WO2016112575A1 - 一种集合成员关系判定的密码学构造方法及系统 - Google Patents

一种集合成员关系判定的密码学构造方法及系统 Download PDF

Info

Publication number
WO2016112575A1
WO2016112575A1 PCT/CN2015/072982 CN2015072982W WO2016112575A1 WO 2016112575 A1 WO2016112575 A1 WO 2016112575A1 CN 2015072982 W CN2015072982 W CN 2015072982W WO 2016112575 A1 WO2016112575 A1 WO 2016112575A1
Authority
WO
WIPO (PCT)
Prior art keywords
function
aggregate
mpk
cryptographic
random
Prior art date
Application number
PCT/CN2015/072982
Other languages
English (en)
French (fr)
Inventor
朱岩
于汝云
郭瑞琦
王欣
Original Assignee
北京科技大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京科技大学 filed Critical 北京科技大学
Priority to US15/542,211 priority Critical patent/US20170359177A1/en
Publication of WO2016112575A1 publication Critical patent/WO2016112575A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3006—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters
    • H04L9/3026—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters details relating to polynomials generation, e.g. generation of irreducible polynomials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3006—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters
    • H04L9/3033—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters details relating to pseudo-prime or prime number generation, e.g. primality test
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3218—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs

Definitions

  • the present invention relates to the field of information technology, and in particular to a cryptographic construction method and system for determining membership membership.
  • the belonging relationship is usually represented by , such as e ⁇ S, indicating that the element e exists in the subset S; similarly, the relationship does not belong to the usual Express, such as Indicates that the element e does not exist in the subset S.
  • the set S has only one element, it degenerates into the element's "equal” and “unequal”relationships; if it is extended, it can also get the subset “contains” and “non-contains” relationships, and the sets “equal” and "unequal””Relationships, etc.
  • Cryptographic set operations have important theoretical value and application value in the field of security protocol design and secure computing. It can implement set-based broadcast encryption, predicate encryption with attribute and non-logical attribute-based encryption, set relationship, and collection-based privacy. Protect keywords and other programs.
  • the cryptography "belongs" relationship and the "do not belong” relationship are essentially cryptographic secure computing technologies, and are the basic technology for ensuring information security under networks and computer systems. They can be widely used in e-commerce, e-government, online transactions, and even military networks. Apply in .
  • the data sender may wish to specify certain users to decrypt the information, then he only needs to generate the set S for these specified users; rely on cryptography to belong to the relationship implementation algorithm, can be any user e It belongs to the set S for cryptographic determination: if e ⁇ S, then decryption can be performed; otherwise, decryption cannot be achieved even if the user has previous authorization.
  • each member of the cryptosystem has a set of attribute values and corresponding attribute value keys to identify one's identity.
  • the technical problem to be solved by the present invention is to provide a cryptographic construction method and system for collective membership determination to solve the problem of cryptographic representation of the set membership in the prior art.
  • an embodiment of the present invention provides a cryptographic construction method for determining membership relationship, including:
  • the cryptographic representation of the set S is generated by cryptographically processing f S ( ⁇ ) with the public parameter mpk as input.
  • the random point includes: a random number or a random vector
  • the constructor further includes: a Lagrangian interpolation polynomial constructed by the random point v i ', a Newton interpolation polynomial, an Hermite interpolation polynomial, a Bernstein polynomial, a Fibonacci polynomial, a binomial type Polynomial or corresponding algebraic curve.
  • the cryptographic representation of the set S by processing the f S ( ⁇ ) by using the public parameter mpk as an input by using a cryptographic method includes:
  • the polymerization by the function to determine the set S of compressed length of the random number or random vector R S, R S is a function of the polymerization Aggregate (mpk, S) of the output value of the polymerization, and the length of the set of R & lt S The number of elements in S is irrelevant.
  • the method includes:
  • the cryptographic decision algorithm is constructed by the aggregate function to determine the inclusion and non-containment relationships between the set and the set.
  • the constructing a cryptographic decision algorithm by using the aggregate function to determine a relationship between an element and a set includes:
  • the determining, by the aggregation function, constructing a cryptographic decision algorithm to determine a relationship between an element and a set does not belong to:
  • the constructing a cryptographic decision algorithm by using the aggregate function to perform a relationship between an element and a set includes:
  • the determining, by the aggregation function, constructing a cryptographic decision algorithm to determine a relationship between an element and a set does not belong to:
  • the present invention also provides a cryptographic construction system for determining membership relationship, comprising:
  • Function generation unit used to get a given collection According to the random point v i is determined for each element e of the set S i 'corresponding random point v i', and according to the random point V i 'constructor f S (x);
  • a secret point determining unit for introducing a random secret ⁇ , determining f S ( ⁇ ) according to the function f S (x), and determining a public parameter mpk according to the random secret ⁇ ;
  • Cryptography processing unit for generating a cryptographic representation of the set S by cryptography, processing the f S ( ⁇ ) with the public parameter mpk as input.
  • the cryptographic processing unit includes:
  • a processing module configured to process f S ( ⁇ ) by using a cryptographic method with the public parameter mpk as an input to generate an aggregate function Aggregate (mpk, S) of the set S, when the function f S (x) is In the case of a zero polynomial, the aggregate function is called the zero point aggregate function ZerosAggr(mpk, S). When the function f S (x) is a pole polynomial, the aggregate function is called the pole aggregation function PolesAggr(mpk, S);
  • the compression module by the aggregation functions for the set S of compressed to determine the length of the random number or random vector R S, R S is the output value of the aggregate function polymerization Aggregate (mpk, S), and the R & lt S The length is independent of the number of elements in the set S.
  • system further includes:
  • a first determining unit configured to determine, by using the aggregate function, a cryptographic decision algorithm to determine an equal and unequal relationship between elements and elements;
  • a second determining unit configured to determine, by using the aggregate function, a cryptographic decision algorithm to determine a relationship between an element and a set that belongs to and not belong to the group;
  • the third determining unit is configured to determine, by using the aggregate function, a cryptographic decision algorithm to determine the inclusion and non-containment relationship between the set and the set.
  • each element e i in the set U is converted into a random point v i in the cryptographic space, and the random corresponding to each element e i ' in the subset S is determined according to the random point v i Point v i ', and according to the random point v i ' constructor f S (x), introduce a random secret ⁇ , determine f S ( ⁇ ) according to the function f S (x), and according to the random
  • the secret ⁇ determines the public parameter mpk, finally takes the public parameter mpk as input, and processes f S ( ⁇ ) by cryptography to generate a cryptographic representation of the set S.
  • all elements in the set are cryptographically represented as random numbers or random vectors in cryptographic random spaces, which can be used in cryptography for sets and sets, sets and elements, and elements and elements.
  • the set aggregation algorithm constructed by the present invention supports aggregate aggregation of the number of elements, that is, there is no limit to the number of set elements to be aggregated, and the construction method provided by the present invention also lays a foundation for subsequent cryptography research, due to the modern mathematical system. It is based on the set theory that the solution to the basic decision problem will inevitably lead to the resolution of a series of related cryptographic problems, especially in the field of security (unilateral, two-way, multi-party) computing, privacy-based data retrieval, and confidential databases. Keyword search, group encryption, predicate encryption, attribute-based encryption, cryptographic access control, etc.
  • FIG. 1 is a schematic flowchart of determining a membership relationship according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of determining a non-collection membership relationship according to an embodiment of the present invention
  • FIG. 3 is a schematic structural diagram of a cryptographic construction system for determining membership relationship according to an embodiment of the present invention.
  • the present invention provides a cryptographic construction method and system for collective membership determination based on the existing problem that cryptographic representation cannot be performed on the set membership relationship.
  • the aggregation function of the set S is determined by the constructing method provided by the present invention, and The aggregation of all elements of the set S into one or more cryptographic random numbers or random vectors is performed by the aggregation function, and the set aggregation algorithm process for generating the aggregate function is defined as follows:
  • PK represents a set of public information spaces, any set And a cryptographic space C
  • the aggregate aggregation algorithm can output the aggregated value of the set S, the aggregate aggregation algorithm, by using the public parameter mpk when the random secret ⁇ cannot be obtained (the random secret ⁇ is kept secret in the cryptographic operation process) Is a polynomial time (determined or non-deterministic) algorithm that satisfies equation (1):
