WO2016112734A1 - 一种具有选择和排除功能的群组加解密方法及系统 - Google Patents

一种具有选择和排除功能的群组加解密方法及系统 Download PDF

Info

Publication number
WO2016112734A1
WO2016112734A1 PCT/CN2015/093838 CN2015093838W WO2016112734A1 WO 2016112734 A1 WO2016112734 A1 WO 2016112734A1 CN 2015093838 W CN2015093838 W CN 2015093838W WO 2016112734 A1 WO2016112734 A1 WO 2016112734A1
Authority
WO
WIPO (PCT)
Prior art keywords
subset
mode
encryption
encryption mode
ciphertext
Prior art date
Application number
PCT/CN2015/093838
Other languages
English (en)
French (fr)
Inventor
朱岩
蒲凤
于汝云
李丹丹
Original Assignee
北京科技大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京科技大学 filed Critical 北京科技大学
Priority to US15/543,223 priority Critical patent/US10411885B2/en
Publication of WO2016112734A1 publication Critical patent/WO2016112734A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/16—Arrangements for providing special services to substations
    • H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/60—Digital content management, e.g. content distribution
    • H04L2209/601—Broadcast encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/065—Network architectures or network communication protocols for network security for supporting key management in a packet data network for group communications

Definitions

  • the present invention relates to the field of information technology, and in particular to a group encryption and decryption method and system having a selection and exclusion function.
  • Group encryption refers to a secure communication method for large-scale groups, such as: secure transmission of messages or emails in the Internet, broadcast transmission of multimedia, selective push of information in a television or broadcast network, dynamics in a mobile network, Adaptive security communication, etc., is the basic technology to ensure information security under network and computer systems. It can be widely used in e-commerce, e-government, online transactions, and even military networks.
  • Group encryption can create a unique cryptographic system for each user to obtain a unique private key that is different from each other, but all users share a public key; on this basis, any person can use the above public key Message encryption and message broadcast on the public channel, but only valid authorized users can decrypt the information. When all users within a large group are able to authorize decryption information, the above process is called broadcast encryption. But more generally, I want group encryption to have the following modes of operation:
  • Each group of encryption can specify a specific set of users (referred to as a subset) as authorized recipients of information, and only those users can decrypt the information. This is called “selective" encryption. ;
  • Exclude mode A group of specific users who are designated as unauthorized recipients of information can be specified from the group during each encryption process. All users other than the unauthorized recipients can decrypt the information. This is called “excluding”. "Sexual encryption.
  • Group encryption systems are fundamentally different from traditional encryption systems.
  • the key structure of a traditional public key cryptosystem such as RSA or ElGamal, ECC, etc.
  • a private key cryptosystem such as DES, AES, etc.
  • the encryptor and the decrypter share one identical private key. Therefore, it can be known that the key structure of the above-mentioned conventional cryptosystem from the encrypter and the decrypter is 1:1.
  • the key structure of the group encryption system is 1:n, that is, one public key corresponds to n different private keys.
  • This key structure provides more security features. For example, n different private keys can provide good user selection, which means that the encryption/decryption of a given user can be achieved by controlling whether different keys can be decrypted.
  • the group cipher system provides convenience for solving the key distribution problem. If you want to implement the group encryption function of n users in the traditional 1:1 cryptosystem, each user needs to store the public key of all other people (n-1). (for a public key cryptosystem), or key, and an own key (for private key encryption system), and therefore, the total number of keys in the system reached n 2 th. However, in the above example, for a public key group password, each user only needs to store one public key, plus his own private key, and the total number of keys of the entire system is n+1. As a result, each user's key storage and total number of keys are greatly reduced, which facilitates simplified key management.
  • the group password system can support the number of users, the number of people who can encrypt the authorized recipients at one time, whether to support the "select" and "exclude” functions, the length of each encrypted ciphertext, and the ciphertext length and key. Whether the length is related to the size of the group, etc., are problems that cannot be solved by the current group password system.
  • the embodiments of the present invention provide a group encryption and decryption method and system with a selection and exclusion function, which implements selective group encryption and can improve the security of group encryption.
  • an embodiment of the present invention provides a group encryption and decryption method with a selection and exclusion function, including:
  • the encryption mode includes: a selection mode and an exclusion mode
  • the encryption mode is the selection mode, it means that only the user in the subset S can decrypt the received ciphertext, and if the subset S is a collection of all users in the group, it means: select all users in the group. Decrypt the received ciphertext;
  • the encryption mode is the exclusion mode, it means that other users in the group except the above subset S can decrypt the received ciphertext, and if the subset S is empty, it means that any user pair in the group is not excluded.
  • the received ciphertext is decrypted;
  • mapping relationship between the preset encryption mode and the aggregate function includes:
  • the obtaining the selected any subset S and the public parameters, and outputting the aggregated values of the subset S by using the obtained aggregate function, the subset S, and the public parameters includes:
  • the pole aggregation function is called to output the aggregated value of the subset S according to the selected arbitrary subset S and the public parameters;
  • the zero point aggregation function is called to output the aggregated value of the subset S according to the selected arbitrary subset S and the public parameters.
  • the operating the subset S with the identity identifier of the current decrypter according to the encryption mode, and outputting the new subset S′ includes:
  • the acquired encryption mode is the selection mode
  • the identity identifier of the current decrypter belongs to the subset S, ie: ID ⁇ S
  • the acquired encryption mode is the exclusion mode
  • the current decryptor has an identity ID that does not belong to the subset S, namely:
  • mapping relationship between the preset encryption mode and the aggregate function includes:
  • the obtaining the public parameters and outputting the aggregated values of the new subset S′ using the acquired aggregate function, the new subset S′, and the public parameters includes:
  • the zero point aggregate function is called to output the aggregated value of the subset S' - ;
  • the pole aggregation function is called to output the aggregate value of the subset S' + according to the new subset S' + and the public parameters.
  • the ciphertext includes: a subset S, an encryption mode, and a ciphertext, wherein the ciphertext has a determined length.
  • the obtaining the decrypted private key of the current decrypter includes:
  • the decrypted private key has a certain length and is unique, and supports a group encryption system in which one public key corresponds to multiple decrypted private keys ;
