WO2023109056A1 - Attribute-based encryption method and system - Google Patents

Abstract

Disclosed in the present application are an attribute-based encryption method and system. In the present application, a shared file is encrypted before being shared, and the encryption mode involves attribute sets corresponding to users that are allowed to access the shared file, such that only the users that are allowed to access the shared file can successfully decrypt ciphertext, thereby greatly reducing the risk of information leakage.

Description

An attribute-based encryption method and system

Cross References to Related Applications

This application claims the priority of the Chinese patent application with the application number 202111518960.3 and the application title "An Attribute-Based Encryption Method and System" filed with the China Patent Office on December 14, 2021, the entire contents of which are incorporated herein by reference Applying.

technical field

This application relates to the field of information encryption, in particular to an attribute-based encryption method and system.

Background technique

With the rapid development and popularization of the Internet, more and more sensitive information is stored and shared on third-party Internet sites (such as cloud storage). The inventor realizes that at present, these sensitive information are not stored in an encrypted form on cloud storage, so they face the risk of sensitive information leakage, and the security threats caused by information leakage are also increasing.

Therefore, how to provide a solution for encrypting sensitive information before sharing is a problem that those skilled in the art need to solve at present.

Contents of the invention

This application provides an attribute-based encryption method and system.

This application provides an attribute-based encryption method, including:

Use the identity provision module to register the user's identity information and its corresponding attribute set in advance;

Obtain the attribute set corresponding to the user who is allowed to access the shared file from the identity providing module, combine the acquired attribute set to obtain an authorization attribute set, and establish an access control matrix matching the authorization attribute set;

Based on the file identification and authorization attribute set of the shared file, request a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set from the key management module;

Receive the symmetric key and the public key set of the asymmetric key returned by the key management module, and use the symmetric key to encrypt the shared file to obtain the file ciphertext, and based on the access control matrix and the public key set, attribute-based Encryption of to get the attribute ciphertext; and

Combine the access control matrix, file ciphertext and attribute ciphertext to obtain the attribute encryption ciphertext, and upload the attribute encryption ciphertext to the cloud storage module, so that the cloud storage module only allows users matching the access control matrix to read and decrypt attributes Encrypt the ciphertext to get the shared file.

In some embodiments, the key management module is used to generate a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set based on the file identifier and the authorization attribute set of the shared file, including:

According to the global parameter setting function Global Setup(λ)→GP, the global parameter setting is performed, and the global parameter GP={g ₁ ,G,G _T ,Z _p ,q,p,H} is obtained; among them, the global parameter GP is provided for all users ; λ is a security parameter; H represents a hash function, which has a mapping function H:{0,1} ^* →G; G is a bilinear group with order q; g ₁ ∈ G; G _T is a The multiplicative cyclic group of q; Z _p is an integer cyclic group of order p;

According to the key generation function GkeyGen(ID, S, GP, pk _u ) → PK, SK, sk, generate a symmetric key sk and an asymmetric key (PK, SK) corresponding to each attribute in the authorization attribute set, To return the public key set of the symmetric key and the asymmetric key after being encrypted by the owner's public key pk _u of the shared file; among them, ID is the file identifier; S is the authorization attribute set; PK is the public key of the asymmetric key ,

e is a bilinear mapping: G×G→G _T ; SK is the private key of an asymmetric key, SK={α _i , y _i }; α _i , y _i are random numbers, α _i , y _i ∈ Z _p ; i is the i-th attribute corresponding to the access control matrix, and there are K attributes in total, i∈{1,2,3,...,K}.

In some embodiments, the public key set of the symmetric key and the asymmetric key returned by the key management module is received, and the shared file is encrypted with the symmetric key to obtain the file ciphertext, and based on the access control matrix and the public key set pair The symmetric key performs attribute-based encryption to obtain attribute ciphertext, including:

Decrypt the ciphertext returned by the key management module based on the private key of the owner of the shared file, and obtain the public key set {PK} of the symmetric key sk and the asymmetric key;

Use the symmetric key sk to encrypt the shared file to obtain the file ciphertext C ₁ ;

Based on the access control matrix A and the public key set {PK}, perform attribute-based encryption on the symmetric key sk, and obtain the attribute ciphertext CT = {C ₂ , C ₃ , C ₄ , C ₅ }; where A is K×L The matrix, K is the number of rows of matrix A, L is the number of columns of matrix A;

All C _3,i form C ₃ ;

All C _4,i form C ₄ ;

All C _5,i form C ₅ ; s ₁ is a random number, s ₁ ∈ Z _p ; λ _i =A _i ×v; A _i is the i-th row of A; v is a random vector, v∈ Z _P ^L ; v The first element of is s ₁ , and other elements are random numbers; _ri is a random number, _ri ∈ Z _p ; ρ is an attribute mapping function used to associate attributes with rows of matrix A.

In some embodiments, the attribute encryption ciphertext is obtained by combining the access control matrix, file ciphertext and attribute ciphertext, including:

Based on the access control matrix A, the file ciphertext C ₁ and the attribute ciphertext CT, the attribute encrypted ciphertext C={ID,A,ρ,C ₁ ,CT,sign} is obtained; where, sign is a digital signature.

