A revocable user identity-based encryption method

Abstract

This invention provides a revocable user identity-based encryption method, belonging to the field of cryptography, and solves the technical problem of high key update overhead when revoking a user in identity-based encryption. The technical solution includes the following steps: S10, system initialization; S20, user private key generation; S30, updated private key generation; S40, user decryption key generation; S50, encryption algorithm; S60, decryption algorithm; S70, user revocation algorithm. The beneficial effect of this invention is that it greatly reduces the computational overhead for system administrators during key updates.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cryptography, and particularly relates to a revocable identity-based encryption method. BACKGROUND

[0002] In 1984, Shamir et al. proposed the concept of identity-based encryption (IBE). In 2001, Boneh et al. proposed the first practical IBE scheme. In IBE, there are two kinds of entities, system administrator and user. The system administrator generates a system master key, and uses the system master key to compute a system public key. The system administrator keeps the system master key secret, and publishes the system public key. The system administrator generates a user private key for each user according to the user's unique global identity, and sends the user private key to the user in secret. A sender encrypts a message using the receiver's identity and the system public key, and sends the ciphertext to the receiver. The receiver can successfully decrypt the ciphertext and recover the message using his own private key. Compared with traditional public key encryption, IBE does not require a public key infrastructure, i.e. users do not need to prove the validity of their public keys, which greatly improves the efficiency of encryption.

[0003] When a user's private key is stolen or the private key expires in an IBE system, the system administrator needs a method to effectively revoke the user. To solve this problem, Boneh et al. proposed a method of periodically updating the user's private key to achieve user revocation. In their IBE scheme [1], the ciphertext is related to the user's identity and the encryption time. When a user is revoked, the system administrator generates an update key for all unrevoked users, and sends the update key to the unrevoked users in secret, thereby achieving user revocation. However, the workload of the update key is linearly related to the number of users. When the number of users is large, the workload of the system administrator may become a bottleneck of the system. SUMMARY

[0004] The present application aims to provide a revocable identity-based encryption method. To solve the technical problem of excessive workload of the system administrator during key update, the subset covering technique of complete binary tree is introduced into identity-based encryption. Through reasonable design, part of the users can share the update key, thereby greatly reducing the workload of the system administrator and improving the efficiency of the update key.

[0005] The inventive concept of this invention is as follows: In the method of this invention, the system administrator selects the system master key, calculates and publishes the system public key, and sets and publishes the user revocation list, user list, and the latest system status. Users submit their identities to the system administrator, who constructs a complete binary tree, connecting each user to a leaf node of the binary tree, thus obtaining the path from the leaf node to the root node. For each node in this path, the system administrator constructs a node private key, and all node private keys in the path constitute the user's private key. This invention divides all time into several time periods, such as one day, each time period being called a cycle. At the end of each cycle at time t, the system administrator publishes the update key for the next cycle. The system administrator uses the revocation list to obtain the set of leaf nodes corresponding to all revoked users in the binary tree, generating a cover set of leaf nodes for all non-revoked users, such that each non-revoked user has exactly one leaf node or its ancestor node in the cover set, while the leaf node and its ancestor node corresponding to a revoked user are not in the cover set. For each node in the overlay set, the system administrator generates a node update key using the system master key. All node update keys constitute the system update key. The administrator publishes the system update key. As determined by the overlay set construction method, each unrevoked user can find a node in the binary tree. This user simultaneously possesses the user's private key and the system update key for that node. These two keys constitute the decryption key for the unrevoked user at time t. However, a revoked user cannot find a node in the binary tree, meaning they possess both the user's private key and the system update key for that node, and therefore cannot generate a decryption key. The ciphertext is dependent on the recipient's identity and time, preventing the revoked user from decrypting the ciphertext. Through this method, the system administrator periodically updates the system update key, allowing some users to share it, thereby reducing the administrator's workload during key updates and improving efficiency.

[0006] To achieve the aforementioned objectives, the present invention employs the following technical solution: a method for revocable user identity-based encryption, comprising the following steps:

[0007] S10, System initialization phase: The system administrator selects a security parameter, specifies the maximum number of users and a complete binary tree, selects the system master key MK, calculates and publishes the public parameter PK, sets and publishes the user revocation list rl, the user list UL and the latest system status st;

[0008] S20. During the private key generation phase, the user submits their identity to the system administrator, who assigns the user to a leaf node in a binary tree and obtains all nodes on the path from that leaf node to the root node of the binary tree. For each node on the path, the system administrator uses the system master key MK to calculate a node private key for the user. All node private keys constitute the user's private key. The system administrator secretly sends the user's private key to the user and updates the status st′.