  • mpk ⁇ PK the public parameter mpk can be disclosed to anyone, and the process of ensuring the generation of the aggregate function can be publicly processed.
  • the aggregate function Aggregate(mpk, S) is a compression function, which can compress all elements in the set into a random number or a random vector R S of a certain length, that is, an aggregate value output by the aggregate function.
  • R S is a fixed-length output. In general, the output of the aggregate function is only one element of the algebraic group.
  • R S is unguessable as a random number or random vector in cryptography, and the random point or random vector It can be d (d ⁇ 1) dimensional random points or random vectors.
  • the set aggregation algorithm supports aggregate aggregation of the number of elements, i.e., there is no limit to the number of set elements to be aggregated.
  • the construction method provided by the invention also lays a foundation for the subsequent cryptography research. Since the modern mathematical system is based on the set theory, the solution of the basic decision problem of the set will inevitably lead to the solution of a series of related cryptographic problems, especially in security. (unilateral, two-way, multi-party) computing areas, data retrieval based on privacy, keyword search in secret databases, group encryption, cryptographic access control, etc.
  • different functions may be selected according to the random point v i ' to construct different aggregate functions to implement different elements and elements, elements and sets, sets and sets.
  • the operations between, for example, the functions include: zero polynomial, pole polynomial, Lagrangian interpolation polynomial, Newton interpolation polynomial, Hermite interpolation polynomial, Bernstein polynomial, Fibonacci polynomial, binomial Polynomial or corresponding algebraic curve, etc.
  • the construction process of the zero polynomial function f S (x) and the pole polynomial function f S (x) is as follows:
  • the aggregate function is called a zero point aggregate function ZerosAggr(mpk, S), and the zero point aggregate function is defined as follows:
  • the polynomial time algorithm is called a zero point aggregate function
  • the specific construction process of the zero point aggregate function includes:
  • the f S ( ⁇ ) is processed by a cryptographic method. Specifically, the number of elements in the set S is m, and the coefficient a k is determined first, and f S ( ⁇ ) is converted into among them, K ⁇ [0,m], where Represents the integer under modulo p; at the same time, in order to ensure the secrecy of ⁇ , the curve f S ( ⁇ ) is transformed into a zero point aggregate function using equations (4):
  • g is a generator of the p-th order cyclic group G, and according to the formula (4), the public parameter mpk is input, Determine the final zero-aggregate function, as shown in equation (5):
  • the aggregate function is called a pole aggregation function PolesAggr (mpk, S), and the pole aggregation function is defined as follows:
  • polesAggr output aggregate value H S the algorithm is called a pole aggregation function, and the pole aggregation function is expressed as equation (6) :
  • the specific construction process of the pole aggregation function includes:
  • all the elements of the set S can be cryptographically represented as random numbers or random vectors in the cryptographic random space by the zero point aggregation function or the pole aggregation function, and the random number or random vector can Used in the "equal” and “not equal” relationships between elements and elements in cryptography, the "belonging” and “not belonging” relationships between elements and sets, the “contains” and “non-contained” relationships between sets and sets. determination.
  • the security of the zero point aggregate function is defined by taking the zero point aggregate function as an example, for a given element e i ⁇ U and subset Definition G S- as shown in equation (9)
  • G S- cannot be calculated by any polynomial time algorithm (including ZerosAggr(mpk, S - )).
  • the zero-aggregation function on the set S is safe, and it can ensure the security of the relationship judgment between the element and the set.
  • the pole aggregation function is taken as an example to define the security of the pole aggregation function for a given element e. i ⁇ U and subset definition If both of the following conditions are met:
  • H S+ is a function of pole aggregation. computational
  • pole aggregation function on the set S is safe, and it can ensure the security of the relationship judgment between the element and the set.
  • the concept of commitment which is a basic concept of cryptography, including two processes of establishing commitment and verifying commitment. After establishing the commitment, no one can guess. The secret in the promise, but if you have a specific secret value (called a clue), you can verify that the promise is the same as the secret hidden in it.
  • the bilinear mapping system has the following properties:
  • the implementation method of the cryptographic decision algorithm of the element and the set "not belonging to" relationship is specifically:
  • the zero-point aggregate function 3ZerosAggr(mpk, S) of the set S is first called to calculate the aggregated value R S of the set S , and then a random secret k is introduced to construct the aggregated value.
  • R S 's commitment And g k given an element e, if satisfied
  • S + S ⁇ e ⁇ 6
  • the pole aggregation function 1PolesAggr(mpk,S+) can be called to calculate equation (12):
  • the protocol executor can then verify the correctness of the relationship decision result.
  • the determination algorithm of the "not belonging" relationship between the elements and the set provided by the invention makes the determination process efficient and accurate, which not only improves the efficiency of the determination, but also ensures the security and consistency of the determination.
  • the present invention also provides a specific implementation manner of a cryptographic construction system for collective membership determination.
  • the cryptographic construction system for collective membership determination provided by the present invention and the cryptographic construction method for determining the membership relationship are described in detail.
  • the cryptographic construction system of the set membership relationship can achieve the object of the present invention by performing the flow steps in the specific implementation manner of the above method, and therefore the explanation of the specific implementation manner of the cryptographic construction method for determining the set membership relationship is
  • the specific implementation manner of the cryptographic construction system that is also applicable to the set membership relationship determination provided by the present invention will not be described in detail in the following specific embodiments of the present invention.
  • an embodiment of the present invention further provides a cryptographic construction system for determining membership relationship, including:
  • Function generation unit 102 for obtaining a given set According to the random point v i is determined for each element e of the set S i 'corresponding random point v i', and according to the random point V i 'constructor f S (x);
  • a secret point determining unit 103 for introducing a random secret ⁇ , determining f S ( ⁇ ) according to the function f S (x), and determining a public parameter mpk according to the random secret ⁇ ;
  • Cryptography processing unit 104 for generating a cryptographic representation of the set S by cryptographically processing the f S ( ⁇ ) with the public parameter mpk as input.
  • the cryptographic construction system of the set membership relationship determination converts each element e i in the set U into a random point v i in the cryptographic space, and determines the child according to the random point v i each element of the set S e i 'corresponding random point v i', and according to the random point v i 'constructor f S (x), and then introducing a random secret ⁇ , according to said function f S (x Determining f S ( ⁇ ), and determining a public parameter mpk according to the random secret ⁇ , finally taking the public parameter mpk as an input, and processing f S ( ⁇ ) by a cryptographic method to generate the set S Cryptographic representation.
  • all elements in the set are cryptographically represented as random numbers or random vectors in cryptographic random spaces, which can be used in cryptography for sets and sets, sets and elements, and elements and elements. The determination of the relationship between.
  • the cryptographic processing unit includes:
  • a processing module configured to process f S ( ⁇ ) by using a cryptographic method with the public parameter mpk as an input to generate an aggregate function Aggregate (mpk, S) of the set S, when the function f S (x) is In the case of a zero polynomial, the aggregate function is called the zero point aggregate function ZerosAggr(mpk, S). When the function f S (x) is a pole polynomial, the aggregate function is called the pole aggregation function PolesAggr(mpk, S);
  • the compression module by the aggregation functions for the set S of compressed to determine the length of the random number or random vector R S, R S is the aggregate value of the aggregate functions Aggregate (mpk, S), and the length of R & lt S It is independent of the number of elements in the set S.
  • the system further includes:
  • a first determining unit configured to determine, by using the aggregate function, a cryptographic decision algorithm to determine an equal and unequal relationship between elements and elements;
  • a second determining unit configured to determine, by using the aggregate function, a cryptographic decision algorithm to determine a relationship between an element and a set that belongs to and not belong to the group;
  • the third determining unit is configured to determine, by using the aggregate function, a cryptographic decision algorithm to determine the inclusion and non-containment relationship between the set and the set.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Physics (AREA)
  • Pure & Applied Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Algebra (AREA)
  • Power Engineering (AREA)
  • Complex Calculations (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种集合成员关系判定的密码学构造方法及系统，能够对集合成员关系进行密码学表示，所述方法包括：将集合U中的每个元素e i转化为密码学空间内的随机点v i；获取给定集合S={ e 1',…, e m'}⊆U，确定集合S中的每个元素e i'对应的随机点v i'，并根据所述随机点v i'构造函数f S(x)；引入一个随机秘密γ，根据所述函数f S(x)确定f S(γ)，并根据所述随机秘密γ确定公开参数mpk；以所述公开参数mpk作为输入对f S(γ)进行处理生成所述集合S的密码学表示。所述密码学表示可实现集合成员关系判定：根据集合S的极点聚合函数输出的聚合值R S构造对R S的承诺；对于元素e i，当e i∈S时，根据集合S_＝S\{e i}的零点聚合函数输出的聚合值R S_验证所述承诺。可用于构造满足集合成员关系的广播加密、基于属性加密、谓词加密等群组密码系统。

