CN111698240A - CP-ABE encryption outsourcing - Google Patents

CP-ABE encryption outsourcing Download PDF

Info

Publication number
CN111698240A
CN111698240A CN202010514527.1A CN202010514527A CN111698240A CN 111698240 A CN111698240 A CN 111698240A CN 202010514527 A CN202010514527 A CN 202010514527A CN 111698240 A CN111698240 A CN 111698240A
Authority
CN
China
Prior art keywords
ciphertext
encryption
authorizer
module
private key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202010514527.1A
Other languages
Chinese (zh)
Inventor
杨志祥
屠袁飞
杨小健
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nanjing Tech University
Original Assignee
Nanjing Tech University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nanjing Tech University filed Critical Nanjing Tech University
Priority to CN202010514527.1A priority Critical patent/CN111698240A/en
Publication of CN111698240A publication Critical patent/CN111698240A/en
Pending legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0464Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/06Protocols specially adapted for file transfer, e.g. file transfer protocol [FTP]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/50Network services
    • H04L67/56Provisioning of proxy services

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

The invention discloses a CP-ABE encryption outsourcing, which solves the problem of efficiently realizing the safe access and sharing of data files in a cloud computing environment, and on one hand, the method introduces a proxy re-encryption technology to convert ciphertexts so that the ciphertexts which can be decrypted by an authorizer are converted into the ciphertexts which can be decrypted by an authorizer, in particular, after the file encryption of a data owner is uploaded to a cloud proxy server, the cloud proxy server re-encrypts the encrypted file under the condition that the authorizer is absent, and after the re-encrypted ciphertexts are obtained from the cloud proxy server by the authorizer, the file can be decrypted by using a private key of the authorizer to obtain a plaintext, thereby ensuring the safe access and sharing of the data; and on the other hand, the ciphertext is encrypted, and the ciphertext is calculated by adopting a CP-ABE-based fixed ciphertext length algorithm, so that the length of the ciphertext in the scheme is fixed and cannot be increased along with the increase of the number of the attributes, and the calculation cost can be effectively reduced.

