CN113965320A - Ciphertext strategy attribute encryption method supporting quick revocation - Google Patents

Ciphertext strategy attribute encryption method supporting quick revocation Download PDF

Info

Publication number
CN113965320A
CN113965320A CN202111157036.7A CN202111157036A CN113965320A CN 113965320 A CN113965320 A CN 113965320A CN 202111157036 A CN202111157036 A CN 202111157036A CN 113965320 A CN113965320 A CN 113965320A
Authority
CN
China
Prior art keywords
ciphertext
attribute
key
algorithm
revocation
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202111157036.7A
Other languages
Chinese (zh)
Inventor
李维勇
顾振飞
孔枫
王颖
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nanjing College of Information Technology
Original Assignee
Nanjing College of Information Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nanjing College of Information Technology filed Critical Nanjing College of Information Technology
Priority to CN202111157036.7A priority Critical patent/CN113965320A/en
Publication of CN113965320A publication Critical patent/CN113965320A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

The invention discloses a ciphertext strategy attribute encryption method supporting quick revocation, which comprises the steps of initializing an algorithm, outputting a public key and a main key by a key center, and sending the public key and the main key to an encryptor and a storage center; after receiving a private key request of a decryptor, executing a key generation algorithm to generate a private key; the encryptor encrypts a data plaintext through an encryption algorithm to generate a primary generation ciphertext, and the primary generation ciphertext is transferred to a storage center; the storage center executes revocation algorithm encryption on the received primary ciphertext to generate a secondary ciphertext; the revocation algorithm updates the iteration ciphertext according to the request times; after receiving a decryption request of a decryptor, acquiring a time stamp of a moment when the decryptor requests to send, and executing a decryption algorithm; the attribute set of the decryptor meets the access policy, and the decryptor carries the timestamp which is consistent with the acquired timestamp for verification, so that the data plaintext can be acquired. The invention does not need the user to keep updating the private key on line through the quick revocation algorithm, reduces the calculation times during decryption, realizes instant revocation and reduces the decryption calculation amount.

