Data controlled sharing method and system based on attribute-based encryption

Abstract

The invention discloses a data controlled sharing method and system based on attribute-based encryption, and the system is characterized in that a key generation center generates a system public key PK, a main private key MK and a user private key SK, a server gateway configures an access strategy, carries out the encryption processing of a data plaintext and the access strategy, generates a ciphertext, and uploads the ciphertext to a storage device for storage. Wherein the access strategy is converted into a mode that an LSSS matrix is embedded into a ciphertext; the one or more data controlled sharing gateways verify whether the attribute set of the data decryption party meets the access strategy according to the ciphertext and the user private key; if yes, the data plaintext is recovered and obtained by calculating the reconstruction coefficient of the LSSS matrix. According to the invention, the algorithm is simplified, and the system operation efficiency and stability are improved; the system does not need to adopt block chain storage, so that the system architecture design is simplified, the deployment is convenient, the cost is low, and the data security is high.

Description

Technical Field

[0001] The present invention relates to the technical field of data sharing, and particularly to a method and system for controlled data sharing based on attribute-based encryption. Background Art

[0002] Regarding the security and privacy issues of the smart grid, Chinese invention patent CN 111986755 B discloses a data sharing system based on blockchain and attribute-based encryption, which realizes a decentralized, tamper-proof, and traceable data security sharing model based on a distributed blockchain system, and uses attribute-based encryption to protect user privacy medical data, and realizes fine-grained access control of the owner to the data based on cryptographic methods.

[0003] However, the following aspects need to be improved in the system architecture and algorithm of this solution:

[0004] First, this solution requires blockchain for storage, which has high costs, cannot be directly applied to existing systems, and has low scalability.

[0005] Second, in the solution, the shared resource address Res_addr is encrypted and decrypted, and the data is stored in a third-party cloud storage service, which is prone to denial-of-service attacks.

[0006] Third, the generation algorithm of the user private key SK uses point multiplication operations of elliptic curves with a relatively large number of times. The algorithm is relatively complex and has low operation efficiency. Errors (including misusing parameters) are likely to occur during implementation, and the security is challenged. Summary of the Invention

[0007] Aiming at the above defects, the technical problem to be solved by the present invention is to provide a method and system for controlled data sharing based on attribute-based encryption, so as to solve the problems of complex algorithms, low operation efficiency, high costs, low scalability, and the data being stored in a third-party cloud storage service and being prone to denial-of-service attacks in the prior art.

[0008] To this end, the present invention provides a method for controlled data sharing based on attribute-based encryption, including the following steps:

[0009] In the system initialization stage, based on the bilinear groups <G0, G ,

[0007] ,

[0006] , ,

[0005] , T ,

[0010] , ,

[0004] ,

[0009] , , ,

[0008] , , >, and the user attribute set of the data decryptor, generate the system public key PK, the master private key MK, and the user private key SK. The master private key MK is stored in the key generation center, the system public key PK is announced by the key generation center, and the user private key SK is sent to the data decryptor;

[0010] The data encryption party configures an access policy, encrypts the data plaintext and the access policy, generates a ciphertext CT, and uploads it to a storage device for storage. Among them, the access policy is converted into a linear secret sharing scheme LSSS matrix W and embedded in the ciphertext CT;

[0011] The data decryption party uses the ciphertext CT and the user private key SK to verify whether the attribute set of the data decryption party satisfies the access policy; if it is satisfied, the reconstruction coefficient w of the LSSS matrix W is calculated i and the data plaintext is recovered; if not, the operation of recovering the data plaintext is cancelled.

[0012] In the above method, preferably, when the user attributes of the data decryption party become invalid, the key generation center issues a revocation list, the data encryption party re-encrypts the data plaintext and the access policy to generate a new ciphertext, and the data decryption party re-applies to the key generation center and obtains a new user private key.

[0013] In the above method, preferably, in the system initialization phase, a system public key PK, a master private key MK, and a user private key SK are generated, which specifically include the following steps:

[0014] Select a security parameter λ, and generate a bilinear mapping e: G0×G0→G of prime order p T , where G0 = G1, a generator of G0 is g, and e(g, g) is a generator of G T ;

[0015] Randomly select a first parameter α and a second parameter β, and calculate the system public key PK, the master private key MK, and the user private key SK based on the bilinear group. α and β are random numbers, α, β ∈ Zp, and Zp is a finite field composed of integers {0, 1,..., p - 1};

[0016] Among them, the system public key PK = (g, h = g β , e(g, g) α );

[0017] The master private key MK = (β, g α );

[0018] The user private key SK = (D, Dx1, Dx1′,......, Dxi, Dxi′,......, Dxn, Dxn′);

[0019] h is a hash function, and the calculated hash value is H;

[0020] e(g, g) α ∈G T is an element in G T and is used to recover the key during decryption;

[0021] Global Component Used to bind the user identity and the system master private key;

[0022] The parameter r is the user random number, the parameter rx is the attribute random number, and r and rx are unique random numbers for each user and each attribute;

[0023] The attribute-related component Dxi = g r ·H(xi) r is used to bind the user attribute x i to the user random number r;

[0024] The attribute-related component Dxi′ = g rx is used to bind the user attribute x i to the attribute random number rx;

[0025] H(x) r is the user attribute hash, which is used to map the user attribute xi to a group element.

