CN116204917A - Fog computing access control method based on attribute-based encryption and trust model - Google Patents

Abstract

The invention discloses a fog computing access control method based on attribute-based encryption and trust model, which comprises the following steps: constructing a fog node trust model: calculating the credit of the fog node through three dimensions of direct trust, audit trust and peer entity trust, and the trust value of the user terminal to the fog node; establishing a semantic optimization attribute-based encryption method: optimizing an attribute-based encryption method based on attribute mapping of semantic reasoning, and converting character attribute mapping of an access strategy tree and a user into semantic attribute mapping; access control in fog calculation is carried out based on a fog node trust model and a semantic optimization attribute-based encryption method: the data owner sets an access control strategy tree and a privacy threshold, selects a proxy fog node through a trust-based weight load balancing algorithm, and performs outsourcing encryption and ciphertext uploading through the proxy fog node; and the data visitor acquires the privacy threshold of the target information, calls the proxy fog node to perform outsourcing decryption to obtain an intermediate ciphertext, and decrypts the intermediate ciphertext to obtain a required plaintext.

Description

A fog computing access control method based on attribute-based encryption and trust model

Technical Field

The present invention relates to the field of information security technology, and in particular to a fog computing access control method based on attribute-based encryption and a trust model.

Background Art

The number of connected devices and applications based on the Internet of Things is and will continue to grow at an astonishing rate, bringing many new devices and applications that require lower latency, location awareness, mobility support, etc. Centralized cloud computing no longer meets the requirements of the Internet of Things scenario, and fog computing has emerged. Fog computing consists of a large number of fog nodes, which are distributed near the user terminal. Therefore, it can provide terminal applications with faster request response speed, location awareness, real-time analysis functions, etc., meeting the requirements of low latency, location awareness, and geographical distribution of IoT devices and applications.

While fog computing provides many benefits, it also faces various security and privacy issues. Privacy protection in fog computing is more challenging because compared with remote cloud servers in the core network, fog server nodes adjacent to terminal nodes may collect sensitive data about identity, location, and utility usage. At the same time, the destruction of unsecured edge nodes may be an entry point for intruders to enter the network. Once an intruder enters the network, he can mine and steal the private data exchanged between users, and the communication between fog architectures will also lead to privacy leakage. Although some existing solutions in cloud computing environments can solve many security and privacy issues in fog computing, fog computing has its own unique characteristics, such as strong mobility of terminal devices, extremely large number scale, and limited computing resources of fog nodes. These new characteristics will bring new security and privacy challenges. Therefore, the data security protection of users in the fog computing environment has important research significance.

In order to ensure data security in cloud fog computing, it is a common practice to use access control for information protection. Access control methods refer to the use of various technologies to limit the access of external objects to the subject data resources. In the traditional role-based access control scheme in cloud computing, the concept of "role" is set between users and permissions. First, the permissions of the role are set, and then the authorization is performed by assigning roles to users. In the Internet of Things with a huge number of terminals, the workload of using this authorization method will be very large, and the access control permissions granted by roles are coarse-grained. Therefore, it is necessary to design an efficient and fine-grained access control method suitable for fog computing scenarios. Access control based on ciphertext policy attribute encryption (CP-ABE) is an access control method widely used in distributed systems. In the CP-ABE system, the data owner uses the relevant policies formulated by the attribute set for encryption. The private key of each data accessor in the system depends on the attributes it owns. When the attributes in the user's private key match the policies in the ciphertext, the information can be successfully decrypted, and fine-grained access control is flexibly implemented. However, traditional attribute-based encryption technology cannot be directly applied to fog computing scenarios. There are mainly the following problems:

(1) Traditional attribute-based encryption technology is computationally complex and difficult to bear for IoT devices with limited computing resources;

(2) Attribute-based encryption technology has complex attribute management, especially for scenarios such as the Internet of Things where there are a large number of devices, the complexity will be greatly increased;

(3) It is difficult to construct access strategies, as all attributes in the attribute set and various combinations must be considered;

(4) Fog computing devices are not completely trustworthy, and it is impossible to determine whether they will steal private information during data transmission;

(5) How to select fog nodes and make full use of the computing power of fog nodes while protecting information security is also an issue worthy of attention.

There are already some studies on attribute-based encryption using fog nodes for outsourced computing, but these research schemes pay little attention to issues such as attribute management, the complexity of building access policies, the trustworthiness of fog nodes, and the rational allocation of computing resources.

In summary, it is of great significance to design a secure and efficient access control method suitable for cloud fog computing architecture.

Summary of the invention

In view of the deficiencies in the prior art, the present invention provides a fog computing access control method based on attribute-based encryption and trust model.

