Zero-trust architecture-based lattice threshold encryption Internet of Things data privacy protection method

Abstract

The invention discloses a lattice threshold encryption Internet of Things data privacy protection method based on a zero-trust architecture. The method comprises the following steps: step 1, identity registration; step 2, performing threshold encryption based on a lattice; step 3, grid-based threshold key sharing is carried out; and step 4, a lattice-based sub-key volume transmission protocol. Based on zero trust and cryptography algorithms, the privacy of Internet of Things data in the circulation process is enhanced, and secure transmission of keys and sub-keys is realized by using threshold secret sharing and a crowd transmission protocol. An error-based lattice cryptographic algorithm is adopted to process the data of the Internet of Things, and privacy leakage of the data of the Internet of Things is prevented. And meanwhile, verification of equipment and a user in an Internet of Things system is realized by utilizing a zero-trust architecture, so that the security during data sharing is improved.

Description

Technical Field

[0001] This invention relates to a grid-threshold encrypted IoT data privacy protection method based on a zero-trust architecture, belonging to the fields of network security and blockchain technology. Background Technology

[0002] With the continuous advancement of IoT technology, IoT data service systems centered on smart terminals and sensing devices are rapidly developing. Real-time data collection and sharing from massive numbers of sensors provides unprecedented convenience and support for applications such as smart manufacturing, intelligent transportation, environmental monitoring, and smart cities. However, user privacy and data security issues are becoming increasingly prominent during the transmission, storage, and sharing of IoT data.

[0003] Most existing IoT privacy protection solutions rely on traditional encryption algorithms or secret sharing mechanisms to ensure the confidentiality and integrity of data collected by devices during communication and storage. However, these solutions still have potential risks in key distribution and management. Keys may be stolen, tampered with, or misused during transmission, leading to compromised system security. Furthermore, with the rapid development of quantum computing technology, the security foundation of traditional public-key encryption algorithms is facing challenges. Existing encryption systems are unable to effectively resist quantum attacks, thus threatening the long-term security and trustworthiness of IoT data. Summary of the Invention

[0004] To address the problems and shortcomings of existing technologies, this invention proposes an innovative lattice-based threshold encryption method for data privacy protection based on Zero Trust Architecture (ZTA). First, this method uses a zero-trust architecture as its core, dynamically and continuously authenticating and authorizing all access subjects, including users, IoT devices, and the Subkey Custodian (SKC), fundamentally eliminating implicit trust and establishing a strict security baseline. Second, this method designs and implements an efficient and secure lattice-based threshold encryption algorithm for confidential sharing of IoT data. This algorithm significantly enhances the system's resistance to future quantum computing attacks, effectively addressing the quantum security crisis faced by traditional encryption algorithms. To ensure the integrity and confidentiality of the master key and subkey distribution process, this invention combines a threshold key sharing mechanism and designs an Oblivious Transfer protocol for subkeys, achieving secure and leak-proof key transmission. Finally, the Subkey Custodian (SKC) uses a customized token authentication mechanism to strictly authenticate data users before distributing the required subkeys. Data users must meet threshold conditions to recover the complete decryption key, thereby achieving secure access and fine-grained decryption of IoT data. This invention protects IoT data privacy while also ensuring quantum-resistant security, zero-trust access principles, and flexible and controllable data sharing.

[0005] To achieve the above objectives, the technical solution of the present invention is as follows: A grid-threshold encrypted IoT data privacy protection method based on a zero-trust architecture, comprising the following steps:

[0006] Step 1: Identity Registration. The Authorization Center (CA) registers the identity information of data owners, sub-key escrow centers, and data users, improving the reliability of the identities of all interacting entities in the IoT system.

[0007] Step 2: Lattice-based threshold encryption. First, the data owner encrypts the Internet of Things for Healthcare (IoMT) data using a public key distributed by a Certificate Authority (CA) and stores the ciphertext on a cloud server. If a data user wants to access the ciphertext, they must first register and obtain a share of the private key through authentication with the private key custodian and the cloud server. Then, they must reconstruct the private key to decrypt and view the ciphertext retrieved from the cloud server.

