WO2022120699A1

WO2022120699A1 - One-way proxy re-encryption method and apparatus, and electronic device and system

Info

Publication number: WO2022120699A1
Application number: PCT/CN2020/135204
Authority: WO
Inventors: 韦家全; 张鹏; 刘宏伟
Original assignee: 深圳大学
Priority date: 2020-12-10
Filing date: 2020-12-10
Publication date: 2022-06-16

Abstract

A one-way proxy re-encryption method and apparatus, and an electronic device and a system, which relate to the technical field of proxy re-encryption. The method comprises: acquiring a first private key and plaintext data (S11); generating a first ciphertext (S12) on the basis of the first private key and the plaintext data, wherein the first ciphertext comprises a plurality of ciphertext parameters; generating a re-encryption key according to the first private key and preset ciphertext parameters in the first ciphertext (S13); and sending the first ciphertext and the re-encryption key to an agent party, such that the agent party converts, by using the re-encryption key, the first ciphertext into a second ciphertext under a second public key of an authorized party (S14). By means of a re-encryption key, a first ciphertext of an authorizing party can only be converted into a second ciphertext of an authorized party, and a first ciphertext of the authorized party cannot be converted into a second ciphertext of the authorizing party, thereby realizing one-way re-encryption; and when plaintext data changes, each ciphertext parameter also changes accordingly, and when under a collusion attack, no additional plaintext is exposed, thereby ensuring a strong capability to resist collusion attacks.

Description

One-way proxy re-encryption method, device, electronic device and system

technical field

The present invention relates to the technical field of proxy re-encryption, and in particular to a one-way proxy re-encryption method, device, electronic device and system.

Background technique

Proxy Re-Encryption (PRE for short) is a public key encryption system that allows ciphertext to be securely converted. Its concept was proposed by Blaze et al. Typically, the main body of the scheme includes a delegate (Delegator), a delegate (Delegatee) and a proxy (Proxy). The scheme is described by a probabilistic polynomial algorithm: PRE={Setup, KeyGen, Enc, Re KeyGen, Re Enc, Dec}. Among them, the authorizer executes the Setup algorithm to generate public parameters, the authorizer and the authorized party execute the KeyGen algorithm to generate their own public and private keys, the authorizer executes the Enc algorithm to encrypt data to generate the first ciphertext, and executes the ReKeyGen algorithm to be authorized The agent generates the re-encryption key, the agent knows the re-encryption key and the first ciphertext and executes the Re Enc algorithm to generate the second ciphertext, and the authorized party uses its own private key to execute the Dec algorithm to decrypt the second ciphertext. As a result, the authorizing party transfers the decryption authority to the authorized party, and proxy re-encryption is widely used in cloud computing data security, data fair transaction protocols, etc.

According to the ciphertext conversion ability of proxy re-encryption key, it can be divided into bidirectional proxy re-encryption (Bidirectional PRE) and unidirectional proxy re-encryption (Unidirectional PRE). Two-way proxy re-encryption means that the proxy can use the re-encryption key to not only convert the ciphertext under the authorized party's public key into the ciphertext under the authorized party's public key, but also convert the ciphertext under the authorized party's public key. It is the ciphertext under the authorized party's public key. In one-way proxy re-encryption, the proxy can only convert the ciphertext under the authorizer's public key into the ciphertext under the authorized party's public key by using the re-encryption key. Obviously, proxy re-encryption in one direction prevents the proxy party from performing ciphertext transformation in the other direction without permission.

In the existing one-way proxy re-encryption method, the re-encryption key generated by the authorizer depends on the authorizer's private key, and the re-encryption key is sent to the proxy party. The first ciphertext generates the second ciphertext, and the second ciphertext is sent to the authorized party for decryption. However, in this technical solution, if the agent and the authorized party collude, although the agent and the authorized party cannot obtain the private key of the authorized party, they can decrypt the first password generated by other authorized parties using this private key. Therefore, the anti-collusion attack ability of the one-way proxy re-encryption method is weak.

SUMMARY OF THE INVENTION

In view of this, embodiments of the present invention provide a one-way proxy re-encryption method, device, electronic device and system to solve the problem that the existing one-way proxy re-encryption method has weak anti-collusion attack capability.

According to a first aspect, an embodiment of the present invention provides a one-way proxy re-encryption method, the method comprising:

Obtain the first private key and plaintext data;

generating a first ciphertext based on the first private key and the plaintext data, where the first ciphertext includes a plurality of ciphertext parameters;

generating a re-encryption key according to the first private key and preset ciphertext parameters in the first ciphertext;

Send the first ciphertext and the re-encryption key to the agent, so that the agent uses the re-encryption key to convert the first ciphertext into the second public key of the authorized party. the second ciphertext.

In the one-way proxy re-encryption method provided by the embodiment of the present invention, since the re-encryption key is generated based on the first private key and the preset ciphertext parameters in the first ciphertext, the re-encryption key can only be used for A ciphertext is converted into the second ciphertext of the authorized party, but the first ciphertext of the authorized party cannot be converted into the second ciphertext of the authorized party, that is, the re-encryption key can only realize the conversion in one direction , thereby realizing one-way re-encryption; since the first ciphertext is generated based on the first private key and plaintext data, correspondingly, multiple ciphertext parameters in the first ciphertext are related to the first private key and plaintext data, when When the plaintext data changes, each ciphertext parameter will also change accordingly. Even if the authorized party colludes with the agent, they can learn the parameters in a first ciphertext, but since the first ciphertext is also related to the plaintext data, the learned parameters can be used. The plaintext corresponding to the other first ciphertext cannot be decrypted either. Therefore, under the collusion attack, no additional plaintext is exposed, which ensures a strong anti-collusion attack capability.

With reference to the first aspect, in a first implementation manner of the first aspect, generating the first ciphertext based on the first private key and the plaintext data includes:

Obtain common parameters, which are represented as param=(p,q,g,H ₁ ,H ₂ ,H ₃ ,l ₀ ,l ₁ );

Using the first private key, the plaintext data, and the public parameters, generate a first ciphertext parameter, and the first private key _ski is expressed as _{ski =(sk i1} _, sk _i2 )=(x _i1 , x _i2 );

Using the first ciphertext parameter, the first private key and the public parameter to generate a second ciphertext parameter;

Using the second ciphertext parameter and the public parameter to generate a third ciphertext parameter to obtain the first ciphertext;

in,

and

is a set of non-negative and non-zero integers less than p and q, p and q are preset prime numbers, respectively, requiring q|p-1, the bit length of q is l _q , and H ₁ , H ₂ and H ₃ are the first The hash function, the second hash function, and the third hash function are expressed as

l ₀ and l ₁ are message lengths, and g is

The generator of the q-order subgroup G of .

In the one-way proxy re-encryption method provided by the embodiment of the present invention, since the second ciphertext parameter is generated based on the first ciphertext parameter, and the third ciphertext parameter is generated based on the second ciphertext parameter, the third ciphertext parameter is generated based on the second ciphertext parameter. There is an association relationship between various ciphertext parameters in a ciphertext. When one ciphertext parameter changes, other ciphertext parameters will also change accordingly, which improves the security of the first ciphertext.

With reference to the first embodiment of the first aspect, in the second embodiment of the first aspect, the first ciphertext is generated by the following method:

choose randomly

Calculate r=H ₁ (m,w);

calculate

D=V ^u , E=V ^r , s=u+r·H ₃ (D,E,F)mod q;

outputting the first ciphertext CT _i =(D, E, F, V, s);

Among them, the plaintext data of m is expressed as

F is the first ciphertext parameter, V is the second ciphertext parameter, and E is the third ciphertext parameter.

In the one-way proxy re-encryption method provided by the embodiment of the present invention, the index of the second ciphertext parameter changes with the first ciphertext parameter, and the third hash function is used in the index of the second ciphertext parameter to convert the first ciphertext parameter to the first ciphertext parameter. The private key is hidden to ensure that the first private key will not be exposed; and the first ciphertext parameter changes with the plaintext data, so the index in the second ciphertext parameter will change every time the first ciphertext is generated. Therefore, when the authorized party colludes with the agent, it is still impossible to use the index value of the second ciphertext parameter in a certain first ciphertext to decrypt the plaintexts corresponding to other first ciphertexts, which improves the ability to resist collusion attacks. .

