WO2019127912A1 - Differential security ciphertext protection system - Google Patents

Abstract

Disclosed is a differential security ciphertext protection system. The system comprises an authorization center, a data owner, a terminal, a data sharing center, a key generation server, an encryption server and a decryption server. Compared to the prior art, according to the embodiments of the present invention, by means of three semi-trusted third-party entities, i.e. the key generation server, the encryption server and the decryption server, most of the computing tasks of three stages, i.e. key generation, encryption and decryption, are respectively executed, so that local computing complexity of the ciphertext protection system is greatly reduced, and thus, the system can be applicable to a terminal with limited computing resources. Moreover, the key generation server, the encryption server and the decryption server, as the semi-trusted third-party entities, can all break down a computing load of the authorization center, so that when a great number of terminals ask the authorization center for keys or need to update the keys, a misoperation of the authorization center can be avoided.

Description

Differential security ciphertext protection system Technical field

The present invention relates to the field of ciphertext protection technologies, and in particular, to a differentiated and secure ciphertext protection system.

Background technique

CP-ABE (Ciphertext Policy-Attribute Based Encryption) is a novel encryption primitive that protects data privacy and implements fine-grained, one-to-many and non-interactive access control. It enables secure data sharing in a distributed environment.

However, when there are some terminal devices with limited resources in the encryption system, the CP-ABE solution has the following challenges:

In most existing CP-ABE schemes, the computational overhead of the encryption and decryption ends increases approximately linearly with the number of attributes included in the ciphertext access structure, so it is not suitable for terminals with limited computing resources; When the terminal requests the key from the authorization center or needs to update the key, the authorization center has a high calculation load and is prone to misoperation.

Summary of the invention

The main purpose of the embodiments of the present invention is to provide a differentiated and secure ciphertext protection system, which can solve the problem that the existing CP-ABE solution is not applicable to terminals with limited computing resources, and when a large number of terminals request a key from an authorization center or When a key update is required, the computing load of the authorization center is high, which is prone to technical problems of misoperation.

To achieve the above objective, an embodiment of the present invention provides a differential security ciphertext protection system, where the system includes an authorization center, a data owner, a terminal, a data sharing center, a key generation server, an encryption server, and a decryption server;

The key generation server and the terminal are both connected to the authorization center, and the key generation server is configured to provide a key generation algorithm to the authorization center, where the authorization center is configured to generate according to the key The algorithm generates a private key and sends the generated private key to the terminal;

The encryption server and the data sharing center are both connected to the data owner, and the encryption server is configured to provide an encryption algorithm to the data owner, where the data owner is used to protect according to the encryption algorithm. Encrypting the data, and storing the encrypted ciphertext in the data sharing center;

The decryption server and the data sharing center are both connected to the terminal, and the decryption server is configured to provide a decryption algorithm to the terminal, where the terminal is configured to acquire the ciphertext stored by the data sharing center, and is based on The decryption algorithm decrypts the ciphertext with the private key.

Preferably, the authorization center is used to:

Define the attribute set A={a ₁ ,...,a _n };

Establish a hash function H: {0, 1} ^* → G ₀ ;

Select random numbers α, β, θ, α, β, θ ∈ Z _P and calculate g ^α , g ^β , g ^{1 / θ, respectively} ;

Generating a public key PK, a primary private key MSK and a user key SK _OKGSP corresponding to the key generation server, and transmitting the generated public key PK to the terminal, and generating the generated user key SK _{OKGSP is} sent to the key generation server;

PK={G ₀ ,g,h,g ^β ,g ^1/θ ,e(g,g) ^α ,H}

MSK={g ^α ,β}

SK _OKGSP = {θ}

Where G ₀ and G _T are two cyclic groups of prime p, g is a generator of group G ₀ , and bilinear pair e:G ₀ ×G ₀ →G _T , e(g,g) is the generator G _{T, α, β, θ∈Z P,} Z P is a set of random numbers, h∈G _0.

Preferably, the authorization center is further used to:

Select two random numbers r, r ^* and r, r ^* ∈Z _p , and calculate the first user key SK ₁ and the first outsourcing key OSK _OKGSP using the following formula, and calculate the first outsourcing key OSK _{The OKGSP is} sent to the key generation server;

OSK _OKGSP ={g ^r/θ }

Wherein, g is a generator of the group G, α, β _0's, θ∈Z _P, Z _P is a set of random numbers, h∈G _0.