The present invention discloses a fog computing access control method based on attribute-based encryption and trust model, comprising:

Building a fog node trust model:

The fog nodes are divided into fog groups. The management nodes in the fog groups calculate the reputation of the fog nodes and the trust value of the user terminals on the fog nodes through three dimensions: direct trust, audit trust, and peer trust.

Establishing a semantically optimized attribute-based encryption method:

The attribute-based encryption method is optimized based on the attribute mapping of semantic reasoning, and the access policy tree and the character attribute mapping of the user are converted into semantic attribute mapping;

Access control in fog computing based on fog node trust model and semantically optimized attribute-based encryption method:

The data owner sets the access control policy tree and privacy threshold, selects the proxy fog node through the trust-based weight load balancing algorithm, and the proxy fog node performs outsourced encryption and ciphertext upload;

The data accessor first obtains the privacy threshold of the target information, then calls the trust-based weighted load balancing algorithm to select the proxy fog node for outsourced decryption to obtain the intermediate ciphertext, and finally decrypts the intermediate ciphertext to obtain the required plaintext;

The integrity of the plaintext is verified through a short signature algorithm, and the verification result is uploaded to the fog management node as one of the bases for trust evaluation.

As a further improvement of the present invention,

The calculation formula of the reputation _k of fog node k is:

Where w _α and w _β are weights and w _α +w _β = 1, trust _b (k) is the audit trust value of fog node k, trust _b (i′) is the audit trust value of the recommended node list {node ₁ ,node ₂ ,...,node _p } of fog node k;

The comprehensive trust value Ti _,k of user terminal i to fog node k is:

T _i,k ＝ _wa ·trust _a (i,k)+w _b ·trust _b (k)+w _c ·trust _c (i,k)

Where _wa , _wb , and _wc are weights and _wa + _wb + _wc =1, _trusta (i,k) is the direct trust of user terminal i in fog node k, _trustb (k) is the audit trust value of fog node k, _{and trustc} (i,k) is the peer entity trust.

As a further improvement of the present invention,

The calculation formula of direct trust value trust _a (i, k) is:

trust _a (i,k)＝dim ₁ ·w ₁ +dim ₂ ·w ₂ +dim ₃ ·w ₃

Where w ₁ , w ₂ , w ₃ are the weights of availability, reliability, and data integrity, respectively, and w ₁ +w ₂ +w ₃ = 1, dim ₁ , dim ₂ , dim ₃ are the availability, reliability, and data integrity of fog node k for user terminal i, respectively;

The calculation formula of the audit trust value trust _b (k) is:

Where L is the access device list of fog node k;

The calculation formula of peer entity trust trust _c (i,k) is:

Where n is the first n terminals that interact with fog node k the most times.

As a further improvement of the present invention, the calculation formulas of dim ₁ , dim ₂ , and dim ₃ are respectively:

Where Acc is the number of times fog node k accepts requests from terminal i, Sub is the number of requests submitted by the terminal, Fin is the number of times the fog node completes the terminal request and returns the result, and Tru is the number of times the result returned by the fog node passes the data integrity verification.

As a further improvement of the present invention, the step of converting the access strategy tree and the character attribute mapping of the user into a semantic attribute mapping comprises:

Perform semantic mapping on the attributes to be used in the strategy tree, transform the attributes into conceptual attributes in the attribute set through semantic reasoning, and then use the conceptual attributes to set the threshold value access strategy tree;

Use WordNet-based semantic reasoning to map the attributes in the user's attribute list to the conceptual attributes in the entire attribute set. Take the user's attribute value x as the starting point, infer the synonym set and hypernym set of x through WordNet, and use WordNet to merge the IDs of these synonym sets and hypernym sets to obtain the user's conceptual attribute set.

As a further improvement of the present invention, the method for selecting a proxy fog node includes:

Filter the nodes whose reputation value is greater than or equal to ε in the fog node list _L0 to obtain a new fog node list L;

According to the fog node trust model, the comprehensive trust value of the user terminal device to the fog nodes in L is calculated, and the weight of the fog node is calculated in combination with the idle resource situation of the fog node. Then, the weighted random load balancing algorithm is used to select the proxy fog node in the list L. First, the idle resource amount of the fog node in L is normalized. The converted idle resource amount is {RS(1), RS(2), ..., RS(n)}, and the interval is [0, 1].

The weight calculation formula of fog node k is:

weight(k)＝∝·T _i,k +β·RS(k)

Where ∝ and β are weight factors and ∝+β=1.

As a further improvement of the present invention, the BLS signature verification algorithm is used to verify the integrity of the decrypted information.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention optimizes the existing attribute-based encryption scheme through attribute mapping based on semantic reasoning, simplifies attribute management, and uses the optimized attribute-based encryption technology to achieve fine-grained access control of privacy information in fog computing; the fog node trust model and node status evaluation mechanism enable the device to select better fog computing nodes, further ensuring the availability and security of the system.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a system model diagram of a method for implementing fog computing access control disclosed in an embodiment of the present invention; a schematic diagram of an access strategy tree;

FIG. 2 is a schematic diagram of an access strategy tree disclosed in an embodiment of the present invention.