With reference to the first embodiment of the first aspect or the second embodiment of the first aspect, in the third embodiment of the first aspect, the preset ciphertext parameter is the first ciphertext parameter, and the A private key and preset ciphertext parameters in the first ciphertext to generate a re-encryption key, including:

Receive ciphertext conversion request information sent by the authorized party, where the ciphertext conversion request information includes the second public key, a first verification parameter, and a second verification parameter, where the first verification parameter is generated based on a public parameter , the second verification parameter is generated based on the first public key and the second private key, and the first public key pk _i is expressed as

The second public key pk _j is expressed as

The second private key is expressed as sk _j =(sk _j1 ,sk _j2 )=(x _j1 ,x _j2 ), and the first verification parameter g ₂ is expressed as: ^g ₂ =gh , wherein,

The second verification parameter δ is expressed as:

The re-encryption key is generated based on the ciphertext conversion request information, the first private key, and the first ciphertext parameter.

In the one-way proxy re-encryption method provided by the embodiment of the present invention, the authorizing party generates a re-encryption key according to the ciphertext conversion request information sent by authorization, so that the method can be applied when the authorizing party cannot actively select the authorized party, and It is an occasion when passively waiting for an authorized party to initiate a request. For example, in a fair data transaction, this method can be called a one-way passive proxy re-encryption method.

With reference to the third implementation of the first aspect, in the fourth implementation of the first aspect, the re-encryption is generated based on the ciphertext conversion request information, the first private key and the first ciphertext parameter keys, including:

calculate

Determine whether g ^h′ = g ₂ is established;

When g ^h′ = g ₂ is established, calculate

output the re-encryption key

The one-way proxy re-encryption method provided by the embodiment of the present invention uses the parameter corresponding to the index in the second ciphertext parameter to generate the parameter of the re-encryption key. If the authorized party and the proxy party conspire to obtain the authorized party's private key, The authorized party and the agent can only obtain the overall value of H ₃ [(x _i1 +F)·x _i2 ]mod q in the re-encryption key. Thanks to the characteristics of the hash function, this value cannot be deduced inversely. The input (x _i1 +F)·x _i2 of the three-hash function H ₃ is the specific value, and the specific value of the first private key cannot be deduced. Therefore, the third hash function is used in the second ciphertext parameter and the re-encryption key. The use in the construction ensures that the first private key will not be exposed; because the construction of the first verification parameter and the second verification parameter ensures that the authorized party can generate the correct ciphertext conversion request for the authorized party only after the authorized party correctly calculates the ciphertext conversion request. If the authorized party maliciously submits incorrect first verification parameters and second verification parameters, it will be detected immediately, ensuring that the output re-encryption key is correct and is for the authorized party. square generated.

According to a second aspect, an embodiment of the present invention further provides a one-way proxy re-encryption method, the method comprising:

Receive the first ciphertext and re-encryption key sent by the authorized party, where the first ciphertext is generated based on the first private key of the authorized party and plaintext data, and the re-encryption key is based on the first The private key and the preset ciphertext parameters in the first ciphertext are generated;

The first ciphertext is converted into a second ciphertext under the authorized party's second public key based on the re-encryption key, so that the authorized party decrypts the second ciphertext to obtain the plaintext data.

With reference to the second aspect, in the first embodiment of the second aspect, the first private key ski is expressed as _{ski =(sk i1} _, sk _i2 )=(x _i1 , x _i2 ₎ , the first public key pk _i Expressed as

The second public key pk _j is expressed as

The second private key is represented as sk _j =(sk _j1 ,sk _j2 )=(x _j1 ,x _j2 );

The first ciphertext CT _i is expressed as CT _i =(D, E, F, V, s),

D=V ^u , E=V ^r , s=u+r·H ₃ (D,E,F)mod q,

r=H ₁ (m, w), m is the plaintext data, F is the first ciphertext parameter, V is the second ciphertext parameter, and E is the third ciphertext parameter;

the re-encryption key

Expressed as:

is a set of non-negative and non-zero integers less than q, q is a preset prime number, the bit length of q is l _q , H ₂ and H ₃ are the second hash function and the third hash function, respectively, expressed as

l ₀ and l ₁ are message lengths, and g is

The generator of the q-order subgroup G of ;

Wherein, converting the first ciphertext based on the re-encryption key into a second ciphertext under the authorized party's second public key, so that the authorized party performs a Decryption to obtain the plaintext data, including:

The correctness of the re-encryption key is verified by using the second ciphertext parameter, the re-encryption key and the first verification parameter, and the first verification parameter g ₂ is expressed as g ₂ =g ^h , wherein,

When the verification of the re-encryption key is passed, the first ciphertext is converted into the second public key of the authorized party based on the first ciphertext, the re-encryption key and the first verification parameter The second ciphertext below.

In the one-way proxy re-encryption method provided by the embodiment of the present invention, the construction of the re-encryption key and the first verification parameter provides a basis for the verification of the re-encryption key, and ensures the reliability of the re-encryption key verification; After the re-encryption key is verified, the first ciphertext is converted, which improves the reliability of the one-way proxy re-encryption method.

With reference to the first embodiment of the second aspect, in the second embodiment of the second aspect, the second ciphertext parameter, the re-encryption key, and the first verification parameter are used to verify the re-encryption key's validity. correctness, including:

Judgment Equation

whether it is established;

when the equation

When established, it is determined that the re-encryption key verification is passed.

With reference to the first embodiment of the second aspect, or the second embodiment of the second aspect, in the third embodiment of the second aspect, the first ciphertext, the re-encryption key, and the first verification are based on parameter to convert the first ciphertext into the second ciphertext under the authorized party's second public key, including:

Judgment Equation

whether it is established;

when the equation

When established, calculate

The converted second ciphertext CT _j =(E',F,δ,g ₂ ) is output.

According to a third aspect, an embodiment of the present invention further provides a one-way proxy re-encryption method, the method comprising:

Obtain the second private key, the second public key, the first public key of the authorizing party and the public parameters, the second private key sk _j is represented as sk _j =(sk _j1 ,sk _j2 )=(x _j1 ,x _j2 ) , the second public key pk _j is expressed as

The first public key pk _i is expressed as

The common parameter is expressed as param=(p,q,g,H ₁ ,H ₂ ,H ₃ ,l ₀ ,l ₁ );

Using the public parameter to generate a first verification parameter, and using the first public key and the second private key to generate a second verification parameter;

generating ciphertext conversion request information based on the first verification parameter, the second verification parameter and the first public key;

sending the ciphertext conversion request information to the authorizing party;

Receive the second ciphertext sent by the agent, where the second ciphertext is obtained by converting the first ciphertext using the re-encryption key, and the first ciphertext is based on the first private key of the authorizing party and the plaintext data is generated, and the re-encryption key is generated based on the first private key and preset ciphertext parameters in the first ciphertext;

Decrypt the second ciphertext using the second private key to obtain the plaintext data;

in,

and

l ₀ and l ₁ are message lengths, and g is

The generator of the q-order subgroup G of .

With reference to the third aspect, in the first implementation manner of the third aspect, the generating a first verification parameter by using the public parameter, and generating a second verification parameter by using the first public key and the second private key, including :

choose randomly

and calculating the first verification parameter g ₂ : g ₂ =g ^h ;

Calculate the second verification parameter δ:

In the one-way proxy re-encryption method provided by the embodiment of the present invention, the special structure of δ enables the authorized party to specify an important value h, and in an open environment, only the authorized party can use its own private key to decrypt and extract h, and other irrelevant The party cannot know h, and this h is an important part of the re-encryption key, thus ensuring the reliability of the re-encryption key.

With reference to the first embodiment of the third aspect, in the second embodiment of the third aspect, the second ciphertext CT _j is expressed as CT _j =(E′,F,δ,g ₂ ),

E=V ^r , r=H ₁ (m,w),

g ₂ =g ^h ,

the re-encryption key

Expressed as

The decrypting the second ciphertext by using the second private key to obtain the plaintext data includes:

calculate

Judgment Equation

whether it is established;

when the equation

When established, the plaintext data m is output.