Preferably, the key generation server is configured to:

_Obtaining a key parameter g ^r based on the user key SK _OKGSP and the first outsourcing key OSK _OKGSP ;

Based on each user attribute in the user attribute collection

Selecting a random number r _j ∈Z _p , generating a second user key SK ₂ related to the attribute set S by using the following formula, and transmitting to the authorization center;

Where g is a generator of group G ₀ , r, β _∈ Z _p , and Z _P is a set of random numbers.

Preferably, the authorization center is further used to:

Based on the first user key SK ₁ and the second user key SK ₂ , a private key SK is generated, the private key SK={SK ₁ , SK ₂ }, and sent to the terminal.

Preferably, the data owner is used to:

Select two random numbers s, s ₁ , s, s ₁ ∈Z _p , and calculate s ₂ = (ss ₁ ) modp;

The first ciphertext CT ₁ and the second outsourcing key OSK _{OESP are} calculated and generated using the following formula:

OSK _OESP ={T,s ₁ }

Sending the second outsourcing key OSK _OESP to the encryption server;

Where α ∈ Z _P , Z _P is a set of random numbers, G ₀ and G _T are two cyclic groups of prime p, g is a generator of group G ₀ , bilinear pair e: G ₀ ×G ₀ → G _T , e(g, g) is a generator of G _T , h ∈ G ₀ , M represents plaintext information, and T represents an access tree.

Preferably, the encryption server is used to:

Generating a second ciphertext CT ₂ based on the second outsourcing key OSK _OESP and transmitting to the data owner;

The data owner is configured to generate a complete ciphertext CT based on the first ciphertext CT ₁ and the second ciphertext CT ₂ , and store the ciphertext CT in the data sharing center.

Preferably, the terminal is used to:

Obtaining the ciphertext CT from the data sharing center, selecting a random number t, t ∈ Z _P , and calculating and generating a third outsourcing key OSK _ODSP and a corresponding escrow key based on the private key SK Key SK _Delegate :

SK _Delegate ={t}

Transmitting the third outsourcing key OSK _ODSP to the decryption server;

Wherein, g is a group G generated element _{0, h∈G 0, α, β,} r, r * ∈Z P, Z P is a set of random numbers, j represents user attributes, S represents the set of attributes.

Preferably, the decryption server is used to:

Obtaining a public key PK and the ciphertext CT in the terminal, and obtaining intermediate results IT ₁ and IT ₂ based on the public key PK, the ciphertext CT, and the third outsourcing key OSK _ODSP , and sending To the terminal.

Preferably, the terminal is further configured to:

Based on the intermediate results IT ₁ and IT ₂ , the ciphertext CT, and the escrow key SK _Delegate , the plaintext information M is calculated using the following formula:

Where α, s, β, r∈Z _P , Z _P are a set of random numbers, G ₀ and G _T are two cyclic groups of prime p, g is a generator of group G ₀ , bilinear pair e: G ₀ × G ₀ → G _T , e(g, g) is a generator of G _T , h ∈ G ₀ .

A differentiated and secure ciphertext protection system provided by the embodiment of the present invention includes an authorization center, a data owner, a terminal, a data sharing center, a key generation server, an encryption server, and a decryption server; compared with the prior art In the embodiment of the present invention, the three key semi-trusted third-party entities, such as the key generation server, the encryption server, and the decryption server, respectively perform most of the calculation tasks of the three stages of key generation, encryption, and decryption, thereby greatly reducing The cryptographic protection system has local computational complexity, so it can be applied to terminals with limited computing resources. At the same time, the above-mentioned key generation server, encryption server and decryption server are semi-trusted third-party entities, which can decompose the calculation of the authorization center. Load, when a large number of terminals ask for a key from the authorization center or need to update the key, it can avoid the misoperation of the authorization center.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a preferred embodiment of the present invention, and those skilled in the art can obtain other drawings according to the drawing without any creative work.

FIG. 1 is a schematic structural diagram of a differential security ciphertext protection system according to an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. The embodiments are merely a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

1 is a schematic structural diagram of a differential security ciphertext protection system according to an embodiment of the present invention. In the embodiment of the present invention, the system includes an authorization center 10, a data owner 20, a terminal 30, and a data sharing center 40. Key generation server 50, encryption server 60 and decryption server 70;

Both the key generation server 50 and the terminal 30 are in communication with the authorization center 10, and the key generation server 50 is configured to provide a key generation algorithm to the authorization center 10, and the authorization center 10 is configured to generate a private key according to the above key generation algorithm, and The generated private key is sent to the terminal 30;

Both the encryption server 60 and the data sharing center 40 are in communication with the data owner 20, and the encryption server 60 is configured to provide an encryption algorithm to the data owner 20, and the data owner 20 encrypts the data to be protected according to the encryption algorithm described above, and The encrypted ciphertext is stored in the data sharing center 40;

Both the decryption server 70 and the data sharing center 40 are in communication with the terminal 30. The decryption server 70 is configured to provide a decryption algorithm to the terminal 30. The terminal 30 is configured to acquire the ciphertext stored by the data sharing center 40, and based on the decryption algorithm and the private key pair. The ciphertext is decrypted.