Description

Ciphertext strategy attribute encryption method supporting quick revocation
Technical Field
The invention belongs to the technical field of information security, and particularly relates to a ciphertext policy attribute encryption method supporting quick revocation.
Background
Personal Health Record (PHR) sharing systems gradually exert advantages in Health management, but an encryption mechanism of an existing PHR sharing system needs to frequently update a private key online, so that a period of decryption operation is slow, and an existing attribute-based encryption system (ABE) is high in time complexity and space complexity, so that revocation often involves huge calculation amount, and even final decryption calculation is not complicated, so that many schemes cannot be directly applied to the PHR system, and usability of the PHR system is greatly reduced.
Disclosure of Invention
The purpose of the invention is as follows: the ciphertext strategy attribute encryption method supporting quick revocation is provided, and the problems that revocation work in the existing encryption mechanism is large in calculation amount, decryption speed is low, and revocation of a PHR system is not flexible enough are solved.
The technical scheme is as follows: a ciphertext strategy attribute encryption method supporting quick revocation comprises the following steps:
initializing an algorithm after the system is started, outputting a public key and a master key by a key center, and sending the public key and the master key to an encryptor and a storage center;
after receiving the private key request of the decryptor, the key center executes a key generation algorithm to generate a private key;
an encryptor encrypts a data plaintext by using a public key and an access strategy through an encryption algorithm to generate a first generation ciphertext, and the first generation ciphertext is transferred to a storage center;
the storage center executes revocation algorithm encryption on the received primary ciphertext to generate a secondary ciphertext;
after receiving the revocation request of a decryptor, the storage center executes the revocation algorithm again on the second-generation ciphertext to generate a third-generation ciphertext, and if the request times are more than one, the revocation algorithm updates the iteration ciphertext according to the request times;
after receiving the decryption request of the decryptor, the storage center acquires a time stamp of the moment when the decryptor requests to send, and executes a decryption algorithm;
and after the attribute set of the decryptor meets the access policy and the decryptor carries the timestamp which is verified to be consistent with the timestamp acquired in the storage center, the decryptor can acquire the data plaintext, otherwise, the decryption fails.
In a further embodiment, in the initialization algorithm, the public and master key generation process is as follows:
let global attribute space be
Figure BDA0003288667370000011
Initial clustering of attributes
Figure BDA0003288667370000012
Inputting a safety parameter 1λThe algorithm generates a prime number p of length lambda bits and two cyclic groups of order p
Figure BDA0003288667370000021
And
Figure BDA0003288667370000022
let g be
Figure BDA0003288667370000023
Generating a bilinear pairwise map e by an algorithm:
Figure BDA0003288667370000024
a set of and attribute spaces
Figure BDA0003288667370000025
Corresponding random number h1,h2,…,hnAnd two collision-resistant hash functions
Figure BDA0003288667370000026
And H1:{0,1}*→Zp；
Finally outputting the public key
Figure BDA0003288667370000027
And master key MSK ═ gα,β}。
In a further embodiment, the private key generation algorithm inputs the set of attributes S, the public key PK, and the master key MSK and then outputs the set of private keys SK and the session public key PK corresponding to the set attributessession,kThe specific process is as follows:
selecting a random number tau epsilon ZpAnd calculates a first private key D1＝gα+βτAnd a second private key D2＝gτ；
For any attribute att in attribute set SxCalculating the x private key
Figure BDA0003288667370000028
For any user ukThe user himself selects a secret character sigmak∈{0,1}*Then generates a session private key SKsession,k＝H(IDk,σk) And a session public key
Figure BDA0003288667370000029
Wherein the IDkAn identity unique to the user; finally, outputting a private key related to the attribute set S:
Figure BDA00032886673700000210
in a further embodiment, the specific steps of the first generation ciphertext are as follows:
for an access policy
Figure BDA00032886673700000211
Note that it contains a total number of attributes of l
Generating corresponding LSSS access structures
Figure BDA00032886673700000212
Wherein
Figure BDA00032886673700000213
The method comprises the following steps that a matrix with l rows and m columns is adopted, and rho is a mapping function and is responsible for mapping any row of the matrix into a certain attribute in an access strategy;
secondly, a secret number s is generated to belong to ZpAnd one random vector v ═ s, v1,v2,…,vm) Wherein v is1,v2,…,vmAre all ZpA random number of (c);
computing a first ciphertext C1＝M·e(g,g)αsAnd a second ciphertext C2＝gs(ii) a Att for any one attributeρ(i)Computing initial ciphertext of Attribute i
Figure BDA00032886673700000214
Wherein
Figure BDA00032886673700000215
Representing a secret shared key share;
and outputting an initial ciphertext:
Figure BDA0003288667370000031
in a further embodiment of the method of the invention,
the first generation ciphertext executes a revocation (FIR) algorithm for the first time to generate FIR message header headers and FIR ciphertext CT, and the steps are as follows:
clustering by attributes
Figure BDA0003288667370000032
Generate a corresponding set of attribute group keys
Figure BDA0003288667370000033
Selecting a secret random number gamma E ZpAnd generates a session public key PKsession＝gγAnd a session private key SKsessionγ; and then calculate the user u with respect to anykFactor of (2)
Figure BDA0003288667370000034
Setting any one attribute group
Figure BDA0003288667370000035