Description

CP-ABE encryption outsourcing
Technical Field
The invention relates to a CP-ABE encryption outsourcing, and belongs to the technical field of cloud computing.
Background
Cloud computing is a dynamic and easily extensible way of resource computing, typically providing virtualization over the internet. By transferring the computing and storage responsibilities to the cloud from the local place, the cloud computing service can save a large amount of cost for users, has a wide application prospect, and becomes a hot spot direction for the next generation of internet technology application. Since a large amount of data generated by the cloud computing service is usually in a user-uncontrollable domain, security has always been a primary consideration for enterprises to implement cloud computing, and security technology has become an important research content of the cloud computing service. Currently, many Cloud Service Providers (CSPs) are not fully trusted, and may deliver user data to a third party without permission of a user, thereby causing data information leakage. For sensitive Data, therefore, the Data Owner (DO) must perform access control by encrypting and controlling the decryption capability of the user, which is called ciphertext access control. The ciphertext access control technology is a technology in an ABE encryption scheme and is used for solving the problem of data confidentiality of CSP in an untrusted scene. The ABE refers to attribute-based encryption, and the attribute-based encryption scheme is divided into two types, namely Key-Policy ABE (KP-ABE) based encryption of a Key Policy and attribute-based encryption (CP-ABE) of a Ciphertext Policy. In CP-ABE, the key is associated with a set of attributes, and the ciphertext is associated with an access policy. In cloud computing, a large number of scenes needing ciphertext conversion exist, if decryption and Re-Encryption processing are performed at the cloud end by an incompletely trusted CSP, the risk of user data leakage is easy to generate, and the Proxy Re-Encryption (PRE) scheme can well solve the problem and ensure safe access and sharing of data.
PRE is an encryption scheme for the conversion of ciphertext, the concept first proposed by Blaze et al in 1998 of the european cryptology society. The PRE scheme allows a semi-trusted Proxy Server (PS) to convert ciphertext that an authorizer (Delegator) Alice can decrypt into ciphertext that an authorizer (Delegatee) Bob can decrypt. Meanwhile, the PS has no knowledge of the plaintext corresponding to the ciphertext. The PRE scheme can be divided into a Single-hop (Single-hop) and a Multi-hop (Multi-hop) according to the number of times of conversion of the ciphertext, wherein the Single-hop refers to that the ciphertext is allowed to be converted only once, and the Multi-hop can be converted for multiple times. The two-way (Bidirectional) and one-way (Unidirectional) are classified according to the conversion direction of the ciphertext. Bidirectional refers to both allowing the PS to convert the ciphertext that Alice can decrypt into ciphertext that Bob can decrypt and allowing the PS to convert the ciphertext that Bob can decrypt into ciphertext that Alice can decrypt. The one-way finger only allows the ciphertext that Alice can decrypt to be converted into the ciphertext that Bob can decrypt. The PRE scheme has been successfully applied in several fields, such as: cloud computing access control, forwarding of encrypted e-mails, distributed file system security management, spam filtering, and the like. In the cloud computing environment, the CSP performs re-encryption on the ciphertext, so that the computation burden of the DO can be reduced, sensitive information cannot be obtained in the re-encryption process, and the data security is protected. However, in the current attribute-based re-encryption scheme, the length of the ciphertext is linearly related to the number of attributes in the scheme. The present invention can solve the above problems well.
Disclosure of Invention
Technical problem to be solved
The invention mainly solves the technical problems in the prior art and provides a CP-ABE encryption outsourcing.
(II) technical scheme
In order to achieve the purpose, the invention adopts the following technical scheme, and aims to solve the problem that the length of a ciphertext (including an original ciphertext and a re-encrypted ciphertext) and the number of attributes of the ciphertext form a linear relation in a proxy re-encryption scheme based on CP-ABE in a cloud computing environment.
The technical scheme adopted by the invention for solving the technical problems is as follows: a CP-ABE-based fixed ciphertext length proxy re-encryption system in cloud computing comprises an initialization module, a private key generation module, a file encryption module, a re-encryption key generation module, a ciphertext re-encryption module and a file decryption module.
An initialization module: the private key generation center generates public parameters and a system master key, the public parameters are public, and the master key is stored by the private key generation center;
a private key generation module: the private key generation center generates a private key for a user newly added into the system and distributes the private key to the user through a secure channel;
a file encryption module: the owner of the data file encrypts the data file, so that an authorizer can safely access and share the data file in the future to obtain the encrypted data file, namely an original ciphertext, and then the owner uploads the encrypted data file to the cloud proxy server;
a re-encryption key generation module: the authorizer generates a re-encryption key, and the generated re-encryption key is transmitted to the cloud proxy server by the authorizer;
the ciphertext re-encryption module: the cloud proxy server uses the obtained re-encryption key to re-encrypt the original ciphertext, and the generated re-encrypted ciphertext is transmitted to an authorized user obtaining the ciphertext by the cloud proxy server;
a file decryption module: after obtaining the ciphertext (including the original ciphertext and the re-encrypted ciphertext), the user decrypts the ciphertext by using the private key of the user, so as to obtain the original text of the data file.
Specifically, the file encryption module uses a CP-ABE encryption outsource; the CP-ABE refers to an attribute encryption algorithm based on a ciphertext strategy, and in the encryption algorithm, a private key is associated with an attribute set, and a ciphertext is associated with an access strategy. The access policy in the scheme is an AND gate consisting of attribute sets; the algorithm of the fixed ciphertext length means that the ciphertext length and the calculation amount of encryption and decryption cannot increase along with the increase of the number of the attributes, namely, the ciphertext length obtained after encryption is fixed no matter how the number of the attributes changes.