The authorization center 10 is a fully trusted entity, which is used to manage the terminal 30 and is responsible for generating a public key, a master private key, and a user key; the data sharing center 40 is a manager who shares data and is semi-trusted. Entity, which provides a variety of services such as data storage, data transfer, outsourced computing, and more. Key generation server 50, encryption server 60, and decryption server 70 are all semi-trusted third party entities that provide a wide variety of outsourced computing services. Among them, semi-trusted entities can honestly execute the various tasks distributed and return the correct results.

Embodiments of the present invention include the following four processes:

First, the system initialization

Use Authorization Center 10 to do the following:

(1), define the attribute set A = {a ₁ , ..., a _n };

(2), establish a hash function H: {0, 1} ^* → G ₀ ;

(3), select random numbers α, β, θ, α, β, θ ∈ Z _P , and calculate g ^α , g ^β , g ^{1 / θ} ;

(4) The public key PK, the master private key MSK and the user key corresponding to the key generation server 50 SK _{OKGSP are} generated by the following formula:

PK={G ₀ ,g,h,g ^β ,g ^1/θ ,e(g,g) ^α ,H}

MSK={g ^α ,β}

SK _OKGSP = {θ}

(5), the generated public key PK is sent to the terminal 30, the generated user key SK _{OKGSP is} sent to the key generation server 50;

Where G ₀ and G _T are two cyclic groups of prime p, g is a generator of group G ₀ , and bilinear pair e:G ₀ ×G ₀ →G _T , e(g,g) is the generator G _{T, α, β, θ∈Z P,} Z P is a set of random numbers, h∈G _0.

Second, generate a user key

To generate partial keys, user authorization center 10 based on public key PK and a private key main MSK, for each terminal, select two random numbers r, r ^*, and r, r ^* ∈Z _p, is then calculated by the following formula The first user key SK ₁ and the first outsourcing key OSK _OKGSP , and the calculated first outsourcing key OSK _{OKGSP is} sent to the key generation server 50;

OSK _OKGSP ={g ^r/θ }

Wherein, g is a generator of the group G, α, β _0's, θ∈Z _P, Z _P is a set of random numbers, h∈G _0.

Further, the key generation server 50 obtains the key parameter g ^r based on the above-described user key SK _OKGSP and the first outsourcing key OSK _OKGSP using the following formula:

Based on each user attribute in the user attribute collection

Selecting a random number r _j , r _j ∈Z _p by the key generation server 50, using the following formula to generate a second user key SK ₂ associated with the attribute set S, and sending it to the authorization center 10;

Where g is a generator of group G ₀ , r, β _∈ Z _p , and Z _P is a set of random numbers.

Further, the authorization center 10 is also used to:

Based on the first user key SK ₁ and the second user key SK _2, generates a secret key SK, the private key _{SK = {SK 1, SK 2} }, and to the terminal 30; namely:

Third, data encryption

The data owner 20 selects two random numbers s, s ₁ , s, s ₁ ∈ Z _p , and calculates ds ₂ = (ss ₁ ) modp;

Calculating and generating the first ciphertext CT ₁ and the second outsourcing key OSK _OESP using the following formula, sending the generated second outsourcing key OSK _OESP to the encryption server 60;

OSK _OESP ={T,s ₁ }

Where α ∈ Z _P , Z _P is a set of random numbers, G ₀ and G _T are two cyclic groups of prime p, g is a generator of group G ₀ , bilinear pair e: G ₀ ×G ₀ → G _T , e(g, g) is a generator of G _T , h ∈ G ₀ , M represents plaintext information, and T represents an access tree.

Specifically, the encryption server 60 defines a polynomial q _x for each node x (including leaf nodes) in the access tree T. Starting from the root node R, the polynomial q _{x of} each node is randomly selected from the top down. . For each node x in the access tree T, the degree of the polynomial q _x is set to k _x -1, where k _x represents the threshold. Starting from the root node R, q _R (0)=s ₁ (s∈Z _p ) is set, where s ₁ is randomly selected; at the same time, d _R other nodes are randomly selected to completely define the polynomial q _R . For each non-root node x, set q _x (0) = q _parent(x) (index(x)), and randomly select d _x other nodes to completely define q _x .

