Outsourcing decryption method based on lattice attribute-based encryption

Abstract

The present invention discloses a lattice-based attribute-based encryption outsourcing decryption method. In view of the problems that the existing key policy attribute-based encryption KP‑ABE (Key Policy Attribute Based Encryption) method has large user-side computing overhead and long decryption time during decryption, a lattice-based attribute-based encryption outsourcing decryption method is proposed. A technology of outsourcing decryption is used to transfer most of the decryption overhead to the server, so that a lightweight user terminal only needs a small overhead to perform the decryption operation. A homomorphic evaluation operation is used to convert the ciphertext into a short ciphertext, so that the lightweight user terminal consumes less storage space. Compared with the construction based on bilinear mapping, this method is resistant to quantum attacks, has better computing performance than the method based on LWE, and is more suitable for lightweight users than the lattice-based non-decryption outsourcing attribute-based encryption method.

Description

Technical Field

[0001] The present invention relates to the field of encryption technology, and more specifically to an outsourced decryption method based on lattice attribute-based encryption. Background Art

[0002] In 2005, Sahai and Waters extended the concept of IBE (Identity Based Encryption) scheme, i.e., identity-based encryption scheme, and proposed the concept of Fuzzy-IBE, which is the first ABE (Attribute Based Encryption) scheme, i.e., attribute-based encryption scheme ([1] Amit Sahai, Brent Waters. Fuzzy Identity Based Encryption. Aarhus, Denmark: Springer Berlin Heidelberg, 457-473, 2004). The original purpose of proposing this scheme was to increase the fault tolerance of the IBE scheme. The user identity is regarded as a series of attributes. When encrypting, the data owner sets a threshold value. Decryption can only be performed when and only when the number of attributes in the intersection of the attribute set of the data user and the attribute set in the ciphertext is equal to or greater than this threshold value. Since this scheme is not expressive, it is not applicable to many scenarios. Goyal et al. proposed the KP-ABE (Key Policy Attribute Based Encryption) scheme in 2006 ([2] Goyal, Vipul, et al. "Attribute based encryption for fine grained access control of encrypted data." Proceedings of the 13th ACM conference on Computer and communications security. 2006). Subsequently, Bethencourt et al. proposed the CP-ABE (Ciphertext Policy Attribute Based Encryption) scheme in 2007 based on the proposal of Goyal et al. ([3] Bethencourt, John, Amit Sahai, and Brent Waters. "Ciphertext policyattribute based encryption." 2007 IEEE symposium on security and privacy (SP'07). IEEE, 2007).In 2011, Waters proposed the first CP-ABE scheme that is fully expressive, efficient, supports monotone LSSS access structure strategy, and is proven to be secure under the standard model ([4] Lewko, Allison, and Brent Waters. "Unbounded HIBE and attribute based encryption." Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, Berlin, Heidelberg, 2011).