Specifically, the ciphertext re-encryption module uses an agent re-encryption technology. The agent re-encryption technology is an encryption technology for converting a ciphertext, wherein a semi-trusted agent can convert the ciphertext which can be decrypted by an authorizer A into the ciphertext which can be decrypted by an authorizer B, and in the process, the agent has no knowledge about the plaintext of a data file corresponding to the ciphertext, so that the safety of the data file is ensured, and the plaintexts corresponding to the two ciphertexts are consistent, so that the sharing of the data file between the A and the B is ensured. By semi-trusted, it is meant that only the agent needs to be trusted to always translate the ciphertext as required by the scheme. After the proxy re-encryption technology is used, even if the authorizer A has something to do not process the ciphertext, the authorized person B can replace the authorizer A to complete decryption of the ciphertext, and therefore the data file is processed in time.
Specifically, the file decryption module is divided into an original ciphertext decryption module and a re-encrypted ciphertext decryption module. The original ciphertext decryption module is used for decrypting by using a private key of an authorizer after the authorizer acquires the original ciphertext from the cloud proxy server, so that the original text of the data file is obtained; and (4) decrypting the re-encrypted ciphertext, namely decrypting the re-encrypted ciphertext by using a private key of the authorized person after the re-encrypted ciphertext is obtained from the cloud proxy server by the authorized person, so as to obtain the original text of the data file, and replacing the authorized person for processing.
Specifically, the proxy re-encryption technology is one-hop and one-way. According to the conversion times of the ciphertext in the proxy re-encryption, the proxy re-encryption scheme can be divided into a single hop and a multi-hop, wherein the single hop means that the proxy re-encryption scheme can only allow the ciphertext to be converted once, namely, the proxy re-encryption can only be performed once; multi-hop means that the ciphertext may be converted multiple times. The agent re-encryption can be divided into two-way encryption and one-way encryption according to the conversion direction of the ciphertext, wherein the two-way encryption means that the agent can convert the ciphertext decrypted by the A into the ciphertext decrypted by the B and can convert the ciphertext decrypted by the B into the ciphertext decrypted by the A; one-way means that only a ciphertext that a can decrypt is allowed to be converted into a ciphertext that B can decrypt.
Advantageous effects
The invention provides a CP-ABE encryption outsourcing. The method has the following beneficial effects:
1. the invention introduces an agent re-encryption technology to convert the ciphertext, so that the ciphertext decrypted by an authorizer is converted into the ciphertext decrypted by the authorizer, specifically, after the file encryption of a data owner is uploaded to a cloud proxy server, the cloud proxy server re-encrypts the encrypted file, namely the original ciphertext under the condition that an authorizer A is absent, and after an authorizer B obtains the re-encrypted ciphertext from the cloud proxy server, the plaintext can be obtained by decrypting the re-encrypted ciphertext by using a private key of the authorizer B, so that the safe access and sharing of the data are ensured.
2. When the ciphertext (including the original ciphertext and the re-encrypted ciphertext) is encrypted, the ciphertext is calculated by adopting the CP-ABE-based algorithm with the fixed ciphertext length, so that the length of the ciphertext (including the original ciphertext and the re-encrypted ciphertext) in the scheme is fixed and cannot be increased along with the increase of the attribute number, the calculation overhead can be effectively reduced, and the scheme becomes efficient.
3. The invention combines the superiority of the proxy re-encryption technology and the CP-ABE-based fixed ciphertext algorithm, fully utilizes the advantages of the proxy re-encryption technology and the CP-ABE-based fixed ciphertext algorithm, ensures the safe access and sharing of data, reduces the calculation cost and improves the efficiency.
Detailed Description
The technical solution of the present invention is further specifically described by the following embodiments in combination.
A CP-ABE encryption outsourcing comprises an initialization module, a private key generation module, a file encryption module, a re-encryption key generation module, a ciphertext re-encryption module and a file decryption module.
An initialization module: the private key generation center generates public parameters and a system master key, the public parameters are public, and the master key is stored by the private key generation center;
a private key generation module: the private key generation center generates a private key for a user newly added into the system and distributes the private key to the user through a secure channel;
a file encryption module: the owner of the data file encrypts the data file so that the user can safely access the shared data file. The encrypted original ciphertext is uploaded to a cloud proxy server by the owner;
a re-encryption key generation module: the authorizer generates a re-encryption key, and the generated re-encryption key is transmitted to the cloud proxy server by the authorizer;
the ciphertext re-encryption module: the cloud proxy server uses the obtained re-encryption key to re-encrypt the original ciphertext, and the generated re-encrypted ciphertext is transmitted to the current authorized user for obtaining the ciphertext by the cloud proxy server;
a file decryption module: after obtaining the ciphertext (including the original ciphertext and the re-encrypted ciphertext), the user decrypts the ciphertext by using the private key of the user, so as to obtain the original text of the data file.
Because the data files in the cloud computing environment are all in the uncontrollable domain, the security of the data files needs to be ensured through a series of processing, the use of the access control technology is particularly important, and the CP-ABE-based algorithm well ensures the security of the data files. In addition, in the cloud computing environment, as cloud users increase, the burden of the cloud proxy server increases continuously, and it is imperative to reduce the storage burden of the cloud proxy server, and the algorithm of fixing the ciphertext length can ensure that the length of the encrypted data file is a fixed value and cannot increase along with the increase of the number of attributes, so that the storage burden of the cloud proxy server is reduced. The invention combines the CP-ABE algorithm with fixed ciphertext length and the proxy re-encryption technology, thereby realizing the high-efficiency safe access and sharing of the data file in the cloud computing environment.
The foregoing shows and describes the fundamental principles and principal features of the invention, namely its novel advantages. It will be understood by those skilled in the art that the present invention is not limited to the embodiments described above, which are described in the specification and illustrated only to illustrate the principle of the present invention, but that various changes and modifications may be made therein without departing from the spirit and scope of the present invention, which fall within the scope of the invention as claimed. The scope of the invention is defined by the appended claims and equivalents thereof.

