Public key encryption method, decryption method and system with two independent regulators

Abstract

The application discloses a public key encryption method, decryption method and system with two independent supervision parties, and the method comprises the following steps: a sending party uses an encryption algorithm to encrypt to-be-sent data by using a private key of the sending party, a public key of a receiving party, a public key of a first supervision party and a public key of a second supervision party, so as to generate ciphertext; the sending party sends the ciphertext to a public system; the receiving party obtains the ciphertext from the public system, uses a decryption algorithm to decrypt the received ciphertext according to a private key of the receiving party, a public key of the sending party, the public key of the first supervision party and the public key of the second supervision party, and generates decrypted data; the first supervision party obtains the ciphertext from the public system, uses a supervision algorithm to decrypt the received ciphertext according to a private key of the first supervision party and the public key of the second supervision party, and generates decrypted data; and the second supervision party obtains the ciphertext from the public system, uses the supervision algorithm to decrypt the received ciphertext according to a private key of the second supervision party and the public key of the first supervision party, and generates decrypted data.

Description

Technical Field

[0001] This invention relates to the field of public key encryption technology, and in particular to a public key encryption method, decryption method and system with two independent supervisors. Background Technology

[0002] To ensure data confidentiality, data is typically encrypted before transmission. However, only the recipient can decrypt the ciphertext, while the regulator cannot. In applications requiring oversight, the regulator needs to decrypt the ciphertext. Therefore, addressing the issue in current public-key encryption schemes where only the recipient can decrypt the data, a technology is needed that allows both the recipient and the regulator to decrypt it, thus enabling oversight of the data content. Summary of the Invention

[0003] Therefore, it is necessary to provide a public-key encryption method, decryption method, and system with two independent supervisors to address the problems of traditional technologies and solve the significant limitations of existing encryption methods mentioned in traditional technologies.

[0004] In a first aspect, embodiments of the present invention provide a public-key encryption method with two independent supervisors, comprising:

[0005] Obtain the recipient's public key, the first supervisor's public key, and the second supervisor's public key;

[0006] An encryption algorithm is used to encrypt the data to be sent using the sender's private key, the receiver's public key, the first supervisor's public key, and the second supervisor's public key, generating ciphertext.

[0007] The encrypted text is sent to a public system, enabling the recipient, the first regulator, and the second regulator to obtain the encrypted text by accessing the public system.

[0008] Preferably, obtaining the recipient's public key, the first supervisor's public key, and the second supervisor's public key includes:

[0009] Set a symmetric bilinear mapping

[0010] Where G is a generator of group G1, G is a bilinear group T Generators; groups G1, G T The order of is a prime number n;

[0011] Using two hash functions, hash1 and hash2, we can map any length of data {0,...,n-1} to integers and data of length n, respectively. hash2:{0,1} * →{0,1} n ;

[0012] In this function, hash1 takes arbitrary length 0 or 1 as input and outputs a natural number between 0 and n-1; hash2 takes arbitrary length 0 or 1 as input and outputs a random string of 0 or 1 bits of length n; the asterisk (*) represents an arbitrary length of 0 / 1 bits; {0,1} * Represents 0 / 1 bit data of arbitrary length; {0,1} n Represents a fixed length of 0 / 1 bit data; It is a natural number between 0 and n-1;

[0013] Using the key derivation function (KDF), a random number of fixed length n is input and output as a random number of arbitrary length KDF:{0,1}. n →{0,1} * ;

[0014] sender's private key and public key The expression is as follows:

[0015]

[0016] Recipient's private key and public key The expression is as follows:

[0017]

[0018] The private key of the first regulator and public key The expression is as follows:

[0019]

[0020] The private key of the second regulator and public key The expression is as follows:

[0021]

[0022] The sender selects two random numbers a1 and a2 from the range 0 to n-1, and sends the private key. Disassembled into and

[0023] The recipient selects two random numbers b1 and b2 from 0 to n-1; and passes the private key. Disassembled into and

[0024] The first supervisory party selects two random numbers c1 and c2 from 0 to n-1; and passes the private key Disassembled into and

[0025] The second supervisor selects two random numbers d1 and d2 from 0 to n-1; and passes the private key Disassembled into and

[0026] G is the base point G on the elliptic curve, and is a publicly available system parameter;

[0027]

[0028] The sender calculates two elliptic curve points based on the base point G and random numbers a1 and a2. These two elliptic curve points are the sender's public key. Disassembled into and

[0029] The receiver calculates two elliptic curve points based on the base point G and random numbers b1 and b2. These two elliptic curve points are the receiver's public key, and the public key is then... Disassembled into and