[0008] Step 3: Lattice-based threshold key sharing. The data owner distributes the private key for decrypting IoT data ciphertext to doctors, patients, academics, and third-party research institutions using lattice-based threshold secret sharing technology. Legitimate data users can recover the private key using the received sub-shares.

[0009] Step 4: Lattice-based Subkey Undefined Transmission Protocol. The data owner uses a designed undefined transmission protocol based on Diffle-Hellman key exchange to transmit private key subshares, ensuring the security of subkey transmission.

[0010] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the aforementioned zero-trust architecture-based threshold encryption IoT data privacy protection method.

[0011] A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the described grid-threshold encrypted IoT data privacy protection method based on a zero-trust architecture.

[0012] Compared with the prior art, the advantages of the present invention are as follows:

[0013] (1) The present invention adopts a threshold encryption mechanism based on lattice cryptography, which provides anti-quantum attack capability for IoT data in a forward-looking manner, and realizes the combination of data encryption and key fragmentation, which significantly improves the privacy protection strength in the data sharing process.

[0014] (2) This invention combines threshold secret sharing with the subkey blind transmission (OT) protocol to achieve decentralized secure custody and leak-proof distribution of subkeys, effectively avoiding the single point of failure and illegal access risks in traditional solutions.

[0015] (3) The present invention designs a token authentication mechanism to strictly verify data users and distribute subkeys, ensuring the reliability and strong controllability of the decryption process and realizing fine-grained control over data access.

[0016] (4) The present invention introduces a zero trust security architecture (ZTA) to implement multi-level, continuous authentication and dynamic authorization for all entities, fundamentally eliminating implicit trust and significantly enhancing the overall security protection level and resilience of the Internet of Things system. Attached Figure Description

[0017] Figure 1 This is an overall flowchart of an embodiment of the present invention.

[0018] Figure 2 This is a data security sharing flow diagram according to an embodiment of the present invention.

[0019] Figure 3 This is a key security sharing flow diagram according to an embodiment of the present invention. Detailed Implementation

[0020] To enhance understanding of the present invention, the invention will be further explained below with reference to specific embodiments.

[0021] Example 1: A zero-trust architecture-based threshold encryption method for protecting IoT data privacy. The first step of this method is identity registration; the second step... (See...) Figure 2 As shown, the data owner encrypts the IoMT data using a public key distributed by the CA and stores the ciphertext on a cloud server. If a data user wants to access the ciphertext, they must first register and obtain a share of the private key through private key escrow and cloud server authentication. Then, they must reconstruct the private key and decrypt it to view the ciphertext obtained from the cloud server. In the third step, referring to step 3, to achieve control over user access to IoT data, the private key of the encrypted Internet medical data is distributed to doctors, patients, scholars, and third-party research institutions through a lattice-based threshold secret sharing method. The private key is shared with the key escrow provider through the threshold secret sharing scheme, and legitimate data users can recover it through the received sub-shares. In the fourth step, the data owner uses a designed blind transmission protocol based on Diffle-Hellman key exchange to transmit the private key sub-shares. Detailed implementation steps are as follows:

[0022] Step 1: Identity Registration. Specifically, the data owner, subkey escrow center, and data user each register their identity information with the Authorized Center (CA). This process involves the following sub-steps:

[0023] Sub-step 1-1: The data owner sends a request to the Authorization Center (CA). CA uses a lattice key generation algorithm to generate keys for itself.

[0024] Sub-steps 1-2: The private key custodian sends the private key to the CA, the CA performs identity registration, and distributes key sub-shares.

[0025] Sub-steps 1-3: Data user sends request Register your identity with the CA. The CA generates a partial public key R. Du =r Du P, where P is a point on the elliptic curve, and r is a point on the elliptic curve. Du It is a random number, t is the current timestamp, and the token is calculated as follows:

[0026] Token = H(ID) Du ||R Du ||t) (1)

[0027] Step 1 allows for the registration and management of the identities of data owners, data users, and private key custodians. Data users are authenticated using tokens. This zero-trust architecture verification, compared with existing solutions, ensures the security of the identities of all interacting entities in the IoT system.