[0026] In the above method, preferably, a random temporary key s is selected, and the data plaintext M is used to generate the ciphertext CT, and the LSSS matrix W is embedded in the ciphertext CT;

[0027] where CT = (C, C′, Ci);

[0028] The first ciphertext component C = M·e(g,g) αs is used to blind the data plaintext M through the bilinear mapping result e(g,g) αs ;

[0029] The second ciphertext component C′ = g βs is used to bind the random temporary key s and the second parameter β, and is used to verify whether the user private key satisfies the access policy during decryption;

[0030] The third ciphertext component is used to generate the ciphertext component C i for each attribute x i , a i is the row vector parameter of the LSSS matrix W, and H(x i ) -s is used to bind the attribute hash value and the random temporary key s to prevent unauthorized decryption.

[0031] In the above method, preferably, by calculating the reconstruction coefficient w i of the LSSS matrix W, the method for recovering the data plaintext is as follows:

[0032] Calculate the reconstruction coefficient w i of the LSSS matrix W such that ∑ i∈I w i ai =(1, 0, …, 0), where I is the set of row indices satisfying ρ(i) ∈ S, and a i is the i-th row vector of the LSSS matrix W;

[0033] Calculate the pairing term of the ciphertext CT and the private key to recover e(g, g) αs ;

[0034] Use e(g, g) αs to solve for the plaintext M,

[0035] The present invention also provides a data-controlled sharing system based on attribute-based encryption, including:

[0036] A key generation center for generating a system public key PK, a master private key MK, and a user private key SK during the system initialization phase;

[0037] A server gateway is set at the end of the data provider. Multiple data providers are connected to the server gateway. The server gateway is equipped with an attribute-based encryption module and a policy configuration module. The policy configuration module is used to define fine-grained access policies. The attribute-based encryption module is used to perform attribute-based encryption processing on the shared data plaintext M and the access policy according to the request of the data provider, and generate the ciphertext CT to be uploaded to the storage device for storage; wherein, the access policy in the attribute-based encryption processing is converted into a linear secret sharing scheme LSSS matrix W and embedded into the ciphertext CT;

[0038] One or more data-controlled sharing gateways are set at the end of the data decryptor. One data-controlled sharing gateway can be connected to one or more data decryptors. Each data-controlled sharing gateway has an access control module and a ciphertext storage module. The ciphertext storage module is used to temporarily store the received ciphertext CT and perform the operation of recovering the data plaintext locally; the access control module is used to verify whether the attribute set of the data decryptor meets the access policy according to the request of the data decryptor, using the ciphertext CT and the user private key SK; if it meets, then by calculating the reconstruction coefficient w of the LSSS matrix W i and recover the data plaintext; if it does not meet, then cancel the operation of recovering the data plaintext.

[0039] Based on the above technical solutions, the present invention does not rely on blockchain, simplifies the system architecture, is convenient for deployment and has low cost. The system architecture adopts an end-to-end encryption design, and any third party other than the communication parties cannot know the communication data content, so it has high security. The server gateway encrypts the shared data plaintext provided by each data provider, and the data-controlled sharing gateway processes the decryption requests of each data decryptor. Both the server gateway and the data-controlled sharing gateway can be connected to multiple terminals at any time, and have strong expansion ability.

[0040] In the above system, the key generation center real-time detects the validity of the user attributes of the data decryptor. When the user attributes of the data decryptor become invalid, the key generation center publishes a revocation list. The data encryptor re-encrypts the data plaintext and the access policy to generate a new ciphertext, and the data decryptor re-applies to the key generation center to obtain a new user private key.

[0041] In the above system, preferably, the key generation center generates a system public key PK, a master private key MK, and a user private key SK during the system initialization phase, which specifically includes the following steps:

[0042] Select a security parameter λ and generate a bilinear mapping e: G0×G1→G with a prime order p, T , where G0 = G1, a generator of G0 is g, and e(g, g) is the generator of G T ;

[0043] Randomly select a first parameter α and a second parameter β, and calculate the system public key PK, the master private key MK, and the user private key SK based on the bilinear group. α and β are random numbers, α, β ∈ Zp, and Zp is a finite field composed of integers {0, 1,..., p - 1};

[0044] Among them, the system public key PK = (g, h = g β , e(g, g) α );

[0045] The master private key MK = (β, g α );

[0046] The user private key SK = (D, Dx1, Dx1′,......, Dxi, Dxi′,......, Dxn, Dxn′);

[0047] h is a hash function, and the calculated hash value is H;

[0048] e(g, g) α is used to recover the key during decryption;

[0049] In the above system, preferably, the server gateway selects a random temporary key s, generates a ciphertext CT for the data plaintext M, and embeds an LSSS matrix W in the ciphertext CT;

[0050] Among them, CT = (C, C′, C i );

[0051] The first ciphertext component C = M·e(g, g) αs , which is used to blind the data plaintext M through the bilinear mapping result e(g, g) αs ;

[0052] The second ciphertext component C′ = gβs for binding the random temporary key s and the second parameter β, which is used to verify whether the user's private key meets the access policy during decryption;

[0053] The third ciphertext component For each attribute x i The generated ciphertext component C i , a i is the row vector parameter of the LSSS matrix W, H(x i ) -s for binding the attribute hash value and the random temporary key s to prevent unauthorized decryption.