In some embodiments, reading the attribute encrypted ciphertext from the cloud storage module includes:

When the data user accesses the cloud storage module, the target attribute set corresponding to the data user is obtained from the identity providing module based on the identity information of the data user;

Obtain the access control matrix in the attribute encrypted ciphertext;

When the target attribute set matches the access control matrix, the cloud storage module is allowed to send the attribute encrypted ciphertext to the data user;

When the target attribute set does not match the access control matrix, the cloud storage module is not allowed to send the attribute encrypted ciphertext to the data consumer.

In some embodiments, the decryption process of attribute encrypted ciphertext includes:

When the data user uses the attribute ciphertext to access the key management module, use the key management module to obtain the target attribute set corresponding to the data user from the identity providing module, and determine the target corresponding to the target attribute set according to the target attribute set and the file identifier collection of private keys;

Decrypt the symmetric key based on the target private key set and attribute ciphertext, and send the decrypted symmetric key to the data user after being encrypted with the public key of the data user, so that the data user can decrypt it with its own private key to obtain Symmetric key, and use the symmetric key to decrypt the ciphertext of the file to obtain the shared file.

In some embodiments, decrypting the symmetric key based on the target private key set and the attribute ciphertext includes:

Find the function based on the derived private key

Get the derived private key set K _id ; among them, K _{x, id} is the derived private key corresponding to the xth attribute of the target attribute set; the target attribute set has K ₁ attributes in total, x∈{1,2,3,...,K ₁ }; id is the user id of the data user;

find function from data

calculate

Among them, ρ(x) means mapping the attribute x to the ρ(x)th row of the access control matrix A;

The constant c _x is calculated under Σ _x c _x A _ρ(x) = (1, 0, ..., 0), and according to

calculate

in,

is a positive integer;

According to the decryption function

Decrypt the symmetric key to get the symmetric key sk.

In some embodiments, the attribute-based encryption method further includes:

When the user who is allowed to access the shared file changes, re-enter the attribute set corresponding to the user who is allowed to access the shared file from the identity providing module, and combine the obtained attribute set to obtain the authorized attribute set, and establish a match with the authorized attribute set The steps of the access control matrix.

In some embodiments, the attribute-based encryption method further includes:

When the user allowed to access the shared file has not changed, do not re-enter the attribute set corresponding to the user who is allowed to access the shared file from the identity providing module, and combine the acquired attribute set to obtain an authorized attribute set, and establish and authorize The set of attributes matches the steps in the access control matrix.

In some embodiments, the attribute-based encryption method further includes:

When the target user loses the access right to the shared file, set the asymmetric key corresponding to the attribute set of the target user in the key management module to be invalid, so that the target user has no right to access the attribute encrypted ciphertext.

In some embodiments, the present application also provides an attribute-based encryption system, comprising:

The identity provision module is used to register the user's identity information and its corresponding attribute set;

The data owner is used to obtain the attribute set corresponding to the user who is allowed to access the shared file from the identity providing module, and combine the obtained attribute set to obtain the authorization attribute set, and establish an access control matrix matching the authorization attribute set; based on sharing The file identifier and authorization attribute set of the file request a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set from the key management module; receive the symmetric key and asymmetric key returned by the key management module The public key set, and use the symmetric key to encrypt the shared file to obtain the file ciphertext, and based on the access control matrix and the public key set, perform attribute-based encryption on the symmetric key to obtain the attribute ciphertext; the access control matrix, file encryption text and attribute ciphertext to obtain attribute encrypted ciphertext, and upload the attribute encrypted ciphertext to the cloud storage module, so that the cloud storage module only allows users matching the access control matrix to read and decrypt the attribute encrypted ciphertext to obtain shared files ;

The key management module is used to generate a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set based on the file identification and the authorization attribute set of the shared file, and combine the symmetric key and the asymmetric key The set of public keys is returned to the data owner; and

Cloud storage module, used to store attribute encrypted ciphertext.

In some embodiments, the identity provisioning module includes:

Identity authentication module;

The LDAP module is used to register the user's identity information and its corresponding attribute collection through the identity authentication module;

The key management module includes:

The attribute discrimination point is used to execute the key management process of the key generated by the key management module;

The key storage module is used to store the key generated by the key management module;

Cloud storage modules include:

Access decision points for enforcing access control processes for attribute encrypted ciphertexts; and

The storage center is used to store attribute encrypted ciphertext.

The details of one or more embodiments of the application are set forth in the accompanying drawings and the description below. Other features and advantages of the application will be apparent from the description, drawings, and claims.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the prior art and the accompanying drawings that need to be used in the embodiments. Obviously, the accompanying drawings in the following description are only some of the present application. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

FIG. 1 is a flowchart of an attribute-based encryption method according to one or more embodiments;

Fig. 2 is a schematic structural diagram of an attribute-based encryption system according to one or more embodiments;

Fig. 3 is an encryption schematic diagram of an attribute-based encryption system according to one or more embodiments;

Fig. 4 is a structural block diagram of a computer device according to one or more embodiments.

Detailed ways

The core of this application is to provide an attribute-based encryption method and system, which encrypts shared files before file sharing, and the encryption method involves the corresponding attribute set of users who are allowed to access shared files. Users can successfully decrypt the ciphertext, which greatly reduces the risk of information leakage.

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

Please refer to FIG. 1 , which is a flow chart of an attribute-based encryption method provided by an embodiment of the present application.

The attribute-based encryption methods include:

Step S1: Use the identity providing module to register the user's identity information and its corresponding attribute set in advance.

Specifically, both the data owner and the data user use the identity provision module to register the user's identity information (including user name and password) in advance, and register the corresponding attribute set of the user at the same time, so that the identity provision module can verify the legitimacy of the user's attributes .