According to a fourth aspect, an embodiment of the present invention further provides a one-way proxy re-encryption device, the device comprising:

an acquisition module for acquiring the first private key and plaintext data;

a first ciphertext generating module, configured to generate a first ciphertext based on the first private key and the plaintext data, where the first ciphertext includes a plurality of ciphertext parameters;

a re-encryption key generation module, configured to generate a re-encryption key according to the first private key and preset ciphertext parameters in the first ciphertext;

a first sending module, configured to send the first ciphertext and the re-encryption key to an agent, so that the agent uses the re-encryption key to convert the first ciphertext into an authorized The second ciphertext under the party's second public key.

According to a fifth aspect, an embodiment of the present invention further provides a one-way proxy re-encryption device, the device comprising:

The first receiving module is configured to receive the first ciphertext and the re-encryption key sent by the authorizing party, where the first ciphertext is generated based on the first private key of the authorizing party and the plaintext data, and the re-encrypting ciphertext is generated based on the first private key of the authorizing party and the plaintext data. The key is generated according to the first private key and preset ciphertext parameters in the first ciphertext;

A ciphertext conversion module, configured to convert the first ciphertext into a second ciphertext under the second public key of the authorized party based on the re-encryption key, so that the authorized party can understand the second ciphertext The ciphertext is decrypted to obtain the plaintext data.

According to a sixth aspect, an embodiment of the present invention further provides a one-way proxy re-encryption device, the device comprising:

The second obtaining module is used to obtain the second private key, the second public key, the first public key of the authorizing party and the public parameters, and the second private key sk _j is represented as sk _j =(sk _j1 ,sk _j2 )= (x _j1 ,x _j2 ), the second public key pk _j is expressed as

The first public key pk _i is expressed as

a verification parameter generation module, configured to generate a first verification parameter by using the public parameter, and generate a second verification parameter by using the first public key and the second private key;

a ciphertext conversion request generation module, configured to generate ciphertext conversion request information based on the first verification parameter, the second verification parameter and the first public key;

a second sending module, configured to send the ciphertext conversion request information to the authorizing party;

The second receiving module is configured to receive the second ciphertext sent by the agent, where the second ciphertext is obtained by converting the first ciphertext by using a re-encryption key, and the first ciphertext is based on the authorizing party The first private key and the plaintext data are generated, and the re-encryption key is generated based on the first private key and the preset ciphertext parameters in the first ciphertext;

a decryption module, configured to decrypt the second ciphertext by using the second private key to obtain the plaintext data;

in,

and

l ₀ and l ₁ are message lengths, and g is

The generator of the q-order subgroup G of .

According to a seventh aspect, an embodiment of the present invention provides an electronic device, including: a memory and a processor, the memory and the processor are connected in communication with each other, the memory stores computer instructions, and the processor By executing the computer instructions, the first aspect or any embodiment of the first aspect is executed, or the second aspect or any embodiment of the second aspect is executed, or the third aspect or the third aspect is executed The one-way proxy re-encryption method described in any one of the embodiments of .

According to an eighth aspect, an embodiment of the present invention provides a computer-readable storage medium, where the computer-readable storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute the first aspect or any one of the first aspect. An implementation manner, or, implements the second aspect or any implementation manner of the second aspect, or implements the one-way proxy re-encryption method described in the third aspect or any implementation manner of the third aspect.

According to a ninth aspect, an embodiment of the present invention further provides a one-way re-encryption system, the system comprising:

an authorizing party, used to execute the first aspect of the present invention, or the one-way proxy re-encryption method described in any embodiment of the first aspect;

a proxy party, connected to the authorized party, for executing the second aspect of the present invention, or the one-way proxy re-encryption method described in any embodiment of the second aspect;

An authorized party, connected with the authorized party, is used to execute the third aspect of the present invention, or the one-way proxy re-encryption method described in any embodiment of the third aspect.

Description of drawings

In order to illustrate the specific embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the specific embodiments or the prior art. Obviously, the accompanying drawings in the following description The drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative efforts.

1 shows a structural diagram of a one-way proxy re-encryption system in an embodiment of the present invention;

2 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention;

3 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention;

4 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention;

5 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention;

6 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention;

7 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention;

8 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention;

9 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention;

10 is a structural block diagram of a one-way proxy re-encryption apparatus according to an embodiment of the present invention;

11 is a structural block diagram of a one-way proxy re-encryption apparatus according to an embodiment of the present invention;

12 is a structural block diagram of a one-way proxy re-encryption apparatus according to an embodiment of the present invention;

FIG. 13 is a schematic diagram of a hardware structure of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts shall fall within the protection scope of the present invention.

An embodiment of the present invention provides a one-way proxy re-encryption system. As shown in FIG. 1 , the system includes an authorizer, an authorized party, and an agent. The authorizing party generates a re-encryption key, and sends the re-encryption key and the first ciphertext to the agent, and the agent uses the re-encryption key to convert the first ciphertext into the authorized The second ciphertext that the second public key can decrypt. Among them, the algorithm structure of the first ciphertext, the re-encryption key and the ciphertext conversion is improved in the system, so that the system has a higher anti-collusion attack capability.

Further, the authorized party in the system is also used to generate ciphertext conversion request information, and send the ciphertext conversion request information to the authorized party, and the authorized party only receives the ciphertext conversion request information sent by the authorized party. The re-encryption key is generated. Based on this, the one-way proxy re-encryption system described in this system can also be called a one-way passive proxy re-encryption system.

The authorizer sends the generated re-encryption key and the first ciphertext to the agent, and the agent verifies the correctness of the re-encryption key before converting the first ciphertext. After the re-encryption key is verified correctly, the first ciphertext is converted into the second ciphertext under the authorized party's second public key.

Among them, the specific configuration will be described in detail below. In the embodiments corresponding to the one-way proxy re-encryption method described below, the one-way proxy re-encryption method is described in detail from the perspectives of the authorizer, the proxy, and the authorized party, respectively.

According to an embodiment of the present invention, an embodiment of a one-way proxy re-encryption method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer-executable instructions, and , although a logical order is shown in the flowcharts, in some cases steps shown or described may be performed in an order different from that herein.

This embodiment provides a one-way proxy re-encryption method, which can be used for the above-mentioned authorized parties, such as computers, mobile phones, tablet computers, etc. FIG. 2 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention , as shown in Figure 2, the process includes the following steps:

S11, obtain a first private key and plaintext data.

Wherein, the first private key is generated by the authorizing party using a key generation algorithm, and what is generated by the authorizing party includes the first private key and the first public key. In this embodiment, the specific manner of generating the first private key and the first public key is not limited, and specific settings may be made according to actual conditions.

The authorizing party needs to encrypt the plaintext data to generate the first ciphertext, and send the first ciphertext to the agent, so that the agent converts it and then sends it to the authorized party for decryption. There is no restriction on the way that the authorized party obtains the plaintext data, and the specific way of obtaining the data can be selected according to the actual situation.

S12, based on the first private key and the plaintext data, generate a first ciphertext.

Wherein, the first ciphertext includes a plurality of ciphertext parameters.

After generating the first private key in the above S11, the authorizing party uses the first private key to perform algorithmic processing on the plaintext data to generate the first ciphertext. The first ciphertext may be obtained by directly using the first private key to perform algorithmic processing on the plaintext data, or may be obtained by the authorizing party using the first private key and other parameters (for example, public parameters generated by the authorizing party) It is obtained by performing algorithm processing on the plaintext data, which is not specifically limited here, it only needs to ensure that the formation of the first ciphertext depends on the first private key and the plaintext data.

The first ciphertext generated by the authorizer is composed of multiple ciphertext parameters, and there is an association relationship between each ciphertext parameter. For example, the authorizing party first generates the first ciphertext parameter by using the first private key and the plaintext data, and then generates the second ciphertext parameter on the basis of the first ciphertext parameter, and so on. Specifically, this step will be described in detail below.

S13: Generate a re-encryption key according to the first private key and preset ciphertext parameters in the first ciphertext.

As described above, the first ciphertext generated by the authorizing party includes various ciphertext parameters, then the authorizing party generates the re-encryption key by using the preset ciphertext parameters in the first ciphertext and the first private key. For example, the authorizer can use the first private key and the preset ciphertext parameters as parameters of the preset function expression, substitute them into the preset function expression, and use the calculation of the preset function to generate the re-encryption key; The authorizing party may also generate a re-encryption key based on the first private key and the preset ciphertext parameters in combination with other parameters (for example, public parameters generated by the authorizing party).