Description

一种集合成员关系判定的密码学构造方法及系统 技术领域
本发明涉及信息技术领域，特别是指一种集合成员关系判定的密码学构造方法及系统。
背景技术
元素与集合之间的“属于”和“不属于”是最常见的二元关系，给定集合U＝{e1，…，en}，对任意子集
Figure PCTCN2015072982-appb-000001
属于关系通常用∈表示，如e∈S，表示元素e存在于子集S中；同样的，不属于关系通常用
Figure PCTCN2015072982-appb-000002
表示，如
Figure PCTCN2015072982-appb-000003
表示元素e不存在于子集S中。当集合S只有一个元素时，退化为元素“相等”和“不相等”关系；如对其扩展，还能得到子集“包含”和“非包含”关系，以及集合“相等”与“不相等”关系等。
在密码学中常用“属于”与“不属于”关系实现元素与集合间关系的判定，即，表示对给定元素e是否存在于(或不存在于)S中的一个判定。如果要求这种判定是密码学安全的，则当e∈S(或
Figure PCTCN2015072982-appb-000004
)时，任何人不能向他人宣称错误关系
Figure PCTCN2015072982-appb-000005
(或e∈S)，或者说任何人不能伪造判定
Figure PCTCN2015072982-appb-000006
(或e∈S)。
密码学集合操作在安全协议设计与安全计算领域中具有重要的理论价值与应用价值，可实现基于集合的广播加密、具有属于和非逻辑的基于属性加密、集合关系的谓词加密、基于集合的隐私保护关键字检索等方案。密码学“属于”关系与“不属于”关系本质上是密码学的安全计算技术，是保证网络及计算机系统下信息安全的基本技术，可广泛在电子商务、电子政务、网上交易、甚至军用网络中进行应用。
例如，在面向群组的广播加密中，数据发送者可能希望指定某些用户进行解密信息，那么他只需要将这些指定用户生成集合S；依靠密码学属于关系实现算法，可对任意用户e是否属于该集合S进行密码学判定：如果e∈S，那么可以进行解密；否则，即使用户具有以往的授权也是无法实现解密。
再如，基于属性的加密中，某一属性由不同属性值构成集合，例如，城市＝{北京、上海、深圳、伦敦、纽约、……}，消息发送者可以从该集合中选择一些属性值构成“授权”解密的属性值子集或“非授权”解密的属性值子集，并用此子集对消息进行加密得到密文。同时，该密码系统内的每名成员具有一组属性值及对应的属性值密钥来标识自己的身份， 依靠本专利中密码学属于关系实现算法，当一个接收者试图解密时，他将自己的属性值与属性值密钥与密文中的加密子集进行比对，如果满足子集中“属于”或“不属于”的要求，那么他能够正确解密出消息。目前，密码学研究中尚无法对集合成员关系进行密码学表示。
发明内容
本发明要解决的技术问题是提供一种集合成员关系判定的密码学构造方法及系统，以解决现有技术所存在的无法对集合成员关系进行密码学表示的问题。
为解决上述技术问题，本发明实施例提供一种集合成员关系判定的密码学构造方法，包括：
获取给定任意集合U＝{e1，…，en}，将集合U中的每个元素ei转化为密码学空间内的随机点vi；
获取给定集合
Figure PCTCN2015072982-appb-000007
根据所述随机点vi确定集合S中的每个元素ei'对应的随机点vi'，并根据所述随机点vi'构造函数fS(x)；
引入一个随机秘密γ，根据所述函数fS(x)确定fS(γ)，并根据所述随机秘密γ确定公开参数mpk；
通过密码学方法，以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的密码学表示。
可选地，所述随机点包括：随机数或随机向量；
所述根据所述随机点vi'构造函数包括：
将集合S中每个元素ei'对应的随机点vi'作为H(x)的零点构造零点多项式函数fS(x)；或者
将集合S中每个元素ei'对应的随机点vi'作为H(x)的极点构造极点多项式函数fS(x)；
其中，H(x)＝P(x)/Q(x)是一个有理多项式，表示两个多项式P(x)和Q(x)相除，对于一个变量z，当P(z)＝0时，P(x)的根z称为H(x)的零点，当Q(z)＝0时，Q(x)的根z被称为H(x)的极点；
所述构造函数还包括：由所述随机点vi'构造的拉格朗日插值多项式、牛顿插值多项式、埃尔米特插值多项式、伯恩斯坦多项式、斐波那契多项式、二项式型多项式或相应代数曲线。
可选地，所述通过密码学方法，以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的密码学表示包括：
通过密码学方法，以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的聚合函数Aggregate(mpk,S)，当所述函数fS(x)为零点多项式时，该聚合函数称为零点聚合函数ZerosAggr(mpk,S)，当所述函数fS(x)为极点多项式时，该聚合函数称为极点聚合函数PolesAggr(mpk,S)；
通过所述聚合函数将所述集合S压缩成确定长度的随机数或随机向量RS，RS是所述聚合函数Aggregate(mpk,S)的输出聚合值，且RS的长度与所述集合S中元素个数无关。
可选地，所述通过所述聚合函数将所述集合S压缩成确定长度的聚合值RS之后包括：
通过所述聚合函数构造密码学判定算法对元素与元素之间等于和不等于关系进行判定；和/或
通过所述聚合函数构造密码学判定算法对元素与集合之间属于和不属于关系进行判定；和/或
通过所述聚合函数构造密码学判定算法对集合与集合之间包含和不包含关系进行判定。
可选地，所述通过所述聚合函数构造密码学判定算法对元素与集合之间属于关系进行判定包括：
获取元素ei，当ei∈S时，令S-＝S\{ei}，则聚合值RS-由零点聚合函数ZerosAggr(mpk,S-)确定；
当
Figure PCTCN2015072982-appb-000008
时，令S-＝S\{ei}，则聚合值RS-不能由任何多项式时间算法确定，所述多项式时间算法包括：ZerosAggr(mpk,S-)；
所述通过所述聚合函数构造密码学判定算法对元素与集合之间不属于关系进行判定包括：
获取元素ei，当
Figure PCTCN2015072982-appb-000009
时，令S+＝S∪{ei}，则聚合值RS+由极点聚合函数PolesAggr(mpk,S+)确定；
当ei∈S时，令S+＝S∪{ei}，则聚合值RS+不能由任何多项式时间算法确定，所述多项式时间算法包括：PolesAggr(mpk,S+)。
可选地，所述通过所述聚合函数构造密码学判定算法对元素与集合之间属于关系进行 判定包括：
根据集合S的极点聚合函数PolesAggr(mpk,S)输出的聚合值RS构造对所述聚合值RS的承诺；
对于所述元素ei，当ei∈S时，根据确定的所述零点聚合函数ZerosAggr(mpk,S-)输出的聚合值RS-验证所述承诺；
当
Figure PCTCN2015072982-appb-000010
则不存在任何多项式时间算法验证所述承诺；
所述通过所述聚合函数构造密码学判定算法对元素与集合之间不属于关系进行判定包括：
根据集合S的零点聚合函数ZerosAggr(mpk,S)输出的聚合值RS构造对所述聚合值RS的承诺；
对于所述元素ei，当
Figure PCTCN2015072982-appb-000011
时，根据确定的极点聚合函数PolesAggr(mpk,S+)输出的聚合值RS+验证所述承诺；
当ei∈S时，则不存在任何多项式时间算法验证所述承诺。