  • the identity identifier includes: an arbitrary character string, and the sender only needs to know the identity of the user to encrypt the message to be transmitted, and the identity identifier is also used to generate a group, that is, the identity identifier corresponds to an element in the group. .
  • an embodiment of the present invention further provides a group encryption method with a selection and exclusion function, including:
  • an embodiment of the present invention further provides a group decryption method with a selection and exclusion function, including:
  • an embodiment of the present invention further provides a group encryption and decryption system with a selection and exclusion function, including:
  • the encryption selection unit is configured to obtain an encryption mode of the message to be transmitted, and set an aggregation function corresponding to the encryption mode when encrypting according to a mapping relationship between the preset encryption mode and the aggregation function;
  • the cryptographic aggregation unit is configured to obtain the selected any subset S and the public parameters, and output the aggregated value of the subset S by using the aggregate function, the subset S and the public parameter corresponding to the encryption mode when the obtained encryption is obtained;
  • a ciphertext generating unit configured to generate, according to the public parameter, the to-be-transmitted message, and the aggregated value of the subset S, the ciphertext of the information to be transmitted;
  • a set operation unit configured to receive the ciphertext, obtain an encryption mode and a subset S included in the received ciphertext, and operate the subset S and the identity identifier of the current decrypter according to the encryption mode, and output a new Subset S';
  • a decryption selection unit configured to acquire an aggregation function corresponding to the encryption mode when decrypting according to a mapping relationship between a preset encryption mode and an aggregation function;
  • a decryption aggregating unit configured to acquire a public parameter, and output an aggregated value of the new subset S′ by using an aggregate function corresponding to the encryption mode obtained during decryption, a new subset S′, and a public parameter;
  • the plaintext generating unit is configured to obtain a decrypted private key of the current decrypter, and decrypt the received ciphertext according to the public parameter, the aggregated value of the new subset S′, and the decrypted private key, to obtain information to be transmitted.
  • the encryption and decryption methods for selecting and excluding the authorization of the specific user (subset S) in the group can be realized.
  • the ciphertext body of the determined length can be generated by the message to be transmitted, which can improve the security of the group encryption;
  • a second beneficial effect of the present invention is that there is no limit to the size of the user and the size of the subset S in the group;
  • a third beneficial effect of the present invention is that any character string can be used as the identity of the user, and the sender can encrypt the message to be transmitted only by knowing the identity of the user, and the identity is also used to generate a group, that is, the The identity corresponds to an element in the group;
  • a fourth beneficial effect of the present invention is to generate a decryption private key of the current decrypter according to the unique identity of the current decryptor, the decrypted private key having a determined length and being unique, and supporting a public key corresponding
  • FIG. 1 is a schematic flowchart of a group encryption and decryption method with a selection and exclusion function according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a group encryption and decryption system with a selection and exclusion function according to an embodiment of the present invention.
  • the group encryption and decryption method can realize the selection and exclusion of a specific user in a group by using the aggregation function Aggregation to implement cryptographic judgments of "belonging" and “not belonging” relationships between elements and sets.
  • the S) authorized encryption and decryption method and can generate a ciphertext of a certain length by the message to be transmitted, and the ciphertext is included in the ciphertext C, which can improve the security of the group encryption and the users in the group.
  • the encryption mode includes: a selection mode and an exclusion mode
  • the encryption mode is the selection mode, it means that only the user in the above subset S can enter the received ciphertext.
  • Row decryption if the subset S is a collection of all users in the group, indicating that all users in the group are selected to decrypt the received ciphertext;
  • the encryption mode is the exclusion mode, it means that other users in the group except the above subset S can decrypt the received ciphertext, and if the subset S is empty, it means that any user pair in the group is not excluded.
  • the received ciphertext is decrypted;
  • the pole aggregation function when the message M to be transmitted is encrypted, if the acquired encryption mode is the selection mode Select-Mode, the pole aggregation function is mapped; if the acquired encryption mode is the exclusion mode Cut-Mode, the mapping zero point aggregation is performed. Function; when decrypting ciphertext C, if the obtained encryption mode is the selection mode Select-Mode, the zero-point aggregation function is mapped; if the acquired encryption mode is the exclusion mode Cut-Mode, the pole aggregation function is mapped; To understand the pole aggregation function and the zero point aggregation function, first, let's briefly introduce the collection aggregation algorithm:
  • PK represents a set of public information spaces, any set And a cryptographic space, a collection aggregation algorithm Is a polynomial time (determined or not determined) algorithm, and the resulting aggregate function satisfies equation (1):
  • the public parameter mpk can be disclosed to anyone, and the process of ensuring the generation of the aggregate function can be publicly processed, wherein the aggregate function Aggregation is a compression function, which can all of the set S The element is compressed into a random number of a certain length or a random vector R S , that is to say, the aggregated value R S of the aggregate function is a fixed-length output, and the Aggregation can be used to implement “belonging” and “not between the element and the set.
  • the cryptographic "belongs” decision can be used to implement the "select” encryption and decryption method for a particular recipient; at the same time, the cryptographic "not belonging” decision is used to achieve “exclude” the encryption of a particular recipient.
  • the data sender may wish to specify that some users can decrypt the information, then only the identity of these designated users needs to be generated into the set S, relying on cryptography belonging to the relationship implementation algorithm, may identify the identity of the user of any e i belongs to the set S of cryptography determination, if the belong to the set, then The received ciphertext can be decrypted, otherwise the received ciphertext cannot be decrypted even if the user has a key.
  • the aggregation algorithm can construct different aggregation functions.
  • the pole aggregation function and the zero point aggregation function are taken as an example, and the pole aggregation function and the zero point aggregation function are briefly introduced as follows:
  • h is the generator of the p-order cyclic group G
  • ⁇ is the introduced random secret
  • the zero-aggregation function and the pole-aggregation function can output the aggregated value of the set S by relying on the public parameter mpk in the case where the random secret ⁇ cannot be acquired (the random secret ⁇ is kept secret in the cryptographic operation process).
  • the public parameter mpk in order to obtain the aggregated value of the set S, the public parameter mpk needs to be obtained.