[0009] S30. During the key update phase, at system update time t, the system administrator obtains the set of leaf nodes in the binary tree corresponding to the revoked users based on the revocation list rl and the user list UL. Using the subset covering algorithm of the complete binary tree, the system administrator obtains the cover set of unrevoked users. For each node in the cover set, the system administrator calculates a node private key using the system master key. All the above node private keys constitute the system update key, and the system administrator publishes the update key.

[0010] S40. During the decryption key generation phase, according to the subset covering algorithm of the complete binary tree, each unrevoked user can find two node private keys in their own private key and the system update key, so that these two node private keys have a common node; the user uses these two node private keys as their decryption key.

[0011] S50, during the encryption phase, user ω' uses the public parameter PK and user ω's identity to encrypt message m and time t to obtain ciphertext C, and then sends the ciphertext to user ω;

[0012] S50. During the decryption phase, after receiving the ciphertext C, if user ω is not revoked at time t, he / she can obtain message m using his / her decryption key at time t; otherwise, decryption fails.

[0013] S70, User Revocation Phase: If user ω is revoked at time t, the system administrator adds the user to the user revocation list rl and updates the status.

[0014] Further, step S10 includes:

[0015] S101. The system administrator selects security parameter κ and sets the maximum number of users N. max Construct a complete binary tree BT of height h, which has 2... h-1 There are 2 leaf nodes, and they satisfy 2 h-1 ≥N max For each node v∈BT in the binary tree, select a random number a. v ∈Z p * Set a function f corresponding to this node. v (y)=a vy+1, and set the tuple (v, f) of each node to y+1. v (y) is stored in a function list FL;

[0016] S102. The system administrator first generates a prime p-order cyclic group G, G T and bilinear mapping e: G×G→G T Choose a generator g∈G, and choose four random numbers a1, a2, b1, b2∈Z. p *,calculate Set both the user list (UL) and the undo user list (rl) to empty sets.

[0017] S103, System Administrator Public Access Revoke the list rl and state st = (BT, UL), and secretly store the system master key MK = (a1, a2, b1, b2, FL);

[0018] Further, step S20 includes:

[0019] S201. Assume that a user has a globally unique identity ω∈Z p * Submit identity ω∈Z to the system administrator p * The system administrator randomly selects an unspecified leaf node u∈BT in the binary tree BT, maps the user identity ω to the leaf node u, stores (ω.u) in the user list UL, and then updates the state st=(BT,UL);

[0020] S202. The system administrator traverses the set of all nodes along the path from the leaf node u to the root node, denoted as Path(u). For any node x∈Path(u), the system administrator retrieves the list of functions. The function f corresponding to the middle node x x (y)=a x y+1, select a random number r 1，x ∈Z p * Calculate using the system master key Obtain the user's private key SKω={(x, r 1，x D x )|x∈Path(u)}, where the user with identity ω is assigned to the leaf node u, Path(u) is the set of all nodes on the path from the leaf node u to the root node, and x is any node in the set Path(u);

[0021] S203, The system administrator will pass the user's private key SKω={(x, r 1，x D x The function )|x∈Path(u) is secretly sent to user ω, updating the state st;

[0022] Further, step S30 includes:

[0023] S301. To revoke a specified user in the system at time t, the system administrator needs to calculate the update private key at time t for the unrevoked users. Assuming user ω' is revoked at time t' and t' ≤ t, the system administrator adds (ω', t') to the user revocation list rl at time t. Based on the user list UL = {(ω, v)}, the system administrator obtains the set R of leaf nodes corresponding to all revoked users in the binary tree BT. The system administrator then uses the subset covering algorithm in the complete subtree scheme to obtain the covering set CV of the unrevoked user set. R This makes CV R The CV does not include the leaf node and its ancestor nodes corresponding to the user who canceled the registration. R It only contains the leaf node corresponding to the user who has not revoked, or one of its ancestor nodes.

[0024] S302, For each node x∈CV R System administrator retrieves function list The function f corresponding to the middle node x x (y)=a x y+1, select a random number r 2，x ∈Z p *,calculate Get updated private key KU t ={(x, r)} 2，x E x )|x∈CV R}, where CV R Let x be the overlay set of the set of leaf nodes R corresponding to users who have not revoked at time t, and let x be the overlay set CV. R Nodes in;

[0025] S303, The system administrator publishes the update status st and the update private key KU. t ={(x, r)} 2，x E x )|x∈CV R Further, step S40 includes:

[0026] S401. Unrevoked user's use of their private key SKω={(x, r 1，x D x )|x∈Path(u)} and the system update key KU published by the system administrator t ={(x, r)} 2，x E x )|x∈CV R}, find a node x∈Path(u)∩CV in the binary tree. RExtract a tuple (x, r) from the private key SKω corresponding to node x. 1，x D x ), from updating key KU t Extract a tuple (x, r) corresponding to the node x. 2，x E x Combine these two tuples to obtain the decryption key DK at time t. ω，t ={x,r 1，x D x r 2，x E x}, where node x is the private key SKω of the unrevoked user ω and the system update private key KU at time t. t The only identical node is the node x. User ω will use node x's private key SKω and the system update private key KU. t Constructing the decryption key DK ω，t Otherwise, if the user is a revoked user, the decryption key at time t will not be obtained;

[0027] Further, step S50 includes:

[0028] S501. In order to construct a secret channel from user ω' to user ω at time t, user ω' encrypts message m using the common parameter PK and selects a random number s∈Z. p * Calculate C0 = m·e(g, g) s C1 = (X1g) ω ) s C2 = (Y1) s C3 = (X2g) t ) s C4 = (Y2) s We obtain the ciphertext C = (ω, t, C0, C1, C2, C3, C4) and send this ciphertext C to user ω;

[0029] Further, step S60 includes:

[0030] S601. User ω receives ciphertext C = (ω, t, C0, C1, C2, C3, C4). If user ω is not revoked at time t, they obtain their decryption key DK at time t based on the time t in the ciphertext. ω，t ={r 1，x D x r 2，x E x};calculate Receive message m;

[0031] S602. If user ω has been revoked at time t, the ciphertext cannot be decrypted and message m cannot be obtained.

[0032] Further, step S70 includes:

[0033] S701. If user ω is revoked at time t, the system administrator uses the user list UL = {(ω, u)} to obtain the leaf node u corresponding to the revoked user ω in the binary tree, adds (u, t) to the user revocation list rl, and executes the three steps S301, S302, and S303 in sequence to complete the user revocation.

[0034] The RIBE scheme of this invention, compared with the well-known related scheme BGK in terms of efficiency and performance, assumes a prime number p-order bilinear group e: G×G→G T In this context, E represents the exponentiation operation in group G, and P represents the bilinear pairing operation e: G × G → G T r represents the number of users who canceled, N max This represents the maximum number of users. The bilinear pairing operation P is e: G × G → G. T The computational cost is far greater than that of exponentiation in group G.

[0035] Compared with the BGK[2] method, the encryption process of BGK requires 12 power-multiplication operations on an elliptic curve. The encryption process of the present invention requires 7 power-multiplication operations on an elliptic curve. The decryption process of BGK requires 2 power-multiplication operations and 4 bilinear pairing operations on an elliptic curve. The encryption process of the present invention requires 4 power-multiplication operations and 2 bilinear pairing operations on an elliptic curve, but the power-multiplication operation is much faster than the bilinear pairing operation. Therefore, the encryption efficiency of the present method is much higher than that of BGK. In addition, the key update workload of the present method is 14.3% of that of BGK.

[0036] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0037] (1) This invention proposes a revocable user identity-based encryption method that uses a complete binary tree to significantly reduce the workload of the system administrator in updating keys. When a new user is revoked within the current time period, the system administrator generates an updated user revocation list rl. Using the user list UL and a subset covering algorithm of the complete binary tree, a set of nodes covering unrevoked users is obtained. For each node in the covering set, the update private key corresponding to each node is calculated, and the update private keys of all nodes constitute the system update private key. The system administrator publishes the system update private key. This method enables the sharing of update private keys, thereby greatly reducing the workload of the system administrator when updating private keys. The key update workload of the system administrator during key updates using this method is 14.3% of that of BGK.

[0038] (2) In the revocable user identity-based encryption method provided by this invention, the ciphertext is related to the user's identity and the encryption time. The ciphertext consists of the user's identity, the encryption time, and four bilinear group elements. Decryption requires only four bilinear group exponentiation operations and two bilinear pairing operations. Compared with the BGK scheme, this method reduces the workload of the system administrator during key updates without increasing the workload of user encryption and decryption. Attached Figure Description

[0039] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0040] Fig. 1 The flowchart illustrates a revocable user identity-based encryption method provided by this invention.

[0041] Fig. 2 This is an example diagram illustrating the combination of a leaf node path in a binary tree and the overlay when a user is revoked, as provided by the present invention. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. Of course, the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0043] Example 1

[0044] See Figs. 1-2 This embodiment provides a technical solution: a revocable user identity-based encryption method, such as... Fig. 1 The process includes: system initialization, user private key generation, update key generation, user decryption key generation, encryption, decryption, and user revocation. The system administrator selects and secretly stores the system master key, and calculates and publishes the system's public parameters. User private keys are generated for each user, and the system update key is calculated and published. Unrevoked users construct their own decryption key using their private key and the system update key. User ω calculates the ciphertext using the system public key, user ω''s identity, and time t. Unrevoked user ω' receives the ciphertext and decrypts it using their own decryption key to obtain the message. Finally, the system administrator generates the system update key for the next time period based on the latest user revocation list to implement user revocation.

