A multi-authority attribute-based encryption protocol implementation method and system

Abstract

The application discloses a kind of multi-authority attribute-based encryption protocol implementation method and system, method as follows: one, each attribute management authority center executes main key generation according to the attribute set managed by itself;Two, client obtains the key corresponding to attribute set from multiple attribute management authority centers;Three, server selects random number, encrypts model parameter according to access structure, generates ciphertext component containing policy information;Four, client reconstructs coefficient using the private key component held locally, calculates shared secret locally and decrypts model parameter if attribute satisfies access structure;If attribute does not satisfy access structure, ciphertext does not need re-encryption through policy token to realize policy update.The protocol system proposed in the application significantly improves the flexibility, verifiability and system stability of permission management in large-scale collaboration, long-term task and high supervision requirement application scenarios.

Description

Technical Field

[0001] This invention belongs to the field of encryption technology, specifically relating to a method and system for implementing a multi-authority attribute-based encryption protocol. Background Technology

[0002] Access control is a technique in the field of cryptography for accessing information or restricting its use. It primarily establishes a security mechanism that defines who can access which resources, how, and in what way. The goal is to precisely implement confidentiality, integrity, and the principle of least privilege while maintaining availability and meeting business needs. Traditional access control methods (such as DAC, MAC, RBAC, etc.) rely on centralized reference monitors for permission determination, resulting in single-point trust dependence and difficulty adapting to open network environments. To address these limitations, researchers have proposed a paradigm of encryption as access control: Attribute-Based Encryption (ABE) and its extended primitives. This technology embeds access policies into ciphertext or keys, utilizing mathematical problems rather than trusted third parties to achieve fine-grained access authorization and data protection.

[0003] (1) The development and related expansion of ABE

[0004] In 1984, researchers proposed Identity-Based Encryption (IBE), replacing public key certificates with identity identifiers. In 2001, researchers introduced bilinear pairings to construct the first practical IBE, laying the mathematical foundation for subsequent protocols, but its limitation was that it could only express simple access decisions.

[0005] To enhance policy expressiveness, researchers proposed Fuzzy IBE in 2005, initiating research into attribute encryption. Subsequently, researchers proposed KP-ABE, and others proposed the first Ciphertext-Policy ABE (CP-ABE), which utilizes Boolean trees and linear master key sharing to support complex structures, transferring policy control to the ciphertext and achieving true encryption-as-access control.

[0006] To address the issue of trust in a single-center environment, researchers proposed the Multi-Authority Attribute-Based Encryption (MA-ABE) model in 2007. In 2011, researchers further implemented a fully decentralized scheme that eliminates the need for central collaboration, utilizing dual-system encryption technology to ensure security in a multi-authority environment while maintaining high expressiveness.

[0007] (2) Dynamic updates and cancellation of ABE

[0008] As the application of Access Control Bypass (ABE) expands, traditional static attribute systems can no longer meet the needs of frequent changes in user attributes or dynamic revocation of permissions. In 2008, researchers proposed an IBE-based revocation mechanism, introducing the concept of a time period, allowing access permissions to be updated over time. In 2010, researchers proposed a revocable ABE for cloud environments, enabling cloud servers to assist in key updates without accessing plaintext. In 2011, researchers proposed a general revocation framework that addresses large-scale user revocation issues through key update time parameters and broadcast encryption structures. This series of innovations has shifted access control from static attributes to dynamic revocation; it has also introduced a time dimension, giving keys and attributes time-sensitive properties; and it has reduced revocation costs through broadcast encryption, combining time slices and revocation lists into the linear secret-sharing construction of ABE, thereby expanding its originally static mathematical structure.

[0009] To address the overhead of key updates and re-encryption caused by frequent attribute changes, researchers began combining ABE (Access Default Environment) with PRE (Pre-Encryption). PRE was first proposed in 1998 and refined into a one-way / two-way model in 2005. Subsequently, several ABE-PRE schemes proposed having an untrusted server perform ciphertext conversion, eliminating the need for data owners to re-encrypt during attribute updates and policy migrations. This shifts the computational burden from the data owner to the agent. Ciphertext can be converted to adapt to new policies or attribute sets while meeting security requirements, supporting online attribute updates without global re-encryption. By constructing a conversion key, policy and attribute updates no longer depend on the original private key or plaintext, thus achieving truly practical dynamic access control.

[0010] Since 2016, numerous studies have incorporated blockchain consensus and smart contract mechanisms into ABE / MA-ABE systems to address auditing, key transparency, and cross-institutional trust issues in traditional ABE. Typical solutions utilize smart contracts to record key issuance, attribute changes, and revocation information, and achieve non-repudiation of access traces through distributed ledgers. This resolves the root of trust problem in multi-authority systems, making attribute management transparent and verifiable, and realizing a cross-institutional trusted access control framework.

[0011] The access control system has transitioned from a cryptographic algorithm to a combined framework of cryptographic algorithms and blockchain protocols, making the ABE system more suitable for multi-source, multi-organizational collaborative environments.