  • the public parameter mpk may also be referred to as a public key.
  • the bilinear mapping system has the following properties:
  • the password encryption and decryption system is composed of the following four algorithms:
  • System initialization algorithm Given a specified security strength (for example: ciphertext length, etc.), generate system public key mpk and system secret msk;
  • a specified security strength for example: ciphertext length, etc.
  • Encryption algorithm Given a user set S and an encryption mode, and a plaintext, generating a ciphertext;
  • Decryption algorithm Given ciphertext, user set and encryption mode when encrypting, if the user satisfies the encryption requirement, the user can decrypt the private key to recover the plaintext, that is, the message M to be transmitted.
  • the public parameter mpk and the master key msk are constructed by using the bilinear mapping system.
  • each user corresponds to an element in the corpus (the set of all users in the group), and according to the unique identifier ⁇ D of each user, the decryption private key of the user can be generated.
  • the decryption private key has a certain length and is unique, and supports a group encryption system in which a public key corresponds to multiple decrypted private keys, and the key storage or key acquisition overhead is small, the storage consumption is small, and the key management can be simplified.
  • any character string may be used as the identity identifier of the user, and the sender only needs to know the identity of the user to encrypt the message to be transmitted, and the identity identifier is also used to generate a group, that is, the identity identifier corresponds to An element in a group.
  • the message M to be transmitted is encrypted according to the encryption mode (selection mode, exclusion mode) selected by the sender.
  • the encryption process is as follows:
  • the corresponding aggregate function is called according to the encryption mode set by the sender as follows:
  • the encryption mode is the selection mode, call the pole aggregation function and the subset S and the public parameter mpk as input, and output the aggregate value.
  • the ciphertext C is decrypted according to the obtained encryption mode.
  • the decryption process is as follows:
  • the operation is as follows:
  • Decrypt the collection aggregation operation 105 call the zero point aggregate function and input the subset S' - and the public parameter mpk as input, and output the aggregate value
  • the encryption mode is the selection mode
  • the user who is not in S wants to perform decryption, which is computationally difficult, that is, the polynomial time electronic computer system cannot be implemented
  • the encryption mode is the exclusion mode
  • the embodiment of the invention implements a group encryption method with an arbitrary selection relationship, which can implement an encryption and decryption method for selecting and excluding a specific user authorization in a group, and can generate a ciphertext C of a certain length by the message M to be transmitted, thereby overcoming
  • a large amount of key storage or key acquisition overhead is required, and management problems are difficult to reduce storage consumption, and the present invention supports particularly large group users in the scale, in user scale and encryption.
  • the collection size is not limited, and can be used by all users in the global Internet. Therefore, the present invention is important for solving the broadcast type of security information sharing and distribution, and at the same time, for solving the Internet, mobile network, vehicle network, cloud Environments such as computing have important application value.
  • An embodiment of the present invention further provides a group encryption method with a selection and exclusion function, including:
  • the embodiment of the invention further provides a group decryption method with a selection and exclusion function, including:
  • the acquisition is performed when decrypting Aggregation function corresponding to dense mode Mode
  • the present invention also provides a specific implementation manner of a group encryption and decryption system with selection and exclusion functions, because the group encryption and decryption system with selection and exclusion functions provided by the present invention and the foregoing group encryption and decryption with selection and exclusion functions
  • the group encryption/decryption system having the selection and exclusion function can achieve the object of the present invention by performing the flow steps in the specific implementation manner of the above method, and thus the above-mentioned group with selection and exclusion functions is added.
  • the explanation in the specific embodiment of the decryption method is also applicable to the specific embodiment of the group encryption and decryption system with the selection and exclusion functions provided by the present invention, which will not be further described in the following specific embodiments of the present invention.
  • an embodiment of the present invention further provides a group encryption and decryption system with a selection and exclusion function, including:
  • the encryption selection unit 201 is configured to: obtain an encryption mode of the message to be transmitted, and set an aggregation function corresponding to the encryption mode when encrypting according to a mapping relationship between the preset encryption mode and the aggregation function;
  • the encryption aggregating unit 202 is configured to acquire the selected arbitrary subset S and the public parameters, and output the aggregated value of the subset S by using the aggregate function, the subset S, and the public parameter corresponding to the encryption mode when the obtained encryption is performed;
  • the ciphertext generating unit 203 is configured to generate the ciphertext of the to-be-transmitted information according to the public parameter, the to-be-transmitted message, and the aggregated value of the subset S.
  • the ensemble operation unit 204 is configured to receive the ciphertext, obtain the encryption mode and the subset S included in the received ciphertext, and operate the subset S and the identity identifier of the current decrypter according to the encryption mode, and output New subset S';
  • Decryption selection unit 205 configured to acquire an aggregation function corresponding to the encryption mode when decrypting according to a mapping relationship between a preset encryption mode and an aggregation function;
  • a decryption aggregating unit 206 configured to acquire a public parameter, and output an aggregated value of the new subset S′ by using an aggregate function, a new subset S′, and a public parameter corresponding to the encryption mode when the obtained decryption is obtained;
  • the plaintext generating unit 207 is configured to acquire a decrypted private key of the current decrypter, according to the public parameter, a new subset S′ The aggregated value and the decrypted private key decrypt the received ciphertext to obtain the information to be transmitted.
  • the group encryption and decryption system can realize the selection and exclusion of a specific user in a group by using the aggregation function Aggregation to implement cryptographic judgments of "belonging" and “not belonging” relationships between elements and sets.
  • the S) authorized encryption and decryption method can generate a ciphertext of a certain length by the message to be transmitted, and the ciphertext is included in the ciphertext C, which can improve the security of the group encryption and the users in the group.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明提供一种具有选择和排除功能的群组加解密方法及系统，能够支持在大规模群组中实现解密用户的选择和排除功能。所述加解密方法包括：加密时，根据加密模式获取对应的聚合函数；获取选定的任意子集S及公开参数，输出所述子集S的聚合值；根据所述公开参数、待传输消息及所述聚合值，生成所述待传输信息的密文；获取接收的密文中包含的加密模式及子集S，并根据所述加密模式将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S'；获取解密时所述加密模式对应的聚合函数；输出所述新的子集S'的聚合值；根据所述公开参数、聚合值对接收的密文进行解密，得到待传输信息。本发明适用于信息技术领域。