另一方面，本发明还提供一种集合成员关系判定的密码学构造系统，包括：
随机化单元：用于获取给定任意集合U＝{e1，…，en}，将集合U中的每个元素ei转化为密码学空间内的随机点vi；
函数生成单元：用于获取给定集合
Figure PCTCN2015072982-appb-000012
根据所述随机点vi确定集合S中的每个元素ei'对应的随机点vi'，并根据所述随机点vi'构造函数fS(x)；
秘密点确定单元：用于引入一个随机秘密γ，根据所述函数fS(x)确定fS(γ)，并根据所述随机秘密γ确定公开参数mpk；
密码学处理单元：用于通过密码学方法，以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的密码学表示。
可选地，所述密码学处理单元包括：
处理模块：用于通过密码学方法以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的聚合函数Aggregate(mpk,S)，当所述函数fS(x)为零点多项式时，该聚合函数称为零点聚合函数ZerosAggr(mpk,S)，当所述函数fS(x)为极点多项式时，该聚合函数称为极点聚合函数PolesAggr(mpk,S)；
压缩模块：用于通过所述聚合函数将所述集合S压缩成确定长度的随机数或随机向量 RS，RS是所述聚合函数Aggregate(mpk,S)的输出聚合值，且RS的长度与所述集合S中元素个数无关。
可选地，所述系统还包括：
第一判定单元：用于通过所述聚合函数构造密码学判定算法对元素与元素之间等于和不等于关系进行判定；和/或
第二判定单元：用于通过所述聚合函数构造密码学判定算法对元素与集合之间属于和不属于关系进行判定；和/或
第三判断单元：用于通过所述聚合函数构造密码学判定算法对集合与集合之间包含和不包含关系进行判定。
可选地，所述第二判定单元：还用于获取元素ei，当ei∈S时，令S-＝S\{ei}，则聚合值RS-由零点聚合函数ZerosAggr(mpk,S-)确定；当
Figure PCTCN2015072982-appb-000013
时，令S-＝S\{ei}，则聚合值RS-不能由任何多项式时间算法确定，所述多项式时间算法包括：ZerosAggr(mpk,S-)；
所述第二判定单元：还用于获取元素ei，当
Figure PCTCN2015072982-appb-000014
时，令S+＝S∪{ei}，则聚合值RS+由极点聚合函数PolesAggr(mpk,S+)确定，当ei∈S时，令S+＝S∪{ei}，则聚合值RS+不能由任何多项式时间算法确定，所述多项式时间算法包括：PolesAggr(mpk,S+)。
本发明的上述技术方案的有益效果如下：
上述方案中，通过将集合U中的每个元素ei转化为密码学空间内的随机点vi，并根据所述随机点vi确定子集S中的每个元素ei'对应的随机点vi'，且根据所述随机点vi'构造函数fS(x)，再引入一个随机秘密γ，根据所述函数fS(x)确定fS(γ)，并根据所述随机秘密γ确定公开参数mpk，最后将所述公开参数mpk作为输入，并通过密码学方法对fS(γ)进行处理，生成所述集合S的密码学表示。这样，将集合中所有元素以密码学的方式表示成密码学随机空间中的随机数或随机向量，所述随机数或随机向量能够用于密码学中集合与集合、集合与元素及元素与元素之间关系的判定。本发明构造的集合聚合算法支持任意元素数目的集合聚合，即，对要聚合的集合元素的数目没有限制，且本发明提供的构造方法还为后续的密码学研究奠定了基础，由于现代数学体制就是建立在集合论基础上，集合基本判定问题的解决必然导致一系列相关密码学问题的解决，特别是在安全(单方、两方、多方)计算领域，对基于隐私的数据检索、保密数据库的关键字检索、群组加密、谓词加密、属性基加密、密码学访问控制等。
附图说明
图1为本发明实施例提供的集合成员关系判定的流程示意图；
图2为本发明实施例提供的非集合成员关系判定的流程示意图；
图3为本发明实施例提供的集合成员关系判定的密码学构造系统的结构示意图。
具体实施方式
为使本发明要解决的技术问题、技术方案和优点更加清楚，下面将结合附图及具体实施例进行详细描述。
本发明针对现有的无法对集合成员关系进行密码学表示的问题，提供一种集合成员关系判定的密码学构造方法及系统。
实施例一
本发明实施例中，对于给定的任意大小的集合U＝{e1，…，en}及所述集合U的子集S，通过本发明提供的构造方法确定集合S的聚合函数，并通过所述聚合函数将所述集合S的所有元素聚合成为一个或多个密码学随机数或随机向量，将产生所述聚合函数的集合聚合算法过程定义如下：
在一个密码系统中，PK表示一组公共信息空间，任意集合
Figure PCTCN2015072982-appb-000015
和一个密码空间C，该集合聚合算法能够在无法获取随机秘密γ(随机秘密γ在密码学运算过程保密)的情况下，依靠公共参数mpk，输出集合S的聚合值，集合聚合算法
Figure PCTCN2015072982-appb-000016
是一个多项式时间(确定或非确定)算法，满足式(1)：
Aggregate(mpk,S)＝RS\*MERGEFORMAT   式(1)
式(1)中，mpk∈PK，公开参数mpk对任何人都可公开，保证产生所述聚合函数的过程可公开处理。
本发明实施例中，所述聚合函数Aggregate(mpk,S)是一个压缩函数，能将集合中的所有元素压缩成确定长度的随机数或者随机向量RS，也就是说聚合函数输出的聚合值RS为定长的输出，通常情况下，聚合函数的输出结果仅为代数群下一个元素，RS作为密码学中的随机数或随机向量是不可猜测的，且所述随机点或随机向量可以为d(d≥1)维空间随机点或随机向量。所述集合聚合算法支持任意元素数目的集合聚合，即，对要聚合的集合 元素的数目没有限制。本发明提供的构造方法还为后续的密码学研究奠定了基础，由于现代数学体制就是建立在集合论基础上，集合基本判定问题的解决必然导致一系列相关密码学问题的解决，特别是在安全(单方、两方、多方)计算领域，对基于隐私的数据检索、保密数据库的关键字检索、群组加密、密码学访问控制等。
本发明实施例中，根据所述随机点vi'能够选用不同函数(所述函数也可以称之为曲线)来构造不同的聚合函数从而实现不同的元素与元素、元素与集合、集合与集合之间的操作，例如，所述函数包括：零点多项式、极点多项式、拉格朗日插值多项式、牛顿插值多项式、埃尔米特插值多项式、伯恩斯坦多项式、斐波那契多项式、二项式型多项式或相应代数曲线等。
本发明实施例中，零点多项式函数fS(x)及极点多项式函数fS(x)的构造过程如下：
将集合S中每个元素ei'对应的随机点vi'作为H(x)的零点构造零点多项式函数fS(x)；或者
将集合S中每个元素ei'对应的随机点vi'作为H(x)的极点构造极点多项式函数fS(x)；
其中，H(x)＝P(x)/Q(x)是一个有理多项式，表示两个多项式P(x)和Q(x)相除，对于一个变量z，当P(z)＝0时，P(x)的根z称为H(x)的零点，当Q(z)＝0时，Q(x)的根z被称为H(x)的极点。
本发明实施例中，当所述函数fS(x)为零点多项式时，该聚合函数称为零点聚合函数ZerosAggr(mpk,S)，将该零点聚合函数定义如下：
对于给定的一个集合U＝{e1，…，en}、所述集合U的一个子集
Figure PCTCN2015072982-appb-000017
和一个p阶循环群G以及群的两个生成元g,h，其中，p是一个大素数，如果存在一个多项式时间算法ZerosAggr，该算法输出满足式(2)：