The specific algorithm structure of the algorithm for generating the re-encryption key is not limited here, as long as it is ensured that the re-encryption key is generated by relying on the first private key and the preset ciphertext parameters in the first ciphertext.

S14: Send the first ciphertext and the re-encryption key to the agent, so that the agent uses the re-encryption key to convert the first ciphertext into the second ciphertext under the authorized party's second public key.

After generating the first ciphertext and the re-encryption key, the authorized party sends it to the agent. The subsequent proxy party converts the first ciphertext by using the re-encryption key, and converts the first ciphertext into a second ciphertext under the authorized party's second public key. This step will be described in detail below, and will not be indexed here.

In the one-way proxy re-encryption method provided by this embodiment, since the re-encryption key is generated based on the first private key and the preset ciphertext parameters in the first ciphertext, the re-encryption key can only The ciphertext is converted into the second ciphertext of the authorized party, but the first ciphertext of the authorized party cannot be converted into the second ciphertext of the authorized party, that is, the re-encryption key can only realize the conversion in one direction, Thus, one-way re-encryption is realized; since the first ciphertext is generated based on the first private key and the plaintext data, correspondingly, multiple ciphertext parameters in the first ciphertext are related to the first private key and the plaintext data. When the data changes, the parameters of each ciphertext will also change accordingly. Even if the authorized party colludes with the agent, they can learn the parameters in a first ciphertext, but since the first ciphertext is also related to the plaintext data, using the learned parameters will also The plaintext corresponding to the other first ciphertext cannot be decrypted. Therefore, under the collusion attack, no additional plaintext is exposed, which ensures a strong anti-collusion attack capability.

This embodiment provides a one-way proxy re-encryption method, which can be used for the above-mentioned authorized parties, such as computers, mobile phones, tablet computers, etc. FIG. 3 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention , as shown in Figure 3, the process includes the following steps:

S21, obtain the first private key and plaintext data.

For example, the authorizing party may use the KeyGen(param) algorithm to generate a first public-private key pair, where the first public-private key pair includes the first private key _{ski and the first public key pk i} _. Specifically, the first public key pair can be generated in the following manner:

(1) Randomly selected

(2) Output sk _i =(sk _i1 ,sk _i2 )=(x _i1 ,x _i2 ),

Among them, param is a common parameter, which can be expressed as param=(p,q,g,H ₁ ,H ₂ ,H ₃ ,l ₀ ,l ₁ ),

and

l ₀ and l ₁ are message lengths, and g is

The generator of the q-order subgroup G of . For example, the authorized party can use the Setup algorithm to generate public parameters.

For other details, please refer to S11 of the embodiment shown in FIG. 2 , which will not be repeated here.

S22, based on the first private key and the plaintext data, generate a first ciphertext.

Wherein, the first ciphertext includes a plurality of ciphertext parameters.

Specifically, the above S22 includes the following steps:

S221, obtain public parameters.

Wherein, the common parameters are expressed as param=(p, q, g, H ₁ , H ₂ , H ₃ , l ₀ , l ₁ ). Optionally, the authorizer may generate public parameters by using the Setup(l _q ) algorithm, where l _q is an input security parameter.

S222, generating a first ciphertext parameter by using the first private key, the plaintext data, and the public parameter.

Wherein, the first private key ski is expressed as _{ski =(sk i1} _, sk _i2 )= ₍ x _i1 , x _i2 ).

S223: Generate a second ciphertext parameter by using the first ciphertext parameter, the first private key and the public parameter.

S224, using the second ciphertext parameter and the public parameter to generate a third ciphertext parameter to obtain the first ciphertext.

The authorizer can use the _Enc (ski,m) algorithm to generate the first ciphertext, and the input of the algorithm is the first private key and plaintext data

specifically,

(1) Randomly selected

Calculate r=H ₁ (m,w);

(2) Calculation

D=V ^u , E=V ^r , s=u+r·H ₃ (D,E,F)mod q;

(3) outputting the first ciphertext CT _i =(D, E, F, V, s);

Among them, the plaintext data of m is expressed as

The index H ₃ [(x _i1 +F)·x _i2 ] in the second ciphertext parameter V varies with the first ciphertext parameter F, and the index H ₃ [(x _i1 + F) x _i2 ] is to use the third hash function H ₃ to hide the first private key s _i , which ensures that the first private key s _i will not be exposed; and the first ciphertext parameter F changes with the plaintext data m , so the index H ₃ [(x _i1 +F)·x _i2 ] in the second ciphertext parameter V will change every time the first ciphertext is generated, and the first private key does not need to be replaced at this time. Therefore, when the authorized party colludes with the agent, it is still impossible to use the index value of the second ciphertext parameter in a certain first ciphertext to decrypt the plaintexts corresponding to other first ciphertexts, which improves the ability to resist collusion attacks. . Specifically, if the authorized party and the agent collude and attempt to obtain the private key of the authorized party, the authorized party and the agent can only obtain H ₃ [(x _i1 +F)·x _i2 ]mod q in the re-encryption key The overall value, thanks to the characteristics of the hash function, has always been unable to infer the specific value of the input (x _i1 +F)·x _i2 of the _third hash function H3, let alone the specific value of the first private key. Numerical value, therefore, the use of the third hash function in the construction of the second ciphertext parameter and the re-encryption key ensures that the first private key is not exposed.

In addition, it should be noted that the structure of the encryption algorithm _Enc (ski ,m) in this case determines the one-way in the one-way proxy re-encryption method. Specifically, in the encryption algorithm Enc(ski ,m), the exponent part of the second ciphertext parameter _V uses a hash function, and the input is not only related to the private key, but also related to the first ciphertext parameter F. In the subsequent ciphertext conversion algorithm ReEnc, use rk _ij to convert the ciphertext parameter E in the first ciphertext:

The above-mentioned F, V and E are part of the first ciphertext of the authorized party i. In addition, denote F, V and E in the first ciphertext belonging to authorized party j as F _j , V _j and E _j respectively, then

At this time, if the agent uses the same re-encryption key rk _ij in an attempt to convert the first ciphertext of the authorized party j itself into a second ciphertext for the authorized party i, the agent performs re-encryption and calculates

Obviously, the two hash functions of the exponent part of this formula cannot be reduced, and the corresponding result in the form of g ^{r h} cannot be obtained, that is to say, one can convert the first ciphertext of the authorizing party i The re-encryption key rk _ij of the ciphertext that can be decrypted by party j cannot convert the first ciphertext of authorized party j into ciphertext that can be decrypted by authorized party i. When this rk _ij can only perform the conversion from authorizer i to authorizer j, but cannot perform the conversion from authorizer j to authorizer i, the proxy re-encryption process is called a one-way proxy. Re-encryption process.

S23: Generate a re-encryption key according to the first private key and preset ciphertext parameters in the first ciphertext.

For details, please refer to S13 of the embodiment shown in FIG. 2 , which will not be repeated here.

S24: Send the first ciphertext and the re-encryption key to the agent, so that the agent uses the re-encryption key to convert the first ciphertext into the second ciphertext under the authorized party's second public key.

For details, please refer to S14 of the embodiment shown in FIG. 2 , which will not be repeated here.

In the one-way proxy re-encryption method provided by this embodiment, since the second ciphertext parameter is generated based on the first ciphertext parameter, and the third ciphertext parameter is generated based on the second ciphertext parameter, the first ciphertext parameter is generated based on the second ciphertext parameter. There is an association relationship between various ciphertext parameters in the ciphertext. When one ciphertext parameter changes, other ciphertext parameters will also change accordingly, which improves the security of the first ciphertext.

This embodiment provides a one-way proxy re-encryption method, which can be used for the above-mentioned authorized parties, such as computers, mobile phones, tablet computers, etc. FIG. 4 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention , as shown in Figure 4, the process includes the following steps:

S31, obtain the first private key and plaintext data.

For details, please refer to S11 of the embodiment shown in FIG. 2 , which will not be repeated here.