In the figure:

CSP: Cloud service provider, mainly responsible for information storage and providing interfaces for users to access;

FN: Fog node, which has geographical location characteristics and is mainly responsible for providing outsourced computing capabilities to nearby user devices;

FN Manage Node: Fog management node, audits the historical interaction between the terminal and the fog node, and evaluates and manages the trust value of the fog node;

Data Owner: Data owner;

Data User: Data user;

CA: Central authority that generates public parameters and master keys for the entire system.

AA: Attribute Authority, responsible for the system's attribute management and user key generation.

DETAILED DESCRIPTION

In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

The present invention is further described in detail below in conjunction with the accompanying drawings:

The present invention provides a fog computing access control method based on attribute-based encryption and trust model, comprising:

1. System initialization

Set the system public parameters PP and master key MK; the attribute authorization agency sets the attribute set S, and optimizes the attribute set through the semantic reasoning module to reduce the number of attributes in the system, and then generates an attribute public key and an attribute private key for each attribute in the attribute set managed by the attribute authorization agency.

The semantic reasoning module optimizes the entire set of attributes as follows: the entire set of attributes is divided by the synonym set in the semantic knowledge base, attributes with the same semantics are merged, and the merged result is represented by the unique number of the synonym set. Each merged attribute represents a concept in the semantic knowledge base, and these concept attributes constitute a new attribute set.

2. Fog node registration, IoT device registration

The specific registration of fog nodes is as follows:

The fog node registers the fog node, generates a unique identifier nid for the fog node, records the node information and initializes its reputation value. The fog node registration can be recommended by other fog nodes registered in the system. The maximum number of recommended fog nodes is m, and the initial reputation value _CFN of the fog node is related to the reputation value of the recommended fog node.

The specific registration of IoT devices is as follows:

In the system shown in Figure 1, IoT devices can be logically divided into data owners DO and data users DU. Data owner registration only requires the generation of a unique identifier uid, while data accessor registration also requires terminal attribute verification and the generation of its attribute list _Suid . In actual systems, an IoT device may be both a data owner and a data user. In the following text, unless otherwise specified, users and data accessors both represent IoT terminal devices with data access functions.

3. User key generation

The system authenticates the user terminal and obtains the user's attribute set in the system after successful authentication.

Use WordNet-based semantic reasoning to map the attributes in the user's attribute list to the conceptual attributes in the entire attribute set. Take the user's attribute value x as the starting point, infer the synonym set and hypernym set of x through WordNet, and use WordNet to merge the IDs of these synonym sets and hypernym sets to obtain the user's conceptual attribute set.

Then the attribute authority generates a user key for the user using the intersection of the attribute set and the entire attribute set, including an outsourced decryption key and a user decryption key.

4. Data upload

4.1 Setting access control policies and privacy thresholds

The access control policy is expressed using the threshold access policy tree shown in Figure 2. Leaf nodes represent attributes, non-leaf nodes represent threshold values, and the root node stores the secret value s. The secret value is distributed to the child nodes. Only the attribute set key that meets the attribute conditions can decrypt the secret value of the root node. First, the attributes to be used in the policy tree are semantically mapped, and these attributes are converted into conceptual attributes in the attribute set through semantic reasoning. Then, these conceptual attributes are used to set the threshold access policy tree. According to the degree of attention to the privacy of the uploaded information, a privacy threshold ε is set and used as the label of the ciphertext.

4.2 Proxy Fog Node Load Balancing Algorithm

Assuming that the list of fog nodes in the fog group is L ₀ , the fog management node selects a better fog node as the proxy of the terminal device through the following steps:

Step 1: Filter the nodes with reputation values greater than or equal to ε in the fog node list _L0 to obtain a new fog node list L. If L is empty, it means that there is no suitable proxy fog node nearby, and DO performs information encryption and upload by itself; otherwise, execute step 2;

Step 2: Calculate the comprehensive trust value of the user terminal device to the fog nodes in L according to the fog node trust model, calculate the weight of the fog node in combination with the idle resources of the fog node, and then use the weighted random load balancing algorithm to select the proxy fog node in the list L. First, normalize the idle resources of the fog nodes in L. The converted idle resources are {RS(1), RS(2),..., RS(n)}, with a range of [0,1]. The weight calculation formula of fog node k is:

weight(k)＝∝·T _i,k +β·RS(k)

Where ∝ and β are weight factors and ∝+β=1.