Figure PCTCN2015072982-appb-000018
   式(2)
则将该多项式时间算法称为零点聚合函数，所述零点聚合函数的具体构造过程包括：
1)随机化阶段
可以通过抗碰撞哈希函数将集合U＝{e1，…，en}中的每个元素ei转化为一维平面的随机点vi，vi的部分信息被公布在公开参数mpk中，vi满足
Figure PCTCN2015072982-appb-000019
其中，
Figure PCTCN2015072982-appb-000020
表示模p下的n个整数，每个元素ei由任意长度二进制串表示。
2)函数生成阶段
根据随机点vi，确定子集S中的每个元素ei'对应的随机点vi'，其中，vi'＝hash(ei')，并将所述随机点vi'作为多项式的(负)根构造零点多项式函数fS(x)，fS(x)表示为式(3)：
fS(x)＝x(x+v1')...(x+vm')＝x·∏(x+vi')modp\*MERGEFORMAT   式(3)
3)秘密点确定阶段
引入一个随机秘密γ，并使用已构造的零点多项式函数fS(x)确定
Figure PCTCN2015072982-appb-000021
4)密码学处理阶段
通过密码学方法对fS(γ)进行处理，具体地，令集合S中元素数目为m，先确定系数ak，将fS(γ)转换为
Figure PCTCN2015072982-appb-000022
其中，
Figure PCTCN2015072982-appb-000023
k∈[0,m]，其中，
Figure PCTCN2015072982-appb-000024
表示模p下的整数；同时，为了保证γ的秘密性，利用离散对数将曲线fS(γ)转化为零点聚合函数为式(4)：
Figure PCTCN2015072982-appb-000025
   式(4)
式(4)中，g是p阶循环群G的生成元，根据式(4)，输入公开参数mpk，
Figure PCTCN2015072982-appb-000026
确定最终的零点聚合函数，如式(5)所示：
Figure PCTCN2015072982-appb-000027
   式(5)
本发明实施例中，当所述函数fS(x)为极点多项式时，该聚合函数称为极点聚合函数PolesAggr(mpk,S)，将所述极点聚合函数定义如下：
对于给定一个集合U＝{e1,…,en}、集合U的一个子集
Figure PCTCN2015072982-appb-000028
U及一个p阶循环群G，其中，p是一个大素数，如果存在一个多项式时间算法PolesAggr输出聚合值HS，则称该算法是极点聚合函数，所述极点聚合函数表示为式(6)：
Figure PCTCN2015072982-appb-000029
   式(6)
该极点聚合函数的具体构造过程包括：
1)随机化阶段
通过抗碰撞哈希函数将集合U＝{e1,…,en}中的每个元素ei转化为一维平面的随机点vi，vi满足
Figure PCTCN2015072982-appb-000030
其中，
Figure PCTCN2015072982-appb-000031
表示模p下的n个整数，每个元素ei由任意长度二进制串表示。
2)函数生成阶段
根据随机点vi，确定子集S中的每个元素ei'对应的随机点vi'，vi'＝hash(ei')，并将所述随机点vi'作为多项式的(负)根构造极点多项式函数gS(x)，gS(x)表示为式(7)：
Figure PCTCN2015072982-appb-000032
   式(7)
3)秘密点确定阶段
引入一个随机秘密γ，并使用已构造的曲线或多项式函数gS(x)确定
Figure PCTCN2015072982-appb-000033
4)密码学处理阶段
通过密码学方法对gS(γ)进行处理，输入公共参数mpk，
Figure PCTCN2015072982-appb-000034
h是p阶循环群G的生成元，输出极点聚合函数为
Figure PCTCN2015072982-appb-000035
为计算所述极点聚合函数，定义
Figure PCTCN2015072982-appb-000036
采用递归的方法确定极点聚合函数的聚合值
Figure PCTCN2015072982-appb-000037
如式(8)所示：
Figure PCTCN2015072982-appb-000038
   式(8)
本发明实施例中，通过所述零点聚合函数或者极点聚合函数能够将集合S的所有元素以密码学的方式表示成密码学随机空间中的随机数或随机向量，所述随机数或随机向量能够用于密码学中元素与元素之间“等于”和“不等于”关系、元素和集合之间“属于”和“不属于”关系，集合与集合之间“包含”和“非包含”关系的判定。
本发明实施例中，对于元素和集合之间“属于”关系的判定，为了保证聚合函数算法的安全，以零点聚合函数为例，对零点聚合函数的安全性进行定义，对于给定元素ei∈U及子集
Figure PCTCN2015072982-appb-000039
定义GS-如式(9)所示
Figure PCTCN2015072982-appb-000040
   式(9)
如果同时满足下述两个条件：
1)对任意ei∈S计算GS-都是容易的，即GS-是可由零点聚合函数
Figure PCTCN2015072982-appb-000041
计算的；
2)对任意
Figure PCTCN2015072982-appb-000042
计算GS-都是困难的，即GS-是不能由任何多项式时间算法(包括 ZerosAggr(mpk,S-))计算的。
则称集合S上的零点聚合函数是安全的，能够保证元素与集合之间属于关系判定的安全性。
本发明实施例中，对于元素和集合之间“不属于”关系的判定，为了保证聚合函数算法的安全，以极点聚合函数为例，对极点聚合函数的安全性进行定义，对于给定元素ei∈U和子集
Figure PCTCN2015072982-appb-000043
定义
Figure PCTCN2015072982-appb-000044
如果同时满足下述两个条件：
1)对任意
Figure PCTCN2015072982-appb-000045
计算HS+都是容易的，即HS+是可由极点聚合函数
Figure PCTCN2015072982-appb-000046
计算的；
2)对任意ei∈S计算HS+都是困难的，即HS+是不能由任何多项式时间算法(包括PolesAggr(mpk,S+))计算的。
则称集合S上的极点聚合函数是安全的，能够保证元素与集合之间不属于关系判定的安全性。
本发明实施例中，为了实现对集合成员关系的判定，首先介绍一下承诺的概念，承诺是密码学的一个基本概念，包括建立承诺和验证承诺两个过程，在建立承诺后，任何人不能猜测出承诺中的秘密，但是如果具备特定的秘密值(称为线索)，可以验证承诺和隐藏在其中的秘密是一致的。
本发明实施例中，判定元素和集合“属于”和“不属于”关系是建立在通常的双线性系统基础上，令该双线性映射系统表示为S＝{p,G,GT,e(·,·)}，其中，G和GT是二个阶为素数p的乘法循环群，元素g和h是G的生成元，那么就有双线性映射
Figure PCTCN2015072982-appb-000047
该双线性映射系统具有以下性质：
1)双线性：对任意的a,b属于
Figure PCTCN2015072982-appb-000048
使得e(ga,hb)＝e(g,h)ab；
2)非退化性：e(g,h)≠1；
3)可计算性：存在多项式时间内算法可快速计算e(g,h)。
元素和集合“属于”关系的密码学判定算法实现方法具体为：