[0054] In the above system, preferably, the data-controlled sharing gateway recovers the data plaintext by calculating the reconstruction coefficient w of the LSSS matrix W i , and the specific method is as follows:

[0055] Calculate the reconstruction coefficient w of the LSSS matrix W i , such that ∑ i∈I w i a i =(1, 0, …, 0), I is the set of row indices satisfying ρ(i) ∈ S, and a i is the i-th row vector of the LSSS matrix W;

[0056] Calculate the pairing term of the ciphertext CT and the private key to recover e(g, g) αs ;

[0057] Use e(g, g) αs to solve for the plaintext M,

[0058] As can be seen from the above technical solutions, the data-controlled sharing method and system based on attribute-based encryption provided by the present invention solve the problems of complex algorithms, low operation efficiency, high cost, low scalability, and easy denial-of-service attacks in the prior art. Compared with the prior art, the present invention has the following beneficial effects:

[0059] Simplify the algorithm, improve the operation efficiency and system stability; by converting the access policy into an LSSS matrix and embedding it into the ciphertext, dynamic fine-grained access control is achieved, supporting multi-dimensional permission management such as "department + role + time".

[0060] The system does not need to use blockchain storage, simplifies the system architecture design, is convenient to deploy and has low cost. Among them, the end-to-end encryption design ensures that any third party other than the two communication parties cannot know the communication data content (including the storage service provider), improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce and explain the drawings required for describing the embodiments of the present invention or the prior art. Obviously, the drawings in the following description are only partial embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0062] Figure 1 Schematic diagram of a data controlled sharing system based on attribute-based encryption provided by the present invention;

[0063] Figure 2 Flowchart of a data controlled sharing method based on attribute-based encryption provided by the present invention. Detailed implementation manners

[0064] The following will clearly and completely describe the technical solutions of the embodiments of the present invention in conjunction with the drawings of the embodiments of the present invention. Obviously, the following described embodiments are only part of the embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0065] To more clearly explain and illustrate the technical solutions and implementation manners of the present invention, the following introduces several preferred specific embodiments for implementing the technical solutions of the present invention.

[0066] It should be noted that the orientation words such as "inside, outside", "front, back", and "left, right" in this article are expressed based on the product use state as the reference object. Obviously, the use of the corresponding orientation words does not limit the protection scope of the present solution.

[0067] As Figure 1 shown, a data controlled sharing system based on attribute-based encryption provided by the present invention includes a key generation center 10 (KCC), a server gateway 20, and one or more data controlled sharing gateways 30.

[0068] The key generation center 10 is used to generate a system public key PK, a master private key MK, and a user private key SK based on a bilinear group <G0, G T > and the user attribute set of the data decryptor during the system initialization phase. The master private key MK is stored in the key generation center, the system public key PK is published by the key generation center 10, and the user private key SK is sent to the data controlled sharing gateway 30 for use by the data decryptor.

[0069] The server gateway 20 is set at the data provider end, and multiple data providers (terminals) are connected to the server gateway 20. An attribute-based encryption module and a policy configuration module are provided on the server gateway 20. The policy configuration module is used to define fine-grained access policies, such as the logical expression "Department: Operation and Maintenance Department AND Role: Administrator", and supports dynamic update and attribute revocation. The attribute-based encryption module performs attribute-based encryption processing on the shared data plaintext M and the access policy according to the request of the data provider, generates the ciphertext CT and uploads it to the storage device for storage. Among them, the attribute-based encryption module converts the access policy into a linear secret sharing scheme LSSS matrix W and embeds it in the ciphertext CT.

[0070] The data-controlled sharing gateway 30 is set at the data decryptor end, and one data-controlled sharing gateway 30 can be connected to one or more data decryptors. Each data-controlled sharing gateway 30 has an access control module and a ciphertext storage module. The access control module verifies whether the attribute set of the data decryptor meets the access policy by using the ciphertext CT and the user private key SK according to the request of the data decryptor; if it meets, the reconstruction coefficient w of the LSSS matrix W is calculated i and the data plaintext is recovered; if not, the operation of recovering the data plaintext is cancelled. The ciphertext storage module is used to temporarily store the received ciphertext CT and perform the operation of recovering the data plaintext locally.

[0071] The specific algorithms involved in the above system will be described in detail in the following data-controlled sharing method based on attribute-based encryption.