[0003] However, the huge decryption time overhead of the ABE scheme has hindered the further development of the ABE scheme. For data users with limited resources, it is impossible to decrypt quickly. With the development of cloud computing technology, outsourcing the decryption operation of ABE to cloud servers has become a feasible way to solve the above problems. Cloud servers can effectively solve problems such as insufficient computing and storage capacity on the user side, and can effectively reduce the computing overhead on the user side. In 2011, Green et al. first proposed a feasible outsourcing decryption ABE (OD-ABE: Outsourcing the Decryption of AttributeBased Encryption) scheme for the ABE scheme. Many subsequent OD-ABE schemes have borrowed the ideas in this scheme. Using their method, data users can outsource most of the decryption operations to cloud servers with abundant computing resources without leaking plaintext messages. After that, data users only need to perform simple operations to decrypt the intermediate ciphertext returned by the cloud server to obtain the corresponding plaintext. In 2016, Wang et al. also proposed a verifiable OD-ABE scheme and outsourced the key generation, message decryption and message encryption processes ([5] Wang, Hao, et al. "Verifiable outsourced ciphertext policy attribute based encryption in cloud computing." Soft Computing, 21.24 (2017): 7325-7335). However, their schemes are all attribute-based encryption schemes based on bilinear pairing. Therefore, these schemes are only resistant to classical computer attacks, not quantum computer attacks. Dai et al. proposed a lattice-based key policy attribute-based encryption scheme ([6] Dai W, Y, Polyakov Y, et al. Implementation and evaluation of a lattice-based key-policy ABE scheme. IEEE Transactions on Information Forensics and Security, 2017, 13(5): 1169-1184). This scheme is not only resistant to classical computer attacks, but also to quantum computer attacks. However, this scheme also has the problems of traditional ABE schemes. The private key generation, data encryption and decryption stages require a lot of calculations. Private key generation and data encryption can be performed by mainframes, but limited computing resources and power resources cause the user machine that performs decryption to be unable to bear excessive computing overhead and communication overhead. Decryption includes expensive operations and users must repeat these operations. How to construct a method that is resistant to classical computer attacks, quantum computer attacks, and suitable for lightweight user terminals is still an open problem. Therefore, the present invention proposes an outsourced decryption method based on lattice attribute-based encryption suitable for lightweight user terminals. Summary of the invention

[0004] The decryption process of the attribute-based encryption (ABE) scheme must perform repeated complex calculations, making the scheme difficult to apply to lightweight user terminals. The purpose of the present invention is to propose a new lattice-based attribute-based encryption outsourced decryption method to obtain a function that is resistant to both classical computer attacks and quantum computer attacks and has good decryption efficiency.

[0005] The invention provides an outsourced decryption method based on lattice attribute-based encryption, which comprises generating system parameters, an encryption algorithm, homomorphic evaluation of a public key and ciphertext, a key generation algorithm, an outsourced decryption algorithm and a decryption algorithm.

[0006] The outsourced decryption method based on lattice attribute-based encryption proposed by the present invention comprises the following steps:

[0007] Step 1: Generate system parameters;

[0008] According to the input security parameter λ, the TRAPGEN(λ) algorithm is called to generate the matrix A and the master key T A ; According to the input attribute quantity parameter l, randomly generate l+1 uniformly distributed vectors B i , B i Corresponding to the attribute set Y = {y1,y2,…,y l}, Y[i] is y i , Randomly generate a challenge β←R q ; Finally, output the public parameter MPK and the master key MSK; MPK = (A, {Bi} i∈{0,1,…,l} ,β),MSK=T A ;

[0009] Step 2: Encryption algorithm;

[0010] According to the plaintext μ∈R2, the attribute set X and MPK, the encryption algorithm is executed to randomly generate s←R q , e1←D R,σ , i=0,1,2,…,l, l is the number of attributes; D R,σ represents the Gaussian distribution on the ring R, Representatives in Gaussian distribution on; the noise vectors e1 and e2 are sampled from Gaussian distribution; G=(1,2,2 2 , 2 3 , …, 2 k-1 , 0, 0), where k = m-2, m depends on T A (Trapdoor) construction; output ciphertext C = (C A ,C B ,C s );in Use Mark C i =(x i G+B i ) T s+e 0,i Represents C B of the various parts, where i = 0, 1, .., l, x i Corresponding to the value in attribute set X, x0=1 does not belong to attribute set X, which is a necessary component to implement Boolean circuits in access strategy circuits. The search version of the ring fault-tolerant learning assumption prevents the adversary from calculating C s =βs+e1+μ[q / 2] where s←R q , the decision version of the ring fault-tolerant learning assumption makes the pseudo-random ciphertext component C i Difficult to distinguish;

[0011] Step 3: Homomorphic evaluation of public key and ciphertext;

[0012] The public key B corresponding to the attribute i and ciphertext C i Both are calculated homomorphically on the access strategy circuit f to obtain the public key B corresponding to f. f And the ciphertext C f ;

