A fast strategy retrieval method based on attribute bloom filter

Abstract

The present invention discloses a fast policy retrieval method based on attribute Bloom filter. The data owner generates the parameters required for platform operation and generates the available private key of the data user by using the subject attributes. The data owner formulates the access control policy and converts the policy into a linear secret sharing matrix to realize the construction of the policy and publish it to the blockchain. Before knowing the message to be encrypted, the data owner performs a large number of pre-calculations based on the public parameters. When the message to be encrypted is known, the ciphertext is quickly generated. During policy retrieval, the attribute matching function is reconstructed by using the attribute Bloom filter, and the specific position of the subject attribute is quickly located by using the hash function. If the attribute mapping function can be successfully constructed, it proves that the attribute of the data user meets the access policy formulated by the data owner, otherwise it indicates that there is no permission to access. Finally, the address of the object resource is decrypted, and the pressure of the chain retrieval is dispersed through multiple clients, the system retrieval time is improved, and data sharing is completed.

Description

Technical Field

[0001] The present invention belongs to the field of big data and access control technology, and specifically relates to the problem of retrieving ciphertext access control policies in blockchain. The method utilizes the transparency of blockchain to propose a ciphertext policy retrieval technology based on attribute Bloom filter, which realizes the rapid positioning of the policy and ensures the retrieval speed of the policy, thus meeting the requirements of data security sharing. Background Art

[0002] With the rapid development and application of big data, the secure sharing of user data is an urgent problem to be solved. Access control is one of the important supporting technologies for achieving data security and privacy protection. Due to the problems of opaque policy execution, inflexible dynamic data management, poor autonomy of resource owners, and single point failures that lead to performance bottlenecks, the traditional "centralized" access control technology is difficult to apply to the new computing environment that processes massive, dynamic and distributed data. Given the advantages of blockchain such as decentralization, transparency, and immutability, the current decentralized access control technology based on blockchain is gaining increasing attention. There are two types of access control methods based on blockchain. One is to use the immutable characteristics of blockchain to combine it with the existing access control model as a trusted entity. The other is an access control mechanism based on smart contracts, which designs an access control model based on transactions and smart contracts.

[0003] However, current research on decentralized access control based on blockchain proposes to encrypt and store access control policies on the blockchain. When the subject and object attributes in the policy are encrypted, neither unauthorized users nor authorized users can know the subject and object attributes involved in the access policy, which makes decryption a challenging problem. In addition, when there are too many access control policies stored on the chain, the retrieval speed of the policy will inevitably become a bottleneck of the entire system. How to quickly and accurately retrieve the corresponding policy is another important problem that needs to be solved urgently. To this end, the present invention proposes a fast policy retrieval method based on attribute Bloom filter, which aims to achieve efficient retrieval of ciphertext policies on the blockchain, while ensuring correct authorization, and not affecting the user experience. Summary of the invention

[0004] Aiming at the problem of retrieving ciphertext access control policies on blockchain, the present invention constructs an attribute Bloom filter based on a linear secret sharing matrix, realizes the retrieval of encrypted access control, and completes the security identification of permissions.

[0005] The present invention proposes a policy retrieval method based on attribute Bloom filter. The implementation of this method involves four entities: data owner, data accessor, blockchain platform and cloud storage service. These four entities cooperate with each other to jointly complete the secure access control of data. Among them:

[0006] ① Data owner: is the owner of the data and has absolute management authority over the data. Its important responsibility is to upload the object resources to the cloud server for storage, formulate corresponding access control policies, initiate transaction applications through the blockchain client, and upload them to the blockchain.

[0007] ②Data accessor: accessor of object resources. When the attributes of the data owner meet the access control policy specified by the data owner, the address of the object resource can be obtained, otherwise it cannot be accessed.

[0008] ③ Blockchain platform: The blockchain platform is the infrastructure of the entire architecture model, which mainly includes the data layer, storing corresponding policy information, smart contracts, subject attribute information, etc.

[0009] ④ Cloud storage service: used to store object resources and interact with blockchain and users to complete data access and sharing.

[0010] The specific process of the method proposed by the present invention is as follows:

[0011] Step 1: Object upload stage

[0012] First, assuming that the cloud data server is trustworthy, the data owner stores the data on the cloud database server and returns the address (address) and digest value (hash) of the stored data. The digest value is mainly used to verify the integrity of the cloud data, and the data address will be used as an object resource to control the access of different subjects to the address through access control policies.