Claims (5)

1. A CP-ABE encryption outsource, the system comprising: the system comprises an initialization module, a private key generation module, a file encryption module, a re-encryption key generation module, a ciphertext re-encryption module and a file decryption module;
an initialization module: the private key generation center generates public parameters and a system master key, the public parameters are public, and the master key is stored by the private key generation center;
a private key generation module: the private key generation center generates a private key for a user newly added into the system and distributes the private key to the user through a secure channel;
a file encryption module: the owner of the data file encrypts the data file, so that an authorizer can safely access and share the data file in the future to obtain the encrypted data file, namely an original ciphertext, and then the owner uploads the encrypted data file to the cloud proxy server;
a re-encryption key generation module: the authorizer generates a re-encryption key, and the generated re-encryption key is transmitted to the cloud proxy server by the authorizer;
the ciphertext re-encryption module: the cloud proxy server uses the obtained re-encryption key to re-encrypt the original ciphertext, and the generated re-encrypted ciphertext is transmitted to an authorized user for obtaining the ciphertext by the cloud proxy server;
a file decryption module: the user obtains the ciphertext, namely: after the original ciphertext and the re-encrypted ciphertext are included, the ciphertext is decrypted by using a private key of the user, and the original text of the data file is obtained.
2. A CP-ABE encryption outsource according to claim 1, wherein the file encryption module uses a CP-ABE encryption outsource; the CP-ABE refers to an attribute encryption algorithm based on a ciphertext strategy, and a private key in the algorithm is associated with an attribute set and a ciphertext is associated with an access strategy; the access policy is an AND gate consisting of a set of attributes; the algorithm of the fixed ciphertext length means that the ciphertext length and the calculation amount of encryption and decryption cannot increase along with the increase of the number of the attributes, namely, the ciphertext length obtained after encryption is fixed no matter how the number of the attributes changes.
3. A CP-ABE encryption outsource according to claim 1, wherein said ciphertext re-encryption module uses proxy re-encryption; the agent re-encryption technology is an encryption technology for converting a ciphertext, wherein a semi-trusted agent can convert the ciphertext which can be decrypted by an authorizer A into the ciphertext which can be decrypted by an authorizer B, and in the process, the agent does not know the plaintext of a data file corresponding to the ciphertext, so that the safety of the data file is ensured, and the plaintexts corresponding to the two ciphertexts are consistent, so that the sharing of the data file between the A and the B is ensured; the semi-credibility means that only the agent needs to be trusted to convert the ciphertext according to the requirement of the scheme all the time; after the proxy re-encryption technology is used, even if the authorizer A has something to do not process the ciphertext, the authorized person B can replace the authorizer A to complete decryption of the ciphertext, and therefore the data file is processed in time.
4. The CP-ABE encryption outsourced of claim 1, wherein the file decryption module is further divided into an original ciphertext decryption module and a re-encrypted ciphertext decryption module; the original ciphertext decryption module is used for decrypting by using a private key of an authorizer after the authorizer acquires the original ciphertext from the cloud proxy server, so that the original text of the data file is obtained; and (4) decrypting the re-encrypted ciphertext, namely decrypting the re-encrypted ciphertext by using a private key of an authorized person after obtaining the re-encrypted ciphertext from the cloud proxy server, so as to obtain the original text of the data file.
5. A CP-ABE encryption outsource according to claim 3, wherein said proxy re-encryption technique is single-hop, one-way; according to the conversion times of the ciphertext in the proxy re-encryption, the proxy re-encryption scheme can be divided into a single hop and a multi-hop, wherein the single hop means that the proxy re-encryption scheme can only allow the ciphertext to be converted once, namely, the proxy re-encryption can only be performed once; multi-hop means that the ciphertext can be converted multiple times; the agent re-encryption can be divided into two-way encryption and one-way encryption according to the conversion direction of the ciphertext, wherein the two-way encryption means that the agent can convert the ciphertext decrypted by the A into the ciphertext decrypted by the B and can convert the ciphertext decrypted by the B into the ciphertext decrypted by the A; one-way means that only a ciphertext that a can decrypt is allowed to be converted into a ciphertext that B can decrypt.
CN202010514527.1A 2020-06-08 2020-06-08 CP-ABE encryption outsourcing Pending CN111698240A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010514527.1A CN111698240A (en) 2020-06-08 2020-06-08 CP-ABE encryption outsourcing