Description

一种具有选择和排除功能的群组加解密方法及系统 技术领域
本发明涉及信息技术领域，特别是指一种具有选择和排除功能的群组加解密方法及系统。
背景技术
群组加密是指一种面向大规模群组的安全通信方式，比如：互联网中的消息或Email安全分发、多媒体的广播传输，电视或广播网络中的信息有选择推送，移动网络中的动态、自适应安全通信等，是保证网络及计算机系统下信息安全的基本技术，可广泛在电子商务、电子政务、网上交易、甚至军用网络中进行应用。
群组加密能通过建立一套密码系统，使得每名用户获得一个唯一性的、彼此不同的私钥，但所有用户共用一个公开密钥；在此基础上，任意人可以使用上述公开密钥进行消息加密和公开信道上的消息广播，但是只有有效的授权用户能够解密信息。当大规模群组内的所有用户都能够授权解密信息时，上述过程被称为广播加密。但更通常情况下，希望群组加密具有如下运行模式：
“选择”模式：每次加密过程中可从群组中指定一组特定的用户(简称子集)为信息的授权接收者，只有这些用户能解密信息，这被称为“选择”性的加密；
“排除”模式：在每次加密过程中可从群组中指定一组特定的用户为信息的非授权接收者，所有这些非授权接收者之外的用户能够解密信息，这被称为“排除”性的加密。
群组加密系统与传统加密系统有本质的不同。例如，传统公钥加密系统(如RSA或者ElGamal、ECC等)的密钥结构是1个公钥和1个对应的私钥；再如，私钥加密系统(如DES、AES等)都是建立加密者与解密者共享1个相同私钥基础上的，因此可知，上述传统密码系统从加密者和解密者的密钥结构都是1:1的。然而，群组加密系统的密钥结构是1:n，也就是1个公钥对应于n个不同的私钥。这种密钥结构提供了更多的安全功能，例如，n个不同私钥能够提供很好的用户选择功能，也就是说可以通过控制不同密钥是否能解密来实现指定用户的加密/解密。
群组密码系统为解决密钥分发问题提供方便，如果想在传统1:1密码系统中实现n个 用户的群组加密功能，那么每名用户需要存储所有其他人(n-1)的公钥(对公钥密码系统而言)或密钥(对私钥加密系统而言)，以及1个自己的密钥，因此，系统内的密钥总数达到了n2个。但上述例子对公钥群组密码而言，每名用户只需要存储1个公钥，再加上自己的私钥，而整个系统的密钥总数为n+1个。因此，每名用户的密钥存储和密钥总数都大幅度降低，有利于简化密钥管理。
巨大的结构变化，导致公钥群组密码系统的实现具有很大的困难。比如：群组密码系统可支持用户的数目大小，可支持一次加密授权接收者的人数数目，是否支持“选择”与“排除”功能，每次加密密文的长度，以及密文长度和密钥长度是否与群组规模相关等，这些都是目前群组密码系统无法解决的问题。
发明内容
有鉴于此，本发明实施例提供一种具有选择和排除功能的群组加解密方法及系统，实现选择性群组加密、并且能够提升群组加密的安全性。
为达到上述目的，本发明实施例提供一种具有选择和排除功能的群组加解密方法，包括：
获取待传输消息的加密模式，根据预设的加密模式与聚合函数的映射关系，设置加密时所述加密模式对应的聚合函数；
获取选定的任意子集S及公开参数，并利用获取的加密时所述加密模式对应的聚合函数、子集S及公开参数输出所述子集S的聚合值；
根据所述公开参数、待传输消息及所述子集S的聚合值，生成所述待传输信息的密文；
接收密文，获取接收的密文中包含的加密模式及子集S，并根据所述加密模式将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′；
根据预设的加密模式与聚合函数的映射关系，获取解密时所述加密模式对应的聚合函数；
获取公开参数，并利用获取的解密时所述加密模式对应的聚合函数、新的子集S′及公开参数输出所述新的子集S′的聚合值；
获取当前解密者的解密私钥，根据所述公开参数、新的子集S′的聚合值及解密私钥对接收的密文进行解密，得到待传输信息。
可选地，所述加密模式包括：选择模式、排除模式；
如果加密模式为选择模式，表示：只有在上述子集S中的用户才能够对接收的密文进行解密，若子集S为群组中全体用户的集合，表示：选择群组中的所有用户对接收的密文进行解密；
如果加密模式为排除模式，表示：除了上述子集S之外的群组内其他用户都能够对接收的密文进行解密，若子集S为空，表示：不排除群组中的任何用户对接收的密文进行解密；
所述加密时，预设的加密模式与聚合函数的映射关系包括：
选择模式映射极点聚合函数；
排除模式映射零点聚合函数。
可选地，所述获取选定的任意子集S及公开参数，并利用获取的聚合函数、子集S及公开参数输出所述子集S的聚合值包括：
如果获取的加密模式为选择模式，根据选定的任意子集S及公开参数，调用极点聚合函数输出所述子集S的聚合值；
如果获取的加密模式为排除模式，根据选定的任意子集S及公开参数，调用零点聚合函数输出所述子集S的聚合值。
可选地，所述根据所述加密模式将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′包括：
如果获取的加密模式为选择模式，且当前解密者所具有的身份标识ID属于子集S，即：ID∈S，对所述标识ID和子集S进行操作，获得新的子集S′-＝S\{ID}；
如果获取的加密模式为排除模式，且当前解密者所具有的身份标识ID不属于子集S，即：
Figure PCTCN2015093838-appb-000001
对所述标识ID和子集S进行操作，获得新的子集S′+＝S∪{ID}。
可选地，所述解密时，预设的加密模式与聚合函数的映射关系包括：
选择模式映射零点聚合函数；
排除模式映射极点聚合函数；
所述获取公开参数，并利用获取的聚合函数、新的子集S′及公开参数输出所述新的子集S′的聚合值包括：
如果获取的加密模式为选择模式，根据新的子集S′-及公开参数，调用零点聚合函数输 出所述子集S′-的聚合值；
如果获取的加密模式为排除模式，根据新的子集S′+及公开参数，调用极点聚合函数输出所述子集S′+的聚合值。
可选地，所述密文包括：子集S、加密模式及密文体，其中，所述密文体具有确定长度。
可选地，所述获取当前解密者的解密私钥包括：
根据当前解密者具有的唯一性的身份标识，生成当前解密者的解密私钥，所述解密私钥具有确定长度且是唯一的，并支持一个公钥对应多个解密私钥的群组加密体制；
所述身份标识包括：任意字符串，发送方只需知道用户的身份标识就能对待传输消息进行加密，该身份标识还用于生成群组，即，该身份标识对应于群组中的一个元素。
另一方面，本发明实施例还提供一种具有选择和排除功能的群组加密方法，包括：
获取待传输消息的加密模式，根据预设的加密模式与聚合函数的映射关系，设置加密时所述加密模式对应的聚合函数；
获取选定的任意子集S及公开参数，并利用获取的聚合函数、子集S及公开参数输出所述子集S的聚合值；
根据所述公开参数、待传输消息及所述聚合值，生成所述待传输信息的密文。
另一方面，本发明实施例还提供一种具有选择和排除功能的群组解密方法，包括：
获取接收的密文中包含的加密模式及子集S，并根据所述加密模式将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′；
根据预设的加密模式与聚合函数的映射关系，获取解密时所述加密模式对应的聚合函数；
获取公开参数，并利用获取的聚合函数、新的子集S′及公开参数输出所述新的子集S′的聚合值；
获取当前解密者的解密私钥，根据所述公开参数、新的子集S′的聚合值及解密私钥对接收的密文进行解密，得到待传输信息。
另一方面，本发明实施例还提供一种具有选择和排除功能的群组加解密系统，包括：
加密选择单元：用于获取待传输消息的加密模式，根据预设的加密模式与聚合函数的映射关系，设置加密时所述加密模式对应的聚合函数；
加密聚合单元：用于获取选定的任意子集S及公开参数，并利用获取的加密时所述加密模式对应的聚合函数、子集S及公开参数输出所述子集S的聚合值；
密文生成单元：用于根据所述公开参数、待传输消息及所述子集S的聚合值，生成所述待传输信息的密文；
集合操作单元：用于接收密文，获取接收的密文中包含的加密模式及子集S，并根据所述加密模式将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′；
解密选择单元：用于根据预设的加密模式与聚合函数的映射关系，获取解密时所述加密模式对应的聚合函数；
解密聚合单元：用于获取公开参数，并利用获取的解密时所述加密模式对应的聚合函数、新的子集S′及公开参数输出所述新的子集S′的聚合值；
明文生成单元：用于获取当前解密者的解密私钥，根据所述公开参数、新的子集S′的聚合值及解密私钥对接收的密文进行解密，得到待传输信息。
本发明的上述技术方案的有益效果如下：