[0072] In this application, the key generation center 10 detects the validity of the user attributes of the data decryptor in real time. When the user attributes of the data decryptor become invalid, the key generation center publishes a revocation list. The data encryptor re-encrypts the data plaintext and the access policy to generate a new ciphertext. The data decryptor re-applies to the key generation center and obtains a new user private key, thereby implementing the revocation mechanism.

[0073] In the present invention, a service interface is also provided on the key generation center 10. The service interface supports RESTful API, an application programming interface (API) designed based on the REST (Representational State Transfer) architectural style, and can be integrated into existing cloud platforms and Internet of Things systems, making the system deployment more flexible and convenient.

[0074] Based on the above description, it can be seen that the data controlled sharing system based on attribute-based encryption provided by the present invention does not need to adopt blockchain storage, simplifies the system architecture, is convenient for deployment and has low cost. Adopting an end-to-end system architecture, the server gateway encrypts the plaintext of the shared data provided by each data provider, and the data controlled sharing gateway processes the decryption requests of each data decryptor, improving the scalability of the system.

[0075] In addition, the present application adopts an end-to-end encryption design. The server gateway encrypts the plaintext of the shared data and uploads it to the storage device for storage. What is stored on the storage device is ciphertext data, and third-party storage services cannot obtain the data content either, improving data security.

[0076] Furthermore, the controlled sharing gateway 30 in the present application has a ciphertext storage module, which can download a large amount of ciphertext and temporarily save it locally at the data decryptor, and perform decryption processing locally. Therefore, the solution of the present application can be integrated into the existing business platform and the Internet of Things system. The controlled sharing gateway 30 can release the decryption data channel in time without affecting the operation of other services on the business platform.

[0077] As Figure 2 shown, the present invention also provides a data controlled sharing method based on attribute-based encryption, including the following steps:

[0078] Step 100, in the system initialization stage, generate a system public key PK, a master private key MK, and a user private key SK based on the bilinear group <G0, G T >, and the user attribute set of the data decryptor. The master private key MK is stored in the key generation center, the system public key PK is announced by the key generation center, and the user private key SK is sent to the data decryptor.

[0079] Step 200, the data encryptor configures an access policy, and encrypts the data plaintext and the access policy to generate a ciphertext CT and upload it to the blockchain for storage, where the access policy is converted into a linear secret sharing scheme LSSS matrix W and embedded in the ciphertext CT.

[0080] Step 300, the data decryptor uses the ciphertext CT and the user private key SK to verify whether the attribute set of the data decryptor satisfies the access policy; if it is satisfied, then calculate the reconstruction coefficient w of the LSSS matrix W i , and recover the data plaintext; if it is not satisfied, then cancel the operation of recovering the data plaintext.

[0081] In the above method, the key generation center real-time detects the validity of the user attributes of the data decryptor. When the user attributes of the data decryptor become invalid, the key generation center issues a revocation list. The data encryptor re-encrypts the data plaintext and the access policy to generate a new ciphertext, and the data decryptor re-applies to the key generation center to obtain a new user private key.

[0082] In the solution of the present invention, the access policy is converted into an LSSS matrix W and embedded into the ciphertext CT. Through flexible configuration of the access policy, multi-dimensional permission management such as "department + role + time" can be achieved, and dynamic fine-grained access control is simple and convenient.

[0083] The following further elaborates on each step in the implementation method of attribute-based encryption for controlled data sharing.

[0084] In step 100, the system public key PK, the master private key MK, and the user private key SK are generated during the system initialization phase, which specifically includes the following steps:

[0085] Step 110, select a security parameter λ and generate a bilinear mapping e:(G0×G1)→G with a prime order p. T , for simplicity, let G0 = G1, that is, G0 and G1 are the same. A generator of G0 is g, then e(g,g) is the generator of G. T

[0086] Step 120, randomly select system parameters α and β, and calculate the system public key PK, the master private key MK, and the user private key SK based on the bilinear group.

[0087] α: The first parameter.

[0088] β: The second parameter, used to prevent attackers from forging private keys and resist collusion attacks.

[0089] α and β are random numbers, α, β ∈ Zp, where Zp is a finite field composed of integers {0, 1,..., p - 1}.

[0090] Step 140, calculate the system public key PK, the master private key MK, and the user private key SK based on the bilinear group.

[0091] (1) The system public key PK = (g, h = g β , e(g, g) α ).

[0092] g: The generator of the cyclic group G0.

[0093] h = g β : Used to bind user parameters.

[0094] h is a hash function, and the calculated hash value is H.

[0095] e(g, g) α ∈ G T is an element of G Y and is used to recover the key during decryption;

[0096] (2) The master private key MK = (β, g α ).

[0097] g α : Used to bind the user's identity.

[0098] (3) The user's private key SK = (D, Dx1, Dx1′,..., Dxi, Dxi′,..., Dxn, Dxn′).