[0028] Step 2: Grid-based threshold encryption, specifically as follows: This step encrypts IoT data and stores it on a cloud server. The implementation consists of the following sub-steps:

[0029] Sub-step 2-1: Initialization. The data contains the corresponding security parameters and two positive integers m and n, where q ≥ 2 and m > 6nlogq. A random matrix is ​​generated using the trapdoor key generation mechanism TrapGen(q,n). There is a short lattice base T A , making Define the public parameter as PK=A and the master key as msk=T. A .

[0030] Sub-step 2-2: Key generation. Input the common parameters and the master key msk. The key generation algorithm outputs a matrix B∈Z. m×n It returns the decryption key sk = s, where s ∈ Z. q Let pk represent the private key vector. The encryption key pk is calculated as follows:

[0031] pk=Bs (2)

[0032] Sub-step 2-3: Encryption. Using the encryption key pk, generate the ciphertext (c1, c0) of M. The ciphertext calculation process is as follows:

[0033] c1=B (3)

[0034] c0=Bs+M+e (4)

[0035] Where e∈[-3,3] represents noise, and B∈Z m×n It is a matrix, s∈Z q Let M represent the private key vector, and M represent the data to be encrypted.

[0036] Sub-steps 2-4: Authentication. The data user sends a token to the key custodian to perform authentication. Upon successful authentication, key sub-shares are distributed. The authentication calculation is as follows:

[0037] H(ID Du ||R Du ) = Token Du (5)

[0038] Sub-steps 2-5: Decryption. The data user uses the private key s reconstructed from the subkey to decrypt and view the ciphertext downloaded from the cloud server. The decryption calculation m′ is as follows:

[0039] m′=c0-sc1 (6)

[0040] Sub-step 2-6: Noise correction. The decision to correct the decrypted plaintext is based on the calculation error, which is as follows:

[0041] Δm=m′-m (7)

[0042] Correction m corrected The calculation is as follows:

[0043] m corrected =m′ (8)

[0044] Where the error Δm < ε, and ε = 3 represents the error value.

[0045] By employing a lattice-based public-key encryption scheme in step 2, quantum attacks can be resisted, further enhancing the privacy of IoT data. Compared with traditional elliptic curve-based encryption methods, this invention can better resist quantum attacks.

[0046] Step 3: Lattice-based threshold key sharing. This step distributes the private key of the IoT data encryption to sub-key custodians such as doctors, patients, scholars, and third-party research institutions through a lattice-based threshold secret sharing mechanism. The implementation consists of the following sub-steps:

[0047] Sub-step 3-1: Private key s(s1,s2,s3,...,s n ) T Split, divide the private key s i Divide the matrix into n parts for each dimension, and construct a lattice-based polynomial coefficient matrix A, where each row corresponds to the polynomial coefficients of a given dimension. A is calculated as follows:

[0048]

[0049] The function f(x) for calculating each share is as follows:

[0050]

[0051] Among them, data users share private key matrices using different thresholds t. i Let i = {1, 2, ..., k}, and 2 ≤ t. i ≤k, s i =a0, where a0 is generated based on a lattice basis. x i is the x-coordinate of each shared point, and all operations are based on the finite field GF(p), where p is a prime number.

[0052] The shared matrices X and Y can be expressed by the following formulas:

[0053]

[0054] Y can be constructed from Y = XAs.

[0055] Sub-step 3-2: Private key reconstruction. The data user recovers the private key using the Lagrange interpolation formula L, and calculates the Lagrange base coefficient l at the zero point for each share. j (0), the calculation process is as follows:

[0056]

[0057] L is further represented as: Each element l j (0) corresponds to the share value y j The base polynomial values. The private key s for each dimension of the matrix. i It can be represented as:

[0058]

[0059] Where Y is a column vector containing the t-share values ​​corresponding to the i-th dimension, and L is a vector of pre-calculated Lagrange interpolation coefficients at zero.

[0060] By utilizing threshold secret sharing in step 3, the distribution and management of private keys can be achieved. Furthermore, this invention employs elements s of the private key vector s generated based on a lattice basis. i Implementing private key distribution, compared to the random generation method used in existing schemes, can better prevent the abuse of private keys.