上述方案中，通过利用聚合函数实现元素与集合之间“属于”和“不属于”关系的密码学判定，能够实现群组内选择和排除特定用户(子集S)授权的加密与解密方法，并且能将待传输消息生成确定长度的密文体，能够提升群组加密的安全性；
本发明的第二个有益效果是对群组中的用户规模和子集S的大小没有限制；
本发明的第三个有益效果是可以用任意字符串作为用户的身份标识，发送方只需知道用户的身份标识就能对待传输消息进行加密，该身份标识还用于生成群组，即，该身份标识对应于群组中的一个元素；
本发明的第四个有益效果是根据当前解密者具有的唯一性的身份标识，能够生成当前解密者的解密私钥，所述解密私钥具有确定长度且是唯一的，并支持一个公钥对应无限多个解密私钥的群组加密体制，密钥存储或密钥获取的开销小，存储消耗小，能够简化密钥管理，其中，每个解密者对应于全集(也称为群组中全体用户的集合)中的一个元素。
附图说明
图1为本发明实施例提供的具有选择和排除功能的群组加解密方法的流程示意图；
图2为本发明实施例提供的具有选择和排除功能的群组加解密系统的结构示意图。
具体实施方式
为使本发明要解决的技术问题、技术方案和优点更加清楚，下面将结合附图及具体实施例进行详细描述。
实施例一
本发明实施例提供的具有选择和排除功能的群组加解密方法，包括：
1.获取待传输消息M的加密模式Mode，根据预设的加密模式Mode与聚合函数Aggregation的映射关系，设置加密时所述加密模式Mode对应的聚合函数Aggregation；
2.获取选定的任意子集S及公开参数mpk，并利用获取的加密时所述加密模式对应的聚合函数Aggregation、子集S及公开参数mpk输出所述子集S的聚合值RS；
3.根据所述公开参数mpk、待传输消息M及所述聚合值RS，生成所述待传输信息M的密文C；
4.接收密文，获取接收的密文C中包含的加密模式Mode及子集S，并根据所述加密模式Mode将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′；
5.根据预设的加密模式Mode与聚合函数Aggregation的映射关系，获取解密时所述加密模式Mode对应的聚合函数Aggregation；
6.获取公开参数mpk，并利用获取的解密时所述加密模式对应的聚合函数Aggregation、新的子集S′及公开参数mpk输出所述新的子集S′的聚合值；
7.获取当前解密者的解密私钥，根据所述公开参数mpk、新的子集S′的聚合值及解密私钥对接收的密文C进行解密，得到待传输信息M。
本发明实施例所述的群组加解密方法，通过利用聚合函数Aggregation实现元素与集合之间“属于”和“不属于”关系的密码学判定，能够实现群组内选择和排除特定用户(子集S)授权的加密与解密方法，并且能将待传输消息生成确定长度的密文体，所述密文体包含在密文C中，能够提升群组加密的安全性，且对群组中的用户规模和子集S的大小没有限制。
本发明实施例中，所述加密模式包括：选择模式、排除模式；
如果加密模式为选择模式，表示：只有在上述子集S中的用户才能够对接收的密文进 行解密，若子集S为群组中全体用户的集合，表示：选择群组中的所有用户对接收的密文进行解密；
如果加密模式为排除模式，表示：除了上述子集S之外的群组内其他用户都能够对接收的密文进行解密，若子集S为空，表示：不排除群组中的任何用户对接收的密文进行解密；
本发明实施例中，当对待传输的消息M进行加密时，如果获取的加密模式为选择模式Select-Mode，则映射极点聚合函数；如果获取的加密模式为排除模式Cut-Mode，则映射零点聚合函数；当对密文C进行解密时，如果获取的加密模式为选择模式Select-Mode，则映射零点聚合函数；如果获取的加密模式为排除模式Cut-Mode，则映射极点聚合函数；为了更好的理解极点聚合函数和零点聚合函数，首先，简要介绍一下集合聚合算法：
对于给定的任意大小的完全集合U＝{e1,…,en}(集合U为全集，是群组中全体用户的集合)及所述集合U的子集S(子集S为选定的特定用户)，通过聚合函数Aggregation能够将集合S的所有元素聚合成为一个或多个密码学随机数或随机向量，将产生所述聚合函数的集合聚合算法过程定义如下：
在一个密码系统中，PK表示一组公共信息空间，任意集合
Figure PCTCN2015093838-appb-000002
和一个密码空间，集合聚合算法
Figure PCTCN2015093838-appb-000003
是一个多项式时间(确定或非确定)算法，得到的聚合函数满足式(1)：
Aggregate(mpk,S)＝RS       式(1)
式(1)中，mpk∈PK，公开参数mpk对任何人都可公开，保证产生所述聚合函数的过程可公开处理，其中，该聚合函数Aggregation是一个压缩函数，能将集合S中的所有元素压缩成确定长度的随机数或者随机向量RS，也就是说该聚合函数的聚合值RS为定长的输出，利用所述聚合函数Aggregation可实现元素与集合之间“属于”和“不属于”关系的密码学判定，因此，可以使用密码学“属于”判定实现“选择”特定接收者的加密与解密方法；同时，使用密码学“不属于”判定实现“排除”特定接收者的加密与解密方法，例如，在面向群组的广播加密中，数据发送方可能希望指定某些用户可以解密信息，那么只需要将这些指定用户的身份标识生成集合S，依靠密码学属于关系实现算法，可对任意用户的身份标识ei是否属于该集合S进行密码学判定，如果属于该集合，那么可以对接收的密文进行解密，否则，即使用户具有密钥也无法对接收的密文进行解密。
通过该聚合算法能够构造不同的聚合函数，本发明实施例以极点聚合函数及零点聚合函数为例，对极点聚合函数及零点聚合函数进行简要介绍如下：
1)零点聚合函数
给定一个任意子集
Figure PCTCN2015093838-appb-000004
和一个p阶循环群G，p是素数，如果存在一个多项式时间算法ZeroAggr，算法输出为
Figure PCTCN2015093838-appb-000005
则该算法被称为零点聚合函数，其中，g是p阶循环群G的生成元，γ为引入的随机秘密，xi＝hash(ei)为集合S中的每个元素转化为密码学空间内的随机点。
2)极点聚合函数
Figure PCTCN2015093838-appb-000006
被称为极点聚合函数，其中，h是p阶循环群G的生成元，γ为引入的随机秘密，xi＝hash(ei)为集合S中的每个元素转化为密码学空间内的随机点。
该零点聚合函数及极点聚合函数能够在无法获取随机秘密γ(随机秘密γ在密码学运算过程保密)的情况下，依靠公共参数mpk，输出集合S的聚合值。
本发明实施例中，为了得到集合S的聚合值，需获取公开参数mpk，在加密过程中，公开参数mpk也可称为公开密钥。
本发明实施例中，将采用常见的双线性映射系统(可作为多线性映射系统的一个特例)，，该系统表示为Ω＝{p,G1,G2,GT,e(·,·)}，其中，G1,G2和GT是三个阶为素数p的乘法循环群，元素g是G1的生成元，元素h是G2的生成元；那么就有双线性映射
Figure PCTCN2015093838-appb-000007
该双线性映射系统具有以下性质：
1)双线性：对任意的a,b属于
Figure PCTCN2015093838-appb-000008
使得e(ga,hb)＝e(g,h)ab，其中，
Figure PCTCN2015093838-appb-000009
表示模p下的整数；
2)非退化性：e(g,h)≠1；
3)可计算性：存在多项式时间内算法可快速计算e(g,h)。
本发明实施例中，所述密码加解密系统由如下4个算法构成：
1.系统初始化算法：给定一个指定的安全强度(例如：密文长度等)，生成系统公钥mpk和系统秘密msk；
2.用户密钥生成算法：给定一个用户唯一性的身份标识，生成一个用户解密私钥；
3.加密算法：给定一个用户集合S和一种加密模式，以及一个明文，生成一个密文；
4.解密算法：给定密文、加密时的用户集合和加密模式，如果用户满足加密要求，那么使用用户解密私钥能够恢复出明文，即，待传输消息M。
(1)本发明的系统初始化过程描述如下：
1.生成密码系统所需的双线性映射系统Ω＝{p,G1,G2,GT,e(·,·)}，在G1,G2群上分别选择随机元素g和h，在
Figure PCTCN2015093838-appb-000010
域随机选取两个指数γ,ε；
2.计算R＝e(g,h)ε；
3.令聚合子集的最大数目为m(子集的元素个数为m)，对每一个k∈[1,m]，依次计算
Figure PCTCN2015093838-appb-000011
4.构造主密钥msk＝(γ,ε,g,gε)和公开参数