[0099] Global component Used to bind the user's identity and the system master private key;

[0100] The parameter r is the user's random number, the parameter rx is the attribute random number, and r and rx are unique random numbers for each user and each attribute;

[0101] The attribute-related component Dxi = g r · H(xi) r is used to bind the user attribute x i to the user's random number r;

[0102] The attribute-related component Dxi′ = g rx is used to bind the user attribute x i to the attribute random number rx;

[0103] H(x) r is the user attribute hash, which is used to map the user attribute xi to a group element.

[0104] Assume the user attribute set S = {department = operation and maintenance department, role = administrator}, the system parameter is α = 5, β = 2, and the random numbers r = 3, rdepartment = 4, rrole = 7 are selected, then:

[0105] D = g (5+3) / 2 = g 4 ;

[0106] Ddepartment = g 3 · H(department = operation and maintenance department) 4 ;

[0107] Ddepartment′ = g 4 ;

[0108] Drole = g 3 7 ;

[0109] D role' = g 7 ;

[0110] The final private key SK = {D = g 4 , D department, D department', D role, D role'}.

[0111] Compared with the existing modular multiplication operations of multiple elliptic curves, the algorithm of this application is simpler, has higher operation efficiency, reduces the probability of software and hardware implementation errors, and improves the system stability.

[0112] In step 200, when the data provider encrypts the data plaintext and the access policy, first convert the access policy into an LSSS matrix W. The LSSS matrix W is an l×n matrix (l is the number of attributes, n is the dimension of random variables), and its elements belong to the finite field Zp. Each row Mi corresponds to an attribute, describing how the attribute shares the master secret.

[0113] The specific steps to convert the access policy into the LSSS matrix W are as follows:

[0114] Step 210, convert the logical expression of the access policy into an access policy tree.

[0115] Among them, logical operators (such as AND / OR) are represented as tree structures. AND corresponds to a threshold gate with a threshold of (n, n) (all leaf nodes need to be satisfied), and OR corresponds to a threshold gate with a threshold of (1, n) (any leaf node is satisfied).

[0116] Step 220, allocate sharing vectors for the access policy tree.

[0117] Each leaf node (attribute) of the LSSS matrix W corresponds to a secret sharing vector.

[0118] Root node: The secret value S is randomly divided into vectors where v2,..., vk are randomly selected.

[0119] Intermediate node: Generate the vectors of the leaf nodes according to the threshold rule. For the AND threshold, the leaf nodes share the vector of the parent node; for the OR threshold, the leaf nodes can independently generate new vectors.

[0120] Step 230, construct the LSSS matrix W and the mapping function ρ.

[0121] Each row of the LSSS matrix W corresponds to an attribute (leaf node), and the number of columns is the vector length. The construction rule is as follows:

[0122] The vector of each leaf node is used as a row of the matrix.

[0123] For leaf nodes that inherit the same vector, the matrix rows are the same.

[0124] Taking the logical expression of the access policy as: "Department = Operation and Maintenance Department AND Role = Administrator AND Access Time from 2025-04-25 10:00:00 to 2025-04-25 11:00:00" as an example, the following is a further detailed description:

[0125] Step 2011, attribute extraction.

[0126] Regarding each condition of the access policy logical expression as an attribute, parsing the logical expression, and extracting each attribute of the access policy.

[0127] Department attribute A: Department = Operation and Maintenance Department;

[0128] Role attribute B: Role = Administrator;

[0129] Time lower limit C: Access Time ≥ 2025-04-25 10:00:00;

[0130] Time upper limit D: Access Time ≤ 2025-04-25 11:00:00.

[0131] Step 2012, convert the logical expression into a binary tree to construct the access policy tree.

[0132] Leaf nodes: represent attributes (A, B, C, D).

[0133] Internal nodes: represent logical operators (AND or OR).

[0134]

[0135] Step 2013, assign sharing rules to each logic gate, and construct the access policy tree into an LSSS matrix W and a mapping function ρ. The mapping function ρ is used to associate each row index Wi of the LSSS matrix W with a specific attribute ρ(i), that is, ρ(i) represents the attribute name corresponding to the i-th row of the matrix (such as Department = Operation and Maintenance Department).

[0136] First, assign a sharing vector to each node.

[0137] Root node (AND): assign a random vector Where S is the master secret, r2, r3 are random numbers, and r2, r3 ∈ Zp.

[0138] The left subtree (AND: A ∧ B) is represented as:

[0139]

[0140] The right subtree (AND: C ∧ D)) is represented as:

[0141]

[0142] After merging, it is represented as:

[0143]

[0144] Among them, each row of the matrix W corresponds to an attribute share.

[0145] The first row (1, 0, 0): The share of attribute A is λA = S.

[0146] The second row (1, 1, 0): The share of attribute B is λB = S + r2.

[0147] The third row (1, 0, 1): The share of attribute C is λC = S + r3.

[0148] The fourth row (1, 1, 1): The share of attribute D is λD = S + r2 + r3.