[0013] Step 4: Key generation algorithm;

[0014] The vector C obtained after homomorphic evaluation in step 3 f is considered to be under public key B f The encrypted ciphertext is: f and B f All correspond to access policy f, written as For e f If there are attributes x1 and x2, the access strategy f is an addition or subtraction operation, where C1 = (x1G + B1) T s+e 0,1 ,C2=(x2G+B2) T s+e 0,2 ,e f =e 0,1 ±e 0,2 , if the access strategy f is multiplication, e f =x2e 0,1 +ψ T e 0,2 ; Then randomly generate a key Based on the challenge β generated in step 1 and B generated in step 3 f Generate t = β-B f a B According to the algorithm GAUSSSAMP(A,T A ,t) Generate key a A , key a A and a B Output to the data user, the data user will key a B Output to the outsourced decryption server;

[0015] Step 5: Outsource the decryption algorithm;

[0016] The outsourced decryption server receives the key a B And the ciphertext C f Generate converted ciphertext

[0017] Step 6: Decryption algorithm.

[0018] Preferably, the generation system parameters described in step 1 are specifically implemented as follows:

[0019] Step 1.1: Generate the matrix A and master key T according to the input security parameter λ using the TRAPGEN(λ) algorithm A ; T A It consists of two vectors d and u, T A ={d,u}, both vectors are generated using discrete Gaussian distribution with distribution parameter σ, d o ←D R,σ ,u o ←DR,σ , D R,σ represents a Gaussian distribution over a polynomial ring R, o = 1, 2, ..., k, k = m-2, where m depends on the specific T A (Trapdoor) structure,

[0020] Step 1.2: According to the input attribute quantity parameter l, randomly generate l+1 uniformly distributed vector pairs Where i = 0, 1, 2, ..., l, B i Corresponding to the attribute set Y = {y1,y2,…,y l} i , l is the number of attributes, y0=1 corresponding to B0 does not belong to the attribute set Y, but is a necessary component to implement the Boolean circuit in the access strategy circuit f; finally, a challenge β←R is generated uniformly and randomly q ,in is a cyclotomic polynomial ring, is a polynomial ring with integer coefficients, R q =R / qR, q is the modulus; represents an m×1 column vector, The elements in the ring R q ; represents a 1×m row vector, The elements in the ring R q ; represents an m×m matrix, The elements in the ring R q ;

[0021] Step 1.3: Output MPK = (A, {B i} i∈{0,1,…,l} ,β),MSK=T A When T A When is unknown and A is pseudo-random, this method satisfies the assumption of fault-tolerant learning on the ring.

[0022] Preferably, the homomorphic evaluation of the public key and the ciphertext described in step 3 is specifically implemented as follows:

[0023] The public key B corresponding to the attribute i and ciphertext C i Both are calculated homomorphically on the access strategy circuit f to obtain the public key B corresponding to f. f And the ciphertext C f ; Treat the access strategy f as a Boolean circuit, and the Boolean circuit used has a binary tree topology; if there are attributes x1 and x2, Get the ciphertext Access strategy f uses addition, subtraction, or multiplication to represent Boolean expressions; if this access strategy f is addition or subtraction, then the homomorphic computation is C ± =C1±C2,B ± =B1±B2, where C1=(x1G+B1) T s+e 0,1 , If the access strategy f is a multiplication operation C X =x2C1+ψ T C2,B X =B2ψ, where ψ=BITDECOMP(-B1), BITDECOMP represents the bit decomposition operation on -B1, so that -B1=Gψ; then the homomorphic evaluation of the NAND gate is expressed as C NAND =C0-x2C1-ψ T C2, B NAND =B0-B2ψ; Based on the homomorphic evaluation of the NAND gate, the calculation can be iteratively completed in the defined binary tree topology; Based on the defined access strategy f, the public key B corresponding to f is obtained f And the ciphertext C f ; B f =EVALPK(X,B i ,f),C f =EVALPK(X,C i , f); C i =(x i G+B i ) T s+e 0,i , Evaluation of the ciphertext will result in an increase in noise in the error vector, and the noise level should not exceed a threshold of the chosen ciphertext modulus q to achieve correct decryption.