Figure PCTCN2015093838-appb-000012
其中pp为公钥集合。
本发明实施例中，利用该双线性映射系统构造公开参数mpk及主密钥msk。
(2)用户密钥生成算法描述如下：
1.获取给定的一个用户的身份标识ΙDk，令xk＝hash(IDk)，其中，k表示第k个用户；
2.计算第k个用户的解密私钥
Figure PCTCN2015093838-appb-000013
3.计算
Figure PCTCN2015093838-appb-000014
并令ppk＝(IDk,Hk)；
4.将ppk添加到公钥中的pp集合中，即pp＝pp∪{ppk}。
本发明实施例中，每个用户对应于全集(群组中全体用户的集合)中的一个元素，根据每个用户具有的唯一性的身份标识ΙD，能够生成该用户的解密私钥，所述解密私钥具有确定长度且是唯一的，并支持一个公钥对应多个解密私钥的群组加密体制，密钥存储或密钥获取的开销小，存储消耗小，能够简化密钥管理。
本发明实施例中，可以用任意字符串作为用户的身份标识，发送方只需知道用户的身份标识就能对待传输消息进行加密，该身份标识还用于生成群组，即，该身份标识对应于群组中的一个元素。
(3)加密算法描述如下：
本发明实施例中，根据发送方选择的加密模式(选择模式、排除模式)对待传输的消息M进行加密，参看图1所示，加密过程如下：
1)加密集合聚合操作101
根据发送方设置的加密模式调用相应的聚合函数如下：
1.如果加密模式为选择模式，调用极点聚合函数并将子集S及将公开参数mpk作为输入，输出聚合值
Figure PCTCN2015093838-appb-000015
2.如果加密模式为排除模式，调用零点聚合函数并将子集S及将公开参数mpk作为输入，输出聚合值
Figure PCTCN2015093838-appb-000016
2)密文生成操作102
随机选取元素
Figure PCTCN2015093838-appb-000017
并根据获取的公开参数mpk，根据式(2)计算C1和C2：
Figure PCTCN2015093838-appb-000018
   式(2)
对于给定的待传输消息M，通过C3＝M·Rt计算C3，生成最终的密文103，其中，C＝(S,Mode,C1,C2,C3)，C1,C2,C3为密文体，该密文体具有确定长度。
(4)解密算法描述如下：
本发明实施例中，根据获取的加密模式对密文C进行解密，参看图1所示，解密过程如下：
先判断接收的密文C＝(S,Mode,C1,C2,C3)中的加密模式并获取子集S，根据加密模式，运行如下：
1)如果加密模式为选择模式：
1.元素与子集操作104：验证第k个用户的身份标识ΙDk是否在子集S中，如果满足IDk∈S，令S′-＝S\{IDk}；
2.解密集合聚合操作105：调用零点聚合函数并将子集S′-及公开参数mpk作为输入，输出聚合值
Figure PCTCN2015093838-appb-000019
3.解密算法106：根据获取的公开参数mpk、解密私钥及
Figure PCTCN2015093838-appb-000020
恢复出秘密
Figure PCTCN2015093838-appb-000021
计算出待传输消息M＝C3/ek′。
2)如果加密模式为排除模式：
1.元素与子集操作104：验证第k个用户的身份标识ΙDk是否满足关系
Figure PCTCN2015093838-appb-000022
如果满足，令S′+＝S∪{IDk}；
2.解密集合聚合操作105：调用极点聚合函数并将子集S′+及公开参数mpk作为输入， 输出聚合值
Figure PCTCN2015093838-appb-000023
3.解密算法106：根据获取的公开参数mpk、解密私钥及
Figure PCTCN2015093838-appb-000024
恢复秘密
Figure PCTCN2015093838-appb-000025
计算出待传输的消息M＝C3/ek′。
本发明实施例中，当加密模式为选择模式，那么不在S中的用户想进行解密，是计算上困难的，即多项式时间的电子计算机系统无法实现；同样，当加密模式为排除模式，那么在S中的用户想进行解密，是计算上困难的，即多项式时间的电子计算机无法实现。
本发明实施例实现了具有任意选择关系的群组加密方法，能够实现在群组内选择和排除特定用户授权的加密与解密方法,并且能将待传输消息M生成确定长度的密文C，克服了传统的算法中需要大量密钥存储或者密钥获取的开销，管理困难的问题，有助于减小存储消耗，且本发明支持特别巨大的群组用户规模内使用，对用户规模和加密中的集合大小都没有限制，可以供全球互联网内的所有用户使用本发明，因此，本发明对于解决广播类型的安全信息共享与分发具有重要意义，同时，对于解决互联网、移动网络、车载网络、云计算等环境具有重要应用价值。
实施例二
本发明实施例还提供一种具有选择和排除功能的群组加密方法，包括：
1.获取待传输消息的加密模式Mode，根据预设的加密模式Mode与聚合函数Aggregation的映射关系，设置加密时所述加密模式对应的聚合函数Aggregation；
2.获取选定的任意子集S及公开参数mpk，并利用获取的聚合函数Aggregation、子集S及公开参数mpk输出所述子集S的聚合值RS；
3.根据所述公开参数mpk、待传输消息M及所述聚合值RS，生成所述待传输信息M的密文C。
实施例三
本发明实施例还提供一种具有选择和排除功能的群组解密方法，包括：
1.获取接收的密文C中包含的加密模式Mode及子集S，并根据所述加密模式Mode将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′；
2.根据预设的加密模式Mode与聚合函数Aggregation的映射关系，获取解密时所述加 密模式Mode对应的聚合函数Aggregation；
3.获取公开参数mpk，并利用获取的聚合函数Aggregation、新的子集S′及公开参数mpk输出所述新的子集S′的聚合值；
4.获取当前解密者的解密私钥，根据所述公开参数mpk、新的子集S′的聚合值及解密私钥对接收的密文进行解密，得到待传输信息M。
实施例四
本发明还提供一种具有选择和排除功能的群组加解密系统的具体实施方式，由于本发明提供的具有选择和排除功能的群组加解密系统与前述具有选择和排除功能的群组加解密方法的具体实施方式相对应，该具有选择和排除功能的群组加解密系统可以通过执行上述方法具体实施方式中的流程步骤来实现本发明的目的，因此上述具有选择和排除功能的群组加解密方法具体实施方式中的解释说明，也适用于本发明提供的具有选择和排除功能的群组加解密系统的具体实施方式，在本发明以下的具体实施方式中将不再赘述。
参看图2所示，本发明实施例还提供一种具有选择和排除功能的群组加解密系统，包括：
加密选择单元201：用于获取待传输消息的加密模式，根据预设的加密模式与聚合函数的映射关系，设置加密时所述加密模式对应的聚合函数；
加密聚合单元202：用于获取选定的任意子集S及公开参数，并利用获取的加密时所述加密模式对应的聚合函数、子集S及公开参数输出所述子集S的聚合值；
密文生成单元203：用于根据所述公开参数、待传输消息及所述子集S的聚合值，生成所述待传输信息的密文；
集合操作单元204：用于接收密文，获取接收的密文中包含的加密模式及子集S，并根据所述加密模式将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′；
解密选择单元205：用于根据预设的加密模式与聚合函数的映射关系，获取解密时所述加密模式对应的聚合函数；
解密聚合单元206：用于获取公开参数，并利用获取的解密时所述加密模式对应的聚合函数、新的子集S′及公开参数输出所述新的子集S′的聚合值；
明文生成单元207：用于获取当前解密者的解密私钥，根据所述公开参数、新的子集S′ 的聚合值及解密私钥对接收的密文进行解密，得到待传输信息。
本发明实施例所述的群组加解密系统，通过利用聚合函数Aggregation实现元素与集合之间“属于”和“不属于”关系的密码学判定，能够实现群组内选择和排除特定用户(子集S)授权的加密与解密方法，并且能将待传输消息生成确定长度的密文体，所述密文体包含在密文C中，能够提升群组加密的安全性，且对群组中的用户规模和子集S的大小没有限制。
以上所述是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明所述原理的前提下，还可以作出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (10)