[0149] During decoding, the user needs to provide the shares of all four attributes (A, B, C, D), and solve the following system of equations through Gaussian elimination to recover S:

[0150]

[0151] Directly obtain S from λA.

[0152] Substitute λB and λC to find r2 and r3.

[0153] Verify whether λD is equal to S + r2 + r3.

[0154] Step 2014, randomly select a random temporary key s, generate the ciphertext CT from the data plaintext M, and the LSSS matrix W is embedded in the ciphertext CT;

[0155] Among them, CT = (C, C′, Ci);

[0156] The first ciphertext component C = M · e(g, g) αs , which is used to blind the data plaintext M through the bilinear mapping result e(g, g) αs ;

[0157] The second ciphertext component C′ = g βs , which is used to bind the random temporary key s and the second parameter β, and is used to verify whether the user's private key satisfies the access policy during decryption (it is necessary to pair with the private key component to eliminate β and s);

[0158] The third ciphertext component For each attribute x i The generated ciphertext component Ci, where ai is the row vector parameter of the LSSS matrix W, H(x i )-s Used to bind the attribute hash value and the random number s to prevent unauthorized decryption.

[0159] In step 300, during the decryption phase of attribute-based encryption (ABE), the user needs to verify whether their attribute set S′ satisfies the access policy (usually defined by an LSSS matrix). If it is satisfied, then e(g, g) is recovered through a bilinear pairing operation αs , and then the plaintext M is solved.

[0160] The specific method is as follows:

[0161] (1) The core formula of the decryption process is as follows:

[0162]

[0163] Finally, the plaintext is recovered:

[0164]

[0165] (2) Parameter meanings.

[0166] The user's private key component g α+βr ; the global part of the user's private key, where:

[0167] r: a random number unique to the user (resisting collusion attacks), used to bind the user's identity to the system master private key.

[0168] g r and H(xi) r : the part of the user's private key related to the attribute xi, used to pair and eliminate the random temporary key s in the ciphertext.

[0169] The ciphertext component: C = M·e(g, g) αS , and e(g, g) needs to be recovered through decryption αs to solve for M.

[0170] C′ = h s = g βs : the randomized form of the system parameter h = g β , used to bind the random temporary key s.

[0171] The ciphertext component corresponding to each attribute xi, where ai is the row vector of the LSSS matrix W.

[0172] w i : the reconstruction coefficient of LSSS, satisfying ∑w i a i = (1, 0, …, 0), used to linearly combine the ciphertext and private key components corresponding to the attributes to recover e(g, g) αs .

[0173] e(·, ·): A bilinear pairing operation that satisfies e(g a , g b ) = e(g, g) ab .

[0174] (3) Decryption steps, that is, by calculating the reconstruction coefficients w of the LSSS matrix W i , to recover the plaintext data. The steps are as follows:

[0175] Step 1: Verify whether the attribute set S′ satisfies the access policy, that is, check whether the user attribute set S′ can cover the rows corresponding to the LSSS matrix W.

[0176] If satisfied, calculate the reconstruction coefficients w of the LSSS matrix W i , such that ∑ i∈I w i a i = (1, 0, …, 0), where I is the set of row indices that satisfy ρ(i) ∈ S, and ai is the i-th row vector of the LSSS matrix W.

[0177] Step 2: Calculate the pairing term of the ciphertext CT and the private key to recover e(g, g) αs .

[0178] The numerator part is: e(g α+βr , h S ), where g α+βr comes from the user's private key and contains the first parameter α and the user's random number r; h s = g βs comes from the ciphertext and binds the second parameter β and the random temporary key s;

[0179] The denominator part is:

[0180] According to the symmetry of the bilinear pairing: e(g, H) = e(H, g), and the group consistency of h = g β and the hash function H(x i ), e(g, H(x i )) -rs ·e(H(x i ), g) rβs = 1;

[0181]

[0182] e(H(x i )) r , C′) = e(H(x i ), g βs ) r = e(H(x i ), g)rβs ;

[0183] The denominator after combination is:

[0184] According to The weighted product of all attributes is:

[0185]

[0186] The combination of the numerator and the denominator gives:

[0187] Divide the numerator by the denominator to recover e(g, g) αs .

[0188] Step 3: Use e(g, g) αs to solve for the plaintext M,

[0189] In the present invention, fine-grained access control based on attributes is realized, while ensuring data confidentiality and user privacy. Among them, the key generation, encryption, and decryption algorithms are redesigned, simplifying the algorithms and improving the operating efficiency and system stability.

[0190] The r of each user is different. Even if multiple users combine their attributes, the influence of r cannot be eliminated, realizing collusion-resistant attacks. The s for each encryption is different, ensuring the unlinkability of ciphertexts.

[0191] α and β are always hidden and are only indirectly used through the results of bilinear pairings.

[0192] Based on the descriptions of the above specific embodiments, the data-controlled sharing method and system based on attribute-based encryption provided by the present invention have the following advantages compared with the prior art:

[0193] First, dynamic fine-grained access control: Through flexible configuration of attribute policies, multi-dimensional permission management such as "department + role + time" is supported.