[0045] This embodiment provides a revocable user identity-based encryption method, which specifically includes the following steps:

[0046] S10, System initialization phase: The system administrator selects a security parameter, specifies the maximum number of users and a complete binary tree, selects the system master key MK, calculates and publishes the public parameter PK, sets and publishes the user revocation list rl, the user list UL and the latest system status st;

[0047] S20. During the private key generation phase, the user submits their identity to the system administrator, who assigns the user to a leaf node in a binary tree and obtains all nodes on the path from that leaf node to the root node of the binary tree. For each node on the path, the system administrator uses the system master key MK to calculate a node private key for the user. All node private keys constitute the user's private key. The system administrator secretly sends the user's private key to the user and updates the status st′.

[0048] S30. During the key update phase, at system update time t, the system administrator obtains the set of leaf nodes in the binary tree corresponding to the revoked users based on the revocation list rl and the user list UL. Using the subset covering algorithm of the complete binary tree, the system administrator obtains the cover set of unrevoked users. For each node in the cover set, the system administrator calculates a node private key using their own private key. All the above node private keys constitute the system update key, and the system administrator publishes the update key.

[0049] S40. During the decryption key generation phase, according to the subset covering algorithm of the complete binary tree, each unrevoked user can find two node private keys in their own private key and the system update key, so that these two node private keys have a common node; the user uses these two node private keys as their decryption key.

[0050] S50, during the encryption phase, user ω' uses the public parameter PK and user ω's identity to encrypt message m and time t to obtain ciphertext C, and then sends the ciphertext to user ω;

[0051] S50. During the decryption phase, after receiving the ciphertext C, if user ω is not revoked at time t, he / she can obtain message m using his / her decryption key at time t; otherwise, decryption fails.

[0052] S70, User Revocation Phase: If user ω is revoked at time t, the system administrator adds the user to the user revocation list rl and updates the status.

[0053] Further, step S10 includes:

[0054] S101. The system administrator selects security parameter κ and sets the maximum number of users N. max Construct a complete binary tree BT of height h, which has 2... h-1 There are 2 leaf nodes, and they satisfy 2 h-1 ≥Nmax For each node v∈BT in the binary tree, select a random number a. v ∈Z p * Set a function f corresponding to this node. v (y)=a v y+1, and set the tuple (v, f) of each node to y+1. v (y) is stored in a function list FL;

[0055] S102. The system administrator first generates a prime p-order cyclic group G, G T and bilinear mapping e: G×G→G T Choose a generator g∈G, and choose four random numbers a1, a2, b1, b2∈Z. p *,calculate Set both the user list (UL) and the undo user list (rl) to empty sets.

[0056] S103, System Administrator Public Access Revoke the list rl and state st = (BT, UL), and secretly store the system master key MK = (a1, a2, b1, b2, FL);

[0057] Further, step S20 includes:

[0058] S201. Assume that a user has a globally unique identity ω∈Z p * Submit identity ω∈Z to the system administrator p * The system administrator randomly selects an unspecified leaf node u∈BT in the binary tree BT, maps the user identity ω to the leaf node u, stores (ω.u) in the user list UL, and then updates the state st=(BT,UL);

[0059] S202. The system administrator traverses the set of all nodes along the path from the leaf node u to the root node, denoted as Path(u). For any node x∈Path(u), the system administrator retrieves the list of functions. The function f corresponding to the middle node x x (y)=a x y+1, select a random number r 1，x ∈Z p * Calculate using the system master key Obtain the user's private key SKω={(x, r 1，x D x )|x∈Path(u)}, where the user with identity ω is assigned to the leaf node u, Path(u) is the set of all nodes on the path from the leaf node u to the root node, and x is any node in the set Path(u);

[0060] S203, The system administrator will pass the user's private key SKω={(x, r 1，x D x The function )|x∈Path(u) is secretly sent to user ω, updating the state st;

[0061] Further, step S30 includes:

[0062] S301. To revoke a specified user in the system at time t, the system administrator needs to calculate the system update key at time t for the unrevoked users. Assuming user ω' is revoked at time t' and t' ≤ t, the system administrator adds (ω', t') to the user revocation list rl at time t. Based on the user list UL = {(ω, u)}, the system administrator obtains the set R of leaf nodes corresponding to all revoked users in the binary tree BT. The system administrator then uses the subset covering algorithm in the complete subtree scheme to obtain the covering set CV of all unrevoked users. R This makes CV R The CV does not include the leaf node and its ancestor nodes corresponding to the user who canceled the registration. R It only contains the leaf node corresponding to the user who has not revoked, or one of its ancestor nodes.