Step S2: Obtain the attribute set corresponding to the user who is allowed to access the shared file from the identity providing module, combine the acquired attribute set to obtain an authorization attribute set, and establish an access control matrix matching the authorization attribute set.

Specifically, each user has its own corresponding attribute set, and the data owner (the client where the data owner of the shared file is located) combines the attribute sets corresponding to the users who are allowed to access the shared file to obtain the authorized attribute set S, namely The attribute set corresponding to a user who is allowed to access the shared file is a subset of the authorization attribute set S, and then an access control matrix A matching the authorization attribute set S is established (the role of the access control matrix A is to control the access user of the shared file).

Step S3: Request a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set from the key management module based on the file identifier and the authorization attribute set of the shared file.

Specifically, the data owner requests a symmetric key sk (encryption key and decryption key) from the key management module based on the file identification ID (Identity Document, unique code) and authorization attribute set S of the shared file M pre-shared to the cloud storage module. The key is the same) and the asymmetric key corresponding to each attribute in the authorized attribute set S (the asymmetric key includes the public key PK for encryption and the private key SK for decryption, and the public key and private key are different ). After receiving the request from the data owner, the key management module generates a symmetric key sk and an asymmetric key corresponding to each attribute in the authorized attribute set S based on the file identification ID of the shared file and the authorized attribute set S, Then return the generated symmetric key sk and the public key set {PK} of all asymmetric keys to the data owner.

Step S4: Receive the symmetric key and the public key set of the asymmetric key returned by the key management module, and use the symmetric key to encrypt the shared file to obtain the file ciphertext, and based on the access control matrix and the public key set, the symmetric key Perform attribute-based encryption to obtain attribute ciphertext.

Specifically, the data owner receives a symmetric key sk returned by the key management module and the public key set {PK} of all asymmetric keys, and then uses the symmetric key sk to encrypt the shared file M to obtain the file ciphertext C ₁ , And, based on the established access control matrix A and the public key set {PK}, perform attribute-based encryption on the symmetric key sk to obtain the attribute ciphertext CT.

Step S5: Combine the access control matrix, file ciphertext and attribute ciphertext to obtain the attribute encryption ciphertext, and upload the attribute encryption ciphertext to the cloud storage module, so that the cloud storage module only allows users matching the access control matrix to read And decrypt the attribute encrypted ciphertext to obtain the shared file.

Specifically, the data owner combines the access control matrix A, file ciphertext C ₁ and attribute ciphertext CT to obtain attribute-based encrypted ciphertext C (called attribute-encrypted ciphertext, which can also contain other content), and then encrypts the attribute The ciphertext C is uploaded to the cloud storage module, so that the cloud storage module only allows users matching the access control matrix A to read and decrypt the attribute-encrypted ciphertext C to obtain the shared file M.

It can be seen that this application encrypts the shared files before file sharing, and the encryption method involves the attribute set corresponding to the users who are allowed to access the shared files. The purpose is to realize that only users who are allowed to access the shared files can successfully decrypt the ciphertext, thereby greatly reducing Risk of Information Leakage.

On the basis of above-mentioned embodiment:

As an optional embodiment, the key management module is used to generate a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set based on the file identifier and the authorization attribute set of the shared file, including:

According to the global parameter setting function Global Setup(λ)→GP, the global parameter setting is performed, and the global parameter GP={g ₁ ,G,G _T ,Z _p ,q,p,H} is obtained; among them, the global parameter GP is provided for all users ; λ is a security parameter; H represents a hash function, which has a mapping function H:{0,1} ^* →G; G is a bilinear group with order q; g ₁ ∈ G; G _T is a The multiplicative cyclic group of q; Z _p is an integer cyclic group of order p;

According to the key generation function GkeyGen(ID, S, GP, pk _u ) → PK, SK, sk, generate a symmetric key sk and an asymmetric key (PK, SK) corresponding to each attribute in the authorization attribute set, To return the public key set of the symmetric key and the asymmetric key after being encrypted by the owner's public key pk _u of the shared file; among them, ID is the file identifier; S is the authorization attribute set; PK is the public key of the asymmetric key ,

e is a bilinear mapping: G×G→G _T ; SK is the private key of an asymmetric key, SK={α _i , y _i }; α _i , y _i are random numbers, α _i , y _i ∈ Z _p ; i is the i-th attribute corresponding to the access control matrix, and there are K attributes in total, i∈{1,2,3,...,K}.

Specifically, the process for the data owner to generate a key with the help of the key management module includes: 1) The data owner requests a symmetric key sk from the key management module based on the file identification ID and authorization attribute set S of the shared file M and the authorization An asymmetric key corresponding to each attribute in the attribute set S, and this operation is performed in a trusted execution environment. 2) After receiving the request from the data owner, the key management module sets the global parameters according to the global parameter setting function Global Setup(λ)→GP, and obtains the global parameters GP={g ₁ ,G,G _T ,Z _p , q,p,H}, and return the global parameter GP to the data owner, and also provide it to other users (it should be noted that the global parameter can use the existing public global parameter of the key management module, and it is not necessary to regenerate the global parameter. to reduce the load on the key management module to generate global parameters). 3) The key management module generates a symmetric key sk and an asymmetric key corresponding to each attribute in the authorization attribute set S according to the key generation function GkeyGen(ID,S,GP,pk _u )→PK,SK,sk key (PK, SK), so that the public key set {PK} of the symmetric key sk and the asymmetric key is encrypted by the public key pk _u of the data owner, and then returned to the data owner through a secure channel; among them,

SK＝{α _i ,y _i }; e is a bilinear mapping: G×G→G _T , such as e(g ₁ , g ₁ ) ^αi ＝(g ₁ ×g ₁ ) ^αi ; α _i ,y _i is Random numbers, α _i , y _i ∈ Z _p ; the subscript i of α _i , y _i is the i-th attribute corresponding to the access control matrix, and the access control matrix corresponds to K attributes in total, i∈{1,2,3, …, K}.