  1. 一种具有选择和排除功能的群组加解密方法，其特征在于，包括：
    获取待传输消息的加密模式，根据预设的加密模式与聚合函数的映射关系，设置加密时所述加密模式对应的聚合函数；
    获取选定的任意子集S及公开参数，并利用获取的加密时所述加密模式对应的聚合函数、子集S及公开参数输出所述子集S的聚合值；
    根据所述公开参数、待传输消息及所述子集S的聚合值，生成所述待传输信息的密文；
    接收密文，获取接收的密文中包含的加密模式及子集S，并根据所述加密模式将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′；
    根据预设的加密模式与聚合函数的映射关系，获取解密时所述加密模式对应的聚合函数；
    获取公开参数，并利用获取的解密时所述加密模式对应的聚合函数、新的子集S′及公开参数输出所述新的子集S′的聚合值；
    获取当前解密者的解密私钥，根据所述公开参数、新的子集S′的聚合值及解密私钥对接收的密文进行解密，得到待传输信息。
  2. 根据权利要求1所述的方法，其特征在于，所述加密模式包括：选择模式、排除模式；
    如果加密模式为选择模式，表示：只有在上述子集S中的用户才能够对接收的密文进行解密，若子集S为群组中全体用户的集合，表示：选择群组中的所有用户对接收的密文进行解密；
    如果加密模式为排除模式，表示：除了上述子集S之外的群组内其他用户都能够对接收的密文进行解密，若子集S为空，表示：不排除群组中的任何用户对接收的密文进行解密；
    所述加密时，预设的加密模式与聚合函数的映射关系包括：
    选择模式映射极点聚合函数；
    排除模式映射零点聚合函数。
  3. 根据权利要求2所述的方法，其特征在于，所述获取选定的任意子集S及公开参数，并利用获取的聚合函数、子集S及公开参数输出所述子集S的聚合值包括：
    如果获取的加密模式为选择模式，根据选定的任意子集S及公开参数，调用极点聚合 函数输出所述子集S的聚合值；
    如果获取的加密模式为排除模式，根据选定的任意子集S及公开参数，调用零点聚合函数输出所述子集S的聚合值。
  4. 根据权利要求1所述的方法，其特征在于，所述根据所述加密模式将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′包括：
    如果获取的加密模式为选择模式，且当前解密者所具有的身份标识ID属于子集S，即：ID∈S，对所述标识ID和子集S进行操作，获得新的子集S′-＝S\{ID}；
    如果获取的加密模式为排除模式，且当前解密者所具有的身份标识ID不属于子集S，即：
    Figure PCTCN2015093838-appb-100001
    对所述标识ID和子集S进行操作，获得新的子集S′+＝S∪{ID}。
  5. 根据权利要求4所述的方法，其特征在于，所述解密时，预设的加密模式与聚合函数的映射关系包括：
    选择模式映射零点聚合函数；
    排除模式映射极点聚合函数；
    所述获取公开参数，并利用获取的聚合函数、新的子集S′及公开参数输出所述新的子集S′的聚合值包括：
    如果获取的加密模式为选择模式，根据新的子集S′-及公开参数，调用零点聚合函数输出所述子集S′-的聚合值；
    如果获取的加密模式为排除模式，根据新的子集S′+及公开参数，调用极点聚合函数输出所述子集S′+的聚合值。
  6. 根据权利要求1所述的方法，其特征在于，所述密文包括：子集S、加密模式及密文体，其中，所述密文体具有确定长度。
  7. 根据权利要求1所述的方法，其特征在于，所述获取当前解密者的解密私钥包括：
    根据当前解密者具有的唯一性的身份标识，生成当前解密者的解密私钥，所述解密私钥具有确定长度且是唯一的，并支持一个公钥对应多个解密私钥的群组加密体制；
    所述身份标识包括：任意字符串，发送方只需知道用户的身份标识就能对待传输消息进行加密，该身份标识还用于生成群组，即，该身份标识对应于群组中的一个元素。
  8. 一种具有选择和排除功能的群组加密方法，其特征在于，包括：
    获取待传输消息的加密模式，根据预设的加密模式与聚合函数的映射关系，设置加密 时所述加密模式对应的聚合函数；
    获取选定的任意子集S及公开参数，并利用获取的聚合函数、子集S及公开参数输出所述子集S的聚合值；
    根据所述公开参数、待传输消息及所述聚合值，生成所述待传输信息的密文。
  9. 一种具有选择和排除功能的群组解密方法，其特征在于，包括：
    获取接收的密文中包含的加密模式及子集S，并根据所述加密模式将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′；
    根据预设的加密模式与聚合函数的映射关系，获取解密时所述加密模式对应的聚合函数；
    获取公开参数，并利用获取的聚合函数、新的子集S′及公开参数输出所述新的子集S′的聚合值；
    获取当前解密者的解密私钥，根据所述公开参数、新的子集S′的聚合值及解密私钥对接收的密文进行解密，得到待传输信息。
  10. 一种具有选择和排除功能的群组加解密系统，其特征在于，包括：
    加密选择单元：用于获取待传输消息的加密模式，根据预设的加密模式与聚合函数的映射关系，设置加密时所述加密模式对应的聚合函数；
    加密聚合单元：用于获取选定的任意子集S及公开参数，并利用获取的加密时所述加密模式对应的聚合函数、子集S及公开参数输出所述子集S的聚合值；
    密文生成单元：用于根据所述公开参数、待传输消息及所述子集S的聚合值，生成所述待传输信息的密文；
    集合操作单元：用于接收密文，获取接收的密文中包含的加密模式及子集S，并根据所述加密模式将所述子集S与当前解密者所具有的身份标识进行操作，输出新的子集S′；
    解密选择单元：用于根据预设的加密模式与聚合函数的映射关系，获取解密时所述加密模式对应的聚合函数；
    解密聚合单元：用于获取公开参数，并利用获取的解密时所述加密模式对应的聚合函数、新的子集S′及公开参数输出所述新的子集S′的聚合值；
    明文生成单元：用于获取当前解密者的解密私钥，根据所述公开参数、新的子集S′的聚合值及解密私钥对接收的密文进行解密，得到待传输信息。
PCT/CN2015/093838 2015-01-12 2015-11-05 一种具有选择和排除功能的群组加解密方法及系统 WO2016112734A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/543,223 US10411885B2 (en) 2015-01-12 2015-11-05 Method and system for group-oriented encryption and decryption with selection and exclusion functions