[0063] S302, For each node x∈CV R System administrator retrieves function list The function f corresponding to the middle node x x (y)=a x y+1, select a random number r 2，x ∈Z p *,calculate Get updated private key KU t ={(x, r)} 2，x E x )|x∈CV R}, where CV R Let x be the overlay set of the set of leaf nodes R corresponding to users who have not revoked at time t, and let x be the overlay set CV. R Nodes in;

[0064] S303, The system administrator publishes the update status st and the update private key KU. t ={(x, r)} 2，x E x )|x∈CV R};

[0065] Further, step S40 includes:

[0066] S401. Unrevoked user's use of their private key SKω={(x, r 1，x D x)|x∈Path(u)} and the update private key KU published by the system administrator t ={(x, r)} 2，x E x )|x∈CV R}, find a node x∈Path(u)∩CV in the binary tree. R Extract a tuple (x, r) from the private key SKω corresponding to node x. 1，x D x ), from updating key KU t Extract a tuple (x, r) corresponding to the node x. 2，x E x Combine these two tuples to obtain the decryption key DK at time t. ω，t ={x,r 1，x D x r 2，x E x}, where node x is the private key SKω of the unrevoked user ω and the system update private key KU at time t. t The only identical node is the node x. User ω will use node x's private key SKω and the system update private key KU. t Constructing the decryption key DK ω，t Otherwise, if the user is a revoked user, the decryption key at time t will not be obtained;

[0067] Further, step S50 includes:

[0068] S501. In order to construct a secret channel from user ω' to user ω at time t, user ω' encrypts message m using the common parameter PK and selects a random number s∈Z. p * Calculate C0 = m·e(g, g) s C1 = (X1g) ω ) s C2 = (Y1) s C3 = (X2g) t ) s C4 = (Y2) s We obtain the ciphertext C = (ω, t, C0, C1, C2, C3, C4) and send this ciphertext C to user ω;

[0069] Further, step S60 includes:

[0070] S601. User ω receives ciphertext C = (ω, t, C0, C1, C2, C3, C4). If user ω is not revoked at time t, they obtain their decryption key DK at time t based on the time t in the ciphertext. ω，t ={r 1，x D x r2，x E x};calculate Receive message m;

[0071] S602. If user ω has been revoked at time t, the ciphertext cannot be decrypted and message m cannot be obtained.

[0072] Further, step S70 includes:

[0073] S701. If user ω is revoked at time t, the system administrator uses the user list UL = {(ω, v)} to obtain the leaf node v corresponding to the revoked user ω in the binary tree, adds (v, t) to the user revocation list rl, and executes the three steps S301, S302, and S303 in sequence to complete the user revocation.

[0074] The following explains some of the terms mentioned in this embodiment:

[0075] A complete binary tree: all nodes except leaf nodes have two child nodes. If v is a non-leaf node, use v. l v r Let v represent the left and right child nodes, respectively, and let root represent the root node of the binary tree. Let u be a leaf node, and Path(u) represent the set of all nodes from the leaf node u to the root node root. Fig. 2 As shown, the path of user 1 in the binary tree is Path(1) = {1, 9, 13, 15}.

[0076] Subset Covering Algorithm (CV) R Let R be the set of leaf nodes in the binary tree corresponding to all users who have revoked their memberships. First, mark the leaf nodes in R as revoked nodes. Then, mark the ancestor nodes of these leaf nodes as revoked nodes. Finally, output the set CV, which is the cover set of the left and right child nodes of all revoked nodes, representing the unrevoked users. R This makes CV R The CV does not include the leaf node and its ancestor nodes corresponding to the user who canceled the registration. R This only contains the leaf nodes corresponding to users whose user account was not revoked, or one of their ancestor nodes. For example, if user u4 revokes their account, the node corresponding to u4 and its ancestor nodes are first marked as revoke nodes. The left or right child nodes of these revoke nodes are the overriding nodes of users whose account was not revoked. Fig. 2 As shown, when user 4 is revoked, the set of revoked users R = {4}, then the set of unrevoked users CV is the overlay set. R ={3, 9, 14}.

[0077] Let G, G T Let e ​​be a cyclic group of order p prime numbers, where e: G × G → G T It is a mapping. If it satisfies:

[0078] 1) Bilinear: For any g1, g2 ∈ G, x, y ∈ Zp, e(g1) x g2 y ) = e(g1, g2) xy

[0079] 2) Non-degeneracy: If g is a generator of G, then e(g, g) is a generator of G. T The generator.