[0194] Second, the system does not need to adopt blockchain storage, simplifying the system architecture design, facilitating deployment and having low costs. Among them, the system architecture adopts an end-to-end design. The server gateway encrypts the plaintext of the shared data provided by each data provider, and the data-controlled sharing gateway processes the decryption requests of each data decryptor. Both the server gateway and the data-controlled sharing gateway can access multiple terminals at any time, improving the system's expansion ability.

[0195] Third, compared with the traditional method of encrypting data access addresses, in the solution of the present application, the ciphertext data is stored on the storage device. Borrowing a third-party storage device for storage can also prevent leakage and improve data security.

[0196] Fourth, by setting up a ciphertext storage module on the controlled gateway, a large volume of ciphertext can be downloaded and temporarily saved locally at the data decryption party, where decryption processing is performed locally, promptly releasing the decryption data channel without affecting the operation of other services on the service platform.

[0197] Fifth, compared with existing solutions that require many elliptic curve point multiplication operations, the algorithm of this application requires fewer operations, so it has higher operating efficiency. At the same time, the probability of software and hardware implementation errors is reduced, improving the system stability.

[0198] Finally, it should also be noted that the term "including", "comprising" or any other variant thereof used in this text is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "including a..." does not exclude the existence of additional identical elements in the process, method, article or device including the said element.

[0199] The present invention is not limited to the above best implementation manner. Anyone should know that structural changes made under the inspiration of the present invention, as long as they have the same or similar technical solutions as the present invention, fall within the protection scope of the present invention.

Claims

1. A method for controlled sharing of data based on attribute-based encryption, characterized in that It includes the following steps: In the system initialization phase, based on the bilinear groups <G0, G T > and the user attribute set of the data decryptor, generate the system public key PK, the master private key MK, and the user private key SK. The master private key MK is stored in the key generation center, the system public key PK is published by the key generation center, and the user private key SK is sent to the data decryptor; The data encryptor configures an access policy, encrypts the data plaintext and the access policy, generates a ciphertext CT and uploads it to the storage device for storage. Among them, the access policy is converted into a linear secret sharing scheme LSSS matrix W and embedded in the ciphertext CT; The data decryptor uses the ciphertext CT and the user private key SK to verify whether the attribute set of the data decryptor satisfies the access policy; If the condition is satisfied, the reconstruction coefficient w of the LSSS matrix W is calculated i , and the plaintext of the data is recovered; if not, the operation of recovering the plaintext of the data is cancelled.

2. The method according to claim 1, wherein When the user attributes of the data decryptor become invalid, the key generation center issues a revocation list. The data encryptor re-encrypts the data plaintext and the access policy to generate a new ciphertext, and the data decryptor re-applies to the key generation center and obtains a new user private key.

3. The method according to claim 1, wherein In the system initialization stage, a system public key PK, a master private key MK, and a user private key SK are generated, which specifically include the following steps: Select a security parameter λ and generate a bilinear map e: (G0 × G1) → G of prime order p T , where G0 = G1, a generator of G0 is g, and e(g, g) is a generator of G T ; Randomly select a first parameter α and a second parameter β, and calculate the system public key PK, the master private key MK, and the user private key SK based on a bilinear group. α and β are random numbers, α, β ∈ Zp, and Zp is a finite field composed of integers {0, 1, …, p - 1}; Among them, the system public key PK = (g, h = g β , e(g, g) α ); The master private key MK = (β, g α ); The user private key SK = (D, Dx1, Dx1′,......, Dxi, Dxi′,......, Dxn, Dxn′); h is a hash function, and the calculated hash value is H; e(g,g) α ∈G T is an element of G Y used to recover the key during decryption; Global component Used to bind the user identity and the system master private key; The parameter r is a user random number, and the parameter rx is an attribute random number. r and rx are unique random numbers for each user and each attribute; Attribute-related component Dxi = g r ·H(xi) r , for binding the user attribute x i to the user random number r; Attribute-related component Dxi′ = g rx , for binding user attribute x i to attribute random number rx; H(x) r Is the user attribute hash, used to map the user attribute xi to a group element.

4. The method according to claim 3, wherein Select a random temporary key s as the temporary key, generate a ciphertext CT from the data plaintext M, and the LSSS matrix W is embedded in the ciphertext CT; Among them, CT = (C, C′, Ci); The first ciphertext component C = M·e(g,g) αs , which is used to blind the data plaintext M through the bilinear mapping result e(g,g) αs ; The second ciphertext component C′ = g βs , which is used to bind the random temporary key s and the second parameter β and is used to verify whether the user's private key satisfies the access policy during decryption; The third ciphertext component For each attribute x i The generated ciphertext component C i , a i Is the row vector parameter of the LSSS matrix W, H(x i ) -s Used to bind the attribute hash value and the random temporary key s to prevent unauthorized decryption.