The number of users involved is d, and for this property group, the FIR algorithm generates a polynomial
Figure BDA0003288667370000036
A set of elements P is then generated0＝Kx+a0,P1＝a1,…,Pd＝adIn turn, with respect to the FIR message header of the attribute group: head devicex＝{P0＝Kx+a0,P1＝a1,…,Pd＝ad}；
From this, the global FIR header is:
Figure BDA0003288667370000037
the final FIR ciphertext is:
Figure BDA0003288667370000038
in a further embodiment, attribute att is revoked when a decryptor revokes ityThe method comprises the following specific steps:
the attribute cluster is updated to:
Figure BDA0003288667370000039
wherein G'yThe attribute group of the user is removed;
the attribute group key set is updated as:
Figure BDA00032886673700000310
wherein K'yIs an updated attribute group key;
then G'yAll users in the system generate their own randomThe number of machines;
let user ukThe new random number generated is σ'kAnd calculates a new public key for the session
Figure BDA00032886673700000311
The storage center calculates X 'according to the new conversation private key'k＝(PK′session,k)γSubsequently, a new polynomial is generated
Figure BDA0003288667370000041
To generate a new FIR header:
header′y＝{P0＝K′y+a′0,P1＝a′0,…,Pd′＝a′d′}；
the global FIR header will then be updated as:
Figure BDA0003288667370000042
attribute att is contained in all access strategiesyThe FIR ciphertext of (a) will be updated as:
Figure BDA0003288667370000043
in a further embodiment, the decryption algorithm steps are as follows:
after the decryption session is established, the timestamp t at this time is recorded, and then the global FIR message header is updated to be:
Figure BDA0003288667370000044
then, the updated global FIR message header and the FIR ciphertext are sent to the user;
the user firstly calculates the user factor by the time stamp t of the user
Figure BDA0003288667370000045
Att for arbitrary attributesxE to S, the decryption algorithm executes the following calculation to obtain a corresponding attribute group key:
Figure BDA0003288667370000046
wherein the content of the first and second substances,
Figure BDA0003288667370000047
represents the ith user factor;
after obtaining the attribute group key, the decryption algorithm performs the following calculations:
Figure BDA0003288667370000048
where ρ (i) ∈ S denotes a row specifying attribute,
Figure BDA0003288667370000049
Dρ(i)each represents a private key encryption key pair, and K rho (i) · 1K rho (i) represents the ith row attribute key;
Figure BDA00032886673700000410
represented as a hash-value algorithm, is,
Figure BDA00032886673700000411
gτare all represented as the generator of the group G,ωi、βτλiωiare all represented as ZpA random number of the set.
In a further embodiment, it can be seen from the LSSS property that if the set of attributes does not satisfy the rights of the access policy, the secret s will not be recovered within the polynomial time and the decryption will fail; otherwise, the secret s can be recovered within the polynomial time, so that the decryption calculation formula is established:
Figure BDA0003288667370000051
the parameter obtained at this time is denoted as a, and then the following bilinear operation is continuously performed:
Figure BDA0003288667370000052
and recording the obtained parameter as B, and finally executing the following operation to obtain the correct message plaintext M:
Figure BDA0003288667370000053
has the advantages that: compared with the prior art, the invention has the following advantages:
a Fast and Immediate Revocation (FIR) algorithm is adopted, a user is not required to keep online to update a private key, and multiplication operation required for obtaining an attribute group key during decryption is reduced to only 1 time, so that decryption overhead is reduced while immediate revocation is ensured; improved revocation work calculation efficiency and flexibility and usability of the PHR system are achieved.
Drawings
Fig. 1 is a topological structure diagram of the ciphertext policy supporting quick revocation according to the present invention.
Fig. 2 is a graph comparing average encryption times in embodiment 2 of the present invention.
Fig. 3 is a graph comparing the average decryption time in embodiment 2 of the present invention.
Detailed Description
In order to more fully understand the technical content of the present invention, the technical solution of the present invention will be further described and illustrated with reference to the following specific embodiments, but not limited thereto.
Fig. 1 to fig. 3 are further used to explain an encryption method for supporting fast revocation ciphertext policy attribute, which includes the following steps:
initializing an algorithm after the system is started, outputting a public key and a master key by a key center, and sending the public key and the master key to an encryptor and a storage center;
after receiving the private key request of the decryptor, the key center executes a key generation algorithm to generate a private key;
an encryptor encrypts a data plaintext by using a public key and an access strategy through an encryption algorithm to generate a first generation ciphertext, and the first generation ciphertext is transferred to a storage center;
the storage center executes revocation algorithm encryption on the received primary ciphertext to generate a secondary ciphertext;
after receiving the revocation request of a decryptor, the storage center executes the revocation algorithm again on the second-generation ciphertext to generate a third-generation ciphertext, and if the request times are more than one, the revocation algorithm updates the iteration ciphertext according to the request times;
after receiving the decryption request of the decryptor, the storage center acquires a time stamp of the moment when the decryptor requests to send, and executes a decryption algorithm;
and after the attribute set of the decryptor meets the access policy and the decryptor carries the timestamp which is verified to be consistent with the timestamp acquired in the storage center, the decryptor can acquire the data plaintext, otherwise, the output indicates that the decryption fails.
In a further embodiment, in the initialization algorithm, the public and master key generation process is as follows:
let global attribute space be
Figure BDA0003288667370000061
Initial clustering of attributes
Figure BDA0003288667370000062
Inputting a safety parameter 1λThe algorithm generates a prime number p of length lambda bits and two cyclic groups of order p
Figure BDA0003288667370000063
And
Figure BDA0003288667370000064
let g be
Figure BDA0003288667370000065
Generating a bilinear pairwise map e by an algorithm:
Figure BDA0003288667370000066
a set of and attribute spaces
Figure BDA0003288667370000067
Corresponding random number h1,h2,…,hnAnd two collision-resistant hash functions
Figure BDA0003288667370000068
And H1:{0,1}*→Zp；
Finally outputting the public key
Figure BDA0003288667370000069
And master key MSK ═ gα,β}。
In a further embodiment, the private key generation algorithm inputs the set of attributes S, the public key PK, and the master key MSK and then outputs the set of private keys SK and the session public key PK corresponding to the set attributessession,kThe specific process is as follows:
selecting a random number tau epsilon ZpAnd calculates a first private key D1＝gα+βτAnd a second private key D2＝gτ；
For any attribute att in attribute set SxCalculating the x private key
Figure BDA00032886673700000610
For any user ukThe user himself selects a secret character sigmak∈{0,1}*Then generates a session private key SKsession,k＝H(IDk,σk) And a session public key
Figure BDA00032886673700000611
Wherein the IDkAn identity unique to the user; finally, outputting a private key related to the attribute set S:
Figure BDA00032886673700000612
in a further embodiment, the specific steps of the first generation ciphertext are as follows:
for an access policy
Figure BDA0003288667370000071
Note that it contains a total number of attributes of l
Generating corresponding LSSS access structures
Figure BDA0003288667370000072
Wherein
Figure BDA0003288667370000073
The method comprises the following steps that a matrix with l rows and m columns is adopted, and rho is a mapping function and is responsible for mapping any row of the matrix into a certain attribute in an access strategy;
secondly, a secret number s is generated to belong to ZpAnd one random vector v ═ s, v1,v2,…,vm) Wherein v is1,v2,…,vmAre all ZpA random number of (c);
computing a first ciphertext C1＝M·e(g,g)αsAnd a second ciphertext C2＝gs(ii) a Att for any one attributeρ(i)Computing initial ciphertext of Attribute i
Figure BDA0003288667370000074
Wherein
Figure BDA0003288667370000075
Representing a secret shared key share;
and outputting an initial ciphertext:
Figure BDA0003288667370000076
in a further embodiment of the method of the invention,
the first generation ciphertext executes a revocation (FIR) algorithm for the first time to generate FIR message header headers and FIR ciphertext CT, and the steps are as follows:
clustering by attributes
Figure BDA0003288667370000077
Generate a corresponding set of attribute group keys
Figure BDA0003288667370000078
Selecting a secret random number gamma E ZpAnd generates a session public key PKsession＝gγAnd a session private key SKsessionγ; and then calculate the user u with respect to anykFactor of (2)
Figure BDA0003288667370000079
Setting any one attribute group
Figure BDA00032886673700000710
The number of users involved is d, and for this property group, the FIR algorithm generates a polynomial
Figure BDA00032886673700000711
A set of elements P is then generated0＝Kx+a0,P1＝a1,…,Pd＝adIn turn, with respect to the FIR message header of the attribute group: head devicex＝{P0＝Kx+a0,P1＝a1,…,Pd＝ad}；
From this, the global FIR header is:
Figure BDA00032886673700000712
the final FIR ciphertext is:
Figure BDA00032886673700000713
in a further embodiment, attribute att is revoked when a decryptor revokes ityThe method comprises the following specific steps:
the attribute cluster is updated to:
Figure BDA0003288667370000081
wherein G'yThe attribute group of the user is removed;
the attribute group key set is updated as:
Figure BDA0003288667370000082
wherein K'yIs an updated attribute group key;
then G'yAll users in the system respectively generate random numbers of the users;
let user ukThe new random number generated is σ'kAnd calculates a new public key for the session
Figure BDA0003288667370000083
The storage center calculates X 'according to the new conversation private key'k＝(PK′session,k)γSubsequently, a new polynomial is generated
Figure BDA0003288667370000084
To generate a new FIR header:
header′y＝{P0＝K′y+a′0,P1＝a′0,…,Pd′＝a′d′}；
the global FIR header will then be updated as:
Figure BDA0003288667370000085
attribute att is contained in all access strategiesyThe FIR ciphertext of (a) will be updated as:
Figure BDA0003288667370000086
in a further embodiment, the decryption algorithm steps are as follows:
after the decryption session is established, the timestamp t at this time is recorded, and then the global FIR message header is updated to be:
Figure BDA0003288667370000087
then, the updated global FIR message header and the FIR ciphertext are sent to the user;
the user firstly calculates the user factor by the time stamp t of the user
Figure BDA0003288667370000088
Att for arbitrary attributesxE to S, the decryption algorithm executes the following calculation to obtain a corresponding attribute group key:
Figure BDA0003288667370000089
wherein the content of the first and second substances,
Figure BDA00032886673700000810
represents the ith user factor;
after obtaining the attribute group key, the decryption algorithm performs the following calculations:
Figure BDA0003288667370000091
where ρ (i) ∈ S denotes a row specifying attribute,
Figure BDA0003288667370000092
Dρ(i)all represent a private key cryptographic key pair, Kρ(i)·1/Kρ(i)Representing the ith row attribute key;
Figure BDA0003288667370000093
represented as a hash-value algorithm, is,
Figure BDA0003288667370000094
gτare all represented as the generator of the group G,ωi、βτλiωiare all represented as ZpA random number of the set. A
In a further embodiment, it can be seen from the LSSS property that if the set of attributes does not satisfy the rights of the access policy, the secret s will not be recovered within the polynomial time and the decryption will fail; otherwise, the secret s can be recovered within the polynomial time, so that the decryption calculation formula is established:
Figure BDA0003288667370000095
the parameter obtained at this time is denoted as a, and then the following bilinear operation is continuously performed:
Figure BDA0003288667370000096
and recording the obtained parameter as B, and finally executing the following operation to obtain the correct message plaintext M:
Figure BDA0003288667370000097
from the above ciphertext composition, it can be seen that att is the attribute which is revokedyEven if it calculates the attribute group key K using the previously acquired message headeryDecryption to obtain the correct message plaintext cannot be completed either because the ciphertext has been updated at this time. Thus, the forward security of the scheme can be guaranteed.
For attribute att still contained in attribute setyOr just possess attribute attyWhen the user initiates decryption, the user can only obtain the re-encrypted message header and the re-encrypted ciphertext of the current time stamp, even if the user obtains the message header at a certain past momentThe user cannot know the specific session time, and therefore cannot extract the past attribute group key. Cannot be decrypted correctly even if it has downloaded past ciphertext; therefore, the backward safety of the scheme can be ensured.
The method is verified by the game employing the encryption mechanism in example 1, and the confidentiality of the CP-ABE-FR scheme is stipulated to the difficulty of the DBDH problem by the game. The game is played by the enemy
Figure BDA0003288667370000098
Simulator
Figure BDA0003288667370000099
And challenger
Figure BDA00032886673700000910
The joint participation is completed, and the process is as follows:
(1) an initialization stage: first enemy
Figure BDA0003288667370000101
Direction simulator
Figure BDA0003288667370000102
Sending a challenge access policy
Figure BDA0003288667370000103
Second challenger
Figure BDA0003288667370000104
Generating a cyclic group
Figure BDA0003288667370000105
Selecting a generator g of the group and three secrets a, b, c ∈ ZpAnd g, A ═ ga、B＝gb、C＝gcAnd Z is sent to the simulator
Figure BDA0003288667370000106
Then simulator
Figure BDA0003288667370000107
Selecting a cyclic group
Figure BDA0003288667370000108
And a two-line pair map e:
Figure BDA0003288667370000109
set of secret random numbers [ beta, r ]1,r2,…,rnAn attribute cluster
Figure BDA00032886673700001010
And two random prediction machines
Figure BDA00032886673700001011
And H1:{0,1}*→Zp. Final simulator
Figure BDA00032886673700001012
To the enemy
Figure BDA00032886673700001013
The following public key is sent:
Figure BDA00032886673700001014
(2) an inquiry stage: enemy
Figure BDA00032886673700001015
Direction simulator
Figure BDA00032886673700001016
The following two queries are sent a limited number of times:
a. private key challenge: first simulator
Figure BDA00032886673700001017
A List is maintained. Second enemy
Figure BDA00032886673700001018
Clustering on attributes
Figure BDA00032886673700001019
In which one user u is arbitrarily selectedk(memory user u)kIs represented as IDkAttribute set is S) parallel simulator
Figure BDA00032886673700001020
A private key request is issued for the set of attributes S. Then simulator
Figure BDA00032886673700001021
Generating a random number R1,R2,R3∈ZpThen, the private key:
Figure BDA00032886673700001022
Figure BDA00032886673700001023
final simulator
Figure BDA00032886673700001024
Add information about user u in List ListkTuple of (2)
Figure BDA00032886673700001025
b. Encrypting the challenge: first enemy
Figure BDA00032886673700001026
Selecting a PHR data plaintext M and an access policy
Figure BDA00032886673700001027
Parallel simulator
Figure BDA00032886673700001028
Sending a message about M and
Figure BDA00032886673700001029
the encryption request of (2). Second simulator
Figure BDA00032886673700001030
Firstly, generating a corresponding attribute group key set according to the attribute group set
Figure BDA00032886673700001031
And generating and accessing policies
Figure BDA00032886673700001032
Corresponding LSSS access structure matrix
Figure BDA00032886673700001033
Simultaneously selecting a secret number s ∈ ZpAnd one random vector v ═ s, v1,v2,…,vm) Calculating
Figure BDA00032886673700001034
Then simulator
Figure BDA00032886673700001035
Generate the following cipher text to
Figure BDA00032886673700001036
Figure BDA00032886673700001037
Extracting user's public key PK from List at the same timesession,kAnd constructing a global re-encryption message header according to a real re-encryption algorithm. For users not in List, the simulator
Figure BDA00032886673700001038
A private key generator is invoked to generate a tuple corresponding to the user and add to the List. Final simulator
Figure BDA00032886673700001039
Sending the ciphertext and the global re-encrypted message header corresponding to the timestamp at that time to the adversary
Figure BDA00032886673700001040
(3) A challenge stage: first enemy
Figure BDA0003288667370000111
Direction simulator
Figure BDA0003288667370000112
Submitting two PHR data plaintext M with same length1And M2. Second simulator
Figure BDA0003288667370000113
Generating and
Figure BDA0003288667370000114
corresponding LSSS access structure
Figure BDA0003288667370000115
And one random vector v ═ s, v1,v2,…,vm). And then for arbitrary attributes
Figure BDA0003288667370000116
Computing
Figure BDA0003288667370000117
Wherein
Figure BDA0003288667370000118
Final simulator
Figure BDA0003288667370000119
Selects a random bit value delta epsilon {0,1} and returns the following challenge ciphertext to
Figure BDA00032886673700001110
Figure BDA00032886673700001111
(4) An inquiry stage: as with step 2, the adversary
Figure BDA00032886673700001112
Continue to simulator
Figure BDA00032886673700001113
A limited number of private key challenges and encrypted challenges are sent. It is to be noted that all queries must satisfy the following constraints:
a. in the private key inquiry process, all attribute sets S cannot meet the challenge access policy
Figure BDA00032886673700001114
b. Access policy
Figure BDA00032886673700001115
Or is M1And M2May not be used to make encrypted queries.