4.3 Data Owner Encryption

First, a symmetric key k is randomly generated, and the information is symmetrically encrypted using a symmetric encryption algorithm to obtain the ciphertext CT _1. Then two secret values are generated, and k is encrypted using the system public parameters and the secret value to obtain the ciphertext CT _2. One of the secret values and the access tree T is sent to the proxy fog node for outsourced calculation. A pair of public and private keys is generated using the BLS short signature algorithm, and the private key is used to encrypt the information to generate a signature. The signature and public key are embedded in the ciphertext and uploaded together.

4.4 Fog Node Outsourcing Computing

The proxy fog node is responsible for the access strategy tree preprocessing and secret value distribution in the encryption process, and obtains the ciphertext CT _3. In particular, if no suitable fog node is found through the fog node load balancing algorithm, the data owner completes all encryption calculations. Finally, the ciphertexts CT ₁ , CT ₂ , CT ₃ , digital signature, signature public key and privacy threshold are merged into the final ciphertext CT and uploaded to the cloud server.

5. Data Access

The user requests the ciphertext from the cloud server and uses the fog node load balancing algorithm in step 4 to select the proxy fog node. If there is a fog node that meets the credibility conditions, the outsourced key is sent to the fog node for outsourced decryption to obtain the intermediate ciphertext, and then the user key is used to perform a decryption operation with low computational overhead to obtain the symmetric key k set by the data owner. Finally, k is used to decrypt the ciphertext to obtain the final plaintext information; otherwise, all decryption operations are completed by the user device.

6. Ciphertext verification

The BLS signature verification algorithm is used to verify the integrity of the decrypted information to ensure that it has not been tampered with, and the verification result is fed back to the fog management node.

The BLS short signature algorithm defines a hash function H:{0,1} ^* →G, where G is a prime multiplication cyclic group with order p and generator g. The specific steps are as follows:

Step 1, key generation: the data owner selects a random number x∈Z _p ^* and calculates v=g ^x , then the public key is v and the private key is x;

Step 2: Signature: The data owner performs the following operation on the plaintext m: σ = H(m) ^x , embeds σ and v into the ciphertext and uploads them together;

Step 3: Verification: The data accessor uses e(σ,g)=e(H(m),v) to verify whether m has been tampered with.

7. Fog Node Trust Model

The interactive behaviors of the terminal device of the present invention with the fog node include outsourced encryption request, outsourced decryption request, and data transmission request. The trust of the terminal device in the fog node consists of direct trust and indirect trust. Direct trust depends on the historical interaction results between the terminal and the fog node; indirect trust includes audit trust value and peer entity trust value. The audit trust value is obtained by auditing the historical interaction results between the fog node and all terminals; the peer entity trust value is selected by a peer selection strategy to calculate the trust of these terminal devices in the fog node.

The historical interaction results between terminal device _i and fog node _k are evaluated from three dimensions: availability, reliability, and data integrity. Availability refers to the ability of fog nodes to respond to terminal requests, reliability refers to the ability of fog nodes to complete accepted requests within a specified time, and data integrity refers to the correctness of fog node outsourced decryption results. The specific calculation method is as follows:

Wherein, dim ₁ , dim ₂ , and dim ₃ are the availability, reliability, and data integrity of node _k for device _i, respectively. Acc is the number of times fog node k accepts requests from terminal i. Sub is the number of requests submitted by the terminal. Fin is the number of times the fog node completes the terminal request and returns the result. Tru is the number of times the result returned by the fog node passes the data integrity verification.

① Direct trust value

The direct trust value trust _a (i, k) of terminal device _i for fog node node _k is:

trust _a (i,k)＝dim ₁ ·w ₁ +dim ₂ *w ₂ +dim ₃ ·w ₃

w ₁ , w ₂ , and w ₃ are the weights of availability, reliability, and data integrity, respectively, and w ₁ +w ₂ +w ₃ = 1. In particular, when the historical interaction between terminal i and fog node k is not outsourced for decryption, the corresponding weight w ₃ is set to 0. If there is no interaction record between terminal i and fog node k, the direct trust value is null.

②Audit Trust Value

The audit trust value reflects the evaluation of the fog node by all terminal devices in the system. Assuming that the access device list of fog node k is L, trust _b (k) represents the audit trust value of fog node k, which is calculated as follows:

③Peer entity trust value

Select the first n terminal devices that interact with fog node k the most times as peer entities and calculate the peer entity trust value:

The peer entity trust value reflects the trust of other representative terminal devices in the system towards the fog node k.

Based on the above three trust value calculation methods, the reputation of the fog node and the comprehensive trust of the terminal device i in the fog node k are expressed below.

Reputation _k of fog node k: Assume that the recommended node list of fog node k is {node ₁ , node ₂ , ..., node _p }. According to ②, calculate the audit trust value trust _b (k) of fog node k and the audit trust value of the recommended node list {trust _b (node ₁ ), trust _b (node ₂ ), ..., trust _b (node _p )} respectively, and then calculate:

w _α and w _β are weights and w _α +w _β =1.