[0012] (3) Access control in federated learning scenarios

[0013] Since the introduction of Federated Learning (FL) in 2016, early focus was primarily on multi-party collaborative optimization, with security mechanisms relying solely on basic communication protocols and simple authentication. However, as FL expanded across institutions and domains, traditional identity- or role-based authorization proved insufficient in policy expression, node trust, and auditability, failing to meet the complex security requirements of distributed environments. With the deployment of FL in sensitive scenarios such as healthcare and finance, access control evolved into a core security constraint. After 2018, research began introducing policies based on fine-grained attributes such as reputation and contribution, controlling node gradient uploads and model acquisition permissions through a defined policy engine. However, these solutions are mostly based on plaintext policies and located outside the system, unable to directly affect encrypted gradients, resulting in a natural disconnect between access control and privacy protection. From 2019 onwards, research shifted its focus to encrypted permissions, attempting to deeply integrate ABE, key revocation, and MA-ABE into the FL process. By directly binding permissions to encrypted gradients or parameters, it ensures that only nodes meeting attribute conditions can decrypt the model, thus resolving the trust issue in cross-institutional collaboration. This marks the first time access control has been migrated from the system layer to the cryptographic protocol layer, achieving true ciphertext-state control.

[0014] In recent years, with the deep integration of blockchain, Trusted Execution Environment (TEE), and federated learning, the role of access control in federated learning (FL) has expanded to include auditability, traceability, and dynamic authorization management. For example, blockchain-driven access control schemes utilize smart contracts to record information such as attribute changes, authorization approvals, and node reputation during the training process, making the policy execution of MA-ABE or ABAC more transparent. TEE combined with access control allows model aggregation and key distribution to be performed in trusted hardware, significantly reducing the risk of policy leakage. Simultaneously, numerous requirements for dynamic policy updates (such as task switching, staged training, and contingency risk control) have emerged in FL scenarios, prompting access control to evolve towards dynamic attribute updates and proxy-assisted re-encryption of permission migration, enabling the system to quickly adjust the training participation scope without redistributing keys. Thus, access control has evolved from simple access control into a key cryptographic framework component supporting the overall security architecture of FL, achieving full lifecycle management of model flow, gradient transmission, and attribute changes. In summary, the shortcomings of existing technologies are summarized as follows:

[0015] Current federated learning access control systems largely remain under a static authorization framework. Their permission determination relies on predefined roles or fixed attribute sets, failing to adapt to changes in training status, participant responsibilities, or data sensitivity levels. Once a policy change touches upon access boundaries, the system needs to re-encrypt or redistribute existing model ciphertext, gradient ciphertext, or user keys, forcing training interruptions and significantly increasing the load on key and communication links. In cross-institutional collaborative training, attributes and compliance requirements are highly dynamic at different stages, and existing solutions lack the ability to migrate policies in parallel with the training process, making it difficult for access control to maintain continuity and scalability in long-term tasks.

[0016] In the specific policy adjustment process, the existing ABE and MA-ABE encryption structures are highly dependent on the access policy. Updating the policy often means that the ciphertext structure itself must be rewritten simultaneously. Because the policy is strongly bound to the ciphertext, any permission adjustment will amplify into a global re-encryption operation, making it difficult for the system to bear the cost of high-frequency policy updates. In scenarios with multiple rounds of training, phased task switching, or temporary authorization contraction, the existing solutions cannot replace or narrow access conditions while keeping the ciphertext unchanged. They lack a mechanism to support uninterrupted training, limiting the usability of encrypted access control in real-world federated environments.

[0017] Meanwhile, existing MA-ABE systems still exhibit significant centralized dependence in cross-institutional applications. Their key generation and authorization processes typically retain some form of global coordinating entity or implicit master key, enabling any single authority to technically influence the overall authorization structure. This characteristic is incompatible with the multi-agent collaborative model of federated learning and fails to meet the requirements of inter-institutional organizations for authorization independence, anti-collusion capabilities, and verifiability. The key generation, attribute revocation, and authorization modification processes all lack truly distributed and collaborative security mechanisms, revealing significant shortcomings in cross-domain collaboration, compliance auditing, and highly sensitive data circulation scenarios. Summary of the Invention

[0018] The technical problem addressed by this invention is as follows: Federated learning exhibits a highly dynamic attribute system and multi-stage task structure in cross-institutional, long-cycle training, while existing access control schemes cannot independently evolve policies in encrypted form. Once the responsibilities of the participants, the data sensitivity level, or regulatory requirements are adjusted, traditional mechanisms require re-encrypting a large amount of historical encrypted data or uniformly replacing user keys, thereby interrupting the training process and rapidly increasing the system's computational and communication burden. The primary problem addressed by this invention is to construct a policy update mechanism compatible with the training process, enabling access rules to be independently replaced while keeping the model and gradients encrypted, thus avoiding process interruption caused by re-encryption and ensuring that access control has the prerequisite for the sustainable operation of the training process.