[0024] Preferably, the decryption algorithm described in step 6 is specifically implemented as follows:

[0025] The data user receives the ciphertext C after outsourcing decryption mid And the ciphertext C s =βs+e1+μ(q / 2), ciphertext Recover the plaintext μ;

[0026] Only when the attribute value in the ciphertext satisfies the access policy, the user holding the key has the authority to decrypt the ciphertext;

[0027] Decryption is successful if and only if f(X) = 0;

[0028]

[0029] |dtext z | otherwise z=1,2,…,N; N is the length of plaintext, and the decryption set is obtained That is, the plaintext encrypted by the data owner

[0030] The present invention has the following advantages relative to other methods:

[0031] 1) High efficiency

[0032] Lattice-based cryptographic systems are typically algorithmically simple, highly parallelizable, and consist primarily of linear operations on vectors and matrices modulo relatively small integers.

[0033] 2) Anti-quantum attack

[0034] Compared with most number-theoretic cryptographic schemes, lattice cryptography is significantly more resistant to quantum attacks, as most number-theoretic cryptographic schemes are not secure in the presence of quantum computers.

[0035] 3) Access strategies are more expressive

[0036] The present invention constructs a method based on Boolean circuits, and can construct various access strategies to cope with complex business scenarios.

[0037] 4) Suitable for lightweight client

[0038] The present invention outsources the decryption algorithm so that the user end only needs to spend a small amount of overhead to complete the decryption.

[0039] The present invention is based on a lattice-based attribute-based encryption method, which can effectively resist quantum attacks. Moreover, because the construction of this method is based on the RLWE assumption (polynomial ring), compared with the LWE assumption (integer ring), the computational and storage complexity is significantly reduced. The present invention can be used to achieve secure data sharing in a distributed cloud environment, and is particularly suitable for resource-constrained devices such as mobile devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0041] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0042] Step 1: Generate system parameters

[0043] Step 1.1: Generate the matrix A and master key T according to the input security parameter λ using the TRAPGEN(λ) algorithm A ; T A It consists of two vectors d and u, T​A ={d,u}, both vectors are generated using discrete Gaussian distribution with distribution parameter σ, d o ←D R,σ ,u o ←D R,σ , D R,σ represents a Gaussian distribution over a polynomial ring R, o = 1, 2, ..., k, k = m-2, where m depends on the specific T A (Trapdoor) structure,

[0044] Step 1.2: According to the input attribute quantity parameter l, randomly generate l+1 uniformly distributed vector pairs Where i = 0, 1, 2, ..., l, B i Corresponding to the attribute set Y = {y1,y2,…,y l} i , l is the number of attributes. The special y0=1 corresponding to B0 does not belong to the attribute set Y, but is a necessary component to implement the Boolean logic circuit in the access strategy circuit f. Finally, a challenge β←R is generated uniformly and randomly. q ,in is a cyclotomic polynomial ring, is a polynomial ring with integer coefficients, R q =R / qR, q is the modulus. represents an m×1 column vector, The elements in the ring R q . represents a 1×m row vector, The elements in the ring R q . represents an m×m matrix, The elements in the ring R q .

[0045] Step 1.3: Output MPK = (A, {B i} i∈{0,1,…,l} ,β),MSK=T A When T A When is unknown and A is pseudo-random, this method satisfies the assumption of fault-tolerant learning on the ring.