Combine the trust values of ①②③ to get the comprehensive trust value Ti _,k of terminal i to node k:

T _i,k ＝ _wa ·trust(device _i ,node _k )+w _b ·trust(device _L ,node _k )+w _c ·trust(device _i ,node _FL )

Among them, _wa , _wb , _wc are corresponding weights and _wa + _wb + _wc = 1. It should be noted that when there is a direct trust value of null or a recommendation node trust value of null, the corresponding part should be removed when calculating the comprehensive trust value, that is, the corresponding weight should be set to 0.

The main function of this model is to calculate the reputation value Reputation _k of fog node k in the system and the comprehensive trust value Ti _,k of terminal device i to node k.

Example:

The present invention provides a fog computing access control method based on attribute-based encryption and trust model, comprising:

1. System initialization

1.1 Public parameters and master key generation

First, according to the random security parameter τ, CA selects the bilinear map e:G*G→G ₀ , where G is a multiplicative cyclic group with a prime order p and a generator g, and randomly selects α, β∈Z _p , h∈G, and the hash function: H:{0,1}*→Z _p . Let the public parameters PP＝(G,G ₀ ,p,g,g ^α ,h,H,e(g,g) ^β ) and the master key MK＝{α,g ^β }.

1.2 Attribute Set Preprocessing

Preprocess the complete set of attributes. For each attribute authorization agency, set the complete set of attributes it manages. Use the WordNet semantic reasoning module to preprocess the complete set of attributes managed by each attribute authorization agency. Divide the complete set of attributes by the synonym set in WordNet, merge attributes with the same semantics, and use the unique number of the synonym set (Lexicographer ID) to represent the merged result. Each merged attribute represents a concept in the semantic knowledge base, and these concept attributes constitute a new attribute set.

The beneficial effects of this processing are: establishing a standardized set of semantic attributes, facilitating the setting of access policies and the mapping of user attributes, and greatly reducing the number of attributes in the attribute set, thereby reducing the complexity of attribute management and computing overhead.

1.3 Attribute Authority Initialization

和

Assume that there are N attribute authorization agencies, each of which manages a set of attributes _Si (i∈N), and each attribute set is disjoint. Each attribute authorization agency selects a random number _{ti∈Zp ,} and for each attribute x in _Si , selects a random number _{bx∈Zp to} generate

and

2. Fog node registration, IoT device registration

The specific registration of fog nodes is as follows:

The fog node registers the fog node, generates a unique identifier nid for the fog node, records the node information and initializes its reputation value. The fog node registration can be recommended by other fog nodes registered in the system. The maximum number of recommended fog nodes is m, and the initial reputation value _CFN of the fog node is related to the reputation value of the recommended fog node.

The specific registration of IoT devices is as follows:

In this system, IoT devices can be logically divided into data owners DO and data users DU. Data owner registration only requires the generation of a unique identifier uid, while data accessor registration also requires terminal attribute verification and the generation of its attribute list _Suid .

3. Key Generation

(uid,PP,ASK)→{SK,SK’}

3.1 User Attribute Semantic Mapping Based on WordNet

First, query the user's registered attribute list _Suid according to uid, and then use WordNet-based semantic reasoning to map the attributes in the user's attribute list to the conceptual attributes in the entire attribute set. Taking the user's attribute value x as the starting point, infer the synonym set and hypernym set of x through WordNet, and use WordNet to merge the IDs of these synonym sets and hypernym sets to obtain a new attribute list _S'uid .

3.2 User Key Generation

令用户的属性私钥SK_AA＝{D’_x}，AA_i将SK_AA发送给CA进行下一步，CA接收到用户的属性私钥之后，选取随机数λ，θ∈Z_p，计算D＝g^β+α,D₁＝g^αλh^θ,D₂＝g^θ,

输出用户的私钥SK和外包密钥SK’为：AA _i For each attribute x∈S _i ∩S' _uid , calculate

Let the user's attribute private key SK _AA = {D' _x }, AA _i sends SK _AA to CA for the next step. After receiving the user's attribute private key, CA selects a random number λ, θ∈Z _p and calculates D = g ^{β + α} , D ₁ = g ^αλ h ^θ , D ₂ = g ^θ ,

The output user's private key SK and outsourcing key SK' are:

SK＝{D＝g ^β+αλ }

4. Data upload

4.1 Setting Access Policies and Privacy Thresholds

First, semantic mapping is performed on the attributes to be used in the strategy tree, and these attributes are converted into conceptual attributes in the attribute set through semantic reasoning. Then, the threshold access strategy tree is set using the conceptual attribute set. According to the degree of attention paid to the privacy of the uploaded information, a privacy threshold ε is set and used as the label of the uploaded content.