[0019] On the other hand, cross-institutional federated learning collaboration places significantly higher demands on key authorization structures than traditional ABE and MA-ABE. Existing multi-authority systems still retain a centralized key path in their technical implementation, lacking mechanisms to ensure the independence of authorization among institutions, resistance to collusion, and verifiability. The problem this invention aims to solve is to construct a key generation and authorization model without centralized escrow and not independently controlled by a single institution. This model enables multiple authorities to complete key derivation, attribute granting, and permission reduction while maintaining organizational independence, thereby forming a trusted authorization foundation suitable for cross-domain collaboration.

[0020] In typical medical collaborative training scenarios, the above two types of problems are even more prominent. Different hospitals have significant differences in data types, privacy requirements, and legal responsibilities. Traditional policy models cannot accurately distinguish their access boundaries, and once attributes or compliance requirements change, a large amount of model ciphertext needs to be re-encrypted. This invention introduces an evolvable attribute expression system and a policy token mechanism, enabling each hospital to independently set authorization rules. Model parameters and image features are access controlled according to attribute requirements in an encrypted state. Lung cancer data can be authorized only to research teams with relevant permissions, while images involving minors or highly sensitive data can only be disseminated between institutions that meet strict compliance requirements. When internal hospital policies or regulatory rules are adjusted, access boundaries can be migrated instantly by updating policy tokens, without the need for large-scale rewriting of historical ciphertext, thereby reducing system maintenance costs and maintaining the continuity of the training process.

[0021] To address the aforementioned technical problems, this invention comprehensively transforms the key structure, policy management, and authorization logic of traditional MA-ABE, focusing on the long-term nature of federated learning training, the frequent changes in attributes, and the complexity of cross-agency collaboration. Existing MA-ABE, as a general encryption framework, does not design corresponding mechanisms for the division of training phases in federated learning, the differences in participant attributes, and the ciphertext transfer methods. This invention, however, builds upon these shortcomings by constructing an access control system that can be embedded in the training lifecycle, supports dynamic policy evolution, and adapts to multi-agency collaboration. This transforms ciphertext-state permission management from a peripheral component into a core control link in the training process.

[0022] The innovation of this invention lies in proposing a encrypted policy update mechanism suitable for federated learning. By introducing a policy token and a context-sensitive key derivation function into MA-ABE (Multi-Author Attribute-Based Encryption), adjustments to the access structure are decoupled from the ciphertext and only affect the key derivation path. In traditional schemes, the policy is bound to the ciphertext, requiring any permission adjustment to re-encrypt historical model parameters and gradients. The mechanism of this invention decouples the policy from the ciphertext structure, enabling access rule replacement to be completed without interruption of the training task. This significantly reduces the system load caused by policy evolution and ensures continuity and maintainability during long-term training.

[0023] In addition, this invention introduces a decentralized, multi-authority authorization structure based on the federated learning scenario. By using a threshold-based master key sharing method, the master key and attribute authorization authority are distributed to multiple independent institutions, making it technically impossible for any of them to recover the key or change the access policy independently. This mechanism provides practically feasible authorization independence for multi-entity collaborative scenarios such as cross-hospital and cross-enterprise collaborations, avoiding the centralized control path that easily occurs in the implementation of traditional MA-ABE. It makes the authorization chain verifiable, anti-collusion, and anti-single point-of-failure, thus building a solid trust foundation for federated learning tasks involving highly sensitive data.

[0024] To achieve the above objectives, the present invention adopts the following technical solution:

[0025] A method for implementing a multi-authority attribute-based encryption protocol, comprising the following steps:

[0026] Step 1: Initialization

[0027] Each attribute management authority generates a master key based on the set of attributes it manages;

[0028] Step 2: User Key Generation

[0029] Client User j Obtain the attribute set S from multiple authoritative attribute management centers. j The corresponding key (i.e., the user's private key component);

[0030] Step 3: Encrypting Model Parameters

[0031] The server selects a random number and encrypts the model parameter M according to the access structure A, generating a ciphertext component containing policy information.

[0032] Step 4: Decryption Process and Policy Tokens and Updatable Tokens

[0033] Client User j Using the locally held private key component, the reconstruction coefficient is calculated in combination with the parameters in the ciphertext; if the attributes satisfy the access structure, the shared secret is calculated locally and the model parameter M is decrypted; if the attributes do not satisfy the access structure, the policy change is implemented through the policy token so that the ciphertext does not need to be re-encrypted.

[0034] Preferably, step one is as follows: Select elliptic curve groups G1 and G... T And a bilinear mapping function e defined between these two groups, which maps two elements in G1 to G... T In the middle; at the same time, a generator g is selected in G1; each attribute management authority center AA iEach in the integer finite field Z modulo p p Two random numbers α are selected from the data. i and β i As a secret parameter, and to calculate the corresponding common parameter components, one is the α result of the bilinear pairing operation on the generator g$. i The power of the power, and the other is the β of the generator g. i The power of the power; the final generated global common parameter PP contains group information, bilinear mapping, generators, and a set of common parameter components calculated by all n attribute management authorities; at this point, the master key MK of each authority is... i Defined as the selected secret parameter pair (α) i ,β i ).