[0046] Step 2: Encryption Algorithm

[0047] Execute the encryption algorithm based on the plaintext μ, μ∈R2, the attribute set X and MPK, and randomly generate s←R q , e1←D R,σ , i=0,1,2,…,l, l is the number of attributes. R,σ represents the Gaussian distribution on the ring R, Representatives in Both e1 and e2 are sampled from Gaussian distributions, which are usually called error vectors or noise vectors in ciphertext. G=(1,2,2 2 , 2 3 , …, 2 k-1 , 0, 0), where k = m-2, m depends on the specific T A (Trapdoor) construction. Output ciphertext C = (C A ,C B ,C s ).in For convenience, we use the symbol C i =(x i G+B i ) T s+e 0,i To represent C B Each part in, where i = 0, 1, .., l, x i Corresponding to the value in the attribute set X, the special x0=1 does not belong to the attribute set X, but is a necessary component to implement the Boolean logic circuit in the access strategy circuit. i =1 means attribute set X contains y in attribute set Y i , x i =0 means that attribute set X does not contain y in attribute set Y i .

[0048] Step 3: Homomorphic evaluation of public key and ciphertext

[0049] The public key B corresponding to the attribute i and ciphertext C i Both are calculated homomorphically on the access policy circuit f, so that the public key B corresponding to f is obtained f And the ciphertext C f The access policy f is considered as a Boolean circuit. More specifically, the Boolean logic circuit used in this method has a binary tree topology. The NAND gate is universal. Any Boolean function can be implemented using only the NAND gate. A subtraction and multiplication operation can be used to obtain the NAND gate. Assuming that there are attributes x1 and x2, Get the ciphertext The access strategy f can be used to represent Boolean expressions using addition, subtraction, or multiplication. If this access strategy f is an addition or subtraction operation, then the homomorphic computation is C ± =C1±C2, B ± =B1±B2, where C1=(x1G+B1) T s+e0,1 , C2=(x2G+B2) T s+e 0,2 , C0=(G+B0) T s+e 0,0 , If the access strategy f is a multiplication operation C X =x2C1+ψ T C2,B X =B2ψ, where ψ=BITDECOMP(-B1), BITDECOMP represents the bit decomposition operation on -B1, so that -B1=Gψ. Then the homomorphic evaluation of the NAND gate can be expressed as C NAND =C0-x2C1-ψ T C2, B NAND = B0-B2ψ. Based on the homomorphic evaluation of the NAND gate, the calculation can be iteratively completed in the defined binary tree topology. According to the defined access policy f, the public key B corresponding to f is obtained. f And the ciphertext C f . B f =EVALPK(X,B i ,f),C f =EVALPK(X,C i , f). C i =(x i G+B i ) T s+e 0,i , Evaluation of the ciphertext results in the addition of noise in the error vector, and the noise level should not exceed a threshold of the chosen ciphertext modulus q to enable correct decryption.

[0050] Step 4: Key Generation Algorithm

[0051] The vector C obtained after homomorphic evaluation in step 3 f is considered to be under public key B f The encrypted ciphertext is as follows. f and B f All correspond to access policy f, so it can be written as where e f The calculation is similar to the homomorphic evaluation mentioned above. Assuming there are attributes x1 and x2, the access strategy f is an addition or subtraction operation, where C1 = (x1G + B1) T s+e 0,1 , C2=(x2G+B2) T s+e 0,2 , e f =e0,1 ±e 0,2 , if the access strategy f is multiplication, e f =x2e 0,1 +ψ T e 0,2 . Then randomly generate a key Based on the challenge β generated in step 1 and B generated in step 3 f Generate t = β-B f a B , according to the algorithm GAUSSSAMP(A, T A , t) Generate key a A , key a A Output to the data user, the key a B Output to the outsourced decryption server.

[0052] Step 5: Outsource the decryption algorithm

[0053] The outsourced decryption algorithm receives the key a B And the ciphertext C generated by homomorphic evaluation f As input, the outsourced decryption server outputs semi-decrypted ciphertext

[0054] Step 6: Decryption Algorithm

[0055] The data user receives the ciphertext C after outsourcing decryption mid And the ciphertext C s =βs+e1+μ(q / 2), ciphertext C A =A T s+e2, recover the plaintext μ. Only when the attribute value in the ciphertext satisfies the access policy, the user holding the key can decrypt the ciphertext. Decryption is successful if and only if f(X)=0.