[0061] Step 4: Lattice-based Subkey Blind Transfer Protocol. In this step, the data owner uses a blind transfer protocol designed based on Diffle-Hellman key exchange to transfer private key subshares. Its implementation consists of the following sub-steps:

[0062] Sub-step 4-1: Protocol initialization. The sender and receiver agree on common system parameters, including the public matrix B and hash function H. Next, the sender generates a decryption key s to decrypt the IoT data ciphertext, calculates and publishes the public key A = s × B for the receiver's use.

[0063] Sub-step 4-2: Receiver selection. The receiver randomly selects the target key index i∈{1,2,…,n} and generates a random number r. Based on r, a challenge message C is constructed. i = (r×B, r×A), use a hash function to calculate the key k for decrypting s. i =H(r×(s) i ×B)), send C i To the sender.

[0064] Sub-step 4-3: Sender encryption, for each candidate key s i (where i∈{1,2,…,n}), based on the decryption key s for decrypting IoT data ciphertext and the receiver message C i Generate encryption key k j =H(s×C) i The sender performs XOR encryption on each sub-share. c i Send to the recipient.

[0065] Sub-step 4-4: The receiver decrypts the data using its known decryption information. i key k i Decrypt target key s i =c i ⊕k i Because the other keys correspond to k i Unable to generate correctly, the receiver can only recover the selected key s i However, the sender cannot know the specific value of i.

[0066] Step 4 involves designing a blind transmission protocol for the private key share during distribution. This ensures the secure transmission of the private key share and prevents attackers from collecting the private key share to recover the original private key and decrypt the IoT data ciphertext, thus preventing the leakage of IoT data privacy.

[0067] Based on the same inventive concept, the present invention provides a lattice-based threshold encryption IoT data privacy protection method based on a zero-trust architecture, including identity registration, lattice-based threshold encryption, lattice-based threshold key sharing, and lattice-based subkey blind transmission protocol. When this process is applied to the IoT system, the above-mentioned lattice-based threshold encryption IoT data privacy protection method based on a zero-trust architecture is realized.

[0068] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention. It should be understood that the embodiments are for illustrative purposes only and are not intended to limit the scope of the invention after reading this document. Various equivalent modifications to the invention by those skilled in the art fall within the scope defined by the claims of this application.

Claims

1. A method for protecting the privacy of IoT data based on a zero-trust architecture with lattice-threshold encryption, characterized in that, The method includes the following steps: Step 1: Identity Registration; Step 2: Lattice-based threshold encryption; Step 3: Grid-based threshold key sharing; Step 4: Lattice-based subkey blind transmission protocol.

2. The grid-threshold encrypted IoT data privacy protection method based on zero-trust architecture according to claim 1, characterized in that, Step 1: Identity Registration. Specifically, the data owner, subkey escrow center, and data user each register their identity information with the Authorized Center (CA). This process involves the following sub-steps: Sub-step 1-1: The data owner sends a request to the Authorization Center (CA). CA uses a lattice key generation algorithm to generate keys for itself. Sub-steps 1-2: The private key custodian sends the private key to the CA, the CA performs identity registration, and distributes key sub-shares. Sub-steps 1-3: Data user sends request Register your identity with a CA (Certificate Authority) and the CA will generate a partial public key R. Du =r Du P, where P is a point on the elliptic curve, t is the current timestamp, and r is the current timestamp. Du It is a random number, and the token is calculated as follows: Token=H(ID Du ||R Du ||t) (1)。 3. The grid-threshold encrypted IoT data privacy protection method based on zero-trust architecture according to claim 1, characterized in that, Step 2: Grid-based threshold encryption, specifically as follows: This step encrypts IoT data and stores it on a cloud server. The implementation consists of the following sub-steps: Sub-step 2-1: Initialization. The data contains the corresponding security parameters and two positive integers m and n, where q ≥ 2 and m > 6nlogq. A random matrix is ​​generated using the trapdoor key generation mechanism TrapGen(q,n). There is a short lattice base T A , making Define the public parameter as PK=A and the master key as msk=T. A , Sub-step 2-2: Key generation. Input the common parameters and the master key msk. The key generation algorithm outputs a matrix B∈Z. m ×n It returns the decryption key sk = s, where s ∈ Z. q Let pk represent the private key vector. The encryption key pk is calculated as follows: pk=Bs (2) Sub-step 2-3: Encryption. Using the encryption key pk, generate the ciphertext (c1, c0) of M. The ciphertext calculation process is as follows: c1=B (3) c0=Bs+M+e (4) Where e∈[-3,3] represents noise, and B∈Z m×n It is a matrix, s∈Z q This represents the private key vector, and M represents the data to be encrypted. Sub-steps 2-4: Authentication. The data user sends the key to the key custodian for token authentication. Upon successful authentication, key sub-shares are distributed. The authentication calculation is as follows: H(ID Du ||R Du )=Token Du (5) Sub-steps 2-5: Decryption. The data user uses the private key s reconstructed from the subkey to decrypt and view the ciphertext downloaded from the cloud server. The decryption calculation m′ is as follows: m′=c0-sc1 (6) Sub-step 2-6: Noise correction. The decision to correct the decrypted plaintext is based on the calculation error, which is as follows: Δm=m′-m (7) Corrected calculation m corrected as follows: m corrected =m′ (8) Where the error Δm < ε, and ε = 3 represents the error value.