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510012649.X 2015-01-12
CN201510012649.XA CN104519071B (zh) 2015-01-12 2015-01-12 一种具有选择和排除功能的群组加解密方法及系统

Publications (1)

Publication Number Publication Date
WO2016112734A1 true WO2016112734A1 (zh) 2016-07-21

Family

ID=52793793

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/093838 WO2016112734A1 (zh) 2015-01-12 2015-11-05 一种具有选择和排除功能的群组加解密方法及系统

Country Status (3)

Country Link
US (1) US10411885B2 (zh)
CN (1) CN104519071B (zh)
WO (1) WO2016112734A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112615825A (zh) * 2020-12-07 2021-04-06 郑州师范学院 一种数据加密传输方法、装置、系统及设备

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104519071B (zh) * 2015-01-12 2017-08-11 北京科技大学 一种具有选择和排除功能的群组加解密方法及系统
CN106685792B (zh) * 2015-11-06 2021-02-23 北京奇虎科技有限公司 保密信息发送方法及其装置
US10700862B2 (en) * 2017-09-08 2020-06-30 Fujitsu Limited Reduced data set digest
CN109040076B (zh) * 2018-08-09 2020-07-24 腾讯科技（深圳）有限公司 一种数据处理方法、系统、装置、设备及介质
US11983280B2 (en) * 2019-01-07 2024-05-14 Cryptography Research, Inc. Protection of cryptographic operations by intermediate randomization
CN111902809B (zh) * 2020-05-18 2024-01-09 深圳技术大学 雾计算下基于cp-abe的密文搜索方法、装置、设备及存储介质
CN111931253B (zh) * 2020-09-15 2021-01-15 腾讯科技（深圳）有限公司 基于节点群的数据处理方法、系统、设备和介质
WO2022187369A1 (en) * 2021-03-02 2022-09-09 Sri International Attribute based encryption with bounded collusion resistance
CN114363858A (zh) * 2022-03-21 2022-04-15 苏州浪潮智能科技有限公司 蜂窝车联网协同通信的会话及注册方法、系统及相关组件

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007053836A2 (en) * 2005-10-31 2007-05-10 Ntt Docomo Inc. Exclusive set system constructions including, but not limited to, applications to broadcast encryption and certificate revocation
CN104038341A (zh) * 2014-06-20 2014-09-10 北京航空航天大学 一种基于身份的跨系统代理重加密方法
CN104135473A (zh) * 2014-07-16 2014-11-05 北京航空航天大学 一种由密文策略的属性基加密实现身份基广播加密的方法
CN104519071A (zh) * 2015-01-12 2015-04-15 北京科技大学 一种具有选择和排除功能的群组加解密方法及系统

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6782475B1 (en) * 1999-01-15 2004-08-24 Terence E. Sumner Method and apparatus for conveying a private message to selected members
US8442219B2 (en) * 2004-03-31 2013-05-14 Jesse Lipson Public key cryptographic methods and systems
JP2007036364A (ja) * 2005-07-22 2007-02-08 Nec Corp タイム装置、暗号化装置、復号化装置、暗号化／復号化システム
CN101150395B (zh) * 2006-09-22 2010-05-12 中国科学院声学研究所 一种加密授权管理系统的双重分组的四层加密方法
FR2913154A1 (fr) * 2007-02-28 2008-08-29 France Telecom Chiffrement broadcast base sur identite
CN101873214A (zh) * 2009-04-24 2010-10-27 索尼株式会社 广播加密中用于密钥生成、加密和解密的方法、设备
US20110238985A1 (en) * 2010-03-24 2011-09-29 Nokia Corporation Method and apparatus for facilitating provision of content protected by identity-based encryption
CN102064946A (zh) * 2011-01-25 2011-05-18 南京邮电大学 一种基于身份加密的密钥共享方法
US9037700B2 (en) * 2011-04-29 2015-05-19 International Business Machines Corporation Predictive placement of content through network analysis
US8782440B2 (en) * 2012-08-15 2014-07-15 International Business Machines Corporation Extending the number of applications for accessing protected content in a media using media key blocks

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007053836A2 (en) * 2005-10-31 2007-05-10 Ntt Docomo Inc. Exclusive set system constructions including, but not limited to, applications to broadcast encryption and certificate revocation
CN104038341A (zh) * 2014-06-20 2014-09-10 北京航空航天大学 一种基于身份的跨系统代理重加密方法
CN104135473A (zh) * 2014-07-16 2014-11-05 北京航空航天大学 一种由密文策略的属性基加密实现身份基广播加密的方法
CN104519071A (zh) * 2015-01-12 2015-04-15 北京科技大学 一种具有选择和排除功能的群组加解密方法及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112615825A (zh) * 2020-12-07 2021-04-06 郑州师范学院 一种数据加密传输方法、装置、系统及设备

Also Published As

Publication number Publication date
CN104519071B (zh) 2017-08-11
CN104519071A (zh) 2015-04-15
US10411885B2 (en) 2019-09-10
US20180006811A1 (en) 2018-01-04

Similar Documents

Publication Publication Date Title
WO2016112734A1 (zh) 一种具有选择和排除功能的群组加解密方法及系统
CN108173639B (zh) 一种基于sm9签名算法的两方合作签名方法
CN105743646B (zh) 一种基于身份的加密方法及系统
Chung et al. A Study of Attribute-based Proxy Re-encryption Scheme in Cloud Environments.
CN104767612B (zh) 一种从无证书环境到公钥基础设施环境的签密方法
CN110113155B (zh) 一种高效无证书公钥加密方法
CN104767611B (zh) 一种从公钥基础设施环境到无证书环境的签密方法
CN109873699B (zh) 一种可撤销的身份公钥加密方法
CN105763528B (zh) 一种混合机制下多重接收者匿名的加密装置
CN104158880A (zh) 一种用户端云数据共享解决方法
CN110519226B (zh) 基于非对称密钥池和隐式证书的量子通信服务端保密通信方法和系统
CN107086912B (zh) 一种异构存储系统中的密文转换方法、解密方法及系统
CN106713349B (zh) 一种能抵抗选择密文攻击的群组间代理重加密方法
CN110784314A (zh) 无证书的加密信息处理方法
Lawnik et al. Application of modified Chebyshev polynomials in asymmetric cryptography
CN114095171A (zh) 一种基于身份的可穿刺代理重加密方法
Qin et al. Strongly secure and cost-effective certificateless proxy re-encryption scheme for data sharing in cloud computing
Nithya et al. Survey on asymmetric key cryptography algorithms
Ahila et al. State of art in homomorphic encryption schemes
CN107294972B (zh) 基于身份的广义多接收者匿名签密方法
Liao et al. Cryptanalysis of an identity-based encryption scheme with equality test and improvement
Kalyani et al. New Hierarchical Identity Based Encryption with maximum hierarchy.
Negalign et al. Outsourced attribute-based signcryption in the cloud computing
Verma et al. An efficient signcryption algorithm using bilinear mapping
Tian et al. Security of a biometric identity-based encryption scheme

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15877645

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15543223

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15877645

Country of ref document: EP

Kind code of ref document: A1