In addition, in the key management module, each asymmetric key record is composed of file identification ID, global parameter GP, attribute, and key, and each asymmetric key record is encrypted and stored in the key management module to ensure The security of the key, the key storage of the key management module is shown in Table 1:

Table 1

It should be noted that when the data owner re-encrypts other shared files, it will re-request a symmetric key from the key management module based on the file ID and authorization attribute set of other shared files and one-to-one correspondence with each attribute in the authorization attribute set asymmetric key. Even if two shared files correspond to the same authorization attribute set, they do not have the same key set, which ensures system security, and realizes the fine-grained encryption capability based on attribute encryption, which fully guarantees the security of encrypted files.

As an optional embodiment, receive the public key set of the symmetric key and the asymmetric key returned by the key management module, and use the symmetric key to encrypt the shared file to obtain the file ciphertext, and based on the access control matrix and public key The key set performs attribute-based encryption on the symmetric key to obtain the attribute ciphertext, including:

Decrypt the ciphertext returned by the key management module based on the private key of the owner of the shared file, and obtain the public key set {PK} of the symmetric key sk and the asymmetric key;

Use the symmetric key sk to encrypt the shared file to obtain the file ciphertext C ₁ ;

Based on the access control matrix A and the public key set {PK}, perform attribute-based encryption on the symmetric key sk, and obtain the attribute ciphertext CT = {C ₂ , C ₃ , C ₄ , C ₅ }; where A is K×L The matrix, K is the number of rows of matrix A, L is the number of columns of matrix A;

All C _3,i form C ₃ ;

All C _4,i form C ₄ ;

All C _5,i form C ₅ ; s ₁ is a random number, s ₁ ∈ Z _p ; λ _i =A _i ×v; A _i is the i-th row of A; v is a random vector, v∈ Z _P ^L ; v The first element of is s ₁ , and other elements are random numbers; _ri is a random number, _ri ∈ Z _p ; ρ is an attribute mapping function used to associate attributes with rows of matrix A.

Specifically, the encryption process of the data owner includes: 1) receiving the ciphertext returned by the key management module (the public key set {PK} of the symmetric key sk and the asymmetric key), and then based on the private key pair of the data owner The ciphertext returned by the key management module is decrypted to obtain the public key set {PK} of the symmetric key sk and the asymmetric key. 2) Use the symmetric key sk to encrypt the shared file M, and obtain the file ciphertext C ₁ =Enc _sk (M); where, Enc _sk is an encryption function, and the encryption key is sk; then based on the access control matrix A and the public key set{ PK} performs attribute-based encryption on the symmetric key sk to obtain the attribute ciphertext CT={C ₂ , C ₃ , C ₄ , C ₅ }; where, the access control matrix A is a K×L matrix, and K is the matrix A The number of rows, L is the number of columns of matrix A;

s ₁ is a random number, s ₁ ∈ Z _p ; λ _i =A _i ×v, A _i is the ith row of the access control matrix A, v is a random vector, v∈Z _P ^L , the first one of the random vector v The element is s ₁ , and the other elements are random numbers; the subscript ρ of y _ρ(i) and α _ρ(i) is an attribute mapping function used to associate the attribute with the row of the access control matrix A, ρ(i) Indicates mapping attribute i to row ρ(i) of access control matrix A, r _i is a random number selected from A _i of access control matrix A, r _i ∈ Z _p ; λ _i , r _i , A _i The subscript i of is the i-th attribute, i∈{1,2,3,…,K}; all C _3,i (i∈{1,2,3,…,K}) form C ₃ ; all C _4,i (i∈{1,2,3,...,K}) constitute C ₄ ; all C _5,i (i∈{1,2,3,...,K}) constitute C ₅ . Then the attribute-based encryption function can be summarized as: Encrypt(M,A,ρ,GP,{PK},sk)→C.

As an optional embodiment, the attribute encryption ciphertext is obtained by combining the access control matrix, file ciphertext and attribute ciphertext, including:

Based on the access control matrix A, the file ciphertext C ₁ and the attribute ciphertext CT, the attribute encrypted ciphertext C={ID,A,ρ,C ₁ ,CT,sign} is obtained; where, sign is a digital signature.

Specifically, based on the access control matrix A, the file ciphertext C ₁ and the attribute ciphertext CT, the data owner finally obtains the attribute encryption ciphertext as: C={ID,A,ρ,C ₁ ,CT,sign}, Among them, sign is a digital signature, and a digital signature is a digital string that only the sender of the message can generate and cannot be forged by others. This digital string is also an effective proof of the authenticity of the message sent by the sender of the message.