[0080] 3) Computability: G, G T If both the group action and e are computable in polynomial time, then e is said to be: G×G→G T Let G be a bilinear pair, and let G be a bilinear group.

[0081] 2(l+1)-DBDHI hypothesis. Randomly select x, z∈Z p Let g∈G be a generator of G. Given a 2l+4 tuple g, g x , T, if any polynomial practical algorithm A is determined Or T = e(g,g) z For G T If the advantage of random elements is negligible, then the 2(l+1)-DBDHI hypothesis is true.

[0082] In this example, we will explain the reduction of participant communication overhead and privacy protection, highlighting how this method reduces participant communication overhead and protects participant privacy.

[0083] The reduction in communication overhead is explained below:

[0084] Table 1 Performance Comparison of Schemes

[0085]

[0086] Note: E represents exponentiation, and P represents bilinear pairing.

[0087] In this embodiment, the RIBE scheme, compared with the well-known related scheme BGK in terms of efficiency and performance, assumes a prime p-order bilinear group e: G×G→G T In this context, E represents the exponentiation operation in group G, and P represents the bilinear pairing operation e: G × G → G T r represents the number of users who canceled, N max This represents the maximum number of users. The bilinear pairing operation P is e: G × G → G. T The computational cost is far greater than that of exponentiation in group G.

[0088] Compared to the BGK method, which requires 12 power-multiplication operations on an elliptic curve for encryption, this embodiment requires 7 power-multiplication operations. BGK's decryption process requires 2 power-multiplication operations and 4 bilinear pairing operations on an elliptic curve. This embodiment's encryption process requires 4 power-multiplication operations and 2 bilinear pairing operations, but power-multiplication operations are much faster than bilinear pairing operations. Therefore, this method is significantly more efficient than BGK, and its key update workload is only 14.3% of BGK's.

[0089] The following demonstrates the security measures:

[0090] Theorem: Suppose there exists an attacker A who can break the RIBOOE scheme, then an algorithm B can be constructed to break the 2(l+1)-DBDHI hypothesis.

[0091] Start: A submits challenge identity ω * Challenge Time t * and t * Time Challenge Cancel List rl * .

[0092] Initialization: B received in or Z∈G T B generates a complete binary tree, a user list UL, and a function list FL, and sets ω * Specify a random leaf node u * And save (ω) * ,u * ) to UL. Let t * The time-to-cancel list is RL * If ω * ∈R, define FixedSubset(ω) * )={Path(u * Otherwise, define The function list FL is set as follows:

[0093] (1) Randomly select y∈Z p Save (x=ω) * ,αy) to FL;

[0094] (2) Randomly select y∈Z p Save (x = t) * From αy) to FL, note the linear function f u (X) is determined by two points (0, 1) and (x, αy).

[0095] B sets the undo list RL and the state ST = (BT, UL), and randomly selects w1, w2, ... w l-1 For system runtime t1, ...,t π-1 ,t π =t * ,t π+1 ,...,t l Calculate the polynomial of degree 2(l-1).

[0096]

[0097] structure

[0098] When i∈{1,2,...,l-1}, B is calculated.

[0099]

[0100]

[0101] When i∈{1,...,l}\{π}, B calculates

[0102]

[0103] Notice This will be used to construct the user's private key and update key.

[0104] B calculation

[0105] when hour, Otherwise T h For G T Random elements in.

[0106] B randomly selects a, b, c, d ∈ Z. p * such that ab=ω*, cd=t*.

[0107] calculate

[0108] X1=(P α ) -a P -ab =P -a(α+b) Y1 = P α ,

[0109] X2=(P 3α ) -c P -cd =P -c(3α+d) Y2=P 3α .

[0110] The public parameter is published as (P, X1, Y1, X2, Y2). Note that the public parameter implicitly sets the administrator's private key.

[0111] a1=-a(α+b), b1=α, a2=-c(3α+d), b2=3α,

[0112] And a1+ab1=-ab=-ω*, a2+cb2=-cd=-t*.

[0113] Phase 1A adaptively performs private key update key queries.

[0114] Targeting identity ω i Private key query, when ω i When ≠ω*, first construct a temporary key component at point (0, 1).

[0115]

[0116] If (ω i If ,*)∈UL, then download (ω) from UL. i Otherwise, randomly select u such that And save (ω) i ,u) to UL, get

[0117] For each node z ∈ Path(u), Path(u) retrieves the list of functions (u, f). u If z∈FixedSubset(ω*), construct a temporary key component (x=ω*,αy).

[0118]

[0119] According to the Lagrange interpolation formula, the private key at this point is...

[0120]

[0121] like Construct a temporary key component for (x = t*, ay)

[0122]

[0123] According to the Lagrange interpolation formula, the private key at this point is...

