zq, calculating U_j＝g×u_j，D_j＝u_j+mk×H4(id_j，U_j)，X_j＝x_j×g，spk_j＝(X_j，U_j)，ssk_i＝(x_j， D_j)，c₃’＝ssk_j，ssk_jSigning the private key for the recipient;

S55、c4＝pk_i；

s56, running a signature algorithm, and randomly selecting an integer e_jE.g. Zq, calculate E_j＝e_j×g，f_j＝H1 (E_j||X_j||id_j||m)，h_j＝e/(x_j+f_j+D_j)，v_j＝x_j/(x_j+f_j+D_j) To obtain a signature S_j＝(f_j，h_j， v_j)；

S57, outputting proxy re-encrypted ciphertext c_j＝(c₁’,c₂,c₃’,c₄,s_j)。

S6 specifically includes the following steps:

s61, judging whether the form of the ciphertext is the original ciphertext or the re-encrypted ciphertext;

s62, if the ciphertext is the original ciphertext, carrying out signature verification and calculating a_i＝H4(id_i,U_i) Inspection h_i×(U_i+X_i+a_i*Z+f_i*g)＝E_iAnd v_i×(U_i+X_i+a_i*Z+f_i*g)＝X_iJudging whether the two formulas are true, if not, outputting T, and if true, performing the next step;

s63, checking

If the T value is not true, outputting T, and if the T value is true, performing the next step;

s64, calculating

Outputting a plaintext message m;

s65, if the ciphertext is the re-encrypted ciphertext, the signature verification is carried out, and a is calculated_j＝H4(id_j,U_j) Inspection h_j×(U_j+X_j+a_j*z+f_j*g)＝E_jAnd v_j×(U_j+X_j+a_j*z+f_j*g)＝X_jJudging whether the two formulas are true, if not, outputting T, and if true, performing the next step;

s66, test c1 ═ c4^H2(m,r,c4)If the T value is not true, outputting T, and if the T value is true, performing the next step;

s67, calculating

Outputting the plaintext message m.

The embodiments in the present description are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other. The device disclosed by the embodiment corresponds to the method disclosed by the embodiment, so that the description is simple, and the relevant points can be referred to the method part for description.

The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (2)

1. A proxy re-encryption method without bilinear pairing is characterized by comprising the following steps:

s1, setting a system public parameter par and a system master key mk; s1 specifically includes the following steps:

s11, giving a security parameter k, selecting a prime number q with the length of k bits, wherein G is a q-order subgroup of Zq, and G is a generator of G;

s12, selecting four hash functions H1, H2, H3 and H4, H1: {0, 1} → Zq @, H2: {0,1}ⁿ⁰×{0，1}ⁿ¹×G→Zq*,H3：G→{0，1}ⁿ⁰⁺ⁿ¹H4: {0, 1 }. xg → Zq; where n0 and n1 are security parameters determined by the security parameter k, and the plaintext space is {0, 1}ⁿ⁰；

S13, randomly selecting a system master key mk, enabling mk to belong to Zq, calculating Z-mk-g, and keeping a system master key mk secret;

s14, and disclosing system parameters par { q, G, G, z, H1, H2, H3, H4, n₀,n₁}；

S2, generating identity id of the client according to the system public parameter par_iID of recipient_jSecret value x_iPublic key pk_iPrivate key sk of the client_iAnd the private key sk of the acceptor_j(ii) a S2 specifically includes the following steps:

s21, inputting system public parameter par, and giving the identity id of the client_iPublic key pk of the client_iAnd the private key sk of the principal_i；

S22, randomly selecting x_iLet x be_i∈Zq*；

S23, randomly selecting x_jLet x be_jE.g. Zq; setting a public key pk of a principal_i＝gx_iSetting the private key sk of the client_i＝x_iSetting the private key sk of the receiver_j＝x_j；

S3, according to the system public parameter par, identity id of the principal_iAnd the public key pk_iEncrypting and signing to obtain an original ciphertext c_i(ii) a S3 specifically includes the following steps:

s31, inputting system public parameter par, plaintext information m and identity id of client_iAnd the public key pk of the principal_i；

