WO2020082692A1

WO2020082692A1 - Cp-abe-based policy update method and system

Info

Publication number: WO2020082692A1
Application number: PCT/CN2019/080917
Authority: WO
Inventors: 王树兰; 王汇文; 王磊
Original assignee: 深圳技术大学
Priority date: 2018-10-22
Filing date: 2019-04-02
Publication date: 2020-04-30
Also published as: CN109561067A; CN109561067B

Abstract

Disclosed are a CP-ABE-based policy update method and system. The method comprises: a data owning terminal encrypting target data by means of a pre-set encryption algorithm and uploading a generated ciphertext to a cloud-end server, and generating an updated key on the basis of a new access policy in the data owning terminal and uploading the updated key to the cloud-end server; and the cloud-end server updating the ciphertext by means of the received updated key. Thus, in the present invention, ciphertext updating in a data owning terminal is entrusted to a cloud-end server, so that the data owning terminal does not need to perform computation related to ciphertext updating, and thus, the amount of computation of the data owning terminal can be efficiently reduced and the overhead of communication between the data owning terminal and the cloud-end server can be reduced.

Description

Strategy update method and system based on CP-ABE

Technical field

The invention relates to the technical field of data encryption, and in particular to a policy updating method and system based on CP-ABE (Ciphertext policy-Attribute-based encryption, ciphertext policy attribute encryption).

Background technique

At present, the ABE (Attribute Based Encryption) mechanism is used as an end-to-end data encryption mode in cloud storage systems, allowing users to customize access policies and encrypt data, so that access control can be flexibly implemented.

In the context of big data, when more and more enterprises and institutions store data on cloud servers, data-owning terminals may need to dynamically and frequently change access policies, so policy updating becomes an important research issue. To implement policy update in the traditional encryption mechanism, the encryptor needs to decrypt the old ciphertext, then encrypt the obtained plaintext, and finally upload the generated new ciphertext to the cloud server, and the data has the terminal's calculation amount in the entire process. , And the communication overhead between the data ownership terminal and the cloud server is relatively large.

Summary of the invention

This application provides a CP-ABE-based strategy update method and system, which can solve the technical problems of the existing strategy update method in which the calculation amount of the data ownership terminal and the communication overhead between the data ownership terminal and the cloud server are large .

Specifically, the first aspect of the present invention provides a policy update method based on CP-ABE, which includes:

The data ownership terminal encrypts the target data using a preset encryption algorithm and uploads the generated ciphertext to the cloud server;

The data possession terminal generates an update key based on the new access policy in the data possession terminal, and uploads the new access policy and the update key to the cloud server;

The cloud server uses the received new access policy and the update key to update the ciphertext.

Optionally, the step of the cloud server using the received new access policy and the update key to update the ciphertext includes:

Using the new access policy to update the LSSS matrix of the old access policy corresponding to the ciphertext;

Use the updated LSSS matrix, the update key, and the preset ciphertext update algorithm to perform policy update on the ciphertext to generate a new ciphertext.

Optionally, the step of generating an update key based on the new access policy in the data possession terminal includes:

The data possession terminal uses the encrypted information in the target data, the new access policy, and the old access policy to run a preset key update algorithm to generate the update key.

Optionally, the method further includes:

When the data owner terminal needs to update the ciphertext file, the new data in the data owner terminal is encrypted using the access policy corresponding to the ciphertext, and the generated new ciphertext is uploaded to the Cloud server.

Optionally, the step of encrypting new data in the data-owning terminal using the access policy corresponding to the ciphertext includes:

The new data is encrypted by using the access strategy and secret value corresponding to the ciphertext, and the preset update file and secret value algorithm to generate the new ciphertext.

Optionally, the method further includes:

When the data ownership terminal needs to update the ciphertext and file at the same time, it uses the access policy and secret value corresponding to the ciphertext, as well as a preset update file and secret value algorithm to update the new data Encrypt, and upload the generated new ciphertext to the cloud server;

Generate an update key based on the new access policy in the data possession terminal, and upload the new access policy and the update key to the cloud server; wherein, the cloud server receives the new ciphertext After the new access policy and the updated key are used, the new ciphertext is updated using the new access policy and the updated key.

A second aspect of the present invention provides a policy update system based on CP-ABE, the system includes a data ownership terminal and a cloud server, and the data ownership terminal is in communication connection with the cloud server;

The data possession terminal is used to encrypt the target data using a preset encryption algorithm, upload the generated ciphertext to the cloud server, and when it is necessary to update the ciphertext policy, based on the data possession The new access policy in the terminal generates an update key, and uploads the new access policy and the update key to the cloud server;

The cloud server is used to update the ciphertext using the received new access policy and the update key.

Optionally, the system further includes a data usage terminal that is in communication connection with the cloud server, and the data usage terminal is used to download ciphertext from the cloud server and decrypt it.

Optionally, the system further includes an attribute authorization terminal, which is in communication with the data usage terminal and the data ownership terminal, respectively, and the attribute authorization terminal is used to generate a public key and The private key and the user private key corresponding to the data usage terminal.

The policy update method based on CP-ABE provided by the present invention includes: a data ownership terminal for encrypting target data using a preset encryption algorithm, and uploading the generated cipher text to a cloud server, and a data ownership terminal based on The new access policy generates an update key and uploads the update key to the cloud server; the cloud server is used to update the ciphertext using the received update key. Compared with the prior art, by entrusting the ciphertext update in the data ownership terminal to the cloud server in the present invention, the data ownership terminal no longer needs to perform calculations related to the ciphertext update, which can effectively reduce the data ownership terminal The amount of calculation in the computer, as well as reducing the communication overhead between the data ownership terminal and the cloud server.

BRIEF DESCRIPTION

In order to more clearly explain the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required in the embodiments or the description of the prior art. Obviously, the drawings in the following description are only These are some embodiments of the present invention. For those skilled in the art, without paying any creative labor, other drawings can be obtained based on these drawings.

1 is a schematic structural diagram of a policy update system based on CP-ABE in an embodiment of the present invention;

2 is a schematic flowchart of a policy update method based on CP-ABE in an embodiment of the present invention;

FIG. 3 is a schematic diagram of conversion from an access tree to an access tree in an embodiment of the present invention;

4 is a schematic diagram of conversion from an access tree to an LSSS matrix in an embodiment of the present invention;

FIG. 5 is a schematic diagram of access tree policy update in an embodiment of the present invention.

detailed description

In order to make the purpose, features, and advantages of the present invention more obvious and understandable, the technical solutions in the embodiments of the present invention will be described clearly and completely in conjunction with the drawings in the embodiments of the present invention. Obviously, the description The embodiments are only a part of the embodiments of the present invention, but not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts fall within the protection scope of the present invention.

1, FIG. 1 is a schematic structural diagram of a policy update system based on CP-ABE in an embodiment of the present invention. In this embodiment, the above system includes a data ownership terminal 10, a cloud server 20, a data usage terminal 30, and an attribute authorization terminal 40. The data ownership terminal 10 is in communication connection with the cloud server 20, the data usage terminal 30 is in communication connection with the cloud server 20, and the attribute authorization terminal 40 is in communication connection with the data usage terminal 10 and the data ownership terminal 30, respectively.

Among them, the data ownership terminal 10 is used to encrypt the target data using a preset encryption algorithm and upload the generated ciphertext to the cloud server 20, and when it is necessary to update the ciphertext policy, based on the data ownership terminal 10 Generates a new update key and uploads the updated key to the cloud server 20. In addition, the data ownership terminal 10 can also be used to update files during file update. If similar files need to be encrypted, new files can be encrypted according to the old policy in the policy update and uploaded to the cloud server 20.

The cloud server 20 is used to update the ciphertext using the received update key. The cloud server 20 is also used to provide computing and storage services, store ciphertext uploaded by the data ownership terminal 10, and provide ciphertext download service to the data usage terminal 30. It is also responsible for updating ciphertext and updating files.

The data usage terminal 30 is used to download the ciphertext from the cloud server 20, and when its attribute satisfies the access policy corresponding to the ciphertext, the downloaded ciphertext can be decrypted.

The attribute authorization terminal 40 is used to generate the public key and the private key corresponding to the above system, and manage the attribute domain thereof, and provide the user private key for the data usage terminal 30 according to the attribute set initialized by the system.

Based on the above system, a policy update method based on CP-ABE provided by an embodiment of the present invention will be described.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of a policy update method based on CP-ABE in an embodiment of the present invention. In the embodiment of the present invention, the above method includes:

Step 201: The data ownership terminal encrypts the target data using a preset encryption algorithm, and uploads the generated cipher text to the cloud server.

Step 202: The data ownership terminal generates an update key based on the new access policy in the data ownership terminal, and uploads the new access policy and the update key to the cloud server;

Step 203: The cloud server uses the received new access policy and the update key to update the ciphertext.

Specifically, based on the system shown in FIG. 1, each algorithm involved in the present invention is described in detail below.

Among them, the CP-ABE mechanism mainly includes four algorithms: Setup, Encrypt, KeyGen, Decrypt. The specific functions are as follows:

Setup (λ, U): The system initialization algorithm takes the security parameter λ and the attribute field U as input, and outputs the system public key PK and master private key MSK.

Encrypt (PK, A, m): The data encryption algorithm takes the system public key PK, data m, and access structure A as input, and outputs the ciphertext CT. The algorithm encrypts the data m and generates a ciphertext CT, where the ciphertext CT implies the access structure A. Only the data usage terminal 30 that meets the attributes of the access structure can decrypt the data.

KeyGen (MSK, S): The key generation algorithm takes the master private key MSK and the attribute set S as input, and outputs the user private key SK.

Decrypt (PK, CT, SK): The data decryption algorithm takes the system public key PK, ciphertext CT (impliedly including access structure A) and private key SK (including attribute set S) as inputs. Only when the attribute set S of the data usage terminal 30 satisfies the attributes in the access structure A, the data usage terminal 30 decrypts the ciphertext and returns the data m.

UpdateKeyGen (PK, EnInfo (m), A, A '): The update key algorithm takes the public parameter PK, data m encryption information EnInfo (m), the old strategy A and the new strategy A' as input, and outputs the update password of the data m Key UK _m .

CTUpdate (CT, UK _m ): The update ciphertext algorithm takes the ciphertext CT and the update key UK _{m of the} data _m as input, and outputs the new ciphertext CT ′.

UpdateFile (PK, A, m '): The update file and secret value algorithm take the public parameter PK, file m' and access structure A 'as input, output the ciphertext CT _ms , and the value changed during the entire update process is m 'And secret value s.

Among them, in this embodiment, a more efficient policy update and file update CP-ABE solution is provided. The advantage of this solution is to flexibly use policy update and file update to solve problems in practical applications, while reducing end-to-end Communication overhead.

The specific functions implemented are as follows:

Setup (λ, U): system initialization; the attribute authorization terminal takes the security parameter λ and the attribute field U in the system as inputs. Select bilinear group G ₀ with prime order p, bilinear mapping e: G ₀ × G ₀ → G _T , generator g of group G ₀ , random predictor h maps the elements of attribute domain U to h ₁ , ..., h _U ∈G ₀ , and defined as U = {h ₁ , ..., h _U }, where the elements correspond to the attributes contained in the attribute domain U one-to-one. In addition, select two random numbers α, a∈Z _p and calculate and generate the public key PK and the master private key MSK:

PK = (g, e (g, g) ^α , g ^a , h ₁ , ..., h _U ), MSK = g ^a (1)

Encrypt (PK, (M, ρ), m): data encryption; the data-owning terminal takes the public parameters PK, data m and LSSS (linear secret sharing scheme) access control strategy (M, ρ) as input , Where the function of the function ρ in the access control strategy (M, ρ) maps each row in the matrix M to attributes one by one. Finally, the Encrypt algorithm outputs the ciphertext CT.

Where M is the l × n matrix and l is the number of ciphertext attributes. Before performing the encryption operation, first select a random vector

Where y ₂ , ..., y _n are for sharing the secret value s of the encryption index. Then calculate

Where M _i is the i-th row of the matrix M corresponding to the vector. Finally, a random number r ₁ , ..., r _l ∈Z _p and an attribute mask λ ₁ ', ..., λ _l ' ∈Z _{p are} generated. Calculate the ciphertext:

C = m · e (g, g) ^αs , C ₀ = g ^s (2)

For i∈ [1, l], calculate

The above equation is described as (Μ, ρ).

Finally, the ciphertext is

Where EnInfo (m) is a set of random numbers during the encryption of data m, that is, EnInfo (m) = {r ₁ , ..., r _l }.

KeyGen (MSK, S): key generation. The attribute authorization terminal takes the master private key MSK and the user attribute set S as inputs, where the attribute set S = {A ₁ , ..., A _x }. When the data usage terminal registers with the attribute authorization terminal, the attribute authorization terminal judges the legitimacy of the user's identity and provides the corresponding private key for it. At the same time, a random number t ∈ Z _p is generated. Calculate the user's private key SK:

The user's private key is:

Decrypt (CT, SK): data decryption. The data usage terminal downloads the ciphertext CT of the file to be decrypted from the cloud server, and takes the ciphertext CT and its private key SK as input. The ciphertext CT includes the attribute set of the access control strategy

Define it as I = {i: ρ (i) ∈S}, and calculate {ω _i ∈Z _p }, if {λ _i } is an effective shared secret value s in matrix M, then ∑ _i∈I ω _i λ _i = s. Then perform decryption calculations:

The data m is obtained through the above-mentioned calculation data using terminal.

Further, in this embodiment, in order to update the access strategy of encrypted data stored in the cloud server, we delegate the ciphertext update of the data-owning terminal to the cloud server, which can reduce the communication overhead between the terminals and reduce The data has the computing overhead of the terminal.

PolicyUpdate: Policy update. Policy update mainly includes three parts: LSSS structure update, key update and cipher text update. The biggest challenge in the CP-ABE mechanism is the strategy update. In the traditional way to implement strategy update, the data ownership terminal needs to decrypt the old ciphertext first, then encrypt the obtained data m, and finally upload the newly generated ciphertext to the cloud server However, in the whole process, the data-owning terminal has to perform a large amount of calculations, consume a large amount of communication with the cloud server, and the storage pressure of the cloud server is large. In order to solve the above problems, this embodiment adopts a strategy update mechanism. The data-owning terminal first retains the secret value s and the encrypted information EnInfo (m) in the first encrypted data m, while retaining the attribute parameter λ _i and attribute mask λ _i 'of each attribute in the encryption algorithm, and then generates an update Key, upload it to the cloud server, and finally use the policy parameters and policy mask in the old ciphertext to update the LSSS matrix of the access policy (M, ρ), and update the policy of the specified ciphertext to generate a new ciphertext Text. This includes:

1. LSSS structure update

The access control strategy can also be used as a representation of the access control scheme in the local structure. In the strategy update mechanism, the old strategy LSSS structure (M, ρ) is converted into a new strategy LSSS structure (M ', ρ'). If a new secret value s is selected under the new access strategy and encrypted calculation is performed, it will result in excessive calculation and communication costs. Collection in ciphertext

The expression is divided into three parts: one is the access control strategy (M, ρ); the second is the ciphertext subset C, C _{0 that} encrypts the data m; the third is the strategy set that encrypts the access control strategy (M, ρ)

The expression of the ciphertext sub-collection is C = m · e (g, g) ^αs and C ₀ = g ^s . To generate a new secret value s again for encryption operation, the data ownership terminal obtains the public key PK from the attribute authorization terminal, And perform encryption calculations locally. In the above process, the communication between the data ownership terminal and the attribute authorization terminal is frequent, and the calculation of the data ownership terminal is repeated. Therefore, the secret value s is not changed during the policy update, and only the old policy is used to update the policy. In order to randomize the encrypted secret value s again, the encrypted information EnInfo (m) of the data m needs to contain two random vectors

with

The public key of each attribute x consists of

Said. The data ownership terminal will construct the update key through the key update algorithm and upload it to the cloud server; after the cloud server obtains the update key, it will run the ciphertext update algorithm to update the ciphertext, which is converted from the old access control strategy to the new LSSS transformation. The conversion process is divided into two stages: access tree to access tree, and access tree to matrix. The specific conversion process is shown in FIG. 3, which is a schematic diagram of the conversion from access tree to access tree in an embodiment of the present invention.

In Figure 3, the old strategy A is on the left, and the new strategy A 'is on the right. Observe that the access strategy in the old strategy is (E, (A, B, C, D, 2), 2). In the threshold access tree, each non-leaf node represents a threshold, and each leaf node represents an attribute. Set of attributes {A, B, C, D, E}. Given an attribute set S, for each leaf node, if the relevant attribute is in S, it means that S satisfies the leaf node of access policy A. In the (t, n) threshold node, n is the number of child nodes, 1 ≤ t ≤ n is the threshold value, if t = 1 represents the OR gate, and t = n represents the AND gate. The access strategy in the new strategy is (E, (A, B, C, (A, F, 2), 2), 2), attribute set {A, B, C, E, F}. Relative to the old strategy, an attribute F and an AND threshold are added.

Referring to FIG. 4, FIG. 4 is a schematic diagram of conversion of an access tree to an LSSS matrix in an embodiment of the present invention. In FIG. 4, the access tree is on the left, and the access strategy is (E, (A, B, C, D, 2), 2) . On the right is the access strategy (M, ρ) of LSSS, where M is a matrix, and the corresponding attributes E, A of the first row, second row, third row, fourth row, and fifth row are mapped by the mapping function ρ, respectively , B, C, D. Given an attribute set S, if and only if the attribute set S is marked to each row in the matrix M and includes a vector (1,0, ..., 0), then S satisfies the LSSS access strategy.

Among them, the Boolean formula of the AND or threshold policy tree is:

E∧ (((A∧B) ∨ (C∧D)) ∨ ((A∧B) ∧ (C∧D)))

Among them, the AND or threshold policy tree generates the LSSS matrix through the Lewko-Waters algorithm, as follows:

Among them, the above formula describes the conversion of the general algorithm Boolean formula into an equivalent LSSS matrix. The Boolean formula is regarded as an access tree. The internal nodes have AND gates, OR gates, and leaf nodes with attributes. 1,0, ..., 0) is set as the shared vector of LSSS. First, the root node of the vector label tree is (1) (the length of the reference vector is 1), then down the tree hierarchy, each node is marked as a vector assigned by its parent node, and finally a global counter variable is initialized c is 1, after traversing the access tree, c is the longest length of the vector.

Follow the following rules throughout the traversal process:

1. If the parent node is an OR gate and it is marked as vector v. Then its child nodes are also marked as v (variable c is unchanged).

2. If the parent node is an AND gate and is marked as a vector v, then add 0 (if necessary) at the end to make its length c. Then mark one child node as vector v | 1 (parent node | child node connection); mark the other as vector (0, ..., 0) | -1, where (0, ..., 0) means The length of the 0 vector is c.

Once the entire tree is marked, the leaf nodes labeled by the vector are converted into each row in the LSSS matrix. If these vectors have different lengths, the vector tail will be padded with vector 0 to achieve the same vector length.

Second, the key update

UpdateKeyGen (PK, EnInfo (m), A, A '): key update. The data ownership terminal takes as input the public parameter PK, the encrypted information EnInfo (m) of the data m, the old access policy A and the new access policy A '. Assuming that the new access strategy is a matrix M ′ of n ′ × l ′, each leaf node in the access tree is mapped to each row in M ′ through a mapping function ρ ′, where each row vector in M ′ represents an attribute. Since the mapping functions ρ and ρ 'are non-injective, we denote num _{ρ (i), M} and num _{ρ (i), M'} as the number of attributes of the attribute ρ (i) in the matrix M and M ', respectively. When the old strategy in the old ciphertext is converted to the new strategy, it is discussed separately according to the different situations encountered by the data-owning terminal. The update key algorithm first compares A and A 'and divides the attributes of the new access strategy into three parts:

(1) The existing attribute set in the old strategy is defined as I _{1, M '} (Type1);

(2) The attribute set that has existed in the old strategy and appears twice or more is defined as I _{2, M '} (Type2);

(3) The attribute set that does not exist in the old strategy is defined as I _{3, M '} (Type 3).

Referring to FIG. 5, FIG. 5 is a schematic diagram of access tree policy update in an embodiment of the present invention. In Figure 5, the old strategy is on the left and the new strategy is on the right. Observe the leaf nodes of the new and old strategies. In the new strategy, the attributes A, B, C, E exist in the old strategy, then they are divided into the set I _{1, M '} (Type1); If it appears twice in the new strategy, it is divided into the set I _{2, M '} (Type 2); if the attribute F does not exist in the old strategy, it is divided into the set I _{3, M'} (Type 3).

According to the classification in the above strategy update, the analysis will proceed from the ciphertext structure. In the ciphertext part produced by the Encrypt algorithm, the ciphertext of each attribute is set to:

In the ciphertext set of formula (9), h _{ρ (i)} is a hash function, which represents that the ciphertext subset corresponds to an attribute, and λ _i ′ is a random number in the Z _p domain, whose main function is to disguise The attribute parameter λ _{i is} also used as a random mask of the ciphertext subset C _{1, i} . The attribute parameter λ _i splits the secret value s of the ciphertext into each attribute according to the access policy, and calls it the policy parameter, and λ _i ′ is the policy parameter mask.

For the three types Type1, Type2, and Type3 in the policy update, the following operations are respectively made:

1) If the attribute in the new strategy corresponds to Type1, just based on the existing ciphertext, according to the strategy parameter λ _{i of the} update strategy C _{3, i} ;

2) If the attribute in the new strategy corresponds to Type 2, you first need to update the strategy parameters λ _i , random numbers r _i and the parameter mask λ _i ′ in C _{1, i} and C ₃ , as well as C _2, random number r _i of _i, then the mapping function ρ, which is separate from the ciphertext Type1 same region attribute;

3) If the attributes in the new policy correspond to Type 3 attributes, since the old policy does not have the same attribute ciphertext, the data-owning terminal needs to recalculate the ciphertext C _{1, i} , C _{2, i} , C ₃ locally _{, I.}

In the strategy update scheme, the data ownership terminal calculates the LSSS matrix (M ', ρ') according to the new strategy, and generates a random variable at the same time

The secret value s is the first element of the vector. Then calculate

Define I _{M '} = {1, ..., l} as the index set of M'. Where (j, i) indicates that an attribute index is i in the old strategy and j is the index in the new strategy. In the old ciphertext strategy (M, ρ), the old strategy parameter of the attribute ρ (i) is λ _i , and the old strategy parameter mask is λ _i '; while in the new ciphertext strategy (M', ρ '), The new policy parameter of the attribute ρ (j) is λ _j , and the new policy parameter mask is λ _j ′.

For j∈ [1, l '], if (j, i) ∈I _{1, M'} (Type1), the algorithm generates an update key:

UK _{j, i, m} = a (λ _j -λ _i ) (10)

If (j, i) ∈I _{2, M '} (Type2), the algorithm generates random numbers a _j , r _j , λ _j ' ∈Z _p , and generates an update key at the same time:

If (j, i) ∈I _{3, M '} (Type3), the algorithm generates random numbers r _j , λ _j ' ∈Z _p , and also generates an update key:

The final update key UK _m is:

UK _m = ((Type1, {UK _{j, i, m} } _{(j, i) ∈I1, M '} ), (Type2, {UK _{j, i, m} } _{(j, i) ∈I2, M'} ), (Type3, {UK _{j, i, m} } _{(j, i) ∈I3M '} ))

(13) The data ownership terminal sends the update key UK _m to the cloud server. Once the cloud server receives the update key UK _m , it will update the old policy according to the policy parameters in UK _m and run the ciphertext update algorithm CTUpdate , Update the corresponding ciphertext of each attribute.

Three, cipher text update

CTUpdate (CT, UK _m ): cipher text update. Once the cloud server receives the update key UK _m , it will use the old ciphertext CT and the update key UK _m as inputs. Run the CTUpdate algorithm to update the corresponding attribute ciphertext.

If Type1 (j ∈ _{I 1, M '} ), the updated ciphertext C' _{j is} calculated as:

Where r _j = r _i , which is consistent with the original ciphertext, and the encrypted information EnInfo (m) is retained during the encryption operation of the data m, and includes all random numbers r _i , EnInfo (m) = {r ₁ , .. ., r _n }.

If Type2 (j ∈ I _{2, M '} ), the updated ciphertext C' _{j is} calculated as:

Where r _j = a _j r _i .

If Type3 (j ∈ I _{3, M '} ), the updated ciphertext C' _{j is} calculated as:

The final new ciphertext CT 'is constructed as:

Further, in this embodiment, the file update is introduced in the CP-ABE scheme with policy update. The original intention of introducing file update lies in two points: One is that in actual applications, files of the same type usually need to be updated For example, a report is revised through version one and version two ... repeatedly to produce the final version; the second is that in the process of policy update, the secret value s of data m remains unchanged, which will bring There are security risks. Therefore, the secret value s needs to be improved in the scheme design.

FileUpdate: File update. The significance of file update is that in real life, the information usually needs to be updated. For files of the same type, once the file is modified, you need to reset the access permissions to encrypt the operation, and upload the new ciphertext generated to the cloud server. Every encryption of the data ownership terminal will cause a large calculation overhead, so it is necessary to explore the significance of the file update.

Considering the file update and policy update schemes proposed later, file update refers to updating file m and secret value s. The algorithm is described as follows:

UpdateFile (PK, (M ', ρ'), m '): update files and secret values. The data-owning terminal takes as input the public parameters PK, the new file m 'and the LSSS access control strategy (M', ρ '), where the function of the function ρ' in the access control strategy (M ', ρ') is included in the matrix M ' Each line of the is mapped one by one with the attributes. Finally, the UpdateFile algorithm outputs the ciphertext CT _ms .

Where M is the l × n matrix and l is the number of ciphertext attributes. Select random number s' and random vector before updating file

Where y ₂ , ..., y _n are for sharing the secret value s' of the encryption index. Then calculate

Where M _i is the i-th row of the matrix M corresponding to the vector. Finally, a random number r ₁ ', ..., r _l ' ∈Z _p and an attribute mask λ ₁ ”, ..., λ _l ” ∈ Z _{p are} generated. Calculate the ciphertext:

among them

Finally upload the CT _ms to the cloud server.

Further, in order to solve the problem of excessive calculation overhead and communication overhead, a scheme for updating files and adding strategies is designed, which is mainly divided into three schemes:

(1) The file is updated and the strategy remains unchanged (Scheme1)

In Scheme1, first run the Encrypt algorithm, and obtain the access control strategy (M, ρ) and secret value s, then run the UpdateFile algorithm, and generate the ciphertext CT _m , and finally upload it to the cloud server.

For example, a user must review every week in a department of a hospital, and the case information may be very different each time after the review, and these case information belong to the same type of file, the difference is the generation time, so they belong to the same access Strategy. The user will encrypt the new case according to the access strategy retained by the previous encryption operation and upload it to the hospital's server, so as to realize the file update.

(2) The file remains unchanged and the strategy is updated (Scheme2)

In Scheme2, first run the UpdateKeyGen algorithm to generate the update key UK _m , and then upload UK _m to the cloud server. Once the cloud server obtains UK _m , the cipher text of the corresponding attribute in the cipher text CT will be updated to finally generate the update password. Text CT '.

For example, the user is in the hospital A, but needs to be referred to the hospital B for personal reasons. The doctor in the hospital B needs to view the user's case information. At this time, the user can open the case information in the hospital A to the hospital B by modifying the access policy. The attending doctor, so as to effectively carry out treatment and reduce the user's overhead.

(3) File update, strategy update (Scheme3)

In Scheme3, first run the UpdateFile algorithm to generate the ciphertext CT _ms and upload it to the cloud server, and then run the UpdateKeyGen algorithm on the data ownership terminal, according to the access control strategy (M ', ρ') in the ciphertext CT _ms Update the LSSS access policy and upload the updated key UK _{m '} to the cloud server. Once the cloud server obtains the UK _m' , the cipher text of the corresponding attribute in the cipher text CT _ms will be updated to finally generate the updated cipher text CT ′ _ms .

Which calculates the updated ciphertext CT ′ _ms :

The policy update method based on CP-ABE provided by the embodiment of the present invention includes: the data ownership terminal encrypts the target data using a preset encryption algorithm, and uploads the generated ciphertext to the cloud server, and if necessary, the above ciphertext When the policy is updated, an update key is generated based on the new access policy in the data possession terminal, and the update key is uploaded to the cloud server; the cloud server uses the received update key to update the ciphertext. Compared with the prior art, by entrusting the ciphertext update in the data ownership terminal to the cloud server in the present invention, the data ownership terminal no longer needs to perform calculations related to the ciphertext update, which can effectively reduce the data ownership terminal The amount of calculation in the computer, as well as reducing the communication overhead between the data ownership terminal and the cloud server.

Further, in order to better illustrate the beneficial effects that the present invention can achieve, the security of the above method is demonstrated by selecting the plaintext attack (Chosen Plaintext Attack, CPA) security game and the decision q-parallel BDHE hypothesis, in which the CPA security game It is based on the CP-ABE scheme.

First, the following briefly introduces CPA security games.

In the efficient policy update and file update CP-ABE scheme, it is known that the user private key SK is associated with the attribute set, and the ciphertext CT is associated with the access structure established by the data ownership terminal. According to known conditions, in the formulated security model, first, adversary A needs to select the access structure A ^* to be challenged. If the attribute set associated with the user's private key SK does not satisfy A ^* , then the adversary can obtain all SK. In the next CPA security game, it is assumed that both the challenger and the adversary are transmitting in a completely secure channel in the process of exchanging information.

SystemInit: Adversary A selects the access structure A ^{* of the} challenge and transmits A ^* to the challenger

Setup: During the system initialization phase, the challenger

First run the Setup algorithm in the scheme, then generate the system public key PK, and finally send the PK to the opponent A.

Query Phase1: In the first phase of inquiry, the attribute set selected by adversary A is defined as

And to the challenger

Ask the user for the private key SK repeatedly. At the same time, if the challenger

After receiving the inquiry, it will run the KeyGen algorithm of the scheme, and finally send the generated SK to the opponent A.

Challenge: In the challenge phase, adversary A first asks the challenger

Submit two equal-length messages m ₀ , m ₁ ∈G _T , and then the challenger

Randomly select a bit μ∈ {0,1}, and run the Encrypt algorithm in the scheme at the same time. When encrypting, use A ^{* to} encrypt m _μ . Last challenger

Send the encrypted ciphertext CT ^* to adversary A.

Query Phase2: Same process as the query phase of Query Phase1, the only difference is that the private key SK queried by adversary A does not satisfy A ^* .

Guess: In the guess phase, adversary A first outputs the guess value

Then judge the guess value:

Then adversary A wins the security game. In this game, the probability that opponent A can win the safety game is

Lemma: If there is no probabilistic polynomial time (PPT) adversary who can break the above-mentioned CPA security game with a non-negligible advantage, then the scheme is safe.

The following is the safety certificate:

Theorem: Assuming that the decision-making q-parallel BDHE assumption holds, then there is no probabilistic polynomial time adversary can selectively destroy the challenge of the proposed efficient strategy update and file update in the CP-ABE scheme with a matrix size of l ^* × n ^* , where l ^* , n ^* ≤q.

Proof: In the CPA security game of efficient strategy update and file update CP-ABE scheme, it is assumed that opponent A has a non-negligible advantage ε = Adv _A can break the above scheme. Furthermore, suppose adversary A chooses a challenging matrix M ^* , where the dimension of matrix M ^* is at least q. Then, build a simulator B, which can decide the problem of q-parallel BDHE.

SystemInit: Simulator B needs a q-parallel BDHE to challenge y, T. Adversary A gives the algorithm's challenge access structure (M ^* , ρ ^* ), where the matrix M ^* has n ^* columns.

Setup: In the system initialization phase, Simulator B chooses a random number α'∈Z _p and writes α = α ′ + α ^{q + 1} . The simulator calculates e (g, g) ^α as follows: e (g, g) ^α = e (g ^a , g ^aq ) e (g, g) ^{α ′} .

Describe the group elements h ₁ , ..., h _U ∈G in the “item” of Simulator B. The random oracle predictor maps the elements of the attribute domain U to h ₁ , ..., h _U ∈G, and is defined as U = {h ₁ , ..., h _U }, where the elements correspond one-to-one with the attributes contained in the attribute field U. For each attribute x, where the range of x 1 ≤ x ≤ U, first select a random value z _x . Let X be the index i of the set, for example, ρ ^* (i) = x. The h _{x of} Simulator B is as follows:

There are two points to note in the above expression: 1) If

Make

) The random distribution of parameters is due to

Value.

Query Phase1: In the first phase of the query, Simulator B repeatedly asks the user's private key SK through the query. Assume that the simulator B can obtain a set of attribute sets S by querying for SK, but S does not satisfy the LSSS matrix M ^* .

Simulator B first selects the random number r ∈ Z _p and the vector

Then define ω ₁ as ω ₁ = -1, and finally satisfy ρ ^* (i) ∈S for all i so that it satisfies the equation

According to the definition of the LSSS matrix, the vector ω must exist in the matrix. If this vector does not exist, then the vector (1,0,0, ..., 0) will exist in the span of the attribute set S.

Simulator B starts by implicitly defining t:

The above expression can be set by

To execute.

After observation t is predefined, where g ^at contains

Items, so that the unknown items can cancel each other and generate K at the same time. Simulator B calculates K as follows:

Next need to calculate

First, considering that there is no i in x ∈ S such that ρ ^* (i) = x, for these cases we simplify the setting such that

Then, the more difficult task is to create a key component K _x for all attributes _{x ∈ S} , where attribute x is the access structure used. For these keys, make sure that

The form is simulated. able to pass

All of the above terms are canceled out, and X is set to the set of all i so that it satisfies the equation ρ ^* (i) = x. Simulator B generates K _x as follows:

Challenge: In the challenge phase, this embodiment establishes a challenge ciphertext. Adversary A first submits two messages of equal length m ₀ , m ₁ ∈G _{T to} Simulator B, then Simulator B randomly selects a bit

Through the Encrypt algorithm of the scheme, C = m _β T · e (g ^s , g ^{α ′} ) and C ′ = g ^s are generated. The next most difficult part is to simulate C _i because the items included inside need to cancel each other out. However, Simulator B can choose a secret split, which can offset the internal terms. Simulator B will choose a random number based on his feeling

And share the secret value vector

In addition to this, the simulator B selects the random values r ₁ ', ..., r _l '.

For i = 1, ..., n ^* , we define R _i as the set of all k ≠ i, for example, ρ ^* (i) = ρ ^* (k). In other words, all other rows in the set are marked as row i with the same attributes, and then the parts in the challenge ciphertext are generated:

Query Phase2: The process is the same as Query Phase1 and will not be described in detail here.

Guess: In the guessing phase, adversary A finally outputs a guess

First, the simulator B judges the conjecture by the output result: if 0 is output, then β = β ', then

Output 1 indicates that it considers T to be a random element on group G _T.

If T = e (g, g) ^abc , then the challenge ciphertext is an effective ciphertext, where the advantage of adversary A is Adv _A , as shown below:

If T is a random element on the group G _T , it means that the challenge ciphertext is a completely random ciphertext. Opponent A has

Therefore, Simulator B has an advantage that cannot be ignored in decision-making q-parallel BDHE games.

In summary, through the CPA security game and decision-making q-parallel BDHE hypothesis, it can prove that the efficient strategy update and file update CP-ABE scheme is safe.

The above is a description of a CP-ABE-based policy update method and system provided by the present invention. For those skilled in the art, according to the ideas of the embodiments of the present invention, there will be changes in specific implementation and application scope In summary, the content of this specification should not be construed as limiting the invention.

Claims

A policy update method based on CP-ABE, characterized in that the method includes:

The data ownership terminal encrypts the target data using a preset encryption algorithm and uploads the generated ciphertext to the cloud server;

The data ownership terminal generates an update key based on the new access policy in the data ownership terminal, and uploads the new access policy and the update key to the cloud server;

The cloud server uses the received new access policy and the update key to update the ciphertext.
The method of claim 1, wherein the step of updating the ciphertext by the cloud server using the received new access policy and the update key includes:

Using the new access policy to update the LSSS matrix of the old access policy corresponding to the ciphertext;

Use the updated LSSS matrix, the update key, and the preset ciphertext update algorithm to perform policy update on the ciphertext to generate a new ciphertext.
The method of claim 2, wherein the step of generating an update key based on the new access policy in the data possession terminal includes:

The data possession terminal uses the encrypted information in the target data, the new access policy, and the old access policy to run a preset key update algorithm to generate the update key.
The method of claim 1, wherein the method further comprises:

When the data owner terminal needs to update the ciphertext file, the new data in the data owner terminal is encrypted using the access policy corresponding to the ciphertext, and the generated new ciphertext is uploaded to the Cloud server.
The method according to claim 4, wherein the step of encrypting new data in the data-owning terminal using the access policy corresponding to the ciphertext includes:

The new data is encrypted by using the access strategy and secret value corresponding to the ciphertext, and the preset update file and secret value algorithm to generate the new ciphertext.
The method according to any one of claims 1 to 5, wherein the method further comprises:

When the data ownership terminal needs to update the ciphertext and file at the same time, it uses the access policy and secret value corresponding to the ciphertext, as well as a preset update file and secret value algorithm to update the new data Encrypt, and upload the generated new ciphertext to the cloud server;

Generate an update key based on the new access policy in the data possession terminal, and upload the new access policy and the update key to the cloud server; wherein, the cloud server receives the new ciphertext After the new access policy and the updated key are used, the new ciphertext is updated using the new access policy and the updated key.
A policy update system based on CP-ABE, characterized in that the system includes a data ownership terminal and a cloud server, and the data ownership terminal is in communication connection with the cloud server;

The data possession terminal is used to encrypt the target data using a preset encryption algorithm, upload the generated ciphertext to the cloud server, and when it is necessary to update the ciphertext policy, based on the data possession The new access policy in the terminal generates an update key, and uploads the new access policy and the update key to the cloud server;

The cloud server is used to update the ciphertext using the received new access policy and the update key.
The system according to claim 7, wherein the system further includes a data usage terminal, the data usage terminal is in communication connection with the cloud server, and the data usage terminal is used to download the ciphertext from the cloud server And decrypt it.
The system according to claim 8, wherein the system further comprises an attribute authorization terminal, the attribute authorization terminal is in communication with the data usage terminal and the data ownership terminal, and the attribute authorization terminal is used for Generate a public key and a private key corresponding to the system, and generate a user private key corresponding to the data usage terminal.