[0124]

[0125] When ω i =ω * At this time, there must be ω. * ∈R * Download from UL (ω) * ,u * ),get for At this point, we have (x = ω) * The private key for this point is (αy).

[0126]

[0127] Generate private key as

[0128] Attacker A against time T i The update key query, when t i When ≠t*, first construct a temporary key component at point (0, 1).

[0129]

[0130] If t is defined i The set of users who cancel at any given time, R, is obtained, along with the overlay set, CV. RI , Search function list (u, f u (x)), if Construct the temporary key component at (x=ω*,αy)

[0131]

[0132] According to the Lagrange interpolation formula, the update key for this point is...

[0133]

[0134] like Construct the temporary key component at (x=t*,αy)

[0135]

[0136] According to the Lagrange interpolation formula, the update key for this point is...

[0137]

[0138] When t i When t = t*, define t * The set of users who cancel at any given time, R * and obtain the covered set.

[0139] When ω*∈R*, FixedSubset(ω*) = Path u *,CV RI* ∩FixedSubset(ω*)=φ.

[0140] when When, FixedSubset(ω*)=φ,CV RI*∩FixedSubset(ω*)=φ.

[0141] In summary, CV RI* ∩FixedSubset(ω*)=φ, for nodes Search function list (u,f u (x)). By We can obtain (x=t*,αy), and the update key for generating this node is:

[0142] Generate update key as

[0143] Challenge: A submits two messages M0 and M1. B randomly selects μ∈{0,1} to construct the challenge ciphertext as: B's implicit setting

[0144] calculate:

[0145]

[0146] C2 = Y1 s =P,

[0147] C4 = (Y2) s =P 3 ,

[0148] when At that time, C0 = M μ e(P, P) s The ciphertext of C1, C2, C3, C4.

[0149] When Z∈G T In this case, C0, C1, C2, C3, and C4 are the ciphertext of the random message.

[0150] It is speculated that when A outputs μ'∈{0,1}, and μ'=μ, B outputs 1. Otherwise, B outputs 0.

[0151] Table 2 provides an explanation of the main symbols used in this scheme.

[0152]

[0153]

[0154] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A revocable identity-based encryption method of a user, characterized by, The method comprises the following steps: S10, a system initialization stage, a system administrator selects a security parameter, specifies a maximum number of users and a complete binary tree, selects a system master key MK, calculates and publishes a public parameter PK, sets and publishes a user revocation list rl, a user list UL and a system latest state st; S20, a private key generation stage, a user submits an identity to the system administrator, the system administrator assigns the user to a leaf node in the binary tree, obtains all nodes on a path from the leaf node to a root node of the binary tree; for each node on the path, the system administrator calculates a node private key of the user by using the system master key MK, and all node private keys constitute a private key of the user; the system administrator secretly sends the private key of the user to the user, and updates a state st'; S30, a key update stage, at an update system time t, the system administrator obtains a leaf node set corresponding to revoked users in the binary tree according to the revocation list rl and the user list UL, obtains an unrevoked user covering set by using a subset covering algorithm of the complete binary tree; for each node in the covering set, the system administrator calculates a node update private key by using the system master key, and all node update private keys constitute a system update key, and the system administrator publicly discloses the system update key; S40, a decryption key generation stage, according to the subset covering algorithm of the complete binary tree, each unrevoked user finds two node private keys in the private key of the user and the system update key, so that the two node private keys have a common node; the user uses the two node private keys as a decryption key of the user; S50, an encryption stage, a user ω' uses the public parameter PK, an identity of a user ω to encrypt a message m and a time t, to obtain a ciphertext C, and then sends the ciphertext to the user ω; S50, a decryption stage, after the user ω receives the ciphertext C, if the user ω is not revoked at the time t, the user ω uses a decryption key of the user ω at the time t to obtain the message m; otherwise, decryption fails; S70, a revoked user stage, if the user ω is revoked at the time t, the system administrator adds the user to the user revocation list rl and updates the state st'.

2. The revocable identity-based encryption method of claim 1, wherein, The step S10 comprises the following steps: S101、system administrator selects security parameter κ, sets the maximum number of users N max , constructs a complete binary tree BT with height h, the binary tree has 2 h-1 leaf nodes, and satisfies 2 h-1 ≥N max , for each node v∈BT in the binary tree, select a random number a v ∈Z p *, set a function f v (y)=a v y+1 corresponding to the node, and store the binary tuple (v, f v (y)) of each node into a function list FL; S102, the system administrator first generates a prime number p order cyclic group G, G T and bilinear mapping e: G x G→ G T , select a generator g∈G, select four random numbers a1, a2, b1, b2∈Z p *, calculate Set the user list UL and the revoked user list r1 to empty sets; S103、system administrator discloses public parameters Revoke list rl and state st = (BT, UL), and keep system master key MK = (a1, a2, b1, b2, FL) secret.