[0035] Preferably, in step two: for each specific attribute in the attribute set owned by the client, the authority center responsible for managing the attribute generates a corresponding private key component—multiplying the result of the exponential operation between the mapping value of the attribute authority center's master private key component on the elliptic curve group and the hash value of the attribute, wherein the exponent is obtained by multiplying another secret parameter of the authority center with the user's unique random number; the user's random number is randomly selected from a finite field of integers and uses a hash function to map the attribute to the group element.

[0036] Preferably, in step three: After selecting a random secret number from a finite integer field, the server performs encryption on the plaintext model parameters based on a preset access structure, first generating the main body of the ciphertext and a randomization component. The server calculates the exponent of the bilinear pair, which is the product of the sum of the private key parameters of all authoritative centers and the selected random secret number. This exponent is used as an encryption mask multiplied with the plaintext model parameters to hide the model data. Simultaneously, the server calculates the power of the random secret number of the group generator as the blinding base of the ciphertext, which is used for derandomization during subsequent decryption.

[0037] Secondly, ciphertext components embedding the access strategy are generated. For the access structure consisting of a linear secret sharing matrix and an attribute mapping function, the server generates two ciphertext components for each row of the matrix. The first component is the power term of the group generator, whose exponent is determined by the inner product of the row vector and the random secret number, representing the ciphertext form of the secret share. The second component is the power term of the attribute mapped to the row after hashing, with the exponent also being the inner product of the row vector and the random secret number, thus forcibly binding the secret share to the specific attribute.

[0038] Finally, the server combines the calculated encryption mask, blinding cardinality, and policy ciphertext components generated for each row of the matrix to form the final encryption gradient ciphertext.

[0039] Preferably, in step four: the client first determines the set of row indices in the access control matrix that match its attribute set. For this feasible set, the client calculates a set of reconstruction coefficients using a linear secret sharing scheme. These coefficients are used to linearly recombine the dispersed secret shares. Utilizing the algebraic properties of bilinear pairing mappings, the client pairs and aggregates the randomized components in the ciphertext with locally held attribute private key components weighted by the reconstruction coefficients. This operation aims to combine the private key shares dispersed across various attributes, thereby mathematically eliminating the influence of encrypted random numbers and accurately reconstructing the blinding factor used during encryption. If the user's attribute set meets the access structure requirements, the above calculation will successfully recover the shared secret. The client then uses this shared secret to remove the blinding masking in the ciphertext body, thereby decrypting and obtaining the original plaintext model parameters. If the attributes do not meet the requirements, reconstruction cannot be completed, and decryption fails.

[0040] Preferably, in step four, the update process is as follows: the attribute management authority generates a new access structure; a new key derivation component is issued to the client; the server switches to the new version of the policy token; the client verifies the new policy based on the token and obtains the new key component.

[0041] Preferably, in step four, the policy token consists of data tuples of three core elements: a version number to identify the current policy's validity and update order, an updated access control structure to define the changed attribute matching logic and permission boundaries, and a digital signature generated by the policy management entity based on the version number and the new access structure. Through this digital signature mechanism, the system ensures the integrity and authenticity of the policy token during broadcast distribution; the client can only execute the policy update process after verifying the signature's validity.

[0042] This invention also discloses a multi-authority attribute-based encryption protocol implementation system for performing the above method, which includes the following modules:

[0043] Initialization module: Used by each attribute management authority center to generate a master key based on the attribute set it manages;

[0044] User key generation module: used for client-side User... j Obtain the attribute set S from multiple authoritative attribute management centers. j The corresponding key;

[0045] Model parameter encryption module: The server selects a random number and encrypts the model parameter Msg according to the access structure A to generate a ciphertext component containing policy information;

[0046] Decryption process and policy token and update module: for client User jUsing the locally held private key component, the reconstruction coefficient is calculated in combination with the parameters in the ciphertext; if the attribute satisfies the access structure A, the shared secret is calculated locally and the model parameter Msg is decrypted; if the attribute does not satisfy the access structure, the policy token is used to update the policy so that the ciphertext does not need to be re-encrypted.

[0047] In summary, the innovation of this invention lies in its system-level reconstruction of the MA-ABE policy update mechanism and authorization architecture to meet the specific needs of federated learning. This enables access control to dynamically adjust during the training process while maintaining encrypted execution. The protocol system proposed in this invention significantly improves the flexibility, verifiability, and system stability of access management in application scenarios with large-scale collaboration, long-term tasks, and high regulatory requirements, providing a sustainable, efficient, and secure technical solution for the deployment of federated learning in privacy-sensitive fields. Attached Figure Description

[0048] Figure 1 This is a graph showing the decline in losses from federal learning, training, and validation.

[0049] Figure 2 This is a graph showing the improvement in accuracy as the number of training rounds increases;

[0050] Figure 3 This is a confusion matrix diagram of classification performance;

[0051] Figure 4 This is a block diagram of a multi-authority attribute-based encryption protocol implementation system according to a preferred embodiment of the present invention. Detailed Implementation

[0052] The preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0053] The preferred embodiment of this invention employs MA-ABE, threshold master key sharing, policy tokens, and context-sensitive key generation mechanisms to achieve encrypted access control over model parameters and local gradients. This invention's technical solution is applicable to cross-institutional and cross-domain collaborative training scenarios, maintaining the controllability, updability, and auditability of access policies throughout the entire training lifecycle, without requiring re-encryption of historical ciphertext. Participants include: a global server—responsible for model aggregation and policy token version management, but not involved in decryption; a set of attribute management authority centers—each authority maintains certain attributes and participates in threshold authorization; and a federated learning client—holding the local dataset and requiring encrypted access to model updates or task parameters during training.