(5) Guessing: enemy
Figure BDA00032886673700001116
Output δ' ∈ {0,1} as a guess for δ. If delta is delta', enemy
Figure BDA00032886673700001117
Win challenge game while simulating
Figure BDA00032886673700001118
Output 1 indicates its guess Z ═ e (g, g)abc. If δ ≠ δ' then adversary challenge fails while the simulator is in progress
Figure BDA00032886673700001119
Output 0 represents guess Z ═ e (g, g)z。
When Z is equal to e (g, g)abcEncryption process of time, challenge phase andthe encryption process of the real CP-ABE-FR algorithm is the same. Suppose an adversary
Figure BDA00032886673700001120
The advantage of breaking the CP-ABE-FR algorithm is epsilon', then the simulator
Figure BDA00032886673700001121
The probability of outputting 1 is:
Figure BDA00032886673700001122
when Z is equal to e (g, g)zTime, enemy
Figure BDA00032886673700001123
The challenge cryptogram obtained is a completely random cryptogram, so that the adversary
Figure BDA00032886673700001124
The guess of (a) is completely random. In such a case, the simulator
Figure BDA00032886673700001125
The probability of outputting 1 is:
Figure BDA00032886673700001126
thus, the simulator
Figure BDA0003288667370000121
The advantages of solving the DBDH problem are satisfied:
Figure BDA0003288667370000122
it can be concluded from this that if there is no polynomial time algorithm that can solve the DBDH problem with a non-negligible dominance epsilon, then there must be no polynomial time adversary
Figure BDA0003288667370000123
And breaking the CP-ABE-FR algorithm. The algorithm can well ensure confidentiality.
In the invention, various network attacks of private key stealing can be faced in the actual use process, the collusion attack is a typical network attack means, and the collusion attack means that a plurality of decryptors illegally generate a brand-new private key through respective private keys, and the brand-new private key can correctly realize correct decryption. If the attribute sets of these multiple decryptors do not conform to the access policy of the ciphertext, but can produce a legal private key through collusion, the security of the ciphertext will be greatly threatened.
In the method of the invention, each time a private key is generated, the algorithm generates a different random number τ and embeds this random number into the private key component, i.e. each private key has a different D ═ g α + β τ. Even if multiple message visitors attempt to collude, a legitimate private key cannot be obtained because different random numbers τ are embedded within the private key components from different message visitors. In summary, CP-ABE-FR is well resistant to collusion attack.
The comparison analysis of the LHS method and the Hur method in the embodiment 2 and the FIR algorithm in the invention is as follows:
definition of TmulAnd TexpThe time required to perform a single multiplication or exponentiation in generating the header and extracting the attribute group key, respectively
The comparison results are shown in Table 1, LHS method [19 ]]And Hur method [21]Generating a group of attributes GxThe message header of (1) needs to perform multiplication and exponent operation for 2d times, and the message header of (d) needs to perform multiplication and exponent operation for d (d +3)/2 times when extracting the attribute group key, where d is the attribute group GxThe number of users involved.
TABLE 1 revocation efficiency comparison
Figure BDA0003288667370000131
The FIR algorithm proposed herein is generating a group G of attributesxThe message header of (1) is needed to perform only 1 multiplication, and 2d exponential operations are reduced compared with the LHS method and the Hur method. Meanwhile, the FIR algorithm needs to execute d times of multiplication and d (d +1)/2 times of exponential operation when extracting the corresponding attribute group key, and d times of exponential operation are reduced compared with the two schemes. The FIR algorithm thus improves the computational efficiency of attribute revocation.
The experimental procedure in the codebase for the following examples is as follows:
the experiment is based on a 512-bit elliptic curve, the order of which is a large prime number of 120 bit. The PHR system access control model is established in experiments based on an LHS method, a Hur method and the scheme provided by the text, and the average encryption and decryption calculation time under the condition of different attribute quantities is recorded;
as shown in fig. 2, several system models have average encryption time under different attribute numbers, and both the LHS method and the Hur method support fine-grained instant revocation based on an attribute group, so that ciphertext needs to be encrypted again in the encryption process; while the encryption time of the Hur method is slightly shorter than that of the LHS method, the CP-ABE-FR-based PHR system access control model adds the FIR algorithm, but the FIR algorithm does not generate too much computational load to the encryption work of the system.
As shown in fig. 3, the average decryption time is calculated by using the distributed private key for decryption, but the decryption time is slightly longer in the LHS method. And CP-ABE-FR reduces PHR decryption time by about 9.3%; therefore, in general, the decryption computation efficiency of the PHR system access control model proposed by the present invention is considerable.
Through the rapid instant revocation (FIR) algorithm, a user is not required to keep online to update a private key, and the multiplication operation required for obtaining an attribute group key during decryption is reduced to only 1 time, so that instant revocation is ensured, and decryption overhead is reduced; improved revocation work calculation efficiency and flexibility and usability of the PHR system are achieved.
The present invention has been described above by way of illustration in the drawings, and it will be understood by those skilled in the art that the present disclosure is not limited to the embodiments described above, and various changes, modifications and substitutions may be made without departing from the scope of the present invention.