[0056]

[0057] |dtext z | otherwise z=1,2,…,N. N is the length of the plaintext, and the decryption set is obtained. That is, the plaintext encrypted by the data owner

[0058] Safety Proof

[0059] ​Assume that there is a polynomial time attacker L that can break the selective security of this KP-ABE scheme with an advantage of ε and can perform at most q key generation queries. Construct a security game that can solve the Decisional RLWE problem with an advantage of ε. Provide an RLWE problem instance as an oracle O, and the elements sampled by the oracle are truly random O * Or the noise pseudo-random O1. The simulator M uses the attacker L to distinguish between the two.

[0060] The details are as follows:

[0061] Attacker L submits a set of attribute values ​​x * , the attribute length is l, and β←R is randomly generated q ,

[0062] M performs the following operations and randomly samples S i ←{±1} m×m , i=1,2,…,l.

[0063] i=1,2,…,l. Then the public key MPK=(A,{B i} i∈[l] ,β) is sent to the attacker L.

[0064] Attacker L cannot distinguish B in the public key MPK i and the randomly sampled B in the normal KP-ABE method i .

[0065] Phase 1:

[0066] An attacker can query any function f in the oracle, provided that f(x * )=1.

[0067] For any f(x * )=1. Oracle calculation Return to a A |a B =SAMPLELEFT(A,G,S,β),(A|AS f -G)*(a A |a B ) = β. The query can be repeated with the same input, but the oracle cannot answer any (A|AS f )*(a A |a B )=β, that is, f(x * )=0.

[0068] challenge:

[0069] Attacker L chooses a plaintext pair (μ0, μ1) to send to M.

[0070]

[0071] C s =βr+e1+μ b (q / 2).

[0072]

[0073] M Encryptionμ b , and then sent to the attacker L, where b∈(0,1).

[0074] Return ciphertext C′=(AS f ,C s ,A).

[0075] Finally, L outputs a value b' as a guess of b. If b' = b, M outputs 1, otherwise it outputs 0.

[0076] Phase 2:

[0077] Similar to phase 1, attacker L continues to send requests to simulator M.

[0078] guess:

[0079] C=(A|AS1|…|AS l ) T s+e0 is close to A′ for uniform random selection i (A|A′1|…|A′ l ) T s+e0, L will convert all vectors AS i It is considered to be close to uniform. Therefore, L has no significant advantage in judging whether b = 0 or b = 1, that is, with a probability of 1 / 2 (no advantage). Assuming that b can be guessed with an advantage of ε, this means that the Decisional RLWE problem can be solved. According to the difficulty of the RLWE problem, it can be concluded that the solution is safe.

[0080] Experimental Results

[0081] In order to demonstrate the practicality of this solution, the outsourced decryption method based on lattice attribute-based encryption described in this patent was implemented based on mobile phones and laptops, and the implementation results were reported. The Ubuntu system was installed in the virtual machine of the laptop (such as VMware Workstation 16 Pro), and the Ubuntu system was deployed on the mobile phone using Linux deploy. The above Ubuntu systems are all Ubuntu 18.04. The algorithms involved are implemented in C++ language. The computer processor model used is Intel Core i7-9750H@2.60GHz, the memory (RAM) is 8.0GB, and the operating system is Windows 10. The mobile phone processor model used is Qualcomm Snapdragon 888, the operating system is Android 11, and the running memory is 12.0GB.