S32, based on the first private key and the plaintext data, generate a first ciphertext.

Wherein, the first ciphertext includes a plurality of ciphertext parameters.

For details, please refer to S22 of the embodiment shown in FIG. 3 , which will not be repeated here.

S33: Generate a re-encryption key according to the first private key and preset ciphertext parameters in the first ciphertext.

Wherein, the preset ciphertext parameter is the first ciphertext parameter.

In this embodiment, the authorizing party regenerates the re-encryption key when receiving the ciphertext conversion request information sent by the authorized party. Specifically, the above S33 may include the following steps:

S331: Receive the ciphertext conversion request information sent by the authorized party.

The ciphertext conversion request information includes the second public key, a first verification parameter, and a second verification parameter, the first verification parameter is generated based on the public parameter, and the second verification parameter is based on the first verification parameter. The public key and the second private key are generated. The first verification parameter and the second verification parameter are generated by the authorized party.

Specifically, the first public key pk _i is expressed as

The second public key pk _j is expressed as

The second verification parameter δ is expressed as:

When the authorized party needs to perform proxy re-encryption, it sends a ciphertext conversion information request to the authorized party. After receiving the ciphertext conversion information request, the authorized party generates a re-encryption key. The ciphertext conversion request information can be expressed as R=(δ, g ₂ , pk _i1 ).

S332: Generate a re-encryption key based on the ciphertext conversion request information, the first private key, and the first ciphertext parameter.

After receiving the ciphertext conversion request information, the authorizing party extracts the parameters in the ciphertext conversion request information, and generates a re-encryption key in combination with the first private key and the first ciphertext parameter F.

As an optional implementation manner of this embodiment, the re-encryption key may be implemented by a _ReKeyGen (ski, R, F) algorithm, and the input of the algorithm is the first private key _ski of the authorizing party, the authorized party The sent ciphertext conversion request information R and the first ciphertext parameter F. The specific algorithm is expressed as follows:

(1) Calculation

(2) Judging whether g ^h′ = g ₂ is established;

(3) When g ^h′ = g ₂ is established, calculate

(4) Output the re-encryption key

Because the construction of the first verification parameter and the second verification parameter ensures that the authorized party can generate the correct re-encryption key for the authorized party only after the authorized party calculates the ciphertext conversion request correctly, if the authorized party maliciously submits an incorrect re-encryption key The first verification parameter and the second verification parameter will be detected immediately, ensuring that the output re-encryption key is correct and generated for the authorized party.

S34: Send the first ciphertext and the re-encryption key to the agent, so that the agent uses the re-encryption key to convert the first ciphertext into the second ciphertext under the authorized party's second public key.

For details, please refer to S14 of the embodiment shown in FIG. 2 , which is not repeated here.

Further optionally, the authorizing party can also use the Dec(ski, CT _i ) algorithm to decrypt the first ciphertext CT _i ₌ (D, E, F, V, s) to obtain the corresponding plaintext data m. This algorithm The input is the authorizer's first private key ski and the first ciphertext CT _i _, and the output is plaintext data. The algorithm may specifically include the following steps:

(1) Judgment Equation

Whether it is established, if so, calculate

Otherwise, output the error symbol ⊥;

(2) Judgment Equation

Whether it is established, if so, output the plaintext data m; otherwise, output the error symbol ⊥.

In the one-way proxy re-encryption method provided in this embodiment, the authorizing party generates a re-encryption key according to the ciphertext conversion request information sent by the authorized party, so that the method can be applied when the authorizing party cannot actively select the authorized party, but When passively waiting for an authorized party to initiate a request, for example, in a data fair transaction, this method can be called a one-way passive proxy re-encryption method.

In this embodiment, a one-way proxy re-encryption method is provided, which can be used for the above-mentioned proxy party, such as a computer, a mobile phone, a tablet computer, and the like. This embodiment corresponds to the one-way proxy re-encryption method described above in the embodiments of FIG. 2 to FIG. 4 , and FIG. 5 is a flowchart of the one-way proxy re-encryption method according to an embodiment of the present invention, as shown in FIG. 5 , The process includes the following steps:

S41: Receive the first ciphertext and the re-encryption key sent by the authorized party.

Wherein, the first ciphertext is generated based on the first private key of the authorizing party and plaintext data, and the re-encryption key is based on the first private key and a preset password in the first ciphertext generated from the text parameters.

As described above, the authorizing party sends the generated re-encryption key and the first ciphertext to the proxy party. Correspondingly, the subsequent agent can use the received re-encryption key to convert the first ciphertext.

Wherein, regarding the method of generating the re-encryption key and the first ciphertext, please refer to the relevant descriptions of the embodiments shown in FIG. 2 to FIG. 4 for details, which will not be repeated here.

S42 , converting the first ciphertext into a second ciphertext under the second public key of the authorized party based on the re-encryption key, so that the authorized party decrypts the second ciphertext to obtain plaintext data.

After the agent receives the re-encryption key, it can first verify the correctness of the re-encryption key, and after the verification is passed, the first ciphertext is converted into the authorized party's second public key by using the re-encryption key. The second ciphertext below. Specifically, this step will be described in detail below.

In this embodiment, a one-way proxy re-encryption method is provided, which can be used for the above-mentioned proxy party, such as a computer, a mobile phone, a tablet computer, and the like. This method corresponds to the one-way proxy re-encryption method described in the embodiments shown in FIG. 2 to FIG. 4 . FIG. 6 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention. As shown in FIG. 6 , the flowchart includes the following steps:

S51: Receive the first ciphertext and the re-encryption key sent by the authorized party.

Specifically, the first private key _{ski is expressed as sk i =(sk i1 ,sk i2 )=(x i1} _, _x _i2 ₎ _, and the first public key pk _i is expressed as

The second public key pk _j is expressed as

The second private key is expressed as sk _j =(sk _j1 ,sk _j2 )=(x _j1 ,x _j2 ).

The first ciphertext CT _i is expressed as CT _i =(D, E, F, V, s),

D=V ^u , E=V ^r , s=u+r·H ₃ (D,E,F)mod q,

the re-encryption key

Expressed as:

l ₀ and l ₁ are message lengths, and g is

The generator of the q-order subgroup G of .

S52, the first ciphertext is converted into a second ciphertext under the second public key of the authorized party based on the re-encryption key, so that the authorized party decrypts the second ciphertext to obtain plaintext data.

Specifically, the above S52 may include the following steps:

S521, using the second ciphertext parameter, the re-encryption key, and the first verification parameter to verify the correctness of the re-encryption key.

Wherein, the first verification parameter g ₂ is expressed as

Specifically, it is possible to use

The algorithm verifies the correctness of the re-encryption key, and the input of the algorithm is the re-encryption key

The second ciphertext parameter V and the first verification parameter g ₂ . The specific algorithm is as follows:

(1) Judgment Equation

whether it is established;

(2) When the equation

When established, it is determined that the re-encryption key verification is passed; otherwise, an error symbol may be output.

S522, when the re-encryption key verification is passed, based on the first ciphertext, the re-encryption key and the first verification parameter, convert the first ciphertext into a second ciphertext under the authorized party's second public key.

Specifically, it is possible to use

The algorithm converts the first ciphertext into the second ciphertext, and the input of the algorithm is the first ciphertext CT _i , the re-encryption key

and the first verification parameter g ₂ , the specific algorithm is expressed as follows:

(1) Judgment Equation

whether it is established;

(2) When the equation

When established, calculate

(3) Output the converted second ciphertext CT _j =(E',F,δ,g ₂ ).

In this embodiment, a one-way proxy re-encryption method is provided, which can be used for the above-mentioned authorized party, such as a computer, a mobile phone, a tablet computer, and the like. This method corresponds to the methods shown in FIGS. 2-4 and the methods shown in FIGS. 5-6 . FIG. 7 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention. As shown in FIG. 7 , the flowchart includes the following steps:

S61: Obtain a second private key, a second public key, a first public key of an authorizing party, and public parameters.

The second private key and the second public key are generated by the authorized party using a key generation algorithm, and the first public key and public parameters are obtained from the authorized party.