In the access tree T, assuming that Y represents a set of leaf nodes, the encryption server 60 generates a second ciphertext CT ₂ based on the second outsourcing key OSK _OESP using the following formula, and generates the generated second ciphertext CT ₂ Send to data owner 20:

Finally, the data owner 20 generates a complete ciphertext CT based on the first ciphertext CT ₁ and the second ciphertext CT ₂ , and stores the generated ciphertext CT in the data sharing center 40; wherein:

Fourth, data decryption

In order to cause the decryption server 70 to perform the relevant decryption work, the terminal 30 obtains the ciphertext CT from the data sharing center 40, and then selects a random number t, t∈Z _P , based on the private key SK, and calculates and generates the first formula by using the following formula. Three outsourced keys OSK _ODSP and corresponding escrow key SK _Delegate :

SK _Delegate ={t}

Wherein, g is a group G generated element _{0, h∈G 0, α, β,} r, r * ∈Z P, Z P is a set of random numbers, j represents user attributes, S represents the set of attributes.

In order to perform most of the decryption work in place of the terminal 30, the decryption server 70 operates the following operations:

The public key PK and the ciphertext CT in the terminal 30 are obtained, and based on the public key PK, the ciphertext CT, and the third outsourcing key OSK _ODSP , the intermediate results IT ₁ and IT _{2 are obtained} and transmitted to the terminal 30.

Wherein, if the attribute set S indirectly related to the third outsourcing key OSK _ODSP satisfies the access policy T, it can be obtained through calculation

Otherwise, an error symbol ⊥ will be output;

Assuming that the attribute set S satisfies the policy T, the decryption server 70 obtains the intermediate results IT ₁ and IT ₂ using the following formula and sends it to the terminal 30;

The terminal 30 calculates the plaintext information M based on the intermediate results IT ₁ and IT ₂ , the ciphertext CT, and the escrow key SK _Delegate using the following formula:

Where α, s, β, r∈Z _P , Z _P are a set of random numbers, G ₀ and G _T are two cyclic groups of prime p, g is a generator of group G ₀ , bilinear pair e: G ₀ × G ₀ → G _T , e(g, g) is a generator of G _T , h ∈ G ₀ .

A differential security ciphertext protection system provided by the embodiment of the present invention includes an authorization center 10, a data owner 20, a terminal 30, a data sharing center 40, a key generation server 50, an encryption server 60, and a decryption server 70; Compared with the prior art, the embodiment of the present invention performs key generation, encryption, and decryption by using the three semi-trusted third-party entities, such as the key generation server 50, the encryption server 60, and the decryption server 70. Most of the computing tasks in the phase greatly reduce the computational complexity of the ciphertext protection system, so it can be applied to the terminal 30 with limited computing resources. At the same time, the above-mentioned key generation server, encryption server and decryption server are semi-trusted. The third-party entity can decompose the computing load of the authorization center 10. When a large number of terminals 30 request the key from the authorization center 10 or need to update the key, the authorization center 10 can be prevented from malfunctioning.

The above is a description of a differential security ciphertext protection system provided by the present invention. For those skilled in the art, according to the idea of the embodiment of the present invention, there are changes in specific implementation manners and application scopes. In summary, the content of the specification should not be construed as limiting the invention.

Claims (10)

1. A differential security ciphertext protection system, characterized in that the system comprises an authorization center, a data owner, a terminal, a data sharing center, a key generation server, an encryption server and a decryption server;

   The key generation server and the terminal are both connected to the authorization center, and the key generation server is configured to provide a key generation algorithm to the authorization center, where the authorization center is configured to generate according to the key The algorithm generates a private key and sends the generated private key to the terminal;

   The encryption server and the data sharing center are both connected to the data owner, and the encryption server is configured to provide an encryption algorithm to the data owner, where the data owner is used to protect according to the encryption algorithm. Encrypting the data, and storing the encrypted ciphertext in the data sharing center;

   The decryption server and the data sharing center are both connected to the terminal, and the decryption server is configured to provide a decryption algorithm to the terminal, where the terminal is configured to acquire the ciphertext stored by the data sharing center, and is based on The decryption algorithm decrypts the ciphertext with the private key.
2. The system of claim 1 wherein said authorization center is for:

   Define the attribute set A={a ₁ ,...,a _n };

   Establish a hash function H: {0, 1} ^* → G ₀ ;