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010514527.1A CN111698240A (en) 2020-06-08 2020-06-08 CP-ABE encryption outsourcing

Publications (1)

Publication Number Publication Date
CN111698240A true CN111698240A (en) 2020-09-22

Family

ID=72479821

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010514527.1A Pending CN111698240A (en) 2020-06-08 2020-06-08 CP-ABE encryption outsourcing

Country Status (1)

Country Link
CN (1) CN111698240A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112788068A (en) * 2021-03-23 2021-05-11 南京工业大学 CP-ABE-based fixed ciphertext length proxy re-encryption system and method in cloud computing

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104580205A (en) * 2015-01-05 2015-04-29 南京邮电大学 CP-ABE-based fixed ciphertext length proxy re-encryption system and method in cloud computing
CN108418681A (en) * 2018-01-22 2018-08-17 南京邮电大学 A kind of searching ciphertext system and method based on attribute for supporting proxy re-encryption

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104580205A (en) * 2015-01-05 2015-04-29 南京邮电大学 CP-ABE-based fixed ciphertext length proxy re-encryption system and method in cloud computing
CN108418681A (en) * 2018-01-22 2018-08-17 南京邮电大学 A kind of searching ciphertext system and method based on attribute for supporting proxy re-encryption

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112788068A (en) * 2021-03-23 2021-05-11 南京工业大学 CP-ABE-based fixed ciphertext length proxy re-encryption system and method in cloud computing

Similar Documents

Publication Publication Date Title
Kim et al. IoT device security based on proxy re-encryption
Jia et al. SDSM: a secure data service mechanism in mobile cloud computing
Moffat et al. A survey on ciphertext-policy attribute-based encryption (CP-ABE) approaches to data security on mobile devices and its application to IoT
JP6173455B2 (en) Attribute-based encryption
CN111541678A (en) Block chain-based proxy re-encryption method, system and storage medium
US20130339726A1 (en) File server apparatus and file server system
CN102624522A (en) Key encryption method based on file attribution
CN102655508A (en) Method for protecting privacy data of users in cloud environment
JP6115573B2 (en) Cryptographic system, data storage system, and apparatus and method used therefor
CN104735070B (en) A kind of data sharing method between general isomery encryption cloud
CN114513327B (en) Block chain-based Internet of things private data rapid sharing method
Nivedhaa et al. A secure erasure cloud storage system using advanced encryption standard algorithm and proxy re-encryption
CN113961959A (en) Proxy re-encryption method and system for data sharing community
Hong et al. Sharing your privileges securely: a key-insulated attribute based proxy re-encryption scheme for IoT
Youn et al. Authorized client-side deduplication using CP-ABE in cloud storage
CN111698240A (en) CP-ABE encryption outsourcing
Canard et al. Highly privacy-protecting data sharing in a tree structure
CN110912691B (en) Ciphertext distribution method, device and system based on grid access control encryption algorithm in cloud environment and storage medium
CN116961893A (en) End-to-end secure encryption communication management method, system and storable medium
Roy et al. Proxy re-encryption schemes for secure cloud data and applications: a survey
Ge et al. A secure fine-grained identity-based proxy broadcast re-encryption scheme for micro-video subscribing system in clouds
Kanchanadevi et al. An Attribute based encryption scheme with dynamic attributes supporting in the hybrid cloud
Thushara et al. A Flexible and Adaptive Hybrid Algorithm for Secure Data Sharing in Cloud Computing
Chandrakala et al. Proxy re-encryption using MLBC (modified lattice based cryptography)
Muhammad et al. Current Issues in Ciphertext Policy-Attribute Based Scheme for Cloud Computing: A Survey

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
WD01 Invention patent application deemed withdrawn after publication

Application publication date: 20200922

WD01 Invention patent application deemed withdrawn after publication