[0013] In the Step 2 policy generation phase, the data owner formulates the access control policy and stores the access control policy in the policy library managed by the policy management contract.

[0014] ①Convert the attribute-related logical expression into a linear secret sharing matrix (LSSS) to obtain (M,ρ).

[0015] At this time, the policy can be expressed as: Policy1:result(R,action,pid)→Θ{(M,ρ)}signature_owner, where signature_owner is the signature of the data owner, pid represents the policy ID, and only when Θ{(M,ρ)} is true, the requester is allowed to perform an action on the resource R; where ρ is an attribute matching function that will leak attribute information.

[0016] ②Remove the attribute matching function ρ and introduce the attribute Bloom filter to achieve policy encryption.

[0017] setup(1 λ )→(PK,MSK) (1)

[0018] The initialization algorithm inputs the security parameter λ and outputs the public key PK and the master key MSK. The initialization algorithm selects two cyclic groups G0 and G1 of order p, where g is the generator of G0. Arbitrarily select h, k, q∈G0, α, β∈Zp to calculate the public key and the master key.

[0019] PK={G0,p,g α ,g β ,h,k,e(g,g) α} (2)

[0020] MSK={α} (3)

[0021] ③ The data owner calculates the key SK based on the attributes of different data users. The algorithm inputs the public key PK, the master key MSK and the attribute set of the data user, and outputs the key SK. After obtaining SK, the public key of the data user is used to encrypt SK to obtain SK'.

[0022] KeyGen(PK,MSK,S)→SK (4)

[0023] ④The data owner encrypts the address of the object resource through the access policy (M, ρ) and the public key PK to obtain the ciphertext CT.

[0024] Enc(PK,address,(M,ρ))→CT (5)

[0025] In the encryption phase, the data owner performs pre-encryption calculations based on the subject's attribute information. Then, when the message to be encrypted is known, the data owner accelerates the generation of ciphertext and then constructs ABF. When the encrypted information is unknown, the data owner performs linear secret sharing on the encrypted information according to the specified access control structure to obtain the shared vectors v1, v2, ... vn. When encryption is required, the key is input to generate the ciphertext.

[0026] ⑤ The data owner constructs an attribute Bloom filter through M, ρ and inputs the access control matrix (M, ρ). The attributes related to the access control policy are associated with the row numbers corresponding to the access matrix M. For the attribute element set Se={i||ate}i∈[1,…l], the relationship between the i-th row of M and ρ is ρ(i)=ate. Then, the row number and attributes are extended to the maximum bit length by filling zeros on the left side of the bit string. Finally, ABF is constructed by calling the ABF algorithm.

[0027] ABFBuilder(M,ρ)→ABF (6)

[0028] At this time, the policy is expressed as: Policy1:result(R,action,pid)←

[0029] Θ{(CT,ABF,PK,SK')}signature_owner.

[0030] Finally, this strategy is put into the strategy library for storage. Then, for the subject attribute set Attr, select the attribute Bloom filter ABF to generate the binary vector V ABF (h,k), for k hash functions, corresponding to hk(attr j ), the storage location of the i-th attribute is hk(attr j ), by calling the kth hash function hk(attr j ), get attr j The specific location of hk(attr j ) represents the index position of the ABF. When you continue to add elements to the ABF, some positions may be occupied by previously added elements. If this happens, the existing share is reused as a share for the new element.

[0031] Step 3: Policy execution phase, when the subject issues a resource request to the data owner, the following operations are performed according to the subject's request:

[0032] ① After receiving the subject's request, the Policy Enforcement Point (PEP) calls the Attribute Authority Contract (PIP Contract) to query the relevant attribute information stored in the blockchain and constructs an attribute-based access request (AAR), which describes the subject, resource, operation and environment attributes. Then the AAR is sent to the Policy Decision Contract (PDP Contract) for access decision.

[0033] ② The policy decision contract obtains the subject attribute information S from the attribute authority contract (PIP Contract), and then passes S to the policy management contract (PAP Contract). After the PAP Contract obtains the subject attribute S to be queried, it reconstructs the attribute matching function ρ' using the attribute Bloom filter, inputs the attribute set S, ABF, and the public hash function hi. For each attribute at∈S, the location index hi(at) of the attribute at can be obtained through the hash function hi.

[0034] ABFQuery(S,ABF,PK)→ρ' (7)

[0035] If the attribute mapping function ρ' can be successfully constructed, it proves that the attributes of the data user meet the access policy set by the data owner. Then PAP Contract will assemble the constructed ρ', the ciphertext CT of the object resource address (address) and the SK' in the access policy into a triple (ρ', CT, SK') and return it to PDP Contract. If the attribute mapping function ρ' cannot be constructed, PAP Contract directly returns null to PDP Contract to indicate that access is denied. The construction process of ρ' is as follows. First, for the attribute attr in the subject attribute Attr = {attr1, ..., attr2} j Use k hash functions H1,…Hk in ABF to calculate Hi(attr j ), for each attr in the body attributes j , using V ABF (h,k)VerifyHi(attr j ) is 1, if so, it means that this attribute attr j ∈Attr, to achieve fast retrieval of subject attributes.

[0036] ③If access is allowed, PDP Contract returns (ρ', CT, SK') to the policy implementation point, and finally the policy implementation point sends the access control result to the data user.

[0037] ④ After the data user obtains (ρ', CT, SK'), he first uses his own private key to decrypt SK'; then he decrypts SK to obtain the plaintext address of the object resource.

[0038] Dec(SK,CT,ρ')→address (8)

[0039] After obtaining the address of the object resource, the corresponding object resource is accessed to complete data sharing.

[0040] Step 4: Contract deployment phase

[0041] This method uses smart contracts as agents to provide the system with query or judgment services for related attributes and policies. PIP Contract provides attribute query services; PAP Contract provides policy query services, mainly completing the construction of attribute mapping functions; PDP Contract acts as a bridge between PIP Contract and PAP Contract, providing policy judgment services. The query process is divided into two parts, on-chain and off-chain, to improve the retrieval speed.

[0042] This method is deployed in a consortium chain environment based on hyperledger fabric2.0. The processor is AMD 3600×1, the memory is 8GB, and the operating system is Ubuntu 18.04. A total of 5 physical machines are used in the experiment, of which 1 physical machine is used as the Order node and 4 physical machines are used as Peer nodes.

[0043] Access control policy retrieval:

[0044] After the data owner has formulated the access control policy, it is converted into a linear secret sharing matrix, so that the attributes related to the access control policy are associated with the row numbers corresponding to the access matrix M, that is, the attribute matching function ρ(i)=ate. Then remove the attribute mapping function ρ that can leak attribute information, construct the attribute Bloom filter ABF through the linear secret sharing matrix, and quickly determine whether the subject attribute is in the ciphertext policy library on the chain by calling k hash functions. When identifying permissions, the attribute mapping function ρ is reconstructed using the subject attribute S and ABF to complete the encryption of the policy. At the same time, before knowing the message to be encrypted, the user performs a lot of pre-calculations based on public parameters. When the message to be encrypted is known, the ciphertext can be generated quickly. The decryption link is completed on the user client, which fully reduces the pressure on the blockchain platform and disperses the decryption time to each client, thereby achieving rapid retrieval of the policy.

[0045] Compared with the prior art, the present invention has the following advantages:

[0046] 1. Realize the retrieval of the encrypted access control policy on the blockchain, hide the entire attribute in the policy, and map the subject attributes to k hash functions; when the subject makes a request, it can quickly determine whether there is the subject's attribute information in the policy library on the chain based on the subject's attributes, and quickly locate the location where it appears. While solving the privacy leakage problem of the access control policy on the blockchain, it completes the retrieval function of the encrypted policy on the chain.

[0047] 2. Using pre-decryption technology, when the encrypted information is unknown, the data owner performs linear secret sharing on the encrypted information according to the specified access control structure to obtain the shared vectors v1, v2,…vn. When encryption is required, the key is input to generate the ciphertext and quickly complete the encryption of the policy.

[0048] 3. Distribute the retrieval pressure to each client, and complete the decryption process on the user client. This will fully reduce the pressure on the blockchain platform, distribute the decryption time to each client, improve the overall system performance, and shorten the strategy retrieval time. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 Ciphertext retrieval flow chart.

[0050] Figure 2 Strategy construction timing diagram.

[0051] Figure 3 Policy retrieval sequence diagram.

[0052] Figure 4 Method deployment diagram DETAILED DESCRIPTION

[0053] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0054] The specific implementation process of the fast strategy retrieval method based on attribute Bloom filter described in the present invention is as follows: Figure 1 As shown, the following steps are included:

[0055] Step 1: Preparation phase.

[0056] Step 1.1: Generate the parameters required for policy encryption and decryption.

[0057] 1) The data owner generates the public key PK and the master key MSK based on the security parameters, see formula (1) for details.

[0058] 2) The data owner generates a key SK based on different user attributes, as shown in formula (4).

[0059] Step 1.2: Convert the access control policy specified by the data owner into a linear secret sharing matrix.

[0060] Step 2: Strategy generation phase.

[0061] The data owner constructs an access control policy based on the linear secret sharing matrix and attribute Bloom filter, as shown in formula (5-6).

[0062] Step 2.1: Generate the ciphertext of the object resource address.

[0063] 1) The data owner enters the address address of the object resource.

[0064] 2) The data owner inputs the linear secret sharing matrix.

[0065] 3) The data owner adds the public key PK required for CP-ABE encryption and obtains the ciphertext CT of the object resource address.

[0066] Step 2.2: Construct attribute Bloom filter.

[0067] 1) The data owner inputs the constructed linear secret sharing matrix (M, ρ).

[0068] 2) The data owner adds the newly generated policy to the policy library.

[0069] Step 3: Strategy execution phase.

[0070] Step 3.1: Construct an access control request AAR.

[0071] 1) The PEP receives the original request from the subject.

[0072] 2) The PIP contract queries the attribute library in the blockchain to verify the subject attributes.

[0073] 3) PEP constructs AAR based on subject attributes and sends a request for judgment.

[0074] Step 3.2: Subject authority identification, see formula (7) for details.

[0075] 1) The PAP contract queries the policy in the policy library based on the subject attributes.

[0076] 2) The PAP contract reconstructs the attribute mapping function ρ'.

[0077] 3) If 2) is constructed successfully, return the triple (ρ', CT, SK'), otherwise return null to indicate construction failure.

[0078] Step 3.3: Decrypt the object resource address, see formula (8) for details.

[0079] 1) Use the private key to decrypt SK' and get SK.

[0080] 2) Decrypt the object resource address address through SK,ρ'.

[0081] 3) Get the object resource through the address address.