3. The revocable identity-based encryption method of claim 1, wherein, The step S20 comprises the following steps: S201. Assume that a user has a globally unique identity ω∈Z p * Submit identity ω∈Z to the system administrator p * The system administrator randomly selects an unspecified leaf node u∈BT in the binary tree BT, maps the user identity ω to the leaf node u, stores (ω.u) in the user list UL, and then updates the state st=(BT,UL); S202, the system administrator traverses all node sets on the path from the leaf node u to the root node, denoted as Path(u), and for any node x e Path(u), the system administrator retrieves the function list the function f corresponding to the intermediate node x x (y) = a x y + 1, selects a random number r 1，x e Z p *, calculates using the system master key obtains the user private key SKω = {(x, r 1，x , D x )x e Path(u)}, wherein the user of the identity ω is assigned to the leaf node u, Path(u) is all node sets on the path from the leaf node u to the root node, and x is any node in the set Path(u); S203, the system administrator sends the user private key SKω= {(x, r 1，x , D x )x∈Path(u)} to the user ω in secret, and updates the state st.

4. The revocable identity-based encryption method of claim 1, wherein, The step S30 comprises the following steps: S301, in order to revoke the designated user in the system at time t, the system administrator needs to calculate the update private key of the non-revoked user at time t; assume that user ω' is revoked at time t' and t'≤t, the system administrator adds (ω', t') to the user revocation list rl at time t, obtains the leaf node set R corresponding to all revoked users in the binary tree BT according to the user list UL={(ω, u)}, and obtains the cover set CV of the leaf node set R by using the subset cover algorithm in the complete subtree scheme R , so that the leaf node corresponding to the revoked user and its ancestor node are not contained in CV R , and the leaf node corresponding to the non-revoked user or one ancestor node of the leaf node is contained in CV R . S302, for each node x e CV R , the system administrator retrieves the function list corresponding to node x f x (y) = axy+1, select a random number r 2，x e Z p *, calculate get the updated private key KU t = {(x, r 2，x , E x )x e CV R}, wherein CV R is the cover set of the leaf node set R corresponding to the non-revoked user at time t, and x is a node in the cover set CV R . S303, the system administrator publishes the update status st and the update private key KU t = {(x, r 2，x , E x ) | x e CV R}.

5. The revocable identity-based encryption method of claim 1, wherein, The step S40 comprises the following steps: S401. Unrevoked user's use of their private key SKω={(x, r 1，x D x x∈Path(u)} and the update private key KU published by the system administrator t ={(x, r)} 2，x E x x∈CV R }, find a node x∈Path(u)∩CV in the binary tree. R Retrieve a tuple (x, r) corresponding to node x from the user's private key SKω. 1，x D x ), update key KU from the system t Extract a tuple (x, r) corresponding to the node x. 2，x E x Combine these two tuples to obtain the decryption key DK at time t. ω，t ={x, r 1，x D x r 2，x E x }, where node x is the private key SKω of the unrevoked user ω and the system update private key KU at time t. t The only identical node is the node x. User ω will use node x's private key SKω and the system update private key KU. t Constructing the decryption key DK ω，t Otherwise, if the user is a revoked user, the decryption key at time t will not be obtained.

6. The revocable identity-based encryption method of claim 1, wherein, The step S50 comprises the following steps: S501, in order to construct a secret channel from user ω' to user ω at time t, user ω' encrypts message m and time t using public parameter PK, selects a random number s∈Z p *, calculates C0=m·e(g,g) s , C1=(X1g ω ) s , C2=(Y1) s , C3=(X2g t ) s , C4=(Y2) s , obtains ciphertext C=(ω,t,C0,C1,C2,C3,C4), and sends the ciphertext C to user ω.

7. The revocable identity-based encryption method of claim 1, wherein, The step S60 comprises the following steps: S601, User ω receives the ciphertext C=(ω, t, C0, C1, C2, C3, C4), if user ω is not revoked at time t, according to the time t in the ciphertext to get his own decryption key DK at time t ω，t = {r 1，x , D x , r 2，x , E x}; calculate to get the message m; S602, if the user ω is revoked at the time t, the user ω cannot decrypt the ciphertext and cannot obtain the message m.

8. The revocable identity-based encryption method of claim 1, wherein, The step S70 comprises the following steps: S701, if the user ω is revoked at the time t, the system administrator obtains a leaf node v corresponding to the revoked user ω in the binary tree by using the user list UL={(ω, v)}, adds (v, t) to the user revocation list rl, and sequentially executes the steps S301, S302 and S303 to complete revocation of the user.

Images