As an optional embodiment, reading attribute encrypted ciphertext from the cloud storage module includes:

When the data user accesses the cloud storage module, the target attribute set corresponding to the data user is obtained from the identity providing module based on the identity information of the data user;

Obtain the access control matrix in the attribute encrypted ciphertext, and judge whether the target attribute set matches the access control matrix;

If so, the cloud storage module is allowed to send the attribute encrypted ciphertext to the data user;

If not, the cloud storage module is not allowed to send the attribute encryption ciphertext to the data consumer.

Specifically, the application obtains the access control matrix in the attribute-encrypted ciphertext, determines that the target attribute set matches the access control matrix, and allows the cloud storage module to send the attribute-encrypted ciphertext to the data user based on the determined result. Further, the application obtains the access control matrix in the attribute encryption ciphertext, determines that the target attribute set does not match the access control matrix, and based on the determined result, the cloud storage module is not allowed to send the attribute encryption ciphertext to the data user.

Specifically, when the data user accesses the cloud storage module, the access decision point of the cloud storage module is used to realize: 1) Based on the identity information of the data user, the attribute set corresponding to the data user (called the target attribute) is obtained from the identity providing module gather). 2) Obtain the access control matrix A in the attribute encrypted ciphertext C, and judge whether the target attribute set matches the access control matrix A; if they match, the cloud storage module sends the attribute encrypted ciphertext C to the data user; if they do not match , then the cloud storage module will not send the attribute encrypted ciphertext C to the data user.

As an optional embodiment, the decryption process of the attribute encrypted ciphertext includes:

When the data user uses the attribute ciphertext to access the key management module, use the key management module to obtain the target attribute set corresponding to the data user from the identity providing module, and determine the target corresponding to the target attribute set according to the target attribute set and the file identifier collection of private keys;

Decrypt the symmetric key based on the target private key set and attribute ciphertext, and send the decrypted symmetric key to the data user after being encrypted with the public key of the data user, so that the data user can decrypt it with its own private key to obtain Symmetric key, and use the symmetric key to decrypt the ciphertext of the file to obtain the shared file.

Specifically, after the data user receives the attribute encrypted ciphertext C, the data user will use the attribute ciphertext CT to access the key management module, and use the attribute discrimination point of the key management module to realize: 1) Based on the identity of the data user Information obtains the target attribute set corresponding to the data user from the identity providing module, and determines the target private key set corresponding to the target attribute set according to the target attribute set and the file identification ID, and then based on the target private key set and attribute cipher text CT symmetrical encryption key to decrypt (in the trusted execution environment of the key management module), and the decrypted symmetric key is encrypted with the public key of the data user and then sent to the data user, so that the data user can use its own private key Decrypt to obtain the symmetric key sk, and use the symmetric key sk to decrypt the file ciphertext C ₁ to obtain the shared file M.

As an optional embodiment, decrypting the symmetric key based on the target private key set and attribute ciphertext includes:

Find the function based on the derived private key

Get the derived private key set K _id ; among them, K _{x, id} is the derived private key corresponding to the xth attribute of the target attribute set; the target attribute set has K ₁ attributes in total, x∈{1,2,3,...,K ₁ }; id is the user id of the data user;

find function from data

calculate

Among them, ρ(x) means mapping the attribute x to the ρ(x)th row of the access control matrix A;

The constant c _x is calculated under Σ _x c _x A _ρ(x) = (1, 0, ..., 0), and according to

calculate

in,

is a positive integer;

According to the decryption function

Decrypt the symmetric key to get the symmetric key sk.

Specifically, the process of using the key management module to decrypt the symmetric key includes: 1) Obtaining the function according to the derived private key

Obtain the derived private key set K _id ; among them, α _x , y _x are random numbers, α _x , y _x ∈ Z _p ; the subscript x of α _x , y _x is the xth of the target attribute set corresponding to the data user Attributes, the target attribute set has K ₁ attributes in total, x∈{1,2,3,…,K ₁ }; K _x,id is the derived private key corresponding to the xth attribute of the target attribute set; all K _x,id (x∈{1,2,3,...,K ₁ }) constitutes the derived private key set K _id ; id is the user id of the data user; H represents the hash function. 2) Find the function based on the data

calculate

Among them, ρ(x) means mapping the attribute x to the ρ(x)th row of the access control matrix A;

λ _ρ(x) =A _ρ(x) ×V, A _ρ(x) is the ρ(x)th row of the access control matrix A. 3) Calculate the constant c _x under Σ _x c _x A _ρ(x) = (1, 0, ..., 0), and according to

calculate

Wherein, c _x is a positive integer. 4) According to the decryption function

Decrypt the symmetric key to obtain the symmetric key sk, then use the symmetric key sk to decrypt the file ciphertext C ₁ to obtain the shared file M=Dec _sk (C ₁ ); where, Dec _sk is the decryption function, and the decryption key for sk.

As an optional embodiment, the attribute-based encryption method also includes:

Determine whether the user allowed to access the shared file has changed;

If yes, then re-enter the steps of obtaining from the identity providing module the attribute sets corresponding to users who are allowed to access shared files, combining the acquired attribute sets to obtain an authorization attribute set, and establishing an access control matrix matching the authorization attribute set.

Specifically, the application determines that the users who are allowed to access the shared files have changed, and based on the determined result, re-enter the attribute set corresponding to the user who is allowed to access the shared file from the identity provision module, and combine the acquired attribute sets to obtain the authorization attribute set, and the step of establishing an access control matrix matching the set of authorization attributes.