Claims (8)

1. A ciphertext strategy attribute encryption method supporting quick revocation is characterized by comprising the following steps:
initializing an algorithm after the system is started, outputting a public key and a master key by a key center, and sending the public key and the master key to an encryptor and a storage center;
after receiving the private key request of the decryptor, the key center executes a key generation algorithm to generate a private key;
an encryptor encrypts a data plaintext by using a public key and an access strategy through an encryption algorithm to generate a first generation ciphertext, and the first generation ciphertext is transferred to a storage center;
the storage center executes revocation algorithm encryption on the received primary ciphertext to generate a secondary ciphertext;
after receiving the revocation request of a decryptor, the storage center executes the revocation algorithm again on the second-generation ciphertext to generate a third-generation ciphertext, and if the request times are more than one, the revocation algorithm updates the iteration ciphertext according to the request times;
after receiving the decryption request of the decryptor, the storage center acquires a time stamp of the moment when the decryptor requests to send, and executes a decryption algorithm;
the attribute set of the decryptor meets the access policy, and the decryptor can acquire the data plaintext only after carrying the timestamp which is acquired from the storage center and verifying the consistency.
2. The method for encrypting the ciphertext policy attribute supporting the quick revocation according to claim 1, wherein in an initialization algorithm, the process of generating the public key and the master key is as follows:
let global attribute space be
Figure FDA0003288667360000011
Initial clustering of attributes
Figure FDA0003288667360000012
Inputting a safety parameter 1λThe algorithm generates a prime number p of length lambda bits and two cyclic groups of order p
Figure FDA0003288667360000013
And
Figure FDA0003288667360000014
let g be
Figure FDA0003288667360000015
A generator for generating a bilinear pairwise map by an algorithm
Figure FDA0003288667360000016
A set of and attribute spaces
Figure FDA0003288667360000017
Corresponding random number h1,h2,…,hnAnd two collision-resistant hash functions
Figure FDA0003288667360000018
And H1:{0,1}*→Zp；
Finally outputting the public key
Figure FDA0003288667360000019
And master key MSK ═ gα,β}。
3. The method as claimed in claim 1, wherein the secret key generation algorithm inputs the attribute set S, the public key PK, and the master key MSK and then outputs the private key set SK and the session public key PK corresponding to the set attributessession,kThe specific process is as follows:
selecting a random number tau epsilon ZpAnd calculates a first private key
Figure FDA0003288667360000021
And a second private key D2＝gτ；
For any attribute att in attribute set SxCalculating the x private key
Figure FDA0003288667360000022
For any user ukThe user himself selects a secret character sigmak∈{0,1}*Then generates a session private key SKsession,k＝H(IDk,σk) And a session public key
Figure FDA0003288667360000023
Wherein the IDkAn identity unique to the user; finally, outputting a private key related to the attribute set S:
Figure FDA0003288667360000024
4. the ciphertext policy attribute encryption method supporting quick revocation as claimed in claim 1, wherein the specific steps of the primary ciphertext are as follows:
for an access policy
Figure FDA0003288667360000025
Note that it contains a total number of attributes of l
Generating corresponding LSSS access structures
Figure FDA0003288667360000026
Wherein
Figure FDA0003288667360000027
The method comprises the following steps that a matrix with l rows and m columns is adopted, and rho is a mapping function and is responsible for mapping any row of the matrix into a certain attribute in an access strategy;
secondly, a secret number s is generated to belong to ZpAnd one random vector v ═ s, v1,v2,…,vm) Wherein v is1,v2,…,vmAre all ZpA random number of (c);
computing a first ciphertext C1＝M·e(g,g)αsAnd a second ciphertext C2＝gs(ii) a Att for any one attributeρ(i)Computing initial ciphertext of Attribute i
Figure FDA0003288667360000028
Wherein
Figure FDA0003288667360000029
Representing a secret shared key share;
and outputting an initial ciphertext:
Figure FDA00032886673600000210
5. the encryption method for supporting fast revocation of ciphertext policy attributes according to claim 1,
the first generation ciphertext executes a revocation (FIR) algorithm for the first time to generate FIR message header headers and FIR ciphertext CT, and the steps are as follows:
clustering by attributes
Figure FDA00032886673600000211
Generate a corresponding set of attribute group keys
Figure FDA00032886673600000212
Selecting a secret random number gamma E ZpAnd generates a session public key PKsession＝gγAnd dialoguePrivate key SKsessionγ; and then calculate the user u with respect to anykFactor of (2)
Figure FDA00032886673600000213
Setting any one attribute group
Figure FDA0003288667360000031
The number of users involved is d, and for this property group, the FIR algorithm generates a polynomial
Figure FDA0003288667360000032
A set of elements P is then generated0＝Kx+a0,P1＝a1,…,Pd＝adIn turn, with respect to the FIR message header of the attribute group: head devicex＝{P0＝Kx+a0,P1＝a1,…,Pd＝ad}；
From this, the global FIR header is:
Figure FDA0003288667360000033
the final FIR ciphertext is:
Figure FDA0003288667360000034
6. the method as claimed in claim 1, wherein when attribute att is revoked by a decryptor, the ciphertext policy attribute encryption method supports fast revocationyThe method comprises the following specific steps:
the attribute cluster is updated to:
Figure FDA0003288667360000035
wherein G'yThe attribute group of the user is removed;
the attribute group key set is updated as:
Figure FDA0003288667360000036
wherein K'yIs an updated attribute group key;
then G'yAll users in the system respectively generate random numbers of the users;
let user ukThe new random number generated is σ'kAnd calculates a new public key for the session
Figure FDA0003288667360000037
The storage center calculates X 'according to the new conversation private key'k＝(PK′session,k)γSubsequently, a new polynomial is generated
Figure FDA0003288667360000038
To generate a new FIR header:
header′y＝{P0＝K′y+a′0,P1＝a′0,…,Pd′＝a′d′}；
the global FIR header will then be updated as:
Figure FDA0003288667360000039
attribute att is contained in all access strategiesyThe FIR ciphertext of (a) will be updated as:
Figure FDA00032886673600000310
7. the method for encrypting the ciphertext policy attribute supporting the quick revocation according to claim 1, wherein a decryption algorithm comprises the following steps:
after the decryption session is established, the timestamp t at this time is recorded, and then the global FIR message header is updated to be:
Figure FDA0003288667360000041
then, the updated global FIR message header and the FIR ciphertext are sent to the user;
the user firstly calculates the user factor by the time stamp t of the user
Figure FDA0003288667360000042
Att for arbitrary attributesxE to S, the decryption algorithm executes the following calculation to obtain a corresponding attribute group key:
Figure FDA0003288667360000043
wherein the content of the first and second substances,
Figure FDA0003288667360000044
represents the ith user factor;
after obtaining the attribute group key, the decryption algorithm performs the following calculations:
Figure FDA0003288667360000045
where ρ (i) ∈ S denotes a row specifying attribute,
Figure FDA0003288667360000046
Dρ(i)all represent a private key cryptographic key pair, Kρ(i)·1/Kρ(i)Representing the ith row attribute key;
Figure FDA0003288667360000047
represented as a hash-value algorithm, is,
Figure FDA0003288667360000048
gτare all represented as generator, ω, of group Gi、
Figure FDA0003288667360000049
Are all represented as ZpA random number of the set.
8. The encryption method for supporting fast revocation of ciphertext policy attributes according to claim 7,
according to the LSSS property, if the attribute set does not meet the authority of the access strategy, the secret s cannot be recovered within the polynomial time, and the decryption fails; otherwise, the secret s can be recovered within the polynomial time, so that the decryption calculation formula is satisfied:
Figure FDA00032886673600000410
the parameter obtained at this time is denoted as a, and then the following bilinear calculation is continuously performed:
Figure FDA00032886673600000411
and recording the obtained parameter as B, and finally executing the following operation to obtain the correct message plaintext M:
Figure FDA0003288667360000051
CN202111157036.7A 2021-09-30 2021-09-30 Ciphertext strategy attribute encryption method supporting quick revocation Pending CN113965320A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111157036.7A CN113965320A (en) 2021-09-30 2021-09-30 Ciphertext strategy attribute encryption method supporting quick revocation