[0054] The settings parameters include: the attribute set constitutes a unified attribute set. Each client has a set of attributes. Access information is described using an access structure. , where 𝑀 is the linear secret sharing matrix and 𝜌 is the row attribute mapping function.

[0055] This embodiment of a multi-authority attribute-based encryption protocol implementation method includes the following specific technical solutions: parameter initialization, master key generation, model encryption parameters, decryption process, policy update method, and threshold master key sharing authorization. The specific steps of the protocol will be described in detail below:

[0056] Step 1: System Initialization

[0057] The attribute management authority generates a master key based on the set of attributes it manages. First, it selects the elliptic curve groups G1 and G... T , and bilinear mapping Select generator Each authoritative AA i Select Master Key ( Represents a finite field of integers modulo p, which defines the system private key (e.g., ...). , The range of values ​​for ) is defined as follows: (i.e., these private keys are scalars randomly selected from integers between 0 and p-1). The common parameters are calculated as follows: , The global common parameter is Each authority's master key is Where n represents the total number of attribute management authorities in the system.

[0058] Step 2: Generating the User Master Key

[0059] Client It is necessary to obtain the set of attributes from multiple authorities. The corresponding private key component. For each attribute By the authority that manages this attribute generate ,in, Random selection This is a hash function. The master key is... In this invention, multiple authorities share a threshold master key to ensure that key generation cannot be performed independently by any single authority.

[0060] In this step, to prevent single points of failure, threshold master key sharing authorization is performed when issuing user private keys. Specifically:

[0061] To avoid single points of trust, this invention achieves decentralized key generation through Shamir threshold sharing. Each authority maintains a polynomial:

[0062] ;

[0063] Each authority receives a share of the master key. i =f(i), which can be restored if and only if there are t authoritative collaborations. This allows it to be used for private key component issuance, policy update authorization, system parameter derivation, etc., enhancing anti-collusion and authorization robustness.

[0064] Step 3: Encrypting Model Parameters

[0065] Before federated learning begins training or during each round of model exchange, the server encrypts the model parameters M according to the access structure A. A random number is selected. The ciphertext is generated as follows:

[0066] ;

[0067] Where C0 represents the randomization component (blinding factor) of the ciphertext, in step four, C0 will be subjected to a bilinear pairing operation with the user's private key component to cancel out the randomness in the ciphertext, thereby recovering the original plaintext M.

[0068] For access structure each line Corresponding attributes :

[0069] ;

[0070] Among them, M l Let represent the l-th row vector of the linear secret sharing matrix M, which is used to distribute the secret s into different shares and bind them to specific attributes.

[0071] The final ciphertext is This encrypted text can be bound to model parameters, local gradients, or a specific training phase.

[0072] Step 4: Decryption Process, Policy Tokens, and Updatable Tokens

[0073] Client If the properties satisfy the access structure, the key can be recovered from the shared master key. For the feasible set in the access structure... Calculate reconstruction coefficients :

[0074] ;

[0075] Here, j represents a specific user. For example, if there are multiple hospitals participating in federated learning in the system, User1 represents hospital A, User2 represents hospital B, and j is the unique identifier used to distinguish these different participants; To reconstruct the coefficients, when the set of attributes possessed by a user satisfies the access policy, the rows M corresponding to these attributes in matrix M are... lThe vector can be reconstructed through linear combination, here These are the weights (coefficients) when these rows are linearly combined. This is achieved through calculation. Users can aggregate the private key components scattered across various attributes to recover the decryption factors needed for decryption.

[0076] If the attributes satisfy the access structure, the shared secret is calculated locally and the model parameters are finally decrypted:

[0077] ;

[0078] If the attributes do not satisfy the access structure, the plaintext cannot be recovered. Policy tokens are used to implement policy changes that allow ciphertext to be encrypted without re-encryption. Policy token structure:

[0079] ;

[0080] Where ver is the version number, A new For the updated access structure, Digital signatures of entities are managed by policy.

[0081] The update process is as follows: the policy management entity generates a new access structure; a new key derivation component is issued to the user (no need to re-encrypt the ciphertext); the server switches to the new version of the policy token; the client verifies the new policy based on the token and obtains the new private key component. Since the model ciphertext remains unchanged, the system avoids full re-encryption.

