WO2020082687A1

WO2020082687A1 - File sharing method and apparatus based on cp-abe layered access control, and device and medium

Info

Publication number: WO2020082687A1
Application number: PCT/CN2019/079637
Authority: WO
Inventors: 王树兰; 黄美东; 王磊; 王汇文
Original assignee: 深圳技术大学
Priority date: 2018-10-25
Filing date: 2019-03-26
Publication date: 2020-04-30
Also published as: CN109617855A; CN109617855B

Abstract

The present invention is applicable to the technical field of ciphertext access control. Provided are a file sharing method and apparatus based on CP-ABE layered access control, and a device and a medium. The method comprises: when a file sharing request sent by a file owner is received, encrypting a set of files to be shared by means of a symmetric encryption algorithm and according to a content key set to obtain a file ciphertext set; encrypting the content key set by means of an encryption function and according to common parameters and an AND gate access control policy corresponding to an AND gate policy LSSS matrix to obtain a key ciphertext set corresponding to the content key set; and uploading the file ciphertext set and the key ciphertext set to a cloud server so as to realize cloud-end file sharing. Thus, while ciphertext layered access is realized by means of CP-ABE, the storage overhead, the communication overhead and the decryption computational complexity of a ciphertext are reduced, and the encryption efficiency, the decryption efficiency and the security degree of shared data are improved.

Description

File sharing method, device, equipment and medium based on CP-ABE hierarchical access control

Technical field

The invention belongs to the technical field of ciphertext access control, and particularly relates to a file sharing method, device, device and medium based on CP-ABE hierarchical access control.

Background technique

With the development of cloud computing and the increasing use of big data, data has become the most valuable information. It has become a trend for people to store their data on cloud servers. The use and sharing of cloud data At the same time that people's lives and work bring convenience, it also brings unprecedented data security risks. Therefore, how to achieve controlled sharing of cloud data has become an urgent problem to be solved.

In order to solve the problem of controlled sharing of cloud data and avoid theft of private data, the traditional method is to encrypt the data to be shared by the user and then transmit it to the cloud server in the form of cipher text. This encryption scheme is used to distribute these encryptions. It is very inefficient for data to be given to users of a specific group, and cannot ensure that the data is completely safe. If you want to ensure the security of the data, you can achieve it by designing an encryption mechanism for access control, which prevents unauthorized users from accessing cloud private data The first line of security, so access control technology is particularly important.

In order to prevent privileged users from illegally accessing users ’sensitive data and at the same time enabling fine-grained access control in cloud storage environments, Sahai et al. Proposed the concept of attribute-based encryption (ABE) in 2005. ABE can Sharing data for fine-grained control reduces the workload of storing and distributing private keys. However, basic ABE cannot support flexible access control strategies. Therefore, Bethencourt et al. Proposed a Ciphertext Policy-Attribute Based Encryption (CP-ABE) mechanism suitable for access control applications. With a flexible access policy, CP-ABE makes it unnecessary for the encrypting party to encrypt information Know who is decrypting, and the decrypting party only needs to meet the corresponding conditions to decrypt. Many scholars at home and abroad have studied the CP-ABE algorithm. Although many achievements have been obtained, there are still many problems in the specific implementation model combined with practical applications, such as how to construct an easy-to-maintain access control structure and how to enhance access control The ability to express etc.

Summary of the invention

The object of the present invention is to provide a file sharing method, device, device and medium based on CP-ABE hierarchical access control, aiming to solve the problem that the existing technology cannot provide an effective access control method, resulting in low security of shared data problem.

In one aspect, the present invention provides a file sharing method based on CP-ABE hierarchical access control. The method includes the following steps:

When a file sharing request sent by the file owner is received, the shared file set is encrypted using a symmetric encryption algorithm according to the preset content key set to obtain a file ciphertext set;

According to the pre-generated public parameters and the pre-built AND gate access control strategy corresponding to the gate strategy LSSS matrix, the content key set is encrypted using a preset encryption function to obtain a secret key corresponding to the content key set A set of key ciphertexts, the set of key ciphertexts containing the AND gate access control strategy;

Upload the set of file ciphertexts and the set of key ciphertexts to a cloud server to achieve cloud file sharing.