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111157036.7A CN113965320A (en) 2021-09-30 2021-09-30 Ciphertext strategy attribute encryption method supporting quick revocation

Publications (1)

Publication Number Publication Date
CN113965320A true CN113965320A (en) 2022-01-21

Family

ID=79462737

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111157036.7A Pending CN113965320A (en) 2021-09-30 2021-09-30 Ciphertext strategy attribute encryption method supporting quick revocation

Country Status (1)

Country Link
CN (1) CN113965320A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115277139A (en) * 2022-07-18 2022-11-01 南京莱斯信息技术股份有限公司 Flight plan data security sharing method based on lightweight attribute-based encryption

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108737391A (en) * 2018-05-03 2018-11-02 西安电子科技大学 Information service entities identity manages system and identifies quick cancelling method
US20190020480A1 (en) * 2017-07-14 2019-01-17 International Business Machines Corporation Establishing trust in an attribute authentication system

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190020480A1 (en) * 2017-07-14 2019-01-17 International Business Machines Corporation Establishing trust in an attribute authentication system
CN108737391A (en) * 2018-05-03 2018-11-02 西安电子科技大学 Information service entities identity manages system and identifies quick cancelling method

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
严新成;陈越;巴阳;贾洪勇;王仲辉;: "支持用户权限动态变更的可更新属性加密方案", 计算机研究与发展 *
李维勇等: "支持快速撤销的ABE 算法在个人健康记录云中的研究", 《电子器件》 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115277139A (en) * 2022-07-18 2022-11-01 南京莱斯信息技术股份有限公司 Flight plan data security sharing method based on lightweight attribute-based encryption
CN115277139B (en) * 2022-07-18 2023-07-21 南京莱斯信息技术股份有限公司 Lightweight attribute-based encryption-based flight plan data secure sharing method

Similar Documents

Publication Publication Date Title
CN112019591B (en) Cloud data sharing method based on block chain
CN108881314B (en) Privacy protection method and system based on CP-ABE ciphertext under fog computing environment
Guo et al. TABE-DAC: Efficient traceable attribute-based encryption scheme with dynamic access control based on blockchain
US20170244687A1 (en) Techniques for confidential delivery of random data over a network
US20140006806A1 (en) Effective data protection for mobile devices
CN106487506B (en) Multi-mechanism KP-ABE method supporting pre-encryption and outsourcing decryption
CN111447192B (en) Lightweight attribute base signcryption method for cloud and mist assisted Internet of things
CN114219483B (en) Method, equipment and storage medium for sharing block chain data based on LWE-CPBE
CN113536389B (en) Fine-grained controllable decentralized editable block chain construction method and system
CN111277412B (en) Data security sharing system and method based on block chain key distribution
CN110838915B (en) Cloud storage data sharing method for forward security key aggregation
CN107294696B (en) Method for distributing full homomorphic keys for Leveled
CN110557248B (en) Secret key updating method and system based on signcryption of certificateless cryptography
CN111211897A (en) Time control encryption security enhancement method based on random prediction model
JP6863514B1 (en) Key sharing method, key sharing system, authentication device, authentication target device, computer program and authentication method
CN111274594A (en) Block chain-based secure big data privacy protection sharing method
CN112087422A (en) Outsourcing access control method based on attribute encryption in edge calculation
CN110557367B (en) Secret key updating method and system for quantum computing secure communication resistance based on certificate cryptography
Sammy et al. An efficient blockchain based data access with modified hierarchical attribute access structure with CP-ABE using ECC scheme for patient health record
CN113098681B (en) Port order enhanced and updatable blinded key management method in cloud storage
CN114697042A (en) Block chain-based Internet of things security data sharing proxy re-encryption method
CN113965320A (en) Ciphertext strategy attribute encryption method supporting quick revocation
CN114629640B (en) White box disciplinable attribute-based encryption system and method for solving key escrow problem
CN106612173A (en) Encryption scheme for trusted key in cloud storage
CN113792315A (en) Cloud data access control method and system supporting block-level encryption and de-duplication

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination