An access token application control method based on attribute encryption mechanism

Abstract

The present invention relates to the field of network information security technology, and in particular to an access token application control method based on an attribute encryption mechanism, comprising the following steps: S1, a trusted third party generates public parameters of the attribute encryption mechanism: Setup(λ)→(params, mpk, msk), generates system parameters params, a master public key mpk, and a master private key msk; S2, the trusted third party generates a private key of a user attribute ω for a user: KeyGen(mpk, msk, ω); S3, a server performs attribute encryption on the access token: Encrypt(mpk, A, m): encrypts the access token m∈{0, 1}* in the set of authorized user attribute strings A; S4, the user receives the ciphertext access token and performs attribute decryption: Decrypt(ct, sk): decrypts the ciphertext access token ct using the user's private key sk. The present invention can encrypt the access token using the attribute encryption mechanism according to the user's access permission attributes, thereby ensuring that the access token cannot be correctly decrypted even if the attributes are changed due to a change in user permissions or a network attack.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and in particular to an access token application control method based on an attribute encryption mechanism. Background Art

[0002] In the user management method of general application systems, after a user passes identity authentication, the authorization server issues an application access token to the user based on the user's access rights. The user then submits the application access request and the access token to the application server. The application server verifies the legitimacy of the user's access token. If it passes verification, the application server responds to the user's access request; otherwise, the application server rejects the user's access request. During this process, although the access token has an expiration date, the user's access rights remain unchanged during the validity period. In other words, even if the user's rights in the authorization server have changed, the user still has a valid access token and can continue to access the application system. Furthermore, once the access token is leaked, an attacker can directly use the access token to impersonate the original user and access the application system without identity authentication. Summary of the Invention

[0003] In response to the shortcomings of the existing technology, the present invention provides an access token application control method based on the attribute encryption mechanism. The access token is encrypted using the attribute encryption mechanism according to the user's access permission attributes. Only when the user has the correct attributes can the access token be correctly decrypted, thereby ensuring that the access token cannot be correctly decrypted even if the attributes are changed due to changes in user permissions or due to network attacks.

[0004] The present invention is achieved through the following technical solutions:

[0005] A method for controlling access token application based on attribute encryption mechanism is provided, comprising the following steps:

[0006] S1. A trusted third party generates public parameters for the attribute encryption mechanism: Setup(λ)→(params, mpk, msk), generating system parameters params, master public key mpk, and master private key msk;

[0007] S2. The trusted third party generates a private key for the user attribute ω: KeyGen(mpk, msk, ω);

[0008] S3. The server encrypts the access token attributes: Encrypt(mpk, A, m): encrypt the access token m∈{0, 1}* in the set of authorized user attribute strings A;

[0009] S4. The user receives the encrypted access token and decrypts the attributes: Decrypt(ct, sk): Use the user's private key sk to decrypt the encrypted access token ct.

[0010] Furthermore, in step S1, the execution steps for generating system parameters params, master public key mpk and master private key msk are as follows:

[0011] (1) Run the bilinear group generation algorithm G(λ) to generate (p, G1, G2, G T , g1, g2, e); input security parameters, output three groups G1, G2, G of prime order p T Description;

[0012] (2) Select two hash functions H1: {0, 1} n →G1 and H2: G T →Z p * ;

[0013] (3) Select two random exponents α, β∈Z p * ;

[0014] (4) Select the IND-CPA secure symmetric encryption scheme SYM = (Enc, Dec), the SUF-CMA secure message authentication code MAC = (Mac, Vrfy) and the secure key derivation function KDF;

[0015] (5) Return system parameters, master public key and master private key: params = (H1, H2, SYM, MAC, KDF), mpk = (g1, g1 α , g1 β , g2, g2 β ), msk=(α, β).

[0016] Furthermore, in step (4), the IND-CPA secure symmetric encryption scheme SYM=(Enc, Dec) is: the encryption algorithm Enc uses the key k∈{0,1} n and plaintext message m∈{0,1} * As input, returns the ciphertext c∈{0, 1} * , n is related to the security parameter; the decryption algorithm Dec inputs the key k and the ciphertext c and returns the message m.

[0017] Furthermore, in step (4), the SUF-CMA secure message authentication code MAC=(Mac, Vrfy) is: The label generation algorithm Mac input key k∈{0,1} n and message m∈{0,1} *, returns label t, n is the key length, which is related to the security parameters, and * indicates that the message length is not fixed; the verification algorithm Vrfy inputs the key k, the message m and the label t, and returns 1 to indicate that t is valid, so m is credible; returns 0 to indicate that t is invalid, so m is untrustworthy.

[0018] Furthermore, in step (4), the secure key derivation function KDF is: takes four parameters as input: a value σ sampled from a key material source, a value l representing the key length to be returned, and two additional parameters, a salt value r defined on a set of possible salt values ​​and a context variable c, both of which are optional, i.e., can be set to an empty string or a constant; if the output distribution of the key derivation function is computationally consistent with {0, 1} l The function is safe if it is indistinguishable from a uniform distribution on .

[0019] Furthermore, in step S2, the step of generating the user private key of the user attribute ω is as follows: calculating h ω =H1(ω)∈G1; select a random number r∈Z p * , return the private key sk=(g αβ 1h r ω , g r 2).

[0020] Furthermore, in step S3, when encrypting the access token: select a random exponent s∈Z p * ; Calculate h ω =H1(ω)∈G1, Calculate σ=H2(e(g1 α , g2 β ) s ); execute the Deffie-Hellman-based encryption scheme DHIES; return the ciphertext ct = (c1, c2, c3, g2 s ,{h ω s} ω∈A ).

[0021] Furthermore, the execution steps of the encryption scheme DHIES are: select a random number k∈Z p * , let c1=g1 β g1 k ; Calculate K = KDF (c1 σ , l1+l2), split the binary string into two substrings K1 and K2 of length l1 and l2 respectively, K=K1||K2; l1 and l2 match the key lengths of the underlying SYM and MAC schemes respectively; calculate c2=Enc k1(m) and c3 = Mac k2 (c2).

[0022] Further, in step S4, the steps of decrypting the ciphertext access token ct with the user's private key sk are: searching for h in ct s ω , whose index ω is the same as g1 in sk αβ h ω r If the search fails, return ⊥ and halt; otherwise, set h s ω is the return value of the search, and then calculate ρ=e(g1 αβ h ω r , g2 s ) / e(h ω s , g2 r ) = e(g1, g2) αβs e(h ω , g2) rs / e(h ω , g2) sr =e(g1, g2) αβs ; Calculate σ = H2(ρ); Use DHIES to recover m and return the plaintext access token m.

[0023] Furthermore, the steps to recover m using DHIES are: calculate k=KDF(c1 σ , l1+l2) and split the binary string k into two substrings k1 and (k=k1||k2)k2 of length l1 and l2 respectively; l1 and l2 match the key lengths of the underlying SYM and MAC schemes respectively; calculate b=Vrfy(c3,Mac k2 (c2)), if b = 0, return ⊥ and halt; otherwise, calculate m = Dec k1 (c2).

[0024] Beneficial effects of the present invention:

[0025] The present invention encrypts the access token based on the attribute encryption mechanism. Only when the user has the attributes that meet the access control permissions can the access token be correctly decrypted and the application system be accessed. It is used to solve the security problems in the general access token application process. When the user does not have the corresponding attributes, or no longer has certain attributes due to changes in access permissions, or certain attributes change due to network attacks, the access token cannot be correctly decrypted, thereby preventing the leakage of the access token. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1This is a flowchart of encryption and decryption of access token attributes in the present invention. DETAILED DESCRIPTION

[0027] In order to clearly illustrate the technical features of this solution, this solution is described below through specific implementation methods.

[0028] A method for controlling access token application based on attribute encryption mechanism, comprising the following steps:

[0029] S1. A trusted third party generates public parameters for the attribute encryption mechanism: Setup(λ)→(params, mpk, msk), generating system parameters params, master public key mpk, and master private key msk;

[0030] The steps to generate system parameters params, master public key mpk and master private key msk are as follows:

[0031] (1) Run the bilinear group generation algorithm G(λ) to generate (p, G1, G2, G T , g1, g2, e); input security parameters, output three groups G1, G2, G of prime order p T Description;

[0032] (2) Select two hash functions H1: {0, 1} n →G1 and H2: G T →Z p * ;

[0033] (3) Select two random exponents α, β∈Z p * ;

[0034] (4) Select the IND-CPA secure symmetric encryption scheme SYM = (Enc, Dec), the SUF-CMA secure message authentication code MAC = (Mac, Vrfy) and the secure key derivation function KDF;

[0035] Where: The symmetric encryption scheme SYM=(Enc, Dec) with IND-CPA security is: the encryption algorithm Enc is encrypted with the key k∈{0,1} n and plaintext message m∈{0,1} * As input, returns the ciphertext c∈{0, 1} * , n is related to the security parameter, the decryption algorithm Dec inputs the key k and the ciphertext c and returns the message m.

[0036] The secure message authentication code MAC=(Mac, Vrfy) of SUF-CMA is: The tag generation algorithm Mac inputs the key k∈{0,1} n and message m∈{0,1}* , returns label t, n is the key length, which is related to the security parameters, and * indicates that the message length is not fixed; the verification algorithm Vrfy inputs the key k, the message m and the label t, and returns 1 to indicate that t is valid, so m is credible; returns 0 to indicate that t is invalid, so m is untrustworthy.

[0037] The secure key derivation function KDF is: takes four parameters as input: a value σ sampled from a key material source, a value l indicating the key length to be returned, and two additional parameters, a salt value r defined on a set of possible salt values ​​and a context variable c, both of which are optional, i.e., they can be set to an empty string or a constant; if the output distribution of the key derivation function is computationally consistent with {0, 1} l The function is safe if it is indistinguishable from a uniform distribution on .

[0038] (5) Return system parameters, master public key and master private key: params = (H1, H2, SYM, MAC, KDF), mpk = (g1, g1 α , g1 β , g2, g2 β ), msk=(α, β).

[0039] S2. A trusted third party generates a private key for the user attribute ω: KeyGen(mpk, msk, ω): Calculate h ω =H1(ω)∈G1; select a random number r∈Z p * , return the private key sk=(g αβ 1h r ω , g r 2).

[0040] S3. The data owner, i.e. the server, encrypts the access token attributes: Encrypt(mpk, A, m): Encrypt the access token m∈{0, 1}* in the set of authorized user attribute strings A; When encrypting the access token: Select a random exponent s∈Z p * ; Calculate h ω =H1(ω)∈G1, Calculate σ=H2(e(g1 α , g2 β ) s ); Execute the Deffie-Hellman-based encryption scheme DHIES: select a random number k∈Z p * , let c1=g1 β g1 k ; Calculate K = KDF (c1 σ, l1+l2), split the binary string into two substrings K1 and K2 of length l1 and l2 respectively, K=K1||K2; l1 and l2 match the key lengths of the underlying SYM and MAC schemes respectively; calculate c2=Enc k1 (m) and c3 = Mac k2 (c2);

[0041] Return ciphertext ct = (c1, c2, c3, g2 s ,{h ω s} ω∈A ).

[0042] S4. The user receives the encrypted access token and performs attribute decryption: Decrypt(ct, sk): Use the user's private key sk to decrypt the encrypted access token ct. The specific steps are: Find h in ct s ω , whose index ω is the same as g1 in sk αβ h ω r If the search fails, return ⊥ and halt; otherwise, set h s ω is the return value of the search, and then calculate ρ=e(g1 αβ h ω r , g2 s ) / e(h ω s , g2 r ) = e(g1, g2) αβs e(h ω , g2) rs / e(h ω , g2) sr =e(g1, g2) αβs ; Calculate σ=H2(ρ); Use DHIES to recover m: Calculate k=KDF(c1 σ , l1+l2) and split the binary string k into two substrings k1 and (k=k1||k2)k2 of length l1 and l2 respectively; l1 and l2 match the key lengths of the underlying SYM and MAC schemes respectively; calculate b=Vrfy(c3,Mac k2 (c2)), if b = 0, return ⊥ and halt; otherwise, calculate m = Dec k1 (c2);

[0043] Returns the plaintext access token m.

[0044] Of course, the above description is not limited to the above examples. Technical features not described in the present invention can be achieved by or by adopting existing technologies, which will not be described here. The above embodiments and drawings are only used to illustrate the technical solutions of the present invention and are not limitations of the present invention. The present invention is described in detail with reference to the preferred implementation methods. Ordinary technicians in this field should understand that changes, modifications, additions or substitutions made by ordinary technicians in this technical field within the essential scope of the present invention do not depart from the purpose of the present invention and should also fall within the scope of protection of the claims of the present invention.

Claims

1. A method for controlling access token application based on attribute encryption mechanism, characterized by: The following steps are involved: S1. A trusted third party generates public parameters for the attribute encryption mechanism: Setup(λ) → (params, mpk, msk), generating system parameters params, master public key mpk, and master private key msk. In step S1, the execution steps for generating system parameters params, master public key mpk and master private key msk are as follows: (1) Run the bilinear group generation algorithm G(λ) to generate (p, G1, G2, G T , g1, g2, e); input security parameters, output three groups G1, G2, G of prime order p T Description; (2) Select two hash functions H1: {0, 1} n →G1 and H2: G T →Z p * ; (3) Select two random exponents α, β∈Z p * ; (4) Select the IND-CPA secure symmetric encryption scheme SYM=(Enc, Dec), the SUF-CMA secure message authentication code MAC=(Mac, Vrfy), and the secure key derivation function KDF; The symmetric encryption scheme SYM=(Enc, Dec) with IND-CPA security is: the encryption algorithm Enc uses the key k∈{0,1} n and plaintext message m∈{0,1} * As input, returns the ciphertext c∈{0, 1} * , n is related to the safety parameters; The decryption algorithm Dec takes as input the key k and the ciphertext c and returns the message m; SUF-CMA secure message authentication code MAC=(Mac, Vrfy) is: label generation algorithm Mac input key k ∈ {0, 1} n and plaintext message m ∈ {0, 1} * , returns label t, n is the key length, which is related to the security parameters, and * indicates that the message length is not fixed; the verification algorithm Vrfy inputs the key k, the message m and the label t, and returns 1 to indicate that t is valid, so m is credible; returns 0 to indicate that t is invalid, so m is untrustworthy; A secure key derivation function (KDF) is a function that takes as input four parameters: a value σ sampled from a key material source, a value l representing the length of the key to be returned, and two additional parameters, a salt value r defined over a set of possible salt values ​​and a context variable c, both of which are optional, i.e., they can be set to an empty string or a constant; if the output distribution of the key derivation function is computationally consistent with {0, 1} l The function is safe if the uniform distribution on is indistinguishable; (5) Return system parameters, master public key and master private key: params = (H1, H2, SYM, MAC, KDF), mpk= (g1,g1 α ,g1 β ,g2,g2 β ),msk=(α,β); S2. The trusted third party generates a private key for the user attribute ω: KeyGen(mpk, msk, ω); Steps for generating the user private key for the user attribute ω: Calculate h ω =H1(ω)∈G1; select a random number r∈Z p * , return the private key sk=(g αβ 1 h r ω , g r 2); S3. The server encrypts the access token attributes: Encrypt(mpk, A, m): encrypts the plaintext access token ct∈{0, 1}* in the set of authorized user attribute strings A; S4. The user receives the encrypted access token and decrypts the attributes: Decrypt(ct, sk): Use the user's private key sk to decrypt the encrypted access token c ct .

2. The access token application control method based on attribute encryption mechanism according to claim 1, characterized in that: In step S3, when encrypting the access token: select a random exponent s∈Z p * ; Calculate h ω =H1(ω)∈G1,∀ω∈A; calculate σ=H2(e(g1 α , g2 β ) s ); Execute the Deffie-Hellman-based encryption scheme DHIES; Returns the encrypted access token c ct =(c1, c2, c3, g2 s ,{h ω s } ω∈A ).

3. The access token application control method based on attribute encryption mechanism according to claim 2, characterized in that: The execution steps of the encryption scheme DHIES are: select a random number k∈Z p * , let c1=g1 β g1 k ; Calculate K=KDF(c1 σ , l1+l2), split the binary string into two substrings K1 and K2 of length l1 and l2 respectively, K=K1‖K2; l1 and l2 match the key lengths of the underlying SYM and MAC schemes respectively; calculate c2=Enc k1 (m) and c3 = Mac k2 (c2).

4. The access token application control method based on attribute encryption mechanism according to claim 1, characterized in that: In step S4, the encrypted access token c is decrypted using the user's private key sk ct The steps are: Find h in ct s ω , whose index ω is the same as g1 in sk αβ h ω r If the search fails, return ⊥ and halt; otherwise, set h s ω is the return value of the search, and then calculate ρ=e(g1 αβ h ω r , g2 s ) / e(h ω s , g2 r ) = e(g1, g2) αβs e(h ω , g2) rs / e(h ω , g2) sr =e(g1,g2) αβs ; Calculate σ = H2 (ρ); Use DHIES to recover m and return the plaintext access token ct.

Images