[0082] Based on the technical solution of this invention, the implementation process of this invention in practical applications will be illustrated through the following case scenarios. The specific application implementation scheme is as follows:

[0083] Step 1: Initialization, the specific process is as follows:

[0084] 1. Jointly generate and publish system public parameters

[0085] The multi-authority attribute center set AAS is initialized using a threshold secret sharing mechanism. First, a prime-order bilinear group based on elliptic curves is selected. and bilinear mapping relationship Subsequently, various authoritative institutions Independently select a random secret scalar as the master private key component. The system then uses the generator g to perform modular exponentiation to calculate the public key components for each party. Finally, the system synthesizes a public parameter PP containing all authoritative contributions using an aggregation algorithm and releases it to the public. This process ensures that the system master key MK is implicitly contained in the parameters of multiple parties in a distributed manner, and cannot be independently reconstructed by a single institution, thus establishing a decentralized foundation of trust.

[0086] Step 2: User key generation, the specific process is as follows:

[0087] 2. Issue the initial private key component

[0088] Federated Learning Client Submit attribute credentials to the attribute center. The authority center verifies the user attribute set. Then, the private key generation algorithm is executed. This is done for each attribute held by the user. The authoritative center uses a collision-resistant hash function to map attributes to group elements, and performs scalar multiplication with its own secret parameters and a user-specific random number to generate an initial private key component bound to that attribute. The aforementioned components are sent to the client via a secure transmission channel, where they are aggregated into a complete local decryption private key. .

[0089] Step 3: Encrypt the model parameters. The specific process is as follows:

[0090] 3. Upload the encrypted gradient

[0091] During training, the client encrypts local gradients or model parameters based on the current access structure, using a linear secret sharing matrix and attribute mapping function definition. The client first selects a random secret number. The system utilizes a linear secret-sharing scheme to divide the data into multiple secret shares, each bound to an attribute corresponding to a row of matrix M. Combined with the system's common parameter PP, the client generates a component that encapsulates the data while hiding the plaintext of the model. Encapsulation components with embedded access structure strategies The encrypted gradient CT is then uploaded to the aggregation server.

[0092] 4. Ciphertext Aggregation

[0093] The global aggregation server receives the encrypted data uploaded by each participant. Then, under the strict premise of not decrypting and not touching the plaintext gradient, a ciphertext aggregation operation is performed. The server utilizes the algebraic homomorphism of the ciphertext or a specific aggregation algorithm to perform domain-wise mathematical merging of ciphertext components from different clients, generating a global model ciphertext containing the global gradient. .

[0094] 5. Broadcast global model ciphertext and policy token

[0095] The server will aggregate the generated global model ciphertext. The current policy token PT is broadcast to all training participants. The formal definition of the policy token PT includes the current policy version number ver, the access structure definition A, and the digital signature σ of the policy management entity, aiming to establish the integrity and authenticity of the access policy.

[0096] Step 4: Decryption process and policy token update, the specific process is as follows:

[0097] 6. Verify the token to determine if decryption was successful.

[0098] After receiving the broadcast data, the client first verifies the validity of the policy token signature σ, and then uses its local private key. Attempting to decrypt, if the attribute set of a compliant participant satisfies the access matrix requirements, the client calculates a set of Lagrange reconstruction coefficients. The ciphertext policy component is paired with the local private key component using a bilinear pairing mapping operation. Through weighted aggregation of the computation results, the client can eliminate the random blinding factor embedded in the ciphertext, successfully reconstruct the shared secret, and decrypt to obtain the global model parameters. Then, the local model is updated to perform the next round of training.

[0099] For parties with mismatched attributes, if their attribute set cannot cover the access matrix requirements, due to the linear correlation limitation, it is impossible to calculate effective reconstruction coefficients to eliminate the random blinding factor, resulting in invalid output values ​​from the decryption algorithm and decryption failure.

[0100] 7. Generate a new version of the strategy token

[0101] When the system enters a new training phase or compliance requirements change, the policy management entity defines a new access control structure. And generate a file containing the new version number. and the new structure of strategy tokens This triggers the system's dynamic policy update protocol.

[0102] 8. Distribute the key update component and broadcast the new token.

[0103] Server broadcasts new policy token Simultaneously, the attribute authority center calculates and distributes key update components to users. The core mechanism of this step lies in applying context-sensitive key derivation technology, meaning that the system does not need to perform re-encryption operations on massive amounts of global model ciphertext, but instead changes the mathematical adaptation relationship between the key and the existing ciphertext structure by updating the key component on the user's end.

[0104] 9. Dynamic access control enforcement

[0105] After receiving the update information, the client executes different results based on the matching of its own attributes with the new policy. The permission maintainer combines the newly issued key update component with the new policy token in its possession. Because its attributes satisfy the new policy, the bilinear pairing operation performed using the new component can still correctly cancel out the random factors in the ciphertext, thereby achieving successful decryption and ensuring a seamless continuation of the training process.

[0106] The party whose permissions have been revoked cannot construct a valid decryption factor even if it possesses the old key and the new components because its attributes do not meet the requirements of the new policy. The decryption operation will output meaningless gibberish, preventing it from obtaining the model parameters, and the state will change to permission revocation. This achieves fine-grained permission revocation while keeping the ciphertext unchanged.

[0107] To further verify the performance of the technical solution of the present invention in a federated learning access control environment, the following description, in conjunction with experimental figures, illustrates the computational efficiency, access policy update cost, and impact on model training effectiveness of the present invention.