On the other hand, the present invention provides a file sharing device based on CP-ABE hierarchical access control. The device includes:

The first encryption unit is used to encrypt the shared file set by using a symmetric encryption algorithm according to the preset content key set when receiving the file sharing request sent by the file owner to obtain a file ciphertext set;

The second encryption unit is configured to encrypt the content key set using a preset encryption function according to the pre-generated public parameters and the pre-built AND gate access control strategy corresponding to the gate strategy LSSS matrix to obtain the A set of key ciphertexts corresponding to the set of content keys, the set of key ciphertexts containing the AND gate access control policy; and

A ciphertext uploading unit is used to upload the set of file ciphertexts and the set of key ciphertexts to a cloud server, so as to realize cloud file sharing.

On the other hand, the present invention also provides a computing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, which is implemented when the processor executes the computer program The steps are as described in the above file sharing method based on CP-ABE hierarchical access control.

On the other hand, the present invention also provides a computer-readable storage medium that stores a computer program, and when the computer program is executed by a processor, implements the CP-ABE-based hierarchical access control as described above The steps described in the file sharing method.

When receiving the file sharing request sent by the file owner, the present invention encrypts the shared file set using a symmetric encryption algorithm according to the content key set to obtain a file ciphertext set. According to the common parameters and the corresponding gate strategy LSSS matrix, the Door access control strategy, use a preset encryption function to encrypt the content key set to obtain the key ciphertext set corresponding to the content key set, and upload the file ciphertext set and key ciphertext set to the cloud server to Realize cloud file sharing, so as to achieve hierarchical access to ciphertext through CP-ABE, reduce the storage overhead, communication overhead and decryption computational complexity of ciphertext, improve encryption efficiency, decryption efficiency and the degree of security of shared data .

BRIEF DESCRIPTION

1 is an implementation flowchart of a file sharing method based on CP-ABE hierarchical access control provided in Embodiment 1 of the present invention;

2 is an implementation flowchart of a file sharing method based on CP-ABE hierarchical access control provided by Embodiment 2 of the present invention;

3 is a schematic diagram of an access structure of an AND gate structure constructed in a file sharing method based on CP-ABE hierarchical access control provided by Embodiment 2 of the present invention;

4 is a schematic diagram of an AND gate hierarchical access tree integrated in a file sharing method based on CP-ABE hierarchical access control provided by Embodiment 2 of the present invention;

5 is a schematic diagram of converting a gate hierarchical access tree into an AND gate strategy LSSS matrix in a file sharing method based on CP-ABE hierarchical access control provided by Embodiment 2 of the present invention;

6 is a schematic structural diagram of a file sharing device based on CP-ABE hierarchical access control provided by Embodiment 3 of the present invention;

7 is a schematic structural diagram of a file sharing device based on CP-ABE hierarchical access control provided by Embodiment 4 of the present invention; and

8 is a schematic structural diagram of a computing device according to Embodiment 5 of the present invention.

detailed description

In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not intended to limit the present invention.

The following describes the specific implementation of the present invention in detail with reference to specific embodiments:

Example one:

FIG. 1 shows an implementation process of a file sharing method based on CP-ABE hierarchical access control provided in Embodiment 1 of the present invention. For ease of description, only the parts related to the embodiment of the present invention are shown. The details are as follows:

In step S101, when a file sharing request sent by the file owner is received, the shared file set is encrypted using a symmetric encryption algorithm according to the preset content key set to obtain a file ciphertext set.

The embodiments of the present invention are applicable to data processing platforms, devices or servers, such as personal computing devices and servers. The embodiments of the present invention mainly include four entities: a file owner, a file visitor, an attribute authorization center, and a cloud server. Among them, the file owner can encrypt a large number of files at once, and store the encrypted ciphertext to the cloud server. Achieve multi-file sharing; file accessors access files stored in cloud servers according to their own access rights; in addition to the management of keys, the attribute authorization center is also responsible for defining the set of system attributes. It is fully trusted and its main function is to accept User registration, key distribution, user verification and management of attribute domains, etc .; the main role of the cloud server is to provide ciphertext storage and file transfer services.

In the embodiment of the present invention, when a file sharing request sent by the file owner is received, according to the content key set preset by the file owner ck = {ck ₁ , ......, ck _k }, symmetric Encryption algorithm (for example, Data Encryption Standard (DES), Advanced Encryption Standard (AES), etc.) encrypts the set of shared files to obtain a set of file ciphertexts

The file set to be shared contains one or more files to be shared, and the content key set ck = {ck ₁ , ......, ck _k } is the kth content key ck _k to be the file set to be shared The key of the k-th file to be shared in the symmetric encryption algorithm,

The file ciphertext corresponding to the k-th file to be shared.

Before using the symmetric encryption algorithm to encrypt the shared file set, preferably, the control attribute authorization center generates the public parameter (public key) PK and the master private key MSK through the system initialization function Setup (λ), thereby improving the public parameter and the master private The trustworthiness of the key. Among them, λ is a preset security parameter.

When the control attribute authorization center generates the public parameter (public key) PK and the master private key MSK through the system initialization function Setup (λ), it is preferably implemented through the following steps:

1). Select a bilinear group G ₀ , G _T with prime order p, bilinear map e: G ₀ × G ₀ → G _T , and select a generator g of the bilinear group G ₀ ;

2). Define a hash function H: {0,1} ^* → G ₀ and randomly select two elements α and β in the Z _p : {0,1, ..., p-1} domain;

3) Calculate the public parameter PK by the formula PK = (G ₀ , p, g, e (g, g) ^α , h = g ^β ), and calculate the master private key MSK, PK by the formula MSK = (g ^α , β) As the public key is open to the public, MSK is kept by the attribute authorization center as the master key.

Therefore, the public parameters PK and the master private key MSK are generated through the above steps 1) to 3), and the trustworthiness of the public parameters and the master private key is further improved.

In step S102, according to the pre-generated public parameters and the pre-built AND gate access control strategy corresponding to the gate strategy LSSS matrix, the content key set is encrypted using a preset encryption function to obtain the corresponding content key set Key ciphertext collection.

In the embodiment of the present invention, the file owner combines the common parameter PK, the content key set ck = {ck ₁ , ......, ck _k } and the AND gate access control strategy (M , ρ) is input into the encryption function CT = Encrypt (PK, (M, ρ), ck), and the content key set is encrypted by the encryption function to obtain the key ciphertext set CT corresponding to the content key set, And the key ciphertext set CT includes the AND gate access control strategy (M, ρ), where (M, ρ) is the AND gate access control corresponding to the matrix M of the linear secret sharing scheme (LSSS) matrix Strategy, function ρ is a single mapping function that maps each row of matrix M to system attributes in the system attribute set, M is an n × n matrix, and n is the number of system attributes in matrix M.

When the encryption function CT = Encrypt (PK, (M, ρ), ck) is used to encrypt the content key set, preferably, the content key set is encrypted through the following steps:

1) Select k random numbers s ₁ , s ₂ , ..., s _k as the secret value of the encryption index in the Z _p : {0,1, ..., p-1} field, for all i = 1 , 2, ..., k calculate C _i and C ′ _i :

2) Choose a set of random vectors

among them,

Among them, y ₂ , ..., y _n is to share the secret value of the encryption index s _i (i∈ [1, k]);

3) Calculation

And select n random numbers λ ′ _{1, j} , λ ′ _{2, j} , ..., λ ′ _{n, j} as the attribute mask in the field of Z _p : {0,1, ..., p-1} , Where i∈ [1, n], j∈ [1, n-1], M _{i, j} is the i-th row of the j-th matrix M _j ,

Random vector collection

The jth vector in;

4) For i ∈ [1, n], calculate C _{1, i} and C _{2, i} :

C _{2, i} = λ _{i, j} -λ ′ _{i, j} ;

5) According to the ciphertext formula

Compute the key ciphertext set CT.

Therefore, the encryption of the content key set is realized through the above steps 1) to 5), and a key ciphertext set corresponding to the file set to be shared is obtained, which improves the efficiency and security of encrypting the shared file.

In step S103, the file ciphertext set and the key ciphertext set are uploaded to the cloud server, so as to realize cloud file sharing.

In the embodiment of the present invention, the file owner uploads the file ciphertext set E _ck (Μ) and the key ciphertext set CT corresponding to the file ciphertext set to the cloud server for the file visitor to access the corresponding cloud server Files to achieve cloud file sharing.

In the embodiment of the present invention, when a file sharing request sent by the file owner is received, the shared file set is encrypted using a symmetric encryption algorithm according to the content key set to obtain a file ciphertext set, based on the common parameters and AND gate strategy The AND gate access control strategy corresponding to the LSSS matrix uses an encryption function to encrypt the content key set to obtain the key ciphertext set corresponding to the content key set, and uploads the file ciphertext set and key ciphertext set to the cloud server , To achieve cloud file sharing, thereby reducing the storage overhead, communication overhead, and decryption computational complexity of ciphertext while achieving hierarchical access to ciphertext through CP-ABE, improving encryption efficiency, decryption efficiency, and shared data Security.

Example 2:

FIG. 2 shows an implementation process of a file sharing method based on CP-ABE hierarchical access control provided in Embodiment 2 of the present invention. For ease of description, only the parts related to the embodiment of the present invention are shown, and the details are as follows:

In step S201, when a file sharing request sent by the file owner is received, the control file owner constructs a corresponding AND gate structure access tree for each file in the shared file set according to a preset system attribute set.

In the embodiment of the present invention, when a file sharing request sent by the file owner is received, the file owner constructs a corresponding AND gate structure access tree for each file in the shared file set according to the system attribute set defined by the attribute authorization center , That is, different files have different access policies.

As an example, the file owner wants to encrypt the file set M = {m ₁ , m ₂ } and upload it to the cloud server. First, according to the system attribute set Y = {"attending doctor", "diabetes", "researcher"} file m ₁ is configured with a gate structure of an access tree T _1, access tree T to the document ₂ is configured with the gate structure m _2, FIG. 3 shows the access tree _{T. 1} and a door structure and a door structure of an access tree T _2, T ₁ corresponding to Attribute set of access strategy Y ₁ = {"attending doctor", "diabetes", "researcher"}, that is, only diabetic researchers who reach the level of attending doctor can access the attribute set of access strategy corresponding to file m ₁ and T ₂ Y ₂ = {"Diabetes", "Researcher"}, that is, as long as a diabetes researcher can access the file m ₂ .

In step S202, according to the commonality between each AND gate structure access tree, all AND gate structure access trees are integrated into an AND gate hierarchical access tree.

In the embodiment of the present invention, each AND gate structure access tree includes a rank node, a transmission node, and a leaf node with attributes. According to the commonality between each AND gate structure access tree (that is, a hierarchical relationship), all The access tree of the gate structure is integrated into a hierarchical access tree of AND gates, thereby reducing the calculation and storage overhead in the form of a shared access strategy. In addition, users only need to calculate the key once to decrypt all ciphertext, which improves the decryption efficiency.

As an example, as shown in the AND gate structure access tree T ₁ and the AND gate structure access tree T ₂ shown in FIG. 3, assuming that the attributes A = "attending doctor", B = "diabetes", and C = "researcher", then T _{1 The} corresponding access strategy is (A, (B, C, 2), 2), and the corresponding access strategy for T ₂ is (B, C, 2). After observation, it is found that T ₂ is a subset of T ₁ , between each other There is an obvious hierarchical relationship, that is, the access policy tree T ₂ can be obtained by expanding the access policy tree T ₁ , and then integrate T ₁ and T ₂ into a hierarchical access tree T as shown in FIG. 4, that is, if this The two files are encrypted using an access policy tree T, where the access policy can be used jointly by file m ₁ and file m ₂ .

In step S203, the AND gate hierarchical access tree is converted into an AND gate strategy LSSS matrix according to a preset matrix conversion rule.

In the embodiment of the present invention, when converting the AND gate hierarchical access tree into an AND gate strategy LSSS matrix according to a preset matrix conversion rule, preferably, the root node of the AND gate hierarchical access tree is first marked as a vector v, And initialize a global counter variable c to 1, after traversing the AND gate hierarchical access tree, c is the longest length of the vector, and then traverse the AND gate hierarchical access tree from top to bottom, marking a child node as its parent Node assigned vector v | 1 (parent node | child node connection), mark the other child node of the parent node as vector (0, ..., 0) | -1, where (0, ..., 0) It means that the length of the 0 vector is c. Finally, once the entire tree is marked, the leaf nodes labeled by the vector are converted into each row in the LSSS matrix. If the length of these vectors is different, the vector 0 will be filled at the end of the vector to achieve With the same vector length, the access structure of the hierarchical access tree is replaced by the AND gate strategy LSSS matrix, which achieves the effect of hierarchical access, improves the efficiency of encrypting shared files, and reduces the storage overhead of ciphertext.

As an example, FIG. 5 shows that the AND gate hierarchical access tree T is converted into an AND gate strategy LSSS matrix M according to a matrix conversion rule.

In step S204, according to the preset content key set, a symmetric encryption algorithm is used to encrypt the set of shared files to obtain a set of file ciphertexts.

In step S205, the content key set is encrypted using a preset encryption function according to the common parameters and the AND access control policy corresponding to the gate policy LSSS matrix to obtain a key ciphertext set corresponding to the content key set.

In step S206, the set of file ciphertexts and the set of key ciphertexts are uploaded to the cloud server to achieve cloud file sharing.

In the implementation of the present invention, for the specific implementation of step S204 to step S206, reference may be made to the description of step S101 to step S103 in Embodiment 1, and details are not described herein again.

In step S207, when receiving the file access request sent by the file accessor, the control file accessor obtains the file accessor's user private key from the attribute authorization center, and the user private key contains the user attribute set corresponding to the file accessor.

In the embodiment of the present invention, when a file access request sent by a file visitor is received, the attribute authorization center takes the master private key MSK and the user attribute set corresponding to the file visitor as input according to the file access request, and passes the key The generating function KeyGen (MSK, S) generates the user private key of the file visitor.

Before the file visitor sends the file access request, preferably, the file visitor registers with the attribute authorization center. During registration, the attribute authorization center verifies the legality of the file visitor ’s identity. Assign user attribute sets to improve the security of file access in the cloud.

When generating the file visitor's user private key through the key generation function KeyGen (MSK, S), preferably, after the file visitor's identity verification is passed, the formula is passed

Calculate the user private key of the file visitor, where K ₀ = g ^α h ^r and K ₁ = g ^r ,

r is Z _p : a random element in the domain {0,1, ..., p-1}, user attribute set S = {A ₁ , ..., A _x }, A _x is the xth attribute in S To further improve the security of file access in the cloud.

In step S208, according to the public parameters and the user's private key, the key ciphertext set in the cloud server is decrypted using a preset decryption function to obtain an access content key set corresponding to the user attribute set.

In the embodiment of the present invention, the file visitor inputs the public parameter PK, the user's private key SK, and the set of key ciphertext CT into the decryption function Decrypt (PK, CT, SK), and uses the decryption function to encrypt The key ciphertext set CT is decrypted to obtain the access content key set corresponding to the user attribute set.

When decrypting the set of key ciphertexts, it is preferable to decrypt the set of key ciphertexts through the following steps:

1) According to the AND gate access control strategy, obtain the file access strategy that satisfies the user attribute set.

In the embodiment of the present invention, when obtaining a file access policy that satisfies the user attribute set, it is preferable to determine whether the user attribute set S satisfies the AND gate access control policy (M, ρ). Is a file access strategy, otherwise, according to the hierarchical relationship rules in the AND gate strategy LSSS matrix M, the first row and first column in the matrix M _j (ie, M) are deleted to generate a new matrix M _{j + 1} , where j∈ [ 1, n-2], M is a matrix of n × n, n is the number of system attributes in matrix M, and then judge whether the user attribute set S satisfies M _{j + 1} , if not, then M _{j + 1} The first row and the first column in the are deleted, a new matrix is generated, and the judgment is continued until the user attribute set meets the AND access control strategy corresponding to the generated new matrix, thereby improving the rationality of the obtained file access strategy.

2) Decrypt the corresponding access content key set according to the file access strategy.

In the embodiment of the present invention, when decrypting the corresponding set of access content keys according to the file access policy, preferably,

When the file access strategy is the AND gate access control strategy (M, ρ) corresponding to the gate strategy LSSS matrix M, first, it is calculated by ∑ _i∈S ω _i · M _i = (1,0, ..., 0) ω _i , and make ω _i ∈ Z _p , where M _i is the i-th row of matrix M, and then pass the formula

Calculate the i-th user attribute A _i , and finally, pass the formula

Calculate the corresponding access content key set ck = {ck ₁ , ......, ck _k };

When the file access strategy is the AND access control strategy corresponding to M _{j + 1} , first, select the attribute set I = {i: ρ (i) ∈S} that satisfies the access strategy corresponding to M _{j + 1} , and then pass ∑ _{i ∈I} ω _i · M _{i, j + 1} = (1,0, ..., 0) calculate ω _i and make ω _i ∈Z _p , where M _{i, j + 1} is the matrix M _{j + 1} Line i, j ∈ [1, n-2], then, through the formula

Calculate the i-th user attribute A _i , and finally, pass the formula

Calculate the corresponding access content key set ck = {ck _{j + 1} , ck _{j + 2} , ......, ck _k }.

Through the above steps, the adaptability and credibility of the decrypted access content key can be improved.

In step S209, according to the access content key set, a symmetric decryption algorithm is used to decrypt the file ciphertext set in the cloud server to obtain the access file plaintext set corresponding to the access content key set.

In the embodiment of the present invention, according to the access content key set, a symmetric decryption algorithm is used to decrypt the file ciphertext set E _ck (Μ) in the cloud server to obtain the access file clear text set corresponding to the access content key set, for example If the access content key set decrypted according to the user attribute set is ck = {ck ₁ , ......, ck _k }, according to the access content key set, a symmetric decryption algorithm is used to set the file ciphertext set

For decryption, the obtained plaintext set of access files is M = {m ₁ , m ₂ , ..., m _k }, and if the set of access content keys decrypted according to the user attribute set is ck = {ck _{j + 1} , ck _{j + 2} , ......, ck _k }, according to the access content key set, a symmetric decryption algorithm is used to set the file ciphertext

After decryption, the obtained plaintext set of access files is M = {m _{j + 1} , m _{j + 2} , ..., m _k }.

In the embodiment of the present invention, when files are shared, each file to be shared has a different access strategy, and the file owner constructs a corresponding AND structure access tree for each to be shared, and then accesses the tree according to the AND structure , The AND gate structure access tree is integrated into an AND gate hierarchical access tree, and the file gate owner uses the AND gate hierarchical access tree when encrypting shared files; during file access, the file visitor matches the user attribute carried by itself Each subtree of the hierarchical access tree traverses to determine which file access strategy the visitor satisfies, and finally decrypts the corresponding content key, and obtains the corresponding plaintext file through symmetric decryption, thus achieving ciphertext separation through CP-ABE At the same time of layer access, it reduces the storage overhead of ciphertext, communication overhead, and the computational complexity of decryption, and improves the efficiency of encryption, decryption, and the security of shared data.

Example three:

FIG. 6 shows the structure of a file sharing device based on CP-ABE hierarchical access control provided in Embodiment 3 of the present invention. For ease of description, only parts related to the embodiment of the present invention are shown, including:

The first encryption unit 61 is configured to, when receiving a file sharing request sent by the file owner, encrypt the shared file set using a symmetric encryption algorithm according to the preset content key set to obtain a set of file ciphertexts;

The second encryption unit 62 is used to encrypt the content key set using a preset encryption function according to the pre-generated public parameters and the pre-built AND gate access control strategy corresponding to the gate strategy LSSS matrix to obtain the content key The set of key ciphertexts corresponding to the set; and

The ciphertext uploading unit 63 is used to upload the set of file ciphertext and the set of key ciphertext to the cloud server, so as to realize cloud file sharing.

In the embodiment of the present invention, each unit of the file sharing device based on CP-ABE hierarchical access control may be implemented by a corresponding hardware or software unit, and each unit may be an independent software or hardware unit, or may be integrated into one software or hardware unit The unit is not used here to limit the invention. Specifically, for the implementation of each unit, reference may be made to the foregoing description of Embodiment 1, and details are not described herein again.

Example 4:

FIG. 7 shows the structure of a file sharing device based on CP-ABE hierarchical access control provided in Embodiment 4 of the present invention. For ease of description, only parts related to the embodiment of the present invention are shown, including:

The access tree construction unit 71, when receiving the file sharing request sent by the file owner, controls the file owner to construct a corresponding AND gate structure access tree for each file in the shared file set according to the preset system attribute set;

The access tree integration unit 72 is used to integrate all AND gate structure access trees into one AND gate hierarchical access tree according to the commonality between each AND gate structure access tree;

The matrix conversion unit 73 is configured to convert the AND gate layered access tree into an AND gate strategy LSSS matrix according to a preset matrix conversion rule;

The first encryption unit 74 is configured to encrypt the set of shared files using a symmetric encryption algorithm according to the preset content key set to obtain a set of file ciphertexts;

The second encryption unit 75 is used to encrypt the content key set using a preset encryption function according to the common parameters and the AND access control policy corresponding to the gate policy LSSS matrix to obtain the key secret corresponding to the content key set Text collection

The ciphertext upload unit 76 is used to upload the set of file ciphertext and the set of key ciphertext to the cloud server, so as to realize cloud file sharing;

The user private key acquisition unit 77 is used to control the file accessor to obtain the file accessor's user private key from the attribute authorization center when receiving the file access request sent by the file accessor, and the user private key contains the user corresponding to the file accessor Attribute collection

The key ciphertext decryption unit 78 is used to decrypt the key ciphertext set in the cloud server using a preset decryption function according to the public parameters and the user's private key to obtain the access content key set corresponding to the user attribute set; as well as

The file ciphertext decryption unit 79 is configured to decrypt the file ciphertext set in the cloud server using a symmetric decryption algorithm according to the access content key set, to obtain the access file cleartext set corresponding to the access content key set.

In the embodiment of the present invention, each unit of the file sharing device based on CP-ABE hierarchical access control may be implemented by a corresponding hardware or software unit, and each unit may be an independent software or hardware unit, or may be integrated into one software or hardware unit The unit is not used here to limit the invention. Specifically, for the implementation of each unit, reference may be made to the description of the foregoing method embodiments, and details are not described herein again.

Example 5:

FIG. 8 shows the structure of the computing device provided in Embodiment 5 of the present invention. For convenience of description, only parts related to the embodiment of the present invention are shown.

The computing device 8 of the embodiment of the present invention includes a processor 80, a memory 81, and a computer program 82 stored in the memory 81 and executable on the processor 80. When the processor 80 executes the computer program 82, the steps in the embodiment of the file sharing method based on CP-ABE hierarchical access control described above are implemented, for example, steps S101 to S103 shown in FIG. 1. Alternatively, when the processor 80 executes the computer program 82, the functions of the units in the foregoing device embodiments are realized, for example, the functions of the units 61 to 63 shown in FIG. 6.

The computing device in this embodiment of the present invention may be a personal computing device or a server. For the steps implemented when the processor 80 in the computing device 8 executes the computer program 82 to implement the file sharing method based on CP-ABE hierarchical access control, reference may be made to the description of the foregoing method embodiments, and details are not described herein again.

Example 6:

In an embodiment of the present invention, a computer-readable storage medium is provided, and the computer-readable storage medium stores a computer program that implements the above-mentioned file sharing method based on CP-ABE hierarchical access control when the computer program is executed by a processor The steps in the embodiment are, for example, steps S101 to S103 shown in FIG. 1. Alternatively, when the computer program is executed by the processor, the functions of the units in the above device embodiments are realized, for example, the functions of the units 61 to 63 shown in FIG. 6.

The computer-readable storage medium in the embodiments of the present invention may include any entity or device capable of carrying computer program code, and a recording medium, such as ROM / RAM, magnetic disk, optical disk, flash memory, and other memories.

The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modification, equivalent replacement and improvement made within the spirit and principle of the present invention should be included in the protection of the present invention Within range.