Specifically, the second private key sk _j is expressed as sk _j =(sk _j1 ,sk _j2 )=(x _j1 ,x _j2 ), and the second public key pk _j is expressed as

The first public key pk _i is expressed as

The common parameters are expressed as param=(p, q, g, H ₁ , H ₂ , H ₃ , l ₀ , l ₁ ).

in,

and

l ₀ and l ₁ are message lengths, and g is

The generator of the q-order subgroup G of .

For example, the authorized party can also use the same algorithm as the authorized party, that is, KeyGen(param) to generate a second public-private key pair, where the public-private key pair includes the second private key sk _j and the second public key pk _j . For details, please refer to the detailed description of S21 in the embodiment shown in FIG. 3 , which will not be repeated here.

S62, using the public parameter to generate the first verification parameter, and using the first public key and the second private key to generate the second verification parameter.

The authorized party uses the public parameters to generate the first verification parameter g ₂ , and uses the first public key pk _i1 and the second private key x _j1 to generate the second verification parameter δ.

S63, based on the first verification parameter, the second verification parameter and the first public key, generate ciphertext conversion request information.

The ciphertext conversion request information may be expressed as R=(δ, g ₂ , pk _j1 ).

S64, sending the ciphertext conversion request information to the authorizing party.

The authorized party sends the ciphertext conversion request information generated in the above S63 to the authorizer, so that the authorizer generates a re-encryption key based on the ciphertext conversion request information.

S65: Receive the second ciphertext sent by the proxy.

The second ciphertext is obtained by converting the first ciphertext by using a re-encryption key, and the first ciphertext is generated based on the first private key of the authorizing party and plaintext data, and the re-encryption key is used to convert the first ciphertext. The key is generated based on the first private key and preset ciphertext parameters in the first ciphertext.

S66, decrypt the second ciphertext by using the second private key to obtain plaintext data.

After receiving the second ciphertext sent by the agent, the authorized party can use the decryption algorithm to decrypt it to obtain corresponding plaintext data.

In this embodiment, a one-way proxy re-encryption method is provided, which can be used for the above-mentioned authorized parties, such as computers, mobile phones, tablet computers, etc. FIG. 8 is a flowchart of a one-way proxy re-encryption method according to an embodiment of the present invention Figure, as shown in Figure 8, the process includes the following steps:

S71: Obtain a second private key, a second public key, a first public key of an authorizing party, and public parameters.

Wherein, the second private key sk _j is expressed as sk _j =(sk _j1 ,sk _j2 )=(x _j1 ,x _j2 ), and the second public key pk _j is expressed as

The first public key pk _i is expressed as

S72: Generate a first verification parameter by using the public parameter, and generate a second verification parameter by using the first public key and the second private key.

Specifically, the above S72 may include the following steps:

S721, randomly selected

And calculate the first verification parameter g ₂ : g ₂ =g ^h .

S722, calculate the second verification parameter δ:

S73, based on the first verification parameter, the second verification parameter and the first public key, generate ciphertext conversion request information.

The ciphertext conversion request information R may be expressed as: R=(δ, g ₂ , pk _j1 ). The authorized party can use the RequestGen(sk _j , p _i ) algorithm to generate the ciphertext conversion request information, the input of the algorithm is the second private key and the first private key, and the algorithm is specifically expressed as follows:

(1) Randomly selected

and calculate the first verification parameter g ₂ : g ₂ =g ^h ;

(2) Calculate the second verification parameter δ:

(3) Output ciphertext conversion request information R=(δ, g ₂ , pk _j1 ).

S74, sending the ciphertext conversion request information to the authorizing party.

For details, please refer to S64 of the embodiment shown in FIG. 7 , which will not be repeated here.

S75: Receive the second ciphertext sent by the agent.

The second ciphertext CT _j is expressed as CT _j =(E′,F,δ,g ₂ ),

E=V ^r , r=H ₁ (m,w),

g ₂ =g ^h ,

the re-encryption key

Expressed as

S76, decrypt the second ciphertext by using the second private key to obtain plaintext data.

Specifically, the above S76 can be implemented by using the Dec(sk _j , CT _j ) algorithm, where the input of the algorithm is the second private key of the authorized party and the second ciphertext, and specifically the algorithm can include the following steps:

S761, Computing

S762, Judgment Equation

is established.

when the equation

When established, execute S763; otherwise, if an error occurs, the error symbol ⊥ can be output.

S763, output plaintext data m.

In the one-way proxy re-encryption method provided by this embodiment, the special structure of δ enables the authorized party to specify an important value h, and in an open environment, only the authorized party can use its own private key to decrypt and extract h, and other irrelevant parties It is impossible to know h, and this h is an important part of the re-encryption key, thus ensuring the reliability of the re-encryption key.

An embodiment of the present invention also provides a one-way proxy re-encryption method, which is applied to the one-way proxy re-encryption system shown in FIG. 1 . As shown in FIG. 9 , the method includes the following steps:

S801, the authorizing party obtains the first private key and plaintext data. For details, please refer to S11 of the embodiment shown in FIG. 2 , which will not be repeated here.

S802, the authorizer obtains public parameters. For details, please refer to S221 of the embodiment shown in FIG. 3 , which will not be repeated here.

S803, the authorized party obtains the second private key, the second public key, the first public key of the authorizing party, and the public parameters. For details, please refer to S61 of the embodiment shown in FIG. 7 , which will not be repeated here.

S804, the authorizing party generates a first ciphertext. For details, please refer to S222-S224 of the embodiment shown in FIG. 3 , which will not be repeated here.

S805, the authorized party generates ciphertext conversion request information. For details, please refer to S72-S73 of the embodiment shown in FIG. 8 , which will not be repeated here.

S806, the authorized party sends the ciphertext conversion request information to the authorized party. For details, please refer to S74 of the embodiment shown in FIG. 8 , which will not be repeated here.

S807, the authorizing party generates a re-encryption key based on the ciphertext conversion request information, the first private key, and the first ciphertext parameter. For details, please refer to S332 of the embodiment shown in FIG. 4 , which will not be repeated here.

S808, the authorizing party sends the first ciphertext and the re-encryption key to the agent, so that the agent uses the re-encryption key to convert the first ciphertext into the second ciphertext under the second public key of the authorized party. For details, please refer to S34 of the embodiment shown in FIG. 4 , which will not be repeated here.

S809, the agent verifies the correctness of the re-encryption key by using the second ciphertext parameter, the re-encryption key and the first verification parameter. For details, please refer to S521 of the embodiment shown in FIG. 6 , which will not be repeated here.

S810, when the re-encryption key verification is passed, the agent converts the first ciphertext into the second ciphertext under the authorized party's second public key based on the first ciphertext, the re-encryption key and the first verification parameter . For details, please refer to S522 of the embodiment shown in FIG. 6 , which will not be repeated here.

S811, the proxy party sends the second ciphertext to the authorized party.

S812, authorized party computing

For details, please refer to S761 of the embodiment shown in FIG. 8 , which will not be repeated here.

S813, Authorized Way Equation

is established. When the equation is established, execute S814; otherwise, report an error. For details, please refer to S762 of the embodiment shown in FIG. 8 , which will not be repeated here.

S814, the authorized party outputs plaintext data m. For details, please refer to S763 of the embodiment shown in FIG. 8 , which will not be repeated here.

This embodiment also provides a one-way proxy re-encryption apparatus, which is used to implement the above-mentioned embodiments and preferred implementations, and the descriptions that have already been described will not be repeated. As used below, the term "module" may be a combination of software and/or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, implementations in hardware, or a combination of software and hardware, are also possible and contemplated.

This embodiment provides a one-way proxy re-encryption device. The device is applied to an authorizing party. As shown in FIG. 10 , the device includes:

an acquisition module 901 for acquiring a first private key and plaintext data;

a first ciphertext generating module 902, configured to generate a first ciphertext based on the first private key and the plaintext data, where the first ciphertext includes a plurality of ciphertext parameters;

A re-encryption key generation module 903, configured to generate a re-encryption key according to the first private key and preset ciphertext parameters in the first ciphertext;

The first sending module 904 is configured to send the first ciphertext and the re-encryption key to the agent, so that the agent uses the re-encryption key to convert the first ciphertext into a re-encryption key. The second ciphertext under the authorized party's second public key.