S32, random selection

Calculate t ═ H2(m, r, pk)_i),c₁＝pk_i ^t(ii) a Wherein l1 represents the length of a string consisting of 0 or 1;

s33, calculating

S34, selecting public and private key pair (spk) needing signature_i，ssk_i) Randomly select u_iE.g. Zq, calculating U_i＝g×u_i，D_i＝u_i+mk×H4(id_i，U_i)，X_i＝x_i×g，spk_i＝(X_i，U_i)，ssk_i＝(x_i，D_i)，c₃＝ssk_i；

S35, running a signature algorithm, and randomly selecting an integer e_iE.g. Zq, calculate E_i＝e_i×g，f_i＝H1(E_i||X_i||id_i||m)，h_i＝e/(x_i+f_i+D_i)，v_i＝x_i/(x_i+f_i+D_i) To obtain a signature S_i＝(f_i，h_i，v_i)；

S36, outputting original ciphertext c_i＝(c₁，c₂，c₃，S_i)；

S4, according to the system public parameter par, the private key sk of the client_iAnd the private key sk of the acceptor_jGenerating proxy re-encryption key rk_ij(ii) a S4 specifically includes the following steps:

s41, inputting private key sk of consignor_i＝x_iAnd the private key sk of the acceptor_j＝x_j；

S42, generating proxy re-encryption key rk_ij＝sk_j/sk_i mod q＝x_j/x_imod q；

S5, according to the system public parameter par, original ciphertext c_iIdentity id of the principal_iID of recipient_jAnd proxy re-encryption key rk_ijPerforming signature authentication, and generating a proxy re-encryption ciphertext c after the authentication is successful_jS5 specifically includes the following steps:

s51, inputting system public parameter par and original ciphertext c_iIdentity id of the principal_iIdentity id of the recipient_jAnd proxy re-encryption key rk_ij；

S52, signature verification, calculation of a_i＝H4(id_i,U_i) Inspection h_i×(U_i+X_i+a_i*Z+f_i*g)＝E_iAnd v_i×(U_i+X_i+a_i*Z+f_i*g)＝X_iJudging whether the two formulas are true, if not, outputting T, and if true, performing the next step;

s53, calculating

S54, selecting public and private key pair (spk) needing signature_j，ssk_j) Randomly select u_jE.g. Zq, meterCalculate U_j＝g×u_j，D_j＝u_j+mk×H4(id_j，U_j)，X_j＝x_j×g，spk_j＝(X_j，U_j)，ssk_j＝(x_j，D_j)，c₃’＝ssk_j；

S55、c₄＝pk_i；

S56, running a signature algorithm, and randomly selecting an integer e_jE.g. Zq, calculate E_j＝e_j×g，f_j＝H1(E_j||X_j||id_j||m)，h_j＝e/(x_j+f_j+D_j)，v_j＝x_j/(x_j+f_j+D_j) To obtain a signature S_j＝(f_j，h_j，v_j)；

S57, outputting proxy re-encrypted ciphertext c_j＝(c₁’,c₂,c₃’,c₄,sj)；

S6, judging whether the received ciphertext is the original ciphertext or the proxy re-encrypted ciphertext, and decrypting to recover the corresponding plaintext information m.

2. The method according to claim 1, wherein S6 specifically includes the following steps:

s61, judging whether the form of the ciphertext is the original ciphertext or the re-encrypted ciphertext;

s62, if the ciphertext is the original ciphertext, carrying out signature verification and calculating a_i＝H4(id_i,U_i) Inspection h_i×(U_i+X_i+a_i*Z+f_i*g)＝E_iAnd v_i×(U_i+X_i+a_i*Z+f_i*g)＝X_iJudging whether the two formulas are true, if not, outputting T, and if true, performing the next step;

s63, checking

If it is not true, outputtingAnd (7) obtaining the T, and if the T is true, performing the next step;

s64, calculating

Outputting a plaintext message m;

s65, if the ciphertext is the re-encrypted ciphertext, the signature verification is carried out, and a is calculated_j＝H4(id_j,U_j) Inspection h_j×(U_j+X_j+a_j*Z+f_j*g)＝E_jAnd v_j×(U_j+X_j+a_j*Z+f_j*g)＝X_jJudging whether the two formulas are true, if not, outputting T, and if true, performing the next step;

s66, test c₁’＝c₄ ^H2(m,r,c4)If the T value is not true, outputting T, and if the T value is true, performing the next step;

s67, calculating

Outputting the plaintext message m.

Images