4. The grid-threshold encrypted IoT data privacy protection method based on zero-trust architecture according to claim 1, characterized in that, Step 3: Lattice-based threshold key sharing. This step distributes the private key of the IoT data encryption to sub-key custodians such as doctors, patients, scholars, and third-party research institutions through a lattice-based threshold secret sharing mechanism. The implementation consists of the following sub-steps: Sub-step 3-1: Private key s(s1,s2,s3,...,s n ) T Split, divide the private key s i Divide the matrix into n parts for each dimension, and construct a lattice-based polynomial coefficient matrix A, where each row corresponds to the polynomial coefficients of a given dimension. The calculation of A is as follows: The function f(x) for calculating each share is as follows: Among them, data users share private key matrices using different thresholds t. i Let i = {1, 2, ..., k}, and 2 ≤ t. i ≤k, s i =a0, a0 is generated based on the lattice basis, x i Here, x is the x-coordinate of each shared point, and all operations are based on the finite field GF(p), where p is a prime number. The shared matrices X and Y are represented by the following formulas: Y is constructed from Y = XAs. Sub-step 3-2: Private key reconstruction. The data user recovers the private key using the Lagrange interpolation formula L, and calculates the Lagrange base coefficient l at the zero point for each share. j (0), the calculation process is as follows: L is further represented as: Each element l j (0) corresponds to the share value y j The basis polynomial values, and the private key s in each dimension of the matrix. i It can be represented as: Where Y is a column vector containing the t-share values ​​corresponding to the i-th dimension, and L is a vector of pre-calculated Lagrange interpolation coefficients at zero.

5. The grid-threshold encrypted IoT data privacy protection method based on zero-trust architecture according to claim 1, characterized in that, Step 4: Lattice-based Subkey Blind Transfer Protocol. In this step, the data owner uses a blind transfer protocol designed based on Diffle-Hellman key exchange to transfer private key subshares. Its implementation consists of the following sub-steps: Sub-step 4-1: Protocol initialization. The sender and receiver agree on common system parameters, including the public matrix B and hash function H. Next, the sender generates a key s for decrypting IoT data, calculates and publishes the public key A = s × B for the receiver's use. Sub-step 4-2: Receiver selection. The receiver randomly selects the target key index i∈{1,2,…,n} and generates a random number r. Based on r, a challenge message C is constructed. i = (r×B, r×A), use a hash function to calculate the key k for decrypting s. i =H(r×(s) i ×B)), send C i To the sender, Sub-step 4-3: Sender encryption, for each candidate key s i (where i∈{1,2,…,n}), based on the key s for decrypting IoT data and the receiver message C i Generate the key k for encrypting s i =H(s×C) i The sender performs XOR encryption on each sub-share. c i Send to the recipient, Sub-step 4-4: The receiver decrypts the data using its known decryption information. i key k i Decrypt target key Because of the k corresponding to other keys i Unable to generate correctly, the receiver can only recover the selected key s i However, the sender cannot know the specific value of i.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the zero-trust architecture-based grid-threshold encrypted IoT data privacy protection method as described in any one of claims 1 to 5.

7. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by a processor, the computer instructions implement the grid-threshold encrypted IoT data privacy protection method based on a zero-trust architecture as described in any one of claims 1-5.

Images