[0108] Figure 1 The figure illustrates the trends of training loss and validation loss of the global model during training epochs. Experimental results show that the access control strategy adopted in this invention does not interfere with the normal training process of the model, and the model can enter a stable descent phase in the first few epochs. The training loss shows a continuous convergence trend, and the validation loss also decreases synchronously. Both tend to stabilize in the mid-to-late stages without significant oscillations or abnormal fluctuations. This figure reflects that throughout the entire training-aggregation cycle, the encryption and access control mechanism of this invention does not negatively affect the effectiveness of gradient exchange, nor does it cause discontinuity or instability in the model training process due to policy switching or key management operations. This result verifies that this invention can maintain the normal convergence behavior of federated training while ensuring security.

[0109] Figure 2 This experiment demonstrates the gradual improvement of model validation accuracy with each training epoch during federated learning training. The results show that, under the access control framework of this invention, model accuracy improves progressively from a low initial level, eventually reaching a stable convergence range. Compared to the baseline model, the proposed solution achieves consistent or even slightly improved accuracy performance within the same training epochs. This experiment illustrates that the encryption mechanism and multi-authority policy control employed in this invention do not cause deviations in model gradient exchange or inconsistencies in global model updates; the policy token mechanism's policy switching also does not alter the existing training trajectory, thus ensuring that the federated learning model maintains a normal trend of accuracy improvement even with enhanced security.

[0110] Figure 3The results demonstrate the classification performance of the final trained global model across multiple medical image categories. The confusion matrix shows that all data types achieve high classification accuracy under the proposed solution, with a low misclassification rate, and the overall classification decision trend is consistent with the unencrypted model. This indicates that the proposed solution does not disrupt the gradient or feature distribution of specific categories, and the model maintains good generalization ability and cross-institutional data fusion capabilities. The experiment further verifies that the access control mechanism proposed in this invention ensures that different categories of data are effectively utilized in multi-institutional joint training, that classification boundaries are not affected by security mechanisms, and that the system possesses stable and reliable task performance.

[0111] By comprehensively evaluating encryption overhead, policy update cost, and model training performance, we can conclude that:

[0112] The multi-authority key computation structure and threshold reconstruction mechanism of this invention enable encryption and decryption operations to remain linearly controllable as the number of attributes expands, significantly reducing the computational load under multi-attribute conditions.

[0113] The policy token mechanism of this invention avoids the re-encryption of historical ciphertexts and the regeneration of all keys, making permission adjustments lightweight and quick to execute, and suitable for collaborative environments with frequent permission changes.

[0114] This invention achieves access control without interfering with the convergence process and accuracy of the federated learning model, ensuring a balance between enhanced security and maintained performance.

[0115] like Figure 4 As shown, this embodiment discloses a multi-authority attribute-based encryption protocol implementation system for executing the above method, which includes the following modules:

[0116] Initialization module: Used by each attribute management authority center to generate a master key based on the attribute set it manages;

[0117] User key generation module: used for client-side User... j Obtain the attribute set S from multiple authoritative attribute management centers. j The corresponding key;

[0118] Model parameter encryption module: The server selects a random number and encrypts the model parameter Msg according to the access structure A to generate a ciphertext component containing policy information;

[0119] Decryption process and policy token and update module: for client User jUsing the locally held private key component, the reconstruction coefficient is calculated in combination with the parameters in the ciphertext; if the attribute satisfies the access structure A, the shared secret is calculated locally and the model parameter Msg is decrypted; if the attribute does not satisfy the access structure, the policy token is used to update the policy so that the ciphertext does not need to be re-encrypted.

[0120] Other aspects of this embodiment can be found in the above method embodiments.

[0121] In summary, this invention does not compromise the effectiveness of gradient exchange, nor does it decrease convergence speed. Furthermore, the model maintains a steady increase in accuracy even with access control mechanisms in place, and it does not compromise the model's ability to distinguish between different categories. While ensuring privacy protection and access control capabilities, it maintains stable training quality and accuracy of the federated learning model, and ensures the system as a whole has good scalability and maintainability. It is suitable for large-scale, multi-institutional collaborative scenarios. Even with a large number of participants or complex attribute systems, this invention maintains stable efficiency, making it particularly suitable for scenarios such as medical image analysis, financial risk control, and cross-industry platform collaboration.

[0122] The preferred embodiments and principles of the present invention have been described in detail above. For those skilled in the art, there may be changes in the specific implementation based on the ideas provided by the present invention, and these changes should also be considered within the scope of protection of the present invention.