4.2 Proxy Fog Node Load Balancing Algorithm

Assuming the fog node list L ₀ in the fog group, the fog management node selects a better fog node as the proxy of the terminal device through the following steps:

Step 1: Filter the nodes with reputation values greater than or equal to ε in the fog node list _L0 to obtain a new fog node list L. If L is empty, it means that there is no suitable proxy fog node nearby, and DO performs information encryption and upload by itself; otherwise, execute step 2;

Step 2: Calculate the comprehensive trust value of the user terminal device to the fog nodes in L according to the fog node trust model, calculate the weight of the fog node in combination with the idle resources of the fog node, and then use the weighted random load balancing algorithm to select the proxy fog node in the list L. First, normalize the idle resources of the fog nodes in L. The converted idle resources are {RS(1), RS(2),..., RS(n)}, with a range of [0,1]. The weight calculation formula of fog node k is:

weight(k)＝∝·T _i,k +β·RS(k)

Among them, ∝, β are weight factors and ∝+β=1.

The beneficial effect of this node load balancing algorithm is that it combines the information privacy level, the reputation value of the fog node in the system, the user's trust value in the fog node, and the idle resource situation to comprehensively select a high-quality fog node as a proxy.

4.3 DO encryption algorithm

DO first selects a symmetric key k to symmetrically encrypt the data information M to obtain the ciphertext SE _k (M), then randomly selects u, v∈Z _p to satisfy s＝u+v, s∈Z _p , calculates C＝k·e(g,g) ^βs , C'＝g ^s , C ₁ ＝g ^v , C ₂ ＝h ^v , σ＝H(M) ^s , and generates the ciphertext CT ₁ ＝{SE _k (M),σ,C,C',C ₁ ,C ₂ }.

If DO finds a proxy fog node that meets the reputation conditions after the node selection algorithm, it will send {T,u} to the fog node for outsourced encryption; otherwise, DO calculates CT ₂ by itself. The calculation method of CT ₂ is shown in 4.4.

4.4 Fog Node Encryption Algorithm

First, for each node i in T, select a polynomial _Qi , where the degree _fi of the polynomial _Qi and the threshold value _ni of the node i are related by _fi = _ni -1. For the root node R, let the constant term of its polynomial be u, and then select f _R random values to complete the definition of _QR ; for other nodes, _Qi (0) = Q _{parent (i)} (index (i)), and then randomly select f _i values to complete the polynomial definition. Where parent (i) is the parent node of node i, and index (i) is the index value of node i.

输出部分密文

Let the set of leaf nodes in access strategy T be S _attr . For each leaf node in S _attr , define

Output partial ciphertext

将CT上传至云服务器进行存储。Finally, the user merges the two parts of the ciphertext into

Upload CT to the cloud server for storage.

5. Data Access

The user requests the ciphertext from the cloud server and uses the load balancing algorithm in 4.2 to select a fog node. If there is a fog node that meets the conditions, the outsourced key is sent to the fog node for outsourced decryption; otherwise, all decryption steps are performed locally on the user.

5.1 Outsourcing Decryption

The process of outsourcing decryption is as follows:

定义递归算法DfsNode(T,SK’,x)表示访问树中任意节点x与用户的概念属性集的解密结果。Outsourced keys for users

Define the recursive algorithm DfsNode(T,SK',x) to represent the decryption result of any node x in the access tree and the user's conceptual attribute set.

如果

F_x为null。If x is a leaf node, assuming attr(x)∈S _attr , calculate

if

F _x is null.

If x is a non-leaf node, S _x represents the set of nodes in x's child nodes that satisfy F≠null. Assuming that the number of nodes in S _x is less than the threshold value of x, F _x is null; otherwise, the Lagrange interpolation method is used to perform the following calculation:

where i = index(z), S' _x = {index(z):z∈S},

Call the recursive algorithm on the root node R. If the user's attribute set meets the access policy T, then:

Generate an intermediate ciphertext CT'={SE _k (M),σ,C,C',IT} and send it to the user.

5.2 User Decryption

然后使用对称密钥k对SE_k(M)进行解密得到明文。User Computing

Then, the symmetric key k is used to decrypt SE _k (M) to obtain the plaintext.

6. Ciphertext verification

The user verifies the correctness of the decrypted information through the following equation:

e(σ,g)＝e(H(M),C’)

If the equation holds true, the plaintext M is correct; otherwise, the verification fails, and the user uploads the failure record to the reputation management server. The failure record includes the user id, fog node id, and ciphertext id.