This embodiment also provides a one-way proxy re-encryption device, the device is applied to the proxy side, as shown in FIG. 11 , the device includes:

The first receiving module 101 is configured to receive a first ciphertext and a re-encryption key sent by an authorizing party, where the first ciphertext is generated based on the first private key of the authorizing party and plaintext data, and the re-encryption key is The key is generated according to the first private key and preset ciphertext parameters in the first ciphertext;

The ciphertext conversion module 102 is configured to convert the first ciphertext into a second ciphertext under the second public key of the authorized party based on the re-encryption key, so that the authorized party can The two ciphertexts are decrypted to obtain the plaintext data.

This embodiment also provides a one-way proxy re-encryption device, which is applied to an authorized party. As shown in FIG. 12 , the device includes:

The second obtaining module 111 is configured to obtain the second private key, the second public key, the first public key of the authorizing party, and the public parameters, where the second private key sk _j is represented as sk _j =(sk _j1 ,sk _j2 ) =(x _j1 ,x _j2 ), the second public key pk _j is expressed as

The first public key pk _i is expressed as

a verification parameter generation module 112, configured to generate a first verification parameter by using the public parameter, and generate a second verification parameter by using the first public key and the second private key;

A ciphertext conversion request generation module 113, configured to generate ciphertext conversion request information based on the first verification parameter, the second verification parameter and the first public key;

A second sending module 114, configured to send the ciphertext conversion request information to the authorizing party;

The second receiving module 115 is configured to receive the second ciphertext sent by the agent, where the second ciphertext is obtained by converting the first ciphertext by using the re-encryption key, and the first ciphertext is based on the authorization The first private key of the party and the plaintext data are generated, and the re-encryption key is generated based on the first private key and the preset ciphertext parameters in the first ciphertext;

A decryption module 116, configured to decrypt the second ciphertext by using the second private key to obtain the plaintext data;

in,

and

l ₀ and l ₁ are message lengths, and g is

The generator of the q-order subgroup G of .

The one-way proxy re-encryption apparatus in this embodiment is presented in the form of functional units, where the units refer to ASIC circuits, processors and memories that execute one or more software or fixed programs, and/or other devices that can provide the above functional device.

Further functional descriptions of the above-mentioned modules are the same as those of the above-mentioned corresponding embodiments, and are not repeated here.

An embodiment of the present invention further provides an electronic device having the one-way proxy re-encryption apparatus shown in any of the above-mentioned FIGS. 10-12 .

Please refer to FIG. 13. FIG. 13 is a schematic structural diagram of an electronic device provided by an optional embodiment of the present invention. As shown in FIG. 13, the electronic device may include: at least one processor 211, such as a CPU (Central Processing Unit, central processing unit). processor), at least one communication interface 213, memory 214, at least one communication bus 212. Among them, the communication bus 212 is used to realize the connection and communication between these components. The communication interface 213 may include a display screen (Display) and a keyboard (Keyboard), and the optional communication interface 213 may also include a standard wired interface and a wireless interface. The memory 214 may be a high-speed RAM memory (Random Access Memory, volatile random access memory), or may be a non-volatile memory (non-volatile memory), such as at least one disk memory. Optionally, the memory 214 may also be at least one storage device located away from the aforementioned processor 211 . The processor 211 may be combined with the device described in any one of FIGS. 10-12 , the memory 214 stores application programs, and the processor 211 calls the program codes stored in the memory 214 for executing any of the above method steps.

The communication bus 212 may be a peripheral component interconnect (PCI for short) bus or an extended industry standard architecture (EISA for short) bus or the like. The communication bus 212 can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is used in FIG. 13, but it does not mean that there is only one bus or one type of bus.

The memory 214 may include volatile memory (English: volatile memory), such as random-access memory (English: random-access memory, abbreviation: RAM); the memory may also include non-volatile memory (English: non-volatile memory) memory), such as flash memory (English: flash memory), hard disk (English: hard disk drive, abbreviation: HDD) or solid-state drive (English: solid-state drive, abbreviation: SSD); the memory 214 may also include the above types of combination of memory.

The processor 211 may be a central processing unit (English: central processing unit, abbreviation: CPU), a network processor (English: network processor, abbreviation: NP), or a combination of CPU and NP.

The processor 211 may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (English: application-specific integrated circuit, abbreviation: ASIC), a programmable logic device (English: programmable logic device, abbreviation: PLD) or a combination thereof. The above-mentioned PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), field programmable logic gate array (English: field-programmable gate array, abbreviation: FPGA), general array logic (English: generic array logic, abbreviation: GAL) or any combination thereof.

Optionally, memory 214 is also used to store program instructions. The processor 211 may invoke program instructions to implement the one-way proxy replay as shown in any of the embodiments of FIGS. 2-4, or any of FIGS. 5-6, or any of the embodiments of FIGS. 7-8. encryption method.

Embodiments of the present invention further provide a non-transitory computer storage medium, where the computer storage medium stores computer-executable instructions, and the computer-executable instructions can execute the one-way proxy re-encryption method in any of the foregoing method embodiments. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a flash memory (Flash Memory), a hard disk (Hard) Disk Drive, abbreviation: HDD) or solid-state drive (Solid-State Drive, SSD), etc.; the storage medium may also include a combination of the above-mentioned types of memories.

Although the embodiments of the present invention have been described with reference to the accompanying drawings, various modifications and variations can be made by those skilled in the art without departing from the spirit and scope of the present invention, and such modifications and variations fall within the scope of the appended claims within the limits of the requirements.

Claims

A one-way proxy re-encryption method, characterized in that the method comprises:

Obtain the first private key and plaintext data;

generating a first ciphertext based on the first private key and the plaintext data, where the first ciphertext includes a plurality of ciphertext parameters;

generating a re-encryption key according to the first private key and preset ciphertext parameters in the first ciphertext;

Send the first ciphertext and the re-encryption key to the agent, so that the agent uses the re-encryption key to convert the first ciphertext into the second public key of the authorized party. the second ciphertext.
The method according to claim 1, wherein the generating the first ciphertext based on the first private key and the plaintext data comprises:

Obtain common parameters, which are represented as param=(p,q,g,H 1 ,H 2 ,H 3 ,l 0 ,l 1 );

Using the first private key, the plaintext data, and the public parameters, generate a first ciphertext parameter, and the first private key ski is expressed as ski =(sk i1 , sk i2 )=(x i1 , x i2 );

Using the first ciphertext parameter, the first private key and the public parameter to generate a second ciphertext parameter;

Using the second ciphertext parameter and the public parameter to generate a third ciphertext parameter to obtain the first ciphertext;

in,
and
is a set of non-negative and non-zero integers less than p and q, p and q are preset prime numbers, respectively, requiring q|p-1, the bit length of q is l q , and H 1 , H 2 and H 3 are the first The hash function, the second hash function, and the third hash function are expressed as
l 0 and l 1 are message lengths, and g is
The generator of the q-order subgroup G of .
The method according to claim 2, wherein the first ciphertext is generated by the following method:

choose randomly
Calculate r=H 1 (m,w);

calculate
D=V u , E=V r , s=u+r·H 3 (D,E,F)mod q;

outputting the first ciphertext CT i =(D, E, F, V, s);

Among them, the plaintext data of m is expressed as
F is the first ciphertext parameter, V is the second ciphertext parameter, and E is the third ciphertext parameter.
The method according to claim 2 or 3, wherein the preset ciphertext parameter is the first ciphertext parameter, and the preset ciphertext parameter is based on the first private key and the first ciphertext Ciphertext parameters to generate re-encryption keys, including:

Receive ciphertext conversion request information sent by the authorized party, where the ciphertext conversion request information includes the second public key, a first verification parameter, and a second verification parameter, where the first verification parameter is generated based on a public parameter , the second verification parameter is generated based on the first public key and the second private key, and the first public key pk i is expressed as
The second public key pk j is expressed as
The second private key is expressed as sk j =(sk j1 ,sk j2 )=(x j1 ,x j2 ), and the first verification parameter g 2 is expressed as: g 2 =gh , wherein,
The second verification parameter δ is expressed as:

The re-encryption key is generated based on the ciphertext conversion request information, the first private key, and the first ciphertext parameter.
The method according to claim 4, wherein the generating the re-encryption key based on the ciphertext conversion request information, the first private key and the first ciphertext parameter comprises:

calculate

Determine whether g h′ = g 2 is established;