Claims

A file sharing method based on CP-ABE hierarchical access control, characterized in that the method includes the following steps:

When a file sharing request sent by the file owner is received, the shared file set is encrypted using a symmetric encryption algorithm according to the preset content key set to obtain a file ciphertext set;

According to the pre-generated public parameters and the pre-built AND gate access control strategy corresponding to the gate strategy LSSS matrix, the content key set is encrypted using a preset encryption function to obtain a secret key corresponding to the content key set A set of key ciphertexts, the set of key ciphertexts containing the AND gate access control strategy;

Upload the set of file ciphertexts and the set of key ciphertexts to a cloud server to achieve cloud file sharing.
The method according to claim 1, wherein before the step of encrypting the set of files to be shared through a symmetric encryption algorithm, the method further comprises:

Controlling the file owner to construct a corresponding AND gate structure access tree for each file in the file set to be shared according to a preset system attribute set;

According to the commonality between each of the AND gate structure access trees, integrate all the AND gate structure access trees into one AND gate hierarchical access tree;

Convert the AND gate hierarchical access tree into the AND gate strategy LSSS matrix according to a preset matrix conversion rule.
The method according to claim 1, wherein after the step of uploading the set of file ciphertexts and the set of key ciphertexts to a cloud server, the method further comprises:

When receiving the file access request sent by the file accessor, the file accessor is controlled to obtain the user private key of the file accessor from the attribute authorization center, and the user private key contains the user attribute corresponding to the file accessor set;

According to the public parameter and the user private key, use a preset decryption function to decrypt the key ciphertext set in the cloud server to obtain a set of access content keys corresponding to the user attribute set;

According to the access content key set, a symmetric decryption algorithm is used to decrypt the file ciphertext set in the cloud server to obtain an access file plaintext set corresponding to the access content key set.
The method of claim 3, wherein the step of decrypting the set of key ciphertexts in the cloud server using a preset decryption function includes:

Obtain a file access strategy that satisfies the user attribute set according to the AND gate access control strategy;

Decrypt the corresponding access content key set according to the file access policy.
The method of claim 4, wherein the step of obtaining a file access policy that satisfies the user attribute set includes:

Determine whether the user attribute set meets the AND access control strategy;

If yes, set the AND access control policy to the file access policy;

Otherwise, delete the first row and first column in the AND gate strategy LSSS matrix corresponding to the gate access control strategy, and set the deleted access strategy corresponding to the AND gate strategy LSSS matrix as the AND gate Access control strategy, and jump to the step of judging whether the user attribute set satisfies the AND gate access control strategy.
A file sharing device based on CP-ABE hierarchical access control, characterized in that the device includes:

The first encryption unit is used to encrypt the shared file set by using a symmetric encryption algorithm according to the preset content key set when receiving the file sharing request sent by the file owner to obtain a file ciphertext set;

The second encryption unit is configured to encrypt the content key set using a preset encryption function according to the pre-generated public parameters and the pre-built AND gate access control strategy corresponding to the gate strategy LSSS matrix to obtain the A set of key ciphertexts corresponding to the set of content keys, the set of key ciphertexts containing the AND gate access control policy; and

A ciphertext uploading unit is used to upload the set of file ciphertexts and the set of key ciphertexts to a cloud server to achieve cloud file sharing.
The device of claim 6, wherein the device further comprises:

An access tree construction unit, configured to control the file owner to construct a corresponding AND gate structure access tree for each file in the file set to be shared according to a preset system attribute set;

An access tree integration unit for integrating all of the AND gate structure access trees into one AND gate hierarchical access tree according to the commonality between each of the AND gate structure access trees; and

The matrix conversion unit is configured to convert the AND gate layered access tree into the AND gate strategy LSSS matrix according to a preset matrix conversion rule.
The device of claim 6, wherein the device further comprises:

The user private key acquisition unit is used to control the file accessor to obtain the file accessor's user private key from the attribute authorization center when receiving the file access request sent by the file accessor. The set of user attributes corresponding to the file visitor;

The key ciphertext decryption unit is used to decrypt the key ciphertext set in the cloud server using a preset decryption function according to the public parameter and the user private key to obtain the user attribute The set of access content keys corresponding to the set; and

A file ciphertext decryption unit, used to decrypt the file ciphertext set in the cloud server according to the set of access content keys, to obtain an access file corresponding to the set of access content keys Clear text collection.
A computing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, claims 1 to 5. Steps of the method of any one.
A computer-readable storage medium storing a computer program, characterized in that, when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.