7. Fog Node Trust Model

In this scheme, the interactive behaviors of terminal devices to fog nodes include outsourced encryption requests, outsourced decryption requests, and data transmission requests. The trust of terminal devices to fog nodes consists of direct trust and indirect trust. Direct trust depends on the historical interaction results between the terminal and the fog node; indirect trust includes audit trust value and peer entity trust value. The audit trust value is obtained by auditing the historical interaction results between the fog node and all terminals; the peer entity trust value is selected by the peer selection strategy to calculate the trust of these terminal devices to the fog node.

The historical interaction results between terminal device _i and fog node _k are evaluated from three dimensions: availability, reliability, and data integrity. Availability refers to the ability of fog nodes to respond to terminal requests, reliability refers to the ability of fog nodes to complete accepted requests within a specified time, and data integrity refers to the correctness of fog node outsourced decryption results. The specific calculation method is as follows:

Wherein, dim ₁ , dim ₂ , and dim ₃ are the availability, reliability, and data integrity of node _k for device _i, respectively. Acc is the number of times fog node k accepts requests from terminal i. Sub is the number of requests submitted by the terminal. Fin is the number of times the fog node completes the terminal request and returns the result. Tru is the number of times the result returned by the fog node passes the data integrity verification.

① Direct trust value

The direct trust value trust _a (i, k) of terminal device _i for fog node node _k is:

trust _a (i,k)＝dim ₁ ·w ₁ +dim ₂ ·w ₂ +dim ₃ ·w ₃

w ₁ , w ₂ , and w ₃ are the weights of availability, reliability, and data integrity, respectively, and w ₁ +w ₂ +w ₃ = 1. In particular, when the historical interaction between terminal i and fog node k is not outsourced for decryption, the corresponding weight w ₃ is set to 0. If there is no interaction record between terminal i and fog node k, the direct trust value is null.

②Audit Trust Value

The audit trust value reflects the evaluation of the fog node by all terminal devices in the system. Assuming that the access device list of fog node k is L, trust _b (k) represents the audit trust value of fog node k, which is calculated as follows:

③Peer entity trust value

Select the first n terminal devices that interact with fog node k the most times as peer entities and calculate the peer entity trust value:

The peer entity trust value reflects the trust of other representative terminal devices in the system towards the fog node k.

Based on the above three trust value calculation methods, the reputation of the fog node and the comprehensive trust of the terminal device i in the fog node k are expressed below.

Reputation value of fog node k: Assume that the recommended node list of fog node k is {node ₁ , node ₂ , ..., node _p }. According to ②, calculate the audit trust value trust _b (k) of fog node k and the audit trust value of the recommended node list {trust _b (node ₁ ), trust _b (node ₂ ), ..., trust _b (node _p )} respectively, and then calculate:

w _α and w _β are weights and w _α +w _β =1.

Combine the trust values of ①②③ to get the comprehensive trust value Ti _,k of terminal i to node k:

T _i,k ＝ _wa ·trust(device _i ,node _k )+w _b ·trust(device _L ,node _k )+w _c ·trust(device _i ,node _FL )

Among them, _wa , _wb , _wc are corresponding weights and _wa + _wb + _wc = 1. It should be noted that when there is a direct trust value of null or a recommendation node trust value of null, the corresponding part should be removed when calculating the comprehensive trust value, that is, the corresponding weight should be set to 0.

The main innovative features of the present invention are:

1. Wordnet-based attribute mapping solution: simplifies attribute management, reduces the difficulty of building access policies, and indirectly improves encryption and decryption efficiency by reducing the number of attributes;

2. Construct a fog node trust model: Use trust metrics to estimate the risk of fog nodes, and calculate the reputation of fog nodes and the comprehensive trust value of terminals to nodes through multiple dimensions;

3. A fog node load balancing solution combining reputation and trust: First, nodes that do not meet the privacy threshold are filtered out by reputation, then fog nodes are weighted by trust and node idle resources, and then proxy fog nodes are selected by weighted random load balancing algorithm.

The advantages of the present invention are:

The present invention optimizes the existing attribute-based encryption scheme through attribute mapping based on semantic reasoning, simplifies attribute management, and uses the optimized attribute-based encryption technology to achieve fine-grained access control of privacy information in fog computing;

In view of the current situation of device attribute explosion in the IoT environment, the present invention combines the heterogeneous characteristics of attributes in different systems and designs an attribute management method based on semantic reasoning, which is not only more convenient for users to set access structures and their own attributes, but also greatly reduces the number of attributes in the attribute set, thereby improving the efficiency of access control;

Since fog nodes are used for outsourced computing and request proxying, it is necessary to judge the security risks of fog nodes. To this end, the present invention designs a trust model for fog nodes, which not only increases the security of access control, but also provides a reference standard for terminal devices to select fog nodes. According to the trust value weight load balancing algorithm, the computing power of fog computing nodes is more fully utilized.