   Select random numbers α, β, θ, α, β, θ ∈ Z _P and calculate g ^α , g ^β , g ^{1 / θ, respectively} ;

   Generating a public key PK, a primary private key MSK and a user key SK _OKGSP corresponding to the key generation server, and transmitting the generated public key PK to the terminal, and generating the generated user key SK _{OKGSP is} sent to the key generation server;

   PK={G ₀ ,g,h,g ^β ,g ^1/θ ,e(g,g) ^α ,H}

   MSK={g ^α ,β}

   SK _OKGSP = {θ}

   Where G ₀ and G _T are two cyclic groups of prime p, g is a generator of group G ₀ , and bilinear pair e:G ₀ ×G ₀ →G _T , e(g,g) is the generator G _{T, α, β, θ∈Z P,} Z P is a set of random numbers, h∈G _0.
3. The system of claim 2 wherein said authorization center is further configured to:

   Select two random numbers r, r ^* and r, r ^* ∈Z _p , and calculate the first user key SK ₁ and the first outsourcing key OSK _OKGSP using the following formula, and calculate the first outsourcing key OSK _{The OKGSP is} sent to the key generation server;

   

   OSK _OKGSP ={g ^r/θ }

   Wherein, g is a generator of the group G, α, β _0's, θ∈Z _P, Z _P is a set of random numbers, h∈G _0.
4. The system of claim 3 wherein said key generation server is configured to:

   _Obtaining a key parameter g ^r based on the user key SK _OKGSP and the first outsourcing key OSK _OKGSP ;

   Based on each user attribute in the user attribute collection

   

   Selecting a random number r _j ∈Z _p , generating a second user key SK ₂ related to the attribute set S by using the following formula, and transmitting to the authorization center;

   

   Where g is a generator of group G ₀ , r, β _∈ Z _p , and Z _P is a set of random numbers.
5. The system of claim 4 wherein said authorization center is further configured to:

   Based on the first user key SK ₁ and the second user key SK ₂ , a private key SK is generated, the private key SK={SK ₁ , SK ₂ }, and sent to the terminal.
6. The system of claim 5 wherein said data owner is for:

   Select two random numbers s, s ₁ , s, s ₁ ∈Z _p , and calculate s ₂ = (ss ₁ ) modp;

   The first ciphertext CT ₁ and the second outsourcing key OSK _{OESP are} calculated and generated using the following formula:

   

   OSK _OESP ={T,s ₁ }

   Sending the second outsourcing key OSK _OESP to the encryption server;

   Where α ∈ Z _P , Z _P is a set of random numbers, G ₀ and G _T are two cyclic groups of prime p, g is a generator of group G ₀ , bilinear pair e: G ₀ ×G ₀ → G _T , e(g, g) is a generator of G _T , h ∈ G ₀ , M represents plaintext information, and T represents an access tree.
7. The system of claim 6 wherein said encryption server is for:

   Generating a second ciphertext CT ₂ based on the second outsourcing key OSK _OESP and transmitting to the data owner;

   The data owner is configured to generate a complete ciphertext CT based on the first ciphertext CT ₁ and the second ciphertext CT ₂ , and store the ciphertext CT in the data sharing center.
8. The system of claim 7 wherein said terminal is for:

   Obtaining the ciphertext CT from the data sharing center, selecting a random number t, t ∈ Z _P , and calculating and generating a third outsourcing key OSK _ODSP and a corresponding escrow key based on the private key SK Key SK _Delegate :

   

   SK _Delegate ={t}

   Transmitting the third outsourcing key OSK _ODSP to the decryption server;

   Wherein, g is a group G generated element _{0, h∈G 0, α, β,} r, r * ∈Z P, Z P is a set of random numbers, j represents user attributes, S represents the set of attributes.
9. The system of claim 8 wherein said decryption server is for:

   Obtaining a public key PK and the ciphertext CT in the terminal, and obtaining intermediate results IT ₁ and IT ₂ based on the public key PK, the ciphertext CT, and the third outsourcing key OSK _ODSP , and sending To the terminal.
10. The system of claim 9 wherein said terminal is further configured to:

    Based on the intermediate results IT ₁ and IT ₂ , the ciphertext CT, and the escrow key SK _Delegate , the plaintext information M is calculated using the following formula:

    

    Where α, s, β, r∈Z _P , Z _P are a set of random numbers, G ₀ and G _T are two cyclic groups of prime p, g is a generator of group G ₀ , bilinear pair e: G ₀ × G ₀ → G _T , e(g, g) is a generator of G _T , h ∈ G ₀ .

Images