When g h′ = g 2 is established, calculate

output the re-encryption key
A one-way proxy re-encryption method, characterized in that the method comprises:

Receive the first ciphertext and re-encryption key sent by the authorized party, where the first ciphertext is generated based on the first private key of the authorized party and plaintext data, and the re-encryption key is based on the first The private key and the preset ciphertext parameters in the first ciphertext are generated;

The first ciphertext is converted into a second ciphertext under the authorized party's second public key based on the re-encryption key, so that the authorized party decrypts the second ciphertext to obtain the plaintext data.
The method according to claim 6, wherein the first private key ski is expressed as sk i =(sk i1 ,sk i2 )=(x i1 , x i2 ) , and the first public key pk i is expressed as
The second public key pk j is expressed as
The second private key is represented as sk j =(sk j1 ,sk j2 )=(x j1 ,x j2 );

The first ciphertext CT i is expressed as CT i =(D, E, F, V, s),
D=V u , E=V r , s=u+r·H 3 (D,E,F)mod q,
r=H 1 (m, w), m is the plaintext data, F is the first ciphertext parameter, V is the second ciphertext parameter, and E is the third ciphertext parameter;

the re-encryption key
Expressed as:

is a set of non-negative and non-zero integers less than q, q is a preset prime number, the bit length of q is l q , H 2 and H 3 are the second hash function and the third hash function, respectively, expressed as
l 0 and l 1 are message lengths, and g is
The generator of the q-order subgroup G of ;

Wherein, converting the first ciphertext based on the re-encryption key into a second ciphertext under the authorized party's second public key, so that the authorized party performs a Decryption to obtain the plaintext data, including:

The correctness of the re-encryption key is verified by using the second ciphertext parameter, the re-encryption key and the first verification parameter, and the first verification parameter g 2 is expressed as g 2 =g h , wherein,

When the verification of the re-encryption key is passed, the first ciphertext is converted into the second public key of the authorized party based on the first ciphertext, the re-encryption key and the first verification parameter The second ciphertext below.
The method according to claim 7, wherein the verifying the correctness of the re-encryption key by using the second ciphertext parameter, the re-encryption key and the first verification parameter comprises:

Judgment Equation
whether it is established;

when the equation
When established, it is determined that the re-encryption key verification is passed.
The method according to claim 7 or 8, wherein the first ciphertext is converted into an authorized one based on the first ciphertext, the re-encryption key and the first verification parameter The second ciphertext under the party's second public key, including:

Judgment Equation
whether it is established;

when the equation
When established, calculate

The converted second ciphertext CT j =(E',F,δ,g 2 ) is output.
A one-way proxy re-encryption method, characterized in that the method comprises:

Obtain the second private key, the second public key, the first public key of the authorizing party and the public parameters, the second private key sk j is represented as sk j =(sk j1 ,sk j2 )=(x j1 ,x j2 ) , the second public key pk j is expressed as
The first public key pk i is expressed as
The common parameter is expressed as param=(p,q,g,H 1 ,H 2 ,H 3 ,l 0 ,l 1 );

Using the public parameter to generate a first verification parameter, and using the first public key and the second private key to generate a second verification parameter;

generating ciphertext conversion request information based on the first verification parameter, the second verification parameter and the first public key;

sending the ciphertext conversion request information to the authorizing party;

Receive the second ciphertext sent by the agent, where the second ciphertext is obtained by converting the first ciphertext using the re-encryption key, and the first ciphertext is based on the first private key of the authorizing party and the plaintext data is generated, and the re-encryption key is generated based on the first private key and preset ciphertext parameters in the first ciphertext;

Decrypt the second ciphertext using the second private key to obtain the plaintext data;

in,
and
is a set of non-negative and non-zero integers less than p and q, p and q are preset prime numbers, respectively, requiring q|p-1, the bit length of q is l q , and H 1 , H 2 and H 3 are the first The hash function, the second hash function, and the third hash function are expressed as
l 0 and l 1 are message lengths, and g is
The generator of the q-order subgroup G of .
The method according to claim 10, wherein the generating a first verification parameter by using the public parameter, and generating a second verification parameter by using the first public key and the second private key, comprises:

choose randomly
and calculating the first verification parameter g 2 : g 2 =g h ;

Calculate the second verification parameter δ:
The method according to claim 11, wherein the second ciphertext CT j is expressed as CT j =(E',F,δ,g 2 ),

E=V r , r=H 1 (m,w),
g 2 =g h ,

the re-encryption key
Expressed as

The decrypting the second ciphertext by using the second private key to obtain the plaintext data includes:

calculate

Judgment Equation
whether it is established;

when the equation
When established, the plaintext data m is output.
A one-way proxy re-encryption device, characterized in that the device comprises:

an acquisition module for acquiring the first private key and plaintext data;

a first ciphertext generating module, configured to generate a first ciphertext based on the first private key and the plaintext data, where the first ciphertext includes a plurality of ciphertext parameters;

a re-encryption key generation module, configured to generate a re-encryption key according to the first private key and preset ciphertext parameters in the first ciphertext;

a first sending module, configured to send the first ciphertext and the re-encryption key to an agent, so that the agent uses the re-encryption key to convert the first ciphertext into an authorized The second ciphertext under the party's second public key.
A one-way proxy re-encryption device, characterized in that the device comprises:

The first receiving module is configured to receive the first ciphertext and the re-encryption key sent by the authorizing party, where the first ciphertext is generated based on the first private key of the authorizing party and the plaintext data, and the re-encrypting ciphertext is generated based on the first private key of the authorizing party and the plaintext data. The key is generated according to the first private key and preset ciphertext parameters in the first ciphertext;

A ciphertext conversion module, configured to convert the first ciphertext into a second ciphertext under the second public key of the authorized party based on the re-encryption key, so that the authorized party can understand the second ciphertext The ciphertext is decrypted to obtain the plaintext data.
A one-way proxy re-encryption device, characterized in that the device comprises:

The second obtaining module is used to obtain the second private key, the second public key, the first public key of the authorizing party and the public parameters, and the second private key sk j is represented as sk j =(sk j1 ,sk j2 )= (x j1 ,x j2 ), the second public key pk j is expressed as
The first public key pk i is expressed as
The common parameter is expressed as param=(p,q,g,H 1 ,H 2 ,H 3 ,l 0 ,l 1 );

a verification parameter generation module, configured to generate a first verification parameter by using the public parameter, and generate a second verification parameter by using the first public key and the second private key;

a ciphertext conversion request generation module, configured to generate ciphertext conversion request information based on the first verification parameter, the second verification parameter and the first public key;

a second sending module, configured to send the ciphertext conversion request information to the authorizing party;

The second receiving module is configured to receive the second ciphertext sent by the agent, where the second ciphertext is obtained by converting the first ciphertext by using a re-encryption key, and the first ciphertext is based on the authorizing party The first private key and plaintext data are generated, and the re-encryption key is generated based on the first private key and the preset ciphertext parameters in the first ciphertext;

a decryption module, configured to decrypt the second ciphertext by using the second private key to obtain the plaintext data;

in,
and
is a set of non-negative and non-zero integers less than p and q, p and q are preset prime numbers, respectively, requiring q|p-1, the bit length of q is l q , and H 1 , H 2 and H 3 are respectively the first The hash function, the second hash function, and the third hash function are expressed as
l 0 and l 1 are message lengths, and g is
The generator of the q-order subgroup G of .
An electronic device, comprising:

A memory and a processor, the memory and the processor are connected in communication with each other, the memory stores computer instructions, and the processor executes any one of claims 1-5 by executing the computer instructions , or any one of 6-9, or the one-way proxy re-encryption method described in any one of 10-12.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a computer to execute any one of claims 1-5, or any one of 6-9 Item, or the one-way proxy re-encryption method described in any one of 10-12.
A one-way re-encryption system, characterized in that the system includes:

An authorizing party, used to execute the one-way proxy re-encryption method described in any one of claims 1-5;

a proxy party, connected with the authorized party, for executing the one-way proxy re-encryption method described in any one of claims 6-9;

an authorized party, connected with the authorized party, for executing the one-way proxy re-encryption method according to any one of claims 10-12.