The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims (7)

1. A fog computing access control method based on attribute-based encryption and trust model, comprising:

constructing a fog node trust model:

dividing the fog nodes into fog groups, and calculating the credit of the fog nodes and the trust value of the user terminal to the fog nodes by the management nodes in the fog groups through three dimensions of direct trust, audit trust and peer entity trust;

establishing a semantic optimization attribute-based encryption method:

optimizing an attribute-based encryption method based on attribute mapping of semantic reasoning, and converting character attribute mapping of an access strategy tree and a user into semantic attribute mapping;

access control in fog calculation is carried out based on a fog node trust model and a semantic optimization attribute-based encryption method:

the data owner sets an access control strategy tree and a privacy threshold, selects a proxy fog node through a trust-based weight load balancing algorithm, and performs outsourcing encryption and ciphertext uploading through the proxy fog node;

the data visitor firstly acquires the privacy threshold of the target information, then invokes a trust-based weight load balancing algorithm to select the proxy fog node for outsourcing decryption to obtain an intermediate ciphertext, and finally decrypts the intermediate ciphertext to obtain a required plaintext;

and carrying out integrity verification on the plaintext through a short signature algorithm, and uploading a verification result to the fog management node as one of trust evaluation bases.

2. The mist computing access control method of claim 1, wherein,

reputation reporting of foggy node k _k The calculation formula of (2) is as follows:

wherein w is _α And w _β Is weight and w _α +w _β ＝1，trust _b (k) Audit trust value for mist node k _b (i') recommended node list { node ] for foggy node k ₁ ，node ₂ ，...，node _p Audit trust value of };

comprehensive trust value T of user terminal i to fog node k _i，k The method comprises the following steps:

T _i，k ＝w _a ·trust _a (i，k)+w _b ·trust _b (k)+w _c ·trust _c (i，k)

wherein w is _a 、w _b 、w _c Is weight and w _a +w _b +w _c ＝1，trust _a (i, k) is the direct trust of the user terminal i to the fog node k, trust _b (k) Audit trust value for mist node k _c (i, k) trust for peer entities.

3. The mist computing access control method of claim 2, wherein,

direct trust value trust _a The calculation formula of (i, k) is:

trust _a (i，k)＝dim ₁ ·w ₁ +dim ₂ ·w ₂ +dim ₃ ·w ₃

wherein w is ₁ 、w ₂ 、w ₃ Weights availability, reliability, data integrity, respectively, and w ₁ +w ₂ +w ₃ ＝1，dim ₁ 、dim ₂ 、dim ₃ Availability, reliability and data integrity of the fog node k to the user terminal i respectively;

audit letterAny value trust _b (k) The calculation formula of (2) is as follows:

wherein L is an access equipment list of the fog node k;

peer trust _c The calculation formula of (i, k) is:

in the formula, n is the first n terminals with the largest interaction times with the fog node k.

4. A fog computing access control method as claimed in claim 3, wherein dim ₁ 、dim ₂ 、dim ₃ The calculation formulas of (a) are respectively as follows:

in the formula, acc is the number of times that the fog node k receives the request of the terminal i, sub is the number of times that the terminal submits the request, fin is the number of times that the fog node finishes the request of the terminal and returns a result, and Tru is the number of times that the result returned by the fog node passes the data integrity verification.

5. The fog-computing access control method of claim 1, wherein the converting the character attribute map of the access policy tree and the user into the semantic attribute map comprises:

performing semantic mapping on attributes to be used in the strategy tree, converting the attributes into concept attributes in the attribute total set through semantic reasoning, and then performing threshold value access strategy tree setting by using the concept attributes;

mapping the attribute in the attribute list of the user to the conceptual attribute in the attribute total set by using semantic reasoning based on WordNet, and merging IDs of the synonym set and the superword set by using the WordNet reasoning of the synonym set and the superword set by taking the attribute value x of the user as a starting point to obtain the conceptual attribute set of the user.

6. The fog computing access control method of claim 1, wherein the method of selecting the proxy fog node comprises:

screening fog node list L ₀ Nodes with the medium reputation value being greater than or equal to epsilon are obtained to obtain a new fog node list L;

calculating the comprehensive trust value of the user terminal equipment to the fog nodes in the L according to the fog node trust model, calculating the weight of the fog nodes by combining the idle resource condition of the fog nodes, and then selecting the alternative fog management nodes in the list L by using a weight random load balancing algorithm; firstly, carrying out normalization processing on the idle resource quantity of the fog node in the L, wherein the converted idle resource quantity is { RS (1), RS (2),. The number of the idle resource quantity is RS (n) }, and the interval is [0,1];

the weight calculation formula of the fog node k is as follows:

weight(k)＝∝·T _i，k +β·RS(k)

where, c and β are weight factors and c+β=1.

7. The fog-computing access control method of claim 1, wherein the decrypted information is integrity verified using a BLS signature verification algorithm.

Images