参看图1所示，本发明实施例中，对于给定任意一个集合S,先调用集合S的极点聚合函数1PolesAggr(mpk,S)计算集合S的聚合值HS，再引入一个随机秘密k，构造对所述聚合值HS的承诺
Figure PCTCN2015072982-appb-000049
和gk；对于给定一个元素e,若满足e∈S，根据零 点聚合函数的安全性定义，令S-＝S\{e}2，此时调用零点聚合函数3ZerosAggr(mpk,S-)能够计算出式(10)：
Figure PCTCN2015072982-appb-000050
   式(10)
式(10)中，v＝hash(e)，故能恢复秘密，恢复出的一个特定的秘密值由式(11)计算：
Figure PCTCN2015072982-appb-000051
   式(11)
并通过等式
Figure PCTCN2015072982-appb-000052
验证承诺5，其中，
Figure PCTCN2015072982-appb-000053
直接来源于mpk；反之，若
Figure PCTCN2015072982-appb-000054
根据零点聚合函数的安全性定义，恢复出一个特定的秘密值是计算困难的，从而验证承诺5。本发明提供的元素与集合之间“属于”关系的判定算法使得判定过程高效而准确，既提高了判定的效率，同时还保证了判定的安全性和一致性。
本发明实施例中，元素和集合“不属于”关系的密码学判定算法实现方法具体为：
参看图2所示，对于给定任意一个集合S,先调用集合S的零点聚合函数3ZerosAggr(mpk,S)计算集合S的聚合值RS，再引入一个随机秘密k，构造对所述聚合值RS的承诺
Figure PCTCN2015072982-appb-000055
和gk；给定一个元素e,若满足
Figure PCTCN2015072982-appb-000056
根据极点聚合函数的安全性定义，令S+＝S∪{e}6，能够调用极点聚合函数1PolesAggr(mpk,S+)计算出式(12)：
Figure PCTCN2015072982-appb-000057
   式(12)
式(12)中，v＝hash(e)，故能恢复秘密4，恢复出的一个特定的秘密值由式(13)计算：
Figure PCTCN2015072982-appb-000058
   式(13)并通过等式
Figure PCTCN2015072982-appb-000059
验证承诺5，其中，
Figure PCTCN2015072982-appb-000060
直接来源于mpk；反之，若e∈S，根据极点聚合函数的安全性定义，恢复出一个特定的秘密值是计算困难的，从而验证承诺 5，通过密码学协议具有可验证的功能，协议结束之后，协议执行者可以验证关系判定结果的正确性。本发明提供的元素与集合之间“不属于”关系的判定算法使得判定过程高效而准确，既提高了判定的效率，同时还保证了判定的安全性和一致性。
本发明实施例中，例如，还可以通过类似的密码学实现方法验证两个集合是否相等，以及一个集合是否包含于另一个集合中，或一个集合与另一个集合不相交交(也被称为完全不包含)等关系。
实施例二
本发明还提供一种集合成员关系判定的密码学构造系统的具体实施方式，由于本发明提供的集合成员关系判定的密码学构造系统与前述集合成员关系判定的密码学构造方法的具体实施方式相对应，该集合成员关系判定的密码学构造系统可以通过执行上述方法具体实施方式中的流程步骤来实现本发明的目的，因此上述集合成员关系判定的密码学构造方法具体实施方式中的解释说明，也适用于本发明提供的集合成员关系判定的密码学构造系统的具体实施方式，在本发明以下的具体实施方式中将不再赘述。
参看图3所示，本发明实施例还提供一种集合成员关系判定的密码学构造系统，包括：
随机化单元101：用于获取给定任意集合U＝{e1，…，en}，将集合U中的每个元素ei转化为密码学空间内的随机点vi；
函数生成单元102：用于获取给定集合
Figure PCTCN2015072982-appb-000061
根据所述随机点vi确定集合S中的每个元素ei'对应的随机点vi'，并根据所述随机点vi'构造函数fS(x)；
秘密点确定单元103：用于引入一个随机秘密γ，根据所述函数fS(x)确定fS(γ)，并根据所述随机秘密γ确定公开参数mpk；
密码学处理单元104：用于通过密码学方法，以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的密码学表示。
本发明实施例所述的集合成员关系判定的密码学构造系统，通过将集合U中的每个元素ei转化为密码学空间内的随机点vi，并根据所述随机点vi确定子集S中的每个元素ei'对应的随机点vi'，且根据所述随机点vi'构造函数fS(x)，再引入一个随机秘密γ，根据所述函数fS(x)确定fS(γ)，并根据所述随机秘密γ确定公开参数mpk，最后将所述公开参数mpk作为输入，并通过密码学方法对fS(γ)进行处理，生成所述集合S的密码学表示。这样，将集合中所有元素以密码学的方式表示成密码学随机空间中的随机数或随机向量，所述随机数 或随机向量能够用于密码学中集合与集合、集合与元素及元素与元素之间关系的判定。
在前述集合成员关系判定的密码学构造系统的具体实施方式中，可选地，可选地，所述密码学处理单元包括：
处理模块：用于通过密码学方法以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的聚合函数Aggregate(mpk,S)，当所述函数fS(x)为零点多项式时，该聚合函数称为零点聚合函数ZerosAggr(mpk,S)，当所述函数fS(x)为极点多项式时，该聚合函数称为极点聚合函数PolesAggr(mpk,S)；
压缩模块：用于通过所述聚合函数将所述集合S压缩成确定长度的随机数或随机向量RS，RS是所述聚合函数Aggregate(mpk,S)的聚合值，且RS的长度与所述集合S中元素个数无关。
在前述集合成员关系判定的密码学构造系统的具体实施方式中，可选地，可选地，所述系统还包括：
第一判定单元：用于通过所述聚合函数构造密码学判定算法对元素与元素之间等于和不等于关系进行判定；和/或
第二判定单元：用于通过所述聚合函数构造密码学判定算法对元素与集合之间属于和不属于关系进行判定；和/或
第三判断单元：用于通过所述聚合函数构造密码学判定算法对集合与集合之间包含和不包含关系进行判定。
在前述集合成员关系判定的密码学构造系统的具体实施方式中，可选地，可选地，所述第二判定单元：还用于获取元素ei，当ei∈S时，令S-＝S\{ei}，则聚合值RS-由零点聚合函数ZerosAggr(mpk,S-)确定；当
Figure PCTCN2015072982-appb-000062
时，令S-＝S\{ei}，则聚合值RS-不能由任何多项式时间算法确定，所述多项式时间算法包括：ZerosAggr(mpk,S-)；
所述第二判定单元：还用于获取元素ei，当
Figure PCTCN2015072982-appb-000063
时，令S+＝S∪{ei}，则聚合值RS+由极点聚合函数PolesAggr(mpk,S+)确定，当ei∈S时，令S+＝S∪{ei}，则聚合值RS+不能由任何多项式时间算法确定，所述多项式时间算法包括：PolesAggr(mpk,S+)。
以上所述是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明所述原理的前提下，还可以作出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (10)