Further, the first way to revoke the corresponding attribute: determine whether the user who is allowed to access the shared file has changed; The combination of attribute sets to obtain the authorization attribute set, and the step of establishing an access control matrix matching the authorization attribute set; if there is no change, then do not re-enter the attribute set corresponding to the user who is allowed to access the shared file from the identity providing module, and combining the obtained attribute sets to obtain an authorization attribute set, and establishing an access control matrix matching the authorization attribute set, so that users who are no longer allowed to access shared files cannot continue to access attribute encrypted ciphertext. Specifically, the application determines that the users who are allowed to access shared files have not changed, and based on the determined result, do not re-enter the attribute set corresponding to the user who is allowed to access shared files obtained from the identity provision module, and combine the acquired attribute sets to obtain An authorization attribute set, and a step of establishing an access control matrix matching the authorization attribute set.

As an optional embodiment, the attribute-based encryption method also includes:

When the target user loses the access right to the shared file, set the asymmetric key corresponding to the attribute set of the target user in the key management module to be invalid, so that the target user has no right to access the attribute encrypted ciphertext.

Further, the second way to revoke the corresponding attribute: when the target user loses access to the shared file, set the asymmetric key corresponding to the attribute set of the target user in the key management module to invalid, so that the target user has no access Attribute encrypted ciphertext.

It should be noted that it is sufficient to choose one of the above two ways of revoking the corresponding attribute, and this application does not make any special limitation here.

The method based on attribute encryption of this application is applied to the system based on attribute encryption as shown in Figure 2. The system based on attribute encryption includes multiple organizations and a cloud computing platform; wherein, each organization includes multiple data users, multiple The data owner and an identity providing module; the cloud computing platform includes a unified cloud storage module and multiple key management modules; each key management module corresponds to an organization. Specifically, as shown in Figure 3, the identity providing module includes an identity authentication module and an LDAP (Light Directory Access Protocol, Lightweight Directory Access Protocol) module. All users register their identities with the LDAP module through the identity authentication module, and register corresponding set of attributes. The key management module includes an attribute discrimination point and a key storage module; wherein, the key storage module is used to store the key generated by the key management module; the attribute discrimination point is used to perform key management of the key generated by the key management module Process (including symmetric key decryption process). The cloud storage module includes an access decision point and a storage center; wherein, the storage center is used to store the attribute encrypted ciphertext; the access decision point is used to implement the access control process of the attribute encrypted ciphertext (deciding whether to allow users to access the attribute encrypted ciphertext).

In summary, this application has the following beneficial effects: 1) This application makes full use of the organization's own LDAP identity verification system and the key management system in the cloud computing platform to realize an attribute-based encryption system without the need for a trusted authority, Make full use of the existing organizational structure of the cloud computing platform. 2) This application makes full use of the organization's own LDAP authentication system, so each organization operates independently without interfering with each other. LDAP is both the authenticator of the user login system and the trusted provider of user attributes. 3) In the attribute-based encryption method of this application, the access control structure is embedded in the ciphertext, and the key is bound to a set of attributes to effectively implement access control. Since different users may have some of the same attributes, the attribute-based encryption method can realize one-to-many secure file access. 4) Use attributes to classify users in a fine-grained manner, and use specific access policies to encrypt data. Only when user attributes meet the access policy can the ciphertext be successfully decrypted. Therefore, attribute-based encryption methods are especially suitable for ensuring user privacy on cloud platforms. Under the premise of protecting the confidentiality of data.

The present application also provides an attribute-based encryption system, including:

The identity provision module is used to register the user's identity information and its corresponding attribute set;

The data owner is used to obtain the attribute set corresponding to the user who is allowed to access the shared file from the identity providing module, and combine the obtained attribute set to obtain the authorization attribute set, and establish an access control matrix matching the authorization attribute set; based on sharing The file identifier and authorization attribute set of the file request a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set from the key management module; receive the symmetric key and asymmetric key returned by the key management module The public key set, and use the symmetric key to encrypt the shared file to obtain the file ciphertext, and based on the access control matrix and the public key set, perform attribute-based encryption on the symmetric key to obtain the attribute ciphertext; the access control matrix, file encryption text and attribute ciphertext to obtain attribute encrypted ciphertext, and upload the attribute encrypted ciphertext to the cloud storage module, so that the cloud storage module only allows users matching the access control matrix to read and decrypt the attribute encrypted ciphertext to obtain shared files ;

The key management module is used to generate a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set based on the file identification and the authorization attribute set of the shared file, and combine the symmetric key and the asymmetric key The public key set is returned to the data owner;

Cloud storage module, used to store attribute encrypted ciphertext.

As an optional embodiment, the identity providing module includes:

Identity authentication module;

The LDAP module is used to register the user's identity information and its corresponding attribute collection through the identity authentication module;

The key management module includes:

The attribute discrimination point is used to execute the key management process of the key generated by the key management module;

The key storage module is used to store the key generated by the key management module;

Cloud storage modules include:

Access decision point, used to execute the access control process of attribute encrypted ciphertext;

The storage center is used to store attribute encrypted ciphertext.

For the introduction of the attribute-based encryption system provided in this application, please refer to the above-mentioned embodiment of the attribute-based encryption method, and the present application will not repeat it here.

A computer device provided by the present application may be a server, and its internal structure may be as shown in FIG. 4 . The computer device includes a processor, memory, network interface and database connected by a system bus. Wherein, the processor of the computer device is used to provide calculation and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer programs and databases. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer equipment is used to store relevant data of the above-mentioned attribute-based encryption method. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the above-mentioned attribute-based encryption method can be realized.