5. The method according to claim 4, wherein By calculating the reconstruction coefficient w of the LSSS matrix W i , the method for recovering the plaintext of the data is as follows: Calculate the reconstruction coefficient w of the LSSS matrix W i , such that ∑ i∈I w i a i =(1, 0, …, 0), where I is the set of row indices satisfying ρ(i) ∈ S, and a i is the i-th row vector of the LSSS matrix W; Compute the pairing term of the ciphertext CT and the private key to recover e(g, g). αs ; Using e(g, g) αs Solve for the plaintext M, 6. A data controlled sharing system based on attribute-based encryption, characterized in that It includes: The key generation center is used to generate a system public key PK, a master private key MK, and a user private key SK in the system initialization stage; The server gateway is set at the end of the data provider. Multiple data providers are connected to the server gateway. The server gateway is equipped with an attribute-based encryption module and a policy configuration module. The policy configuration module is used to define a fine-grained access policy, and the attribute-based encryption module is used to perform attribute-based encryption processing on the shared data plaintext M and the access policy according to the request of the data provider, generate a ciphertext CT and upload it to the storage device for storage; among them, the access policy in the attribute-based encryption processing is converted into a linear secret sharing scheme LSSS matrix W and embedded in the ciphertext CT; One or more data-controlled sharing gateways are set at the end of the data decrypting party. One data-controlled sharing gateway can access one or more data decrypting parties. Each data-controlled sharing gateway has an access control module and a ciphertext storage module. The ciphertext storage module is used to temporarily store the received ciphertext CT and perform the operation of restoring the plaintext of the data locally; the access control module is used to verify whether the attribute set of the data decrypting party meets the access policy according to the request of the data decrypting party, using the ciphertext CT and the user private key SK; if it meets, then calculate the reconstruction coefficient w of the LSSS matrix W i , and restore and obtain the plaintext of the data; if it does not meet, then cancel the operation of restoring the plaintext of the data.

7. The system according to claim 6, wherein The key generation center real-time detects the validity of the user attributes of the data decryptor. When the user attributes of the data decryptor become invalid, the key generation center issues a revocation list. The data encryptor re-encrypts the data plaintext and the access policy to generate a new ciphertext, and the data decryptor re-applies to the key generation center and obtains a new user private key.

8. The system according to claim 6, characterized in that, The key generation center generates a system public key PK, a master private key MK, and a user private key SK in the system initialization stage, which specifically include the following steps: Select a security parameter λ and generate a bilinear map e: (G0 × G1) → G of prime order p, where G0 = G1, a generator of G0 is g, and e(g, g) is a generator of G T , G0 = G1, a generator of G0 is g, and e(g, g) is a generator of G T ; Randomly select a first parameter α and a second parameter β, and calculate the system public key PK, the master private key MK, and the user private key SK based on a bilinear group. α and β are random numbers, α, β ∈ Zp, and Zp is a finite field composed of integers {0, 1, …, p - 1}; Among them, the system public key PK = (g, h = g β , e(g, g) α ); Master secret key, master private key MK = (β, g α ); User private key SK = (D, Dx1, Dx1′,......, Dxi, Dxi′,......, Dxn, Dxn′); h is a hash function, and the obtained hash value is H; e(g,g) α ∈G T is an element of G T and is used to recover the key during decryption; Global component Used to bind the user identity and the system master private key; Parameter r is a user random number, parameter rx is an attribute random number, and r and rx are unique random numbers for each user and each attribute; Attribute-related component Dxi = g r ·H(xi) r , which is used to bind the user attribute x i to the user random number r; Attribute-related component Dxi′ = g rx , used to bind the user attribute x i to the attribute random number rx; H(x) r Is the user attribute hash, used to map the user attribute xi to the group element.

9. The system according to claim 8, wherein The server gateway selects a random temporary key s, generates ciphertext CT from the data plaintext M, and embeds the access policy through the LSSS matrix W in the ciphertext CT; where CT = (C, C′, C i ), i = 1, …, n; The first ciphertext component C = M·e(g,g) αs , which is used to blind the data plaintext M through the bilinear mapping result e(g,g) αs ; The second ciphertext component C′ = g βs , which is used to bind the random temporary key s and the second parameter β, and is used to verify whether the user's private key satisfies the access policy during decryption; The third ciphertext component For each attribute x i The generated ciphertext component C i , a i Is the row vector parameter of the LSSS matrix W, H(x i ) -s Used to bind the attribute hash value and the random temporary key s to prevent unauthorized decryption.

10. The system according to claim 9, wherein The data-controlled sharing gateway recovers the plaintext of the data by calculating the reconstruction coefficient w of the LSSS matrix W i , and the specific method is as follows: Calculate the reconstruction coefficient w of the LSSS matrix W i , such that ∑ i∈I w i a i =(1, 0, …, 0), where I is the set of row indices that satisfy ρ(i) ∈ S, and a i is the i-th row vector of the LSSS matrix W; Calculate the pairing item of the ciphertext CT and the private key to recover e(g, g) αs : Using e(g, g) αs Solve for the plaintext M,

Images