  1. 一种集合成员关系判定的密码学构造方法，其特征在于，包括：
    获取给定任意集合U＝{e1，…，en}，将集合U中的每个元素ei转化为密码学空间内的随机点vi；
    获取给定集合
    Figure PCTCN2015072982-appb-100001
    根据所述随机点vi确定集合S中的每个元素ei'对应的随机点vi'，并根据所述随机点vi'构造函数fS(x)；
    引入一个随机秘密γ，根据所述函数fS(x)确定fS(γ)，并根据所述随机秘密γ确定公开参数mpk；
    通过密码学方法，以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的密码学表示。
  2. 根据权利要求1所述的构造方法，其特征在于，所述随机点包括：随机数或随机向量；
    所述根据所述随机点vi'构造函数包括：
    将集合S中每个元素ei'对应的随机点vi'作为H(x)的零点构造零点多项式函数fS(x)；或者
    将集合S中每个元素ei'对应的随机点vi'作为H(x)的极点构造极点多项式函数fS(x)；
    其中，H(x)＝P(x)/Q(x)是一个有理多项式，表示两个多项式P(x)和Q(x)相除，对于一个变量z，当P(z)＝0时，P(x)的根z称为H(x)的零点，当Q(z)＝0时，Q(x)的根z被称为H(x)的极点；
    所述构造函数还包括：由所述随机点vi'构造的拉格朗日插值多项式、牛顿插值多项式、埃尔米特插值多项式、伯恩斯坦多项式、斐波那契多项式、二项式型多项式或相应代数曲线。
  3. 根据权利要求1所述的构造方法，其特征在于，所述通过密码学方法，以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的密码学表示包括：
    通过密码学方法，以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的聚合函数Aggregate(mpk,S)，当所述函数fS(x)为零点多项式时，该聚合函数称为零点聚合函数ZerosAggr(mpk,S)，当所述函数fS(x)为极点多项式时，该聚合函数称为极点聚合函数PolesAggr(mpk,S)；
    通过所述聚合函数将所述集合S压缩成确定长度的随机数或随机向量RS，RS是所述聚合函数Aggregate(mpk,S)的输出聚合值，且RS的长度与所述集合S中元素个数无关。
  4. 根据权利要求3所述的构造方法，其特征在于，所述通过所述聚合函数将所述集合S压缩成确定长度的聚合值RS之后包括：
    通过所述聚合函数构造密码学判定算法对元素与元素之间等于和不等于关系进行判定；和/或
    通过所述聚合函数构造密码学判定算法对元素与集合之间属于和不属于关系进行判定；和/或
    通过所述聚合函数构造密码学判定算法对集合与集合之间包含和不包含关系进行判定。
  5. 根据权利要求4所述的构造方法，其特征在于，所述通过所述聚合函数构造密码学判定算法对元素与集合之间属于关系进行判定包括：
    获取元素ei，当ei∈S时，令S-＝S\{ei}，则聚合值
    Figure PCTCN2015072982-appb-100002
    由零点聚合函数ZerosAggr(mpk,S-)确定；
    当
    Figure PCTCN2015072982-appb-100003
    时，令S-＝S\{ei}，则聚合值
    Figure PCTCN2015072982-appb-100004
    不能由任何多项式时间算法确定，所述多项式时间算法包括：ZerosAggr(mpk,S-)；
    所述通过所述聚合函数构造密码学判定算法对元素与集合之间不属于关系进行判定包括：
    获取元素ei，当
    Figure PCTCN2015072982-appb-100005
    时，令S+＝S∪{ei}，则聚合值
    Figure PCTCN2015072982-appb-100006
    由极点聚合函数PolesAggr(mpk,S+)确定；
    当ei∈S时，令S+＝S∪{ei}，则聚合值
    Figure PCTCN2015072982-appb-100007
    不能由任何多项式时间算法确定，所述多项式时间算法包括：PolesAggr(mpk,S+)。
  6. 根据权利要求5所述的构造方法，其特征在于，所述通过所述聚合函数构造密码学判定算法对元素与集合之间属于关系进行判定包括：
    根据集合S的极点聚合函数PolesAggr(mpk,S)输出的聚合值RS构造对所述聚合值RS的承诺；
    对于所述元素ei，当ei∈S时，根据确定的所述零点聚合函数ZerosAggr(mpk,S-)输出的聚合值
    Figure PCTCN2015072982-appb-100008
    验证所述承诺；
    当
    Figure PCTCN2015072982-appb-100009
    则不存在任何多项式时间算法验证所述承诺；
    所述通过所述聚合函数构造密码学判定算法对元素与集合之间不属于关系进行判定包括：
    根据集合S的零点聚合函数ZerosAggr(mpk,S)输出的聚合值RS构造对所述聚合值RS的承诺；
    对于所述元素ei，当
    Figure PCTCN2015072982-appb-100010
    时，根据确定的极点聚合函数PolesAggr(mpk,S+)输出的聚合值
    Figure PCTCN2015072982-appb-100011
    验证所述承诺；
    当ei∈S时，则不存在任何多项式时间算法验证所述承诺。
  7. 一种集合成员关系判定的密码学构造系统，其特征在于，包括：
    随机化单元：用于获取给定任意集合U＝{e1，…，en}，将集合U中的每个元素ei转化为密码学空间内的随机点vi；
    函数生成单元：用于获取给定集合
    Figure PCTCN2015072982-appb-100012
    根据所述随机点vi确定集合S中的每个元素ei'对应的随机点vi'，并根据所述随机点vi'构造函数fS(x)；
    秘密点确定单元：用于引入一个随机秘密γ，根据所述函数fS(x)确定fS(γ)，并根据所述随机秘密γ确定公开参数mpk；
    密码学处理单元：用于通过密码学方法，以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的密码学表示。
  8. 根据权利要求7所述的构造系统，其特征在于，所述密码学处理单元包括：
    处理模块：用于通过密码学方法以所述公开参数mpk作为输入对fS(γ)进行处理生成所述集合S的聚合函数Aggregate(mpk,S)，当所述函数fS(x)为零点多项式时，该聚合函数称为零点聚合函数ZerosAggr(mpk,S)，当所述函数fS(x)为极点多项式时，该聚合函数称为极点聚合函数PolesAggr(mpk,S)；
    压缩模块：用于通过所述聚合函数将所述集合S压缩成确定长度的随机数或随机向量RS，RS是所述聚合函数Aggregate(mpk,S)的输出聚合值，且RS的长度与所述集合S中元素个数无关。
  9. 根据权利要求8所述的构造系统，其特征在于，所述系统还包括：
    第一判定单元：用于通过所述聚合函数构造密码学判定算法对元素与元素之间等于和不等于关系进行判定；和/或
    第二判定单元：用于通过所述聚合函数构造密码学判定算法对元素与集合之间属于和不属于关系进行判定；和/或
    第三判断单元：用于通过所述聚合函数构造密码学判定算法对集合与集合之间包含和不包含关系进行判定。
  10. 根据权利要求9所述的构造系统，其特征在于，所述第二判定单元：还用于获取元素ei，当ei∈S时，令S-＝S\{ei}，则聚合值
    Figure PCTCN2015072982-appb-100013
    由零点聚合函数ZerosAggr(mpk,S-)确定；当
    Figure PCTCN2015072982-appb-100014
    时，令S-＝S\{ei}，则聚合值
    Figure PCTCN2015072982-appb-100015
    不能由任何多项式时间算法确定，所述多项式时间算法包括：ZerosAggr(mpk,S-)；
    所述第二判定单元：还用于获取元素ei，当
    Figure PCTCN2015072982-appb-100016
    时，令S+＝S∪{ei}，则聚合值
    Figure PCTCN2015072982-appb-100017
    由极点聚合函数PolesAggr(mpk,S+)确定，当ei∈S时，令S+＝S∪{ei}，则聚合值
    Figure PCTCN2015072982-appb-100018
    不能由任何多项式时间算法确定，所述多项式时间算法包括：PolesAggr(mpk,S+)。
PCT/CN2015/072982 2015-01-12 2015-02-13 一种集合成员关系判定的密码学构造方法及系统 WO2016112575A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/542,211 US20170359177A1 (en) 2015-01-12 2015-02-13 Method and System for Cryptographic Decision-making of Set Membership