A computer device provided by the present application includes: a memory and one or more processors, where computer-readable instructions are stored in the memory, and when the computer-readable instructions are executed by the processor, the one or more processors execute any one of the above-mentioned The steps of the above-mentioned attribute-based encryption method in the embodiment.

The embodiment of the present specification also provides one or more non-volatile storage media storing computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, one or more processors can execute any one of the above-mentioned implementations. The steps of the attribute-based encryption method described above in the example.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above-mentioned embodiments can be completed by instructing related hardware through computer-readable instructions, and the computer-readable instructions can be stored in a non-volatile computer-readable When the computer-readable instructions are executed, the computer-readable instructions may include the processes of the embodiments of the above-mentioned methods. Wherein, any references to memory, storage, database or other media used in the various embodiments provided in the present application may include non-volatile and/or volatile memory. Nonvolatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Chain Synchlink DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

The technical features of the above embodiments can be combined arbitrarily. To make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be It is considered to be within the range described in this specification.

The above examples only express several implementation modes of the present application, and the description thereof is relatively specific and detailed, but should not be construed as limiting the scope of the patent for the invention. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the scope of protection of the patent application should be based on the appended claims.

Claims (14)

1. An attribute-based encryption method, characterized in that it comprises:

   Use the identity provision module to register the user's identity information and its corresponding attribute set in advance;

   Obtain from the identity providing module the attribute set corresponding to the user who is allowed to access the shared file, combine the acquired attribute set to obtain an authorization attribute set, and establish an access control matrix matching the authorization attribute set;

   Requesting a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set from the key management module based on the file identifier of the shared file and the authorization attribute set;

   receiving the public key set of the symmetric key and the asymmetric key returned by the key management module, and encrypting the shared file with the symmetric key to obtain file ciphertext, and based on the access control The matrix and the set of public keys perform attribute-based encryption on the symmetric key to obtain attribute ciphertext; and

   Combining the access control matrix, the file ciphertext, and the attribute ciphertext to obtain attribute encryption ciphertext, and uploading the attribute encryption ciphertext to the cloud storage module, so that the cloud storage module only allows The user who matches the access control matrix reads and decrypts the attribute encrypted ciphertext to obtain the shared file.
2. The attribute-based encryption method according to claim 1, characterized in that, using the key management module, a symmetric key is generated based on the file identifier of the shared file and the authorization attribute set and is related to the authorization attribute An asymmetric key corresponding to each attribute in the collection, including:

   Perform global parameter setting according to the global parameter setting function Global Setup(λ)→GP, and obtain the global parameter GP={g ₁ ,G,G _T ,Z _p ,q,p,H}; wherein, the global parameter GP is all Provided by the user; λ is a security parameter; H represents a hash function, which has a mapping function H:{0,1} ^* →G; G is a bilinear group with order q; g ₁ ∈ G; G _T is a a multiplicative cyclic group of order q; Z _p is an integer cyclic group of order p; and

   According to the key generation function GkeyGen(ID, S, GP, pk _u ) → PK, SK, sk, generate a symmetric key sk and an asymmetric key (PK, SK ), to return the public key set of the symmetric key and the asymmetric key after being encrypted by the owner public key pk _u of the shared file; wherein, ID is the file identifier; S is the authorization attribute set; PK is the public key of the asymmetric key,

   

   e is a bilinear mapping: G×G→G _T ; SK is the private key of the asymmetric key, SK={α _i , y _i }; α _i , y _i are random numbers, α _i , y _i ∈Z _p ; i is the i-th attribute corresponding to the access control matrix, there are K attributes in total, i∈{1,2,3,...,K}.
3. The attribute-based encryption method according to claim 2, wherein the public key set of the symmetric key and the asymmetric key returned by the key management module is received, and the symmetric key is used to Encrypting the shared file to obtain file ciphertext, and performing attribute-based encryption on the symmetric key based on the access control matrix and the public key set to obtain attribute ciphertext, including:

   Decrypt the ciphertext returned by the key management module based on the private key of the owner of the shared file to obtain the public key set {PK} of the symmetric key sk and the asymmetric key;

   Using the symmetric key sk to encrypt the shared file to obtain file ciphertext _C1 ; and

   Perform attribute-based encryption on the symmetric key sk based on the access control matrix A and the public key set {PK} to obtain attribute ciphertext CT={C ₂ , C ₃ , C ₄ , C ₅ }; where , A is a K×L matrix, K is the number of rows of matrix A, and L is the number of columns of matrix A;

   

   All C _3,i form C ₃ ;

   

   All C _4,i form C ₄ ;

   

   All C _5,i form C ₅ ; s ₁ is a random number, s ₁ ∈ Z _p ; λ _i =A _i ×v; A _i is the i-th row of A; v is a random vector, v∈ Z _P ^L ; v The first element of is s ₁ , and other elements are random numbers; _ri is a random number, _ri ∈ Z _p ; ρ is an attribute mapping function used to associate attributes with rows of matrix A.
4. The attribute-based encryption method according to claim 3, wherein the combination of the access control matrix, the file ciphertext and the attribute ciphertext to obtain the attribute encryption ciphertext comprises:

   Based on the access control matrix A, the file ciphertext C ₁ and the attribute ciphertext CT, the attribute encrypted ciphertext C={ID,A,ρ,C ₁ ,CT,sign}; where sign is a number sign.
5. The attribute-based encryption method according to claim 4, wherein reading the attribute-encrypted ciphertext from the cloud storage module comprises:

   When a data user accesses the cloud storage module, obtain a target attribute set corresponding to the data user from the identity providing module based on the identity information of the data user;

   Obtain the access control matrix in the attribute encrypted ciphertext;

   When the target attribute set matches the access control matrix, allowing the cloud storage module to send the attribute encrypted ciphertext to the data consumer; and

   When the target attribute set does not match the access control matrix, the cloud storage module is not allowed to send the attribute encrypted ciphertext to the data user.
6. The attribute-based encryption method according to claim 5, wherein the decryption process of the attribute-encrypted ciphertext comprises:

   When the data user uses the attribute ciphertext to access the key management module, use the key management module to obtain the target attribute set corresponding to the data user from the identity providing module, and according to the The target attribute set and the file identifier determine the target private key set corresponding to the target attribute set; and

   Decrypt the symmetric key based on the target private key set and the attribute ciphertext, and send the decrypted symmetric key to the data user after being encrypted with the public key of the data user, so as to The data user is made to use its own private key to decrypt to obtain the symmetric key, and to use the symmetric key to decrypt the file ciphertext to obtain the shared file.
7. The attribute-based encryption method according to claim 6, wherein decrypting the symmetric key based on the target private key set and the attribute ciphertext comprises:

   Find the function based on the derived private key

   

   Obtain the derived private key set K _id ; wherein, K _{x, id} is the derived private key corresponding to the xth attribute of the target attribute set; the target attribute set has a total of K ₁ attributes, and x∈{1,2,3 ,...,K ₁ }; id is the user id of the data user;

   find function from data

   

   calculate

   

   Wherein, ρ(x) represents that the attribute x is mapped to the ρ(x) row of the access control matrix A;

   The constant c _x is calculated under ∑ _x c _x A _ρ(x) = (1, 0, .., 0), and according to

   

   calculate

   

   in,

   

   

   is a positive integer; and

   According to the decryption function

   

   The symmetric key is decrypted to obtain the symmetric key sk.
8. The attribute-based encryption method according to any one of claims 1-7, wherein the attribute-based encryption method further comprises:

   When the user who is allowed to access the shared file changes, re-enter the attribute set corresponding to the user who is allowed to access the shared file from the identity providing module, combine the acquired attribute set to obtain an authorization attribute set, and establish a Steps to match the access control matrix with the set of authorization attributes described above.
9. The attribute-based encryption method according to claim 8, wherein the attribute-based encryption method further comprises:

   When the user allowed to access the shared file has not changed, do not re-enter the attribute set corresponding to the user who is allowed to access the shared file from the identity providing module, and combine the acquired attribute set to obtain an authorized attribute set, and establish and authorize The set of attributes matches the steps in the access control matrix.
10. The attribute-based encryption method according to any one of claims 1-7, wherein the attribute-based encryption method further comprises:

    When the target user loses the access right to the shared file, set the asymmetric key corresponding to the attribute set of the target user in the key management module to be invalid, so that the target user has no right to access the attribute encryption ciphertext.
11. An attribute-based encryption system, characterized in that it comprises:

    The identity provision module is used to register the user's identity information and its corresponding attribute set;

    The data owner is used to acquire from the identity providing module the attribute set corresponding to the user who is allowed to access the shared file, combine the acquired attribute set to obtain an authorization attribute set, and establish an access control matching the authorization attribute set Matrix; request a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set from the key management module based on the file identifier of the shared file and the authorization attribute set; receive the key The management module returns the public key set of the symmetric key and the asymmetric key, and encrypts the shared file with the symmetric key to obtain file ciphertext, and based on the access control matrix and the public key The key set performs attribute-based encryption on the symmetric key to obtain attribute ciphertext; combine the access control matrix, the file ciphertext and the attribute ciphertext to obtain attribute encryption ciphertext, and encrypt the attribute The ciphertext is uploaded to the cloud storage module, so that the cloud storage module only allows users matching the access control matrix to read and decrypt the attribute encrypted ciphertext to obtain the shared file;

    The key management module is configured to generate a symmetric key and an asymmetric key corresponding to each attribute in the authorization attribute set based on the file identifier of the shared file and the authorization attribute set, and generate the the set of public keys for said symmetric key and said asymmetric key are returned to said data owner; and

    The cloud storage module is used to store the attribute encryption ciphertext.
12. The attribute-based encryption system according to claim 11, wherein the identity providing module comprises:

    Identity authentication module;

    The LDAP module is used to register the user's identity information and its corresponding attribute set through the identity authentication module;

    The key management module includes:

    An attribute discrimination point, used to execute the key management process of the key generated by the key management module;

    a key storage module, configured to store the key generated by the key management module;

    The cloud storage module includes:

    an access decision point for enforcing the access control process for said attribute encrypted ciphertext; and

    The storage center is used to store the attribute encrypted ciphertext.
13. A computer device, comprising a memory and one or more processors, wherein computer readable instructions are stored in the memory, and when the computer readable instructions are executed by the one or more processors, the one or more processors are executed as claimed in claim 1 - 10 the steps of any of said methods.
14. One or more non-volatile computer-readable storage media storing computer-readable instructions, when the computer-readable instructions are executed by one or more processors, the one or more processors perform any of claims 1-10 A step of said method.

Images