[0082] According to the experimental results in Table 1, it can be seen that the time for key generation, encryption and decryption increases with the increase of the number of attributes l. EvalPK and EvalC occupy the main time consumption. Homomorphic evaluation is a public operation that can be performed by the receiver or agent, so this process can be performed by a high-performance server authorized by the data owner. In a typical application scenario, the access policy is shared by multiple data users. A high-performance proxy server can be deployed to perform homomorphic evaluation operations on the ciphertext, which avoids multiple data users from repeating the same operation and helps resource-constrained data users who cannot perform expensive homomorphic evaluations themselves, so as to improve the efficiency of the entire encryption system. At the same time, after the ciphertext is homomorphically evaluated, it will generate compressed short ciphertext, which can consume less storage space and is more suitable for lightweight data users. Private key generation is only occasionally executed and is not a bottleneck of the encryption system. For the entire system, this time consumption can be tolerated. Although the consumption of the decryption operation does not take up a lot of time, generally speaking, after the data owner performs an encryption operation, the data user will repeat the decryption operation.

[0083]

[0084] Table 1 Experimental results

[0085] Relatively speaking, the overhead after outsourcing decryption processing is significantly reduced. Although the decryption overhead of this scheme seems to be very small, only tens of milliseconds, data users usually perform decryption operations repeatedly to obtain ciphertext, and the cumulative decryption overhead cannot be ignored. The performance of the laptop computer used in the simulation experiment is limited, but it can still handle the overhead of outsourcing decryption relatively easily. However, this is a major challenge for users who manage and view private data on resource-constrained devices. On resource-constrained devices, such as the mobile phones used in this experiment, battery life is also a long-standing problem.

[0086] In summary, in terms of time consumption, this solution has a good advantage in the field of adapting to lightweight user terminals with limited resources.