Claims

1. A method for implementing a multi-authority attribute-based encryption protocol, characterized in that, The specific steps are as follows: Step 1: Initialization Each attribute management authority generates a master key based on the set of attributes it manages; Step 2: User Key Generation Client User j obtain from a plurality of attribute management authorities attributes of the attribute set S j corresponding key; Step 3: Encrypting Model Parameters The server selects a random number and encrypts the model parameter Msg according to the access structure A to generate a ciphertext component containing policy information. Step 4: Decryption Process and Policy Token Update User j With the local holding of private key components, combined with the parameters in the ciphertext to calculate the reconstruction coefficient; if the attribute satisfies the access structure A, the shared secret is calculated locally and the model parameters Msg are decrypted; if the attribute does not satisfy the access structure, the ciphertext is updated without re-encryption through the strategy token. In step four, the update process is as follows: the attribute management authority generates a new access structure; a new key derivation component is issued to the client; the server switches to the new version of the policy token; The client verifies the new strategy based on the token and obtains the new key component; In step four, the policy token consists of a data tuple of three elements: the version number, which identifies the validity period and update order of the current policy; the updated access control structure, which defines the changed attribute matching logic and permission boundaries; and the digital signature, which is calculated and generated by the policy management entity based on the version number and the new access structure.

2. The method for implementing a multi-authority attribute-based encryption protocol as described in claim 1, characterized in that, Step one is as follows: Select the elliptic curve group G1 and G... T And a bilinear mapping function e defined between these two groups, which maps two elements in G1 to G... T Meanwhile, a generator g is selected in G1; Each attribute management authority center (AA) i Each in the integer finite field Z modulo p p Two random numbers α are selected from the data. i and β i As a secret parameter, and to calculate the corresponding common parameter components, one is the α result of the bilinear pairing operation on the generator g. i The power of the power, and the other is the β of the generator g. i The power of the power; the final generated global common parameter PP contains group information, bilinear mapping, generators, and a set of common parameter components calculated by all n attribute management authorities; at this point, the master key MK of each authority is... i Defined as the selected secret parameter pair (α) i ,β i ).

3. The method for implementing a multi-authority attribute-based encryption protocol as described in claim 1, characterized in that, in step two: for each specific attribute in the attribute set owned by the client, the authority center responsible for managing the attribute generates a corresponding private key component—multiplying the result of an exponential operation between the mapping value of the attribute authority center's master private key component on the elliptic curve group and the hash value of the attribute, wherein, The index is obtained by multiplying another secret parameter of the authority center with the user's unique random number; the user's random number is randomly selected from a finite field of integers and uses a hash function to map the attributes to group elements.

4. The method for implementing a multi-authority attribute-based encryption protocol as described in claim 1. Its characteristic is that, in step three: after the server selects a random secret number in the finite field of integers, it performs an encryption operation on the plaintext of the model parameters based on the preset access structure A. First, it generates the main body of the ciphertext and the randomization component; the server calculates the exponent of the bilinear pair, the exponent of which is the product of the sum of the private key parameters of all authoritative centers and the selected random secret number, and uses it as an encryption mask to multiply with the plaintext of the model parameters, thereby hiding the model data; the server calculates the power of the random secret number of the group generator as the blinding base of the ciphertext; Secondly, the server generates ciphertext components that embed the access strategy. For the access structure consisting of a linear secret sharing matrix and an attribute mapping function, the server generates two ciphertext components for each row of the matrix. The first component is the power term of the group generator, and the exponent is determined by the inner product of the row vector of the corresponding row of the linear secret sharing matrix and the random secret number, representing the ciphertext form of the secret share. The second component is the power term of the attribute mapped to the row after hashing, and the exponent is the inner product of the row vector of the corresponding row of the linear secret sharing matrix and the random secret number, thus binding the secret share to the specific attribute. Finally, the server combines the calculated encryption mask, blinding cardinality, and policy ciphertext components generated for each row of the matrix to form the final encryption gradient ciphertext.

5. A method for implementing a multi-authority attribute-based encryption protocol as described in any one of claims 1-4. Its characteristic is that, in step four: the client first determines the set of row indices in the access control matrix that match its attribute set; for the feasible set, the client uses a linear secret sharing scheme to calculate a set of reconstruction coefficients, which are used to linearly recombine the scattered secret shares; the client uses the algebraic properties of bilinear pairing mapping to pair and aggregate the randomized components in the ciphertext with the locally held attribute private key components weighted by the reconstruction coefficients. If the user's attribute set meets the access structure requirements, the shared secret is successfully recovered. The client uses this shared secret to remove the blinding masking in the ciphertext body, thereby decrypting and obtaining the original plaintext model parameters. If the attributes do not meet the requirements, reconstruction cannot be completed and decryption fails.

6. A multi-authority attribute-based encryption protocol implementation system for performing the method as described in any one of claims 1-5, characterized in that, Includes the following modules: Initialization module: Used by each attribute management authority center to generate a master key based on the attribute set it manages; User key generation module: used for client-side User... j Obtain the attribute set S from multiple authoritative attribute management centers. j The corresponding key; Model parameter encryption module: The server selects a random number and encrypts the model parameter Msg according to the access structure A to generate a ciphertext component containing policy information; Decryption process and policy token and update module: for client User j Using the locally held private key component, the reconstruction coefficient is calculated in combination with the parameters in the ciphertext; if the attribute satisfies the access structure A, the shared secret is calculated locally and the model parameter Msg is decrypted; if the attribute does not satisfy the access structure, the policy token is used to update the policy so that the ciphertext does not need to be re-encrypted.

Images