Claims

1. A fast strategy retrieval method based on attribute Bloom filter, characterized in that: The following steps are involved: Step 1: Preparation stage; Step 1.1: Generate the parameters required for policy encryption and decryption; 1) The data owner generates the public key PK and the master key MSK based on the security parameters; 2) The data owner generates a key SK for different user attributes; Step 1.2: uniformly transform the access control policy specified by the data owner into a linear secret sharing matrix; Step 2: Strategy generation phase; The data owner constructs an access control policy based on the linear secret sharing matrix and attribute Bloom filter ABF; Step 2.1: Generate the ciphertext of the object resource address; 1) The data owner enters the address of the object resource; 2) The data owner inputs the linear secret sharing matrix; 3) The data owner adds the public key PK required for policy encryption and obtains the ciphertext CT of the object resource address; Step 2.2: Construct attribute Bloom filter; 1) The data owner inputs the constructed linear secret sharing matrix and uses k hash functions to map the subject attributes into the linear secret sharing matrix; 2) The data owner adds the newly generated policy to the policy library; 3) Before knowing the message to be encrypted, the data owner performs a lot of pre-calculations based on public parameters; when the message to be encrypted is known, the ciphertext is generated quickly; Step 3: Strategy retrieval phase; Step 3.1: Construct an attribute-based access request AAR; 1) The policy enforcement point PEP receives the original request from the subject; 2) PEP calls the attribute authority PIP contract to query the attribute library in the blockchain and verify the subject attributes; 3) PEP constructs AAR based on the subject attributes and sends a request decision to the policy decision PDP contract. AAR describes the subject, resources, operations and environment attributes; Step 3.2: Subject authority identification; 1) The PDP contract obtains the subject attributes from the PIP contract, and then passes the subject attributes to the policy management PAP contract. The policy management PAP contract queries and locates the policies in the policy library based on the subject attributes; 2) The PAP contract uses the attribute Bloom filter to reconstruct the attribute mapping function ρ'; 3) If 2) is constructed successfully, return the triple (ρ', CT, SK') to the PDP contract, otherwise return null to indicate access denial; Step 3.3: Decrypt the object resource address; 1) If access is allowed, the PDP contract returns (ρ', CT, SK') to PEP, and PEP sends the access control result to the data user. After the data user obtains (ρ', CT, SK'), he uses the private key in his blockchain personal information to decrypt SK' and obtain SK; 2) Decrypt the object resource address address by SK, ρ'; 3) Get the object resource through the address address; In step 2, the policy generation phase, the data owner formulates the access control policy and stores the access control policy in the policy library managed by the policy management contract: ① Convert the attribute-related logical expression into a linear secret sharing matrix LSSS to obtain (M, ρ); at this time, the policy can be expressed as: Policy1:result(R,action,pid)→Θ{(M,ρ)}signature_owner, where signature_owner is the signature of the data owner, pid represents the policy ID, and only when Θ{(M,ρ)} is true, the requester is allowed to perform an action on the resource R; Where ρ is the attribute mapping function, which will leak attribute information, and M is the access matrix; ② Remove the attribute mapping function ρ and introduce the attribute Bloom filter to achieve policy encryption; setup(1 λ )→(PK,MSK) Initialize the algorithm to input security parameter λ and output public key PK and master key MSK; ③ The data owner calculates the key SK based on the attributes of different data users. The calculation inputs the public key PK, the master key MSK and the attribute set S of the data user, and outputs the key SK; After obtaining SK, use the public key in the data user's blockchain personal information to encrypt SK to obtain SK'; ④ The data owner encrypts the address of the object resource through the access control matrix (M, ρ) and the public key PK to obtain the ciphertext CT; In the encryption phase, the data owner performs pre-encryption calculations based on the subject's attribute information. When the data owner knows the message to be encrypted, the data owner accelerates the generation of ciphertext and then constructs the attribute Bloom filter ABF. When the encrypted information is unknown, the data owner performs linear secret sharing on the encrypted information according to the specified access control structure to obtain the shared vectors v1, v2, ... vn. When encryption is required, the key is input to generate the ciphertext. ⑤ The data owner constructs an attribute Bloom filter through M, ρ, and inputs the access control matrix (M, ρ). The attributes related to the access control policy are associated with the row number corresponding to the access matrix M; For the attribute element set Se = {i||ate}, i∈[1,…l], the relationship between the i-th row of M and ρ is ρ(i) = ate, and then the row number and attribute are extended to the maximum bit length by filling the left side of the bit string with zeros, and finally the ABF is constructed by calling the ABF algorithm; at this time, the strategy is expressed as: Policy1:result(R,action,pid)←Θ{(CT,ABF,PK,SK')}signature_owner; For the subject attribute set Attr, select the attribute Bloom filter ABF to generate a binary vector V ABF (h,k), for k hash functions, the storage location of the jth attribute is hk(attr j ), by calling k hash functions, get attr j The specific location of hk(attr j ) represents the index position of ABF. When adding elements to ABF, some positions will be occupied by previously added elements. In this case, the existing share will be reused as a share of the new element. Among them, in the contract deployment, smart contracts are used as agents to provide query or judgment services for relevant attributes and strategies. The PIP contract provides attribute query services; the PAP contract provides strategy query services to complete the construction of attribute mapping functions; the PDP contract serves as a bridge between the PIP contract and the PAP contract, providing strategy judgment services; the query process is divided into two parts: on-chain and off-chain.

2. A fast strategy retrieval method based on attribute Bloom filter according to claim 1, characterized in that: First, assume that the cloud data server is trustworthy. The data owner stores the data on the cloud data server and returns the address and summary value of the stored data. The summary value is used to verify the integrity of the cloud data. The address of the stored data will be used as an object resource, and access control policies will be used to control access to the address by different subjects.

3. The fast strategy retrieval method based on attribute Bloom filter according to claim 1, characterized in that: Access control policy retrieval: After the data owner has formulated the access control policy, it is converted into a linear secret sharing matrix, so that the attributes related to the access control policy are associated with the corresponding row numbers of the access matrix M, that is, the attribute mapping function ρ(i)=ate; then the attribute mapping function ρ that can leak attribute information is removed, and the attribute Bloom filter ABF is constructed through the linear secret sharing matrix. By calling k hash functions, it is quickly determined whether the subject attribute is in the ciphertext policy library on the chain; when identifying permissions, the subject attribute information and ABF are used to reconstruct the attribute mapping function ρ to complete the encryption of the policy.

Images