Claims

1. An outsourced decryption method based on lattice attribute-based encryption, characterized in that: The steps include: Step 1: Generate system parameters; According to the input security parameter λ, the TRAPGEN(λ) algorithm is called to generate the matrix A and the master key T A ; According to the input attribute quantity parameter l, randomly generate l+1 uniformly distributed vectors B i , B i Corresponding to the attribute set Y = {y1, y2, ..., y l }, Y[i] is y i , Randomly generate a challenge β←R q ; Finally, output the public parameter MPK and the master key MSK; MPK = (A, {B i } i∈{0，1，...,l} ,β),MSK=T A ; Step 2: Encryption algorithm; According to the plaintext μ∈R2, the attribute set X and MPK, the encryption algorithm is executed to randomly generate s←R q , e1←D R,σ , l is the number of attributes; D R，σ represents the Gaussian distribution on the ring R, Representatives in Gaussian distribution on; the noise vectors e1 and e2 are sampled from Gaussian distribution; G=(1,2,2 2 , 2 3 , ..., 2 k-1 , 0, 0), where k = m-2, m depends on T A Construction; output ciphertext C = (C A , C B , C s );in Use Mark C i =(x i G+B i ) T s+e 0，i Represents C B of the various parts, where i = 0, 1, .., l, x i Corresponding to the value in attribute set X, x0=1 does not belong to attribute set X, which is a necessary component for implementing Boolean circuits in access strategy circuits. The fault-tolerant learning assumption on the search version prevents the adversary from calculating s←R q , the decision version of the ring fault-tolerant learning assumption makes the pseudo-random ciphertext component C i Difficult to distinguish; Step 3: Homomorphic evaluation of public key and ciphertext; The public key B corresponding to the attribute i and ciphertext C i Both are calculated homomorphically on the access strategy circuit f to obtain the public key B corresponding to f. f And the ciphertext C f ; Treat the access strategy f as a Boolean circuit, and the Boolean circuit used has a binary tree topology; if there are attributes x1 and x2, (x1∧x2)=1-x1x2, get the ciphertext Access strategy f uses addition, subtraction, or multiplication to represent Boolean expressions; if this access strategy f is addition or subtraction, then the homomorphic computation is C ± =C1±C2, B ± =B1±B2, where C1=(x1G+B1) T s+e 0，1 , C2=(x2G+B2) T s+e 0，2 , C0=(G+B0) T s+e 0，0 , If the access strategy f is a multiplication operation C X =x2C1+ψ T C2, B X =B2ψ, where ψ=BITDEC OMP(-B1), BITDECOMP represents the bit decomposition operation on -B1, so that -B1=Gψ; then the homomorphic evaluation of the NAND gate is expressed as C NAND =C0-x2C1-ψ T C2, B NAND =B0-B2ψ; Based on the homomorphic evaluation of the NAND gate, the calculation can be iteratively completed in the defined binary tree topology; Based on the defined access strategy f, the public key B corresponding to f is obtained f And the ciphertext C f ; B f =EVALPK(X,B i , f), C f =EVALPK(X,C i , f); C i =(x i G+B i ) T s+e 0，i , The evaluation of the ciphertext will result in an increase in noise in the error vector, and the noise level should not exceed the threshold of the selected ciphertext modulus q to achieve correct decryption; Step 4: Key generation algorithm; The vector C obtained after homomorphic evaluation in step 3 f is considered to be under public key B f The encrypted ciphertext is: f and B f All correspond to access policy f, written as For e f If there are attributes x1 and x2, the access strategy f is an addition or subtraction operation, where C1 = (x1G + B1) T s+e 0,1 , C2=(x2G+B2) T s+e 0,2 ,e f =e 0,1 ±e 0,2 , if the access strategy f is multiplication, e f =x2e 0,1 +ψ T e 0,2 ; Then randomly generate a key Based on the challenge β generated in step 1 and B generated in step 3 f Generate t = β-B f a B , according to the algorithm GAUSSSAMP(A, T A , t) Generate key a A , key a A and a B Output to the data user, the data user will key a B Output to the outsourced decryption server; Step 5: Outsource the decryption algorithm; The outsourced decryption server receives the key a B And the ciphertext C f Generate converted ciphertext Step 6: Decryption algorithm; data users receive the decrypted ciphertext C from the outsourcing service. mid And the ciphertext Ciphertext Recover the plaintext μ; Only when the attribute value in the ciphertext satisfies the access policy, the user holding the key has the authority to decrypt the ciphertext; Decryption is successful if and only if f(X) = 0; |dtext z |<q / 4, otherwise N is the length of the plaintext, and the decrypted set is obtained That is, the plaintext encrypted by the data owner 2. The outsourced decryption method based on lattice attribute-based encryption according to claim 1 is characterized in that The generation of system parameters described in step 1 is specifically implemented as follows: Step 1.1: Generate the matrix A and master key T according to the input security parameter λ using the TRAPGEN(λ) algorithm A ; T A It consists of two vectors d and u, T A = {d, u}, both vectors are generated using discrete Gaussian distribution with distribution parameter σ, d o ←D R，σ ,u o ←D R,σ , D R,σ represents a Gaussian distribution over a polynomial ring R, o = 1, 2, ..., k, k = m-2, where m depends on the specific T A structure, Step 1.2: According to the input attribute quantity parameter l, randomly generate l+1 uniformly distributed vector pairs where i = 0, 1, 2, ..., l, B i Corresponding to the attribute set Y = {y1, y2, ..., y l } i , l is the number of attributes, y0=1 corresponding to B0 does not belong to the attribute set Y, but is a necessary component to implement the Boolean circuit in the access strategy circuit f; finally, a challenge β←R is generated uniformly and randomly q ,in is a cyclotomic polynomial ring, is a polynomial ring with integer coefficients, R q =R / qR, q is the modulus; represents an m×1 column vector, The elements in the ring R q ; represents a 1×m row vector, The elements in the ring R q ; represents an m×m matrix, The elements in the ring R q ; Step 1.3: Output MPK = (A, {B i } i∈{0，1，...,l} ,β),MSK=T A When T A When is unknown and A is pseudo-random, this method satisfies the assumption of fault-tolerant learning on the ring.

Images