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510013367.1 2015-01-12
CN201510013367.1A CN104618098B (zh) 2015-01-12 2015-01-12 一种集合成员关系判定的密码学构造方法及系统

Publications (1)

Publication Number Publication Date
WO2016112575A1 true WO2016112575A1 (zh) 2016-07-21

Family

ID=53152393

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/072982 WO2016112575A1 (zh) 2015-01-12 2015-02-13 一种集合成员关系判定的密码学构造方法及系统

Country Status (3)

Country Link
US (1) US20170359177A1 (zh)
CN (1) CN104618098B (zh)
WO (1) WO2016112575A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10680810B2 (en) * 2016-10-26 2020-06-09 Nxp B.V. Method of generating an elliptic curve cryptographic key pair
CN110351079B (zh) * 2019-07-09 2022-03-01 政采云有限公司 基于父子关系验证的三方解密方法
CN110602099B (zh) * 2019-09-16 2021-04-06 广西师范大学 基于可验证的对称可搜索加密的隐私保护方法
CN114826552A (zh) * 2022-05-07 2022-07-29 上海阵方科技有限公司 一种同态加密隐私集合求交下的密文还原方法

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1801702A (zh) * 2004-12-30 2006-07-12 同济大学 一种基于零知识的分布式网络交互式身份认证方法
CN102109974A (zh) * 2009-12-24 2011-06-29 上海华虹集成电路有限责任公司 适用于椭圆曲线密码安全保护的随机点生成方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101351789B1 (ko) * 2009-04-24 2014-01-15 니뽄 덴신 덴와 가부시키가이샤 암호 시스템, 암호 통신 방법, 암호화 장치, 키 생성 장치, 복호 장치, 콘텐츠 서버 장치, 프로그램, 기억매체

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1801702A (zh) * 2004-12-30 2006-07-12 同济大学 一种基于零知识的分布式网络交互式身份认证方法
CN102109974A (zh) * 2009-12-24 2011-06-29 上海华虹集成电路有限责任公司 适用于椭圆曲线密码安全保护的随机点生成方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
DOU, YONGLI ET AL.: "Secure Multiparty Computation Solutions of Collection Member Decision", JOURNAL OF COMPUTER APPLICATIONS, vol. 33, no. 12, 1 December 2013 (2013-12-01) *

Also Published As

Publication number Publication date
CN104618098A (zh) 2015-05-13
US20170359177A1 (en) 2017-12-14
CN104618098B (zh) 2017-09-26

Similar Documents

Publication Publication Date Title
Wang et al. Attribute-based data sharing scheme revisited in cloud computing
Lu et al. Lightweight public key authenticated encryption with keyword search against adaptively-chosen-targets adversaries for mobile devices
Liu et al. Toward highly secure yet efficient KNN classification scheme on outsourced cloud data
Zhou et al. ExpSOS: Secure and verifiable outsourcing of exponentiation operations for mobile cloud computing
Zheng et al. A cloud data deduplication scheme based on certificateless proxy re-encryption
Yin et al. Improved Elliptic Curve Cryptography with Homomorphic Encryption for Medical Image Encryption.
Qiao et al. Improved secure transaction scheme with certificateless cryptographic primitives for IoT-based mobile payments
WO2016112734A1 (zh) 一种具有选择和排除功能的群组加解密方法及系统
Vu et al. An efficient approach for secure multi-party computation without authenticated channel
CN111130804A (zh) 一种基于sm2算法的协同签名方法及装置、系统、介质
Zhang et al. Constant size ciphertext distributed CP-ABE scheme with privacy protection and fully hiding access structure
WO2016112575A1 (zh) 一种集合成员关系判定的密码学构造方法及系统
Qin et al. Privacy-preserving wildcards pattern matching protocol for IoT applications
Yao et al. A privacy-preserving RLWE-based remote biometric authentication scheme for single and multi-server environments
Li et al. Key-aggregate searchable encryption under multi-owner setting for group data sharing in the cloud
Zhu et al. Password-Authenticated Key Exchange Scheme Using Chaotic Maps towards a New Architecture in Standard Model.
Lawnik et al. Application of modified Chebyshev polynomials in asymmetric cryptography
Chang et al. Secure medical data management with privacy-preservation and authentication properties in smart healthcare system
CN111832044A (zh) 一种安全的协同计算处理方法及系统
Zhang et al. Secdedup: Secure encrypted data deduplication with dynamic ownership updating
Salman et al. A homomorphic cloud framework for big data analytics based on elliptic curve cryptography
CN110912695B (zh) 一种基于六粒子隐形传态的量子仲裁签名方法及系统
CN114362912A (zh) 基于分布式密钥中心的标识密码生成方法、电子设备及介质
Singamaneni et al. An improved dynamic polynomial integrity based QCP-ABE framework on large cloud data security
Li et al. Privacy-preserving large-scale systems of linear equations in outsourcing storage and computation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15877493

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15542211

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15877493

Country of ref document: EP

Kind code of ref document: A1