[0030] The two elliptic curve points calculated by the first regulator based on the base point G and random numbers c1 and c2 represent the public key of the first regulator. Disassembled into and

[0031] The two elliptic curve points calculated by the second regulator based on the base point G and random numbers d1 and d2 represent the public key of the second regulator. Disassembled into and

[0032] Preferably, the step of employing an encryption algorithm to encrypt the data to be sent using the sender's private key, the receiver's public key, the first supervisor's public key, and the second supervisor's public key includes:

[0033] Using the sender's private key The message of arbitrary length m∈{0,1} in the data to be sent M is... * An arbitrary element and the recipient's public key, the first supervisor's public key, and the second supervisor's public key Perform the following calculations:

[0034]

[0035] C1:=γ, C2:=r·G,

[0036]

[0037] Generate ciphertext C = (C1, C2, C3), where || represents concatenating two data items into a single unit, which is then used as the input to the hash function;

[0038] r is a natural number between 0 and n-1, output by the hash function hash1;

[0039] It is the bitwise XOR operation in computers;

[0040] Alternatively, using the sender's private key The message of arbitrary length m∈{0,1} in the data to be sent M is... * An arbitrary element and the recipient's public key, the first supervisor's public key, and the second supervisor's public key Perform the following calculations:

[0041]

[0042] C1:=γ0, C2:=r·G,

[0043] Generate ciphertext C = (C1, C2, C3, C4, C5), where, This indicates that the private key is used as a random number to perform a multiplication operation on the points of the elliptic curve, where the elliptic curve point is the recipient's public key;

[0044] := represents assignment, assigning the value of the parameter on the right to the parameter on the left.

[0045] The superscript 'r' in the upper right corner refers to the bilinear mapping. After the calculation is complete, calculate the power of r.

[0046] On the other hand, the present invention also provides a decryption method with two independent supervisors, comprising: encrypting ciphertext in a public system using the above-described method;

[0047] The receiver obtains the ciphertext from the public system, uses a decryption algorithm, and decrypts the received ciphertext based on the receiver's private key, the sender's public key, the first supervisor's public key, and the second supervisor's public key to generate decrypted data.

[0048] The first regulator obtains the ciphertext from the public system, uses a regulator algorithm, and decrypts the received ciphertext based on the first regulator's private key and the second regulator's public key to generate decrypted data.

[0049] The second regulator obtains the ciphertext from the public system, uses a regulator algorithm, and decrypts the received ciphertext using the second regulator's private key and the first regulator's public key to generate decrypted data.

[0050] Preferably, the method further includes:

[0051] The receiving party, the first supervisor, and the second supervisor each perform decryption consistency verification on the obtained decrypted data.

[0052] Preferably, the receiver uses a decryption algorithm to decrypt the received ciphertext based on the receiver's private key, the sender's public key, the first supervisor's public key, and the second supervisor's public key, including:

[0053] The receiver parses the ciphertext C = (C1, C2, C3) obtained from the public system; using the receiver's private key... Local ciphertexts C1 and C3, including the sender's public key, the first supervisor's public key, and the second supervisor's public key. Perform the following calculations:

[0054]

[0055] Where r' is a natural number between 0 and n-1, output by the hash function hash1;

[0056] Alternatively, the recipient can parse the ciphertext C = (C1, C2, C3, C4, C5) obtained from the public system; using the recipient's private key. Local ciphertexts C1, C3, C4, C5, the sender's public key, the first supervisor's public key, and the second supervisor's public key. Perform the following calculations:

[0057]

[0058] Preferably, the first regulator uses a regulator algorithm to decrypt the received ciphertext based on the first regulator's private key and the second regulator's public key, including:

[0059] The first supervisor parses the ciphertext C = (C1, C2, C3) obtained from the public system; using the first supervisor's private key... Second regulatory public key Perform the following calculations:

[0060]

[0061] Alternatively, the first supervisor can parse the ciphertext C = (C1, C2, C3, C4, C5) obtained from the public system; using the first supervisor's private key. Local ciphertext C2, C3, C4, C5 and the second supervisor's public key Perform the following calculations:

[0062]

[0063] Preferably, the second supervisor employs a supervisory algorithm to decrypt the received ciphertext based on the second supervisor's private key and the first supervisor's public key, including:

[0064] The second supervisor parses the ciphertext C = (C1, C2, C3) obtained from the public system; using the second supervisor's private key... and the first regulatory party's public key Perform the following calculations:

[0065]

[0066] Alternatively, the second supervisory party can parse the ciphertext C = (C1, C2, C3, C4, C5) obtained from the public system; using the second supervisory party's private key. Local ciphertexts C2, C3, C4, C5 and the first supervisor's public key Perform the following calculations:

[0067]

[0068] Preferably, the receiving party, the first supervisor, and the second supervisor each perform decryption consistency verification on the obtained decrypted data, including:

[0069] The receiver's decryption consistency verification process is as follows:

[0070]

[0071] or,

[0072]

[0073] The first regulatory body's decryption and consistency verification process is as follows:

[0074] or,

[0075]

[0076] The second regulator's decryption and consistency verification process is as follows:

[0077] or,

[0078]

[0079] Furthermore, the present invention also provides a public key encryption and decryption system with two independent supervisory parties, including: a sender, a receiver, a first supervisory party, and a second supervisory party;

[0080] The sender obtains the receiver's public key, the first supervisor's public key, and the second supervisor's public key;

[0081] The sender uses an encryption algorithm to encrypt the data to be sent using the sender's private key, the receiver's public key, the first supervisor's public key, and the second supervisor's public key to generate ciphertext.

[0082] The sender transmits the ciphertext to a public system, enabling the receiver, the first supervisor, and the second supervisor to obtain the ciphertext by accessing the public system.

[0083] The receiver obtains the ciphertext from the public system, uses a decryption algorithm, and decrypts the received ciphertext based on the receiver's private key, the sender's public key, the first supervisor's public key, and the second supervisor's public key to generate decrypted data.

[0084] The first regulator obtains the ciphertext from the public system, uses a regulator algorithm, and decrypts the received ciphertext based on the first regulator's private key and the second regulator's public key to generate decrypted data.

[0085] The second regulator obtains the ciphertext from the public system, uses a regulator algorithm, and decrypts the received ciphertext using the second regulator's private key and the first regulator's public key to generate decrypted data.

[0086] This invention provides a public-key encryption method, decryption method, and system with two independent supervisory parties. The sender uses the public keys of the receiver and the two independent supervisory parties to encrypt the data. Not only can the receiver decrypt the data, but both independent supervisory parties can also decrypt it, thus achieving data content supervision. This solution has significant demand in blockchain and military application scenarios with supervisory parties. Attached Figure Description

[0087] Figure 1 This is a flowchart illustrating a public-key encryption method with two independent supervisors in one embodiment of the present invention.

[0088] Figure 2 This is a flowchart illustrating a public key decryption method with two independent supervisors, as described in one embodiment of the present invention. Detailed Implementation

[0089] Embodiments of the present invention are described in detail below. Examples of these embodiments are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0090] like Figure 1 The diagram shown illustrates a public-key encryption method with two independent supervisors in one embodiment. Specifically, it includes the following steps:

[0091] Step S101: Obtain the receiver's public key, the first supervisor's public key, and the second supervisor's public key;

[0092] Step S102: Using an encryption algorithm, the sender's private key, the receiver's public key, the first supervisor's public key, and the second supervisor's public key are used to encrypt the data to be sent, generating ciphertext;

[0093] Step S103: Send the encrypted text to the public system, so that the recipient, the first supervisor and the second supervisor can obtain the encrypted text by accessing the public system.

[0094] In this embodiment of the invention, step S101, obtaining the receiver's public key, the first supervisor's public key, and the second supervisor's public key, includes:

[0095] Set a symmetric bilinear mapping

[0096] Where G is a generator of group G1, G is a bilinear group T Generators; groups G1, G T The order of is a prime number n;

[0097] Using two hash functions, hash1 and hash2, we can map any length of data {0,...,n-1} to integers and data of length n, respectively. hash2:{0,1} * →{0,1} n ;

[0098] In this function, hash1 takes arbitrary length 0 or 1 as input and outputs a natural number between 0 and n-1; hash2 takes arbitrary length 0 or 1 as input and outputs a random string of 0 or 1 bits of length n; the asterisk (*) represents an arbitrary length of 0 / 1 bits; {0,1} * Represents 0 / 1 bit data of arbitrary length; {0,1} nRepresents a fixed length of 0 / 1 bit data; It is a natural number between 0 and n-1;

[0099] Using the key derivation function (KDF), a random number of fixed length n is input and output as a random number of arbitrary length KDF:{0,1}. n →{0,1} * ;

[0100] sender's private key and public key The expression is as follows:

[0101]

[0102] Recipient's private key and public key The expression is as follows:

[0103]

[0104] The private key of the first regulator and public key The expression is as follows:

[0105]

[0106] The private key of the second regulator and public key The expression is as follows:

[0107]

[0108] The sender selects two random numbers a1 and a2 from the range 0 to n-1, and sends the private key. Disassembled into and

[0109] The recipient selects two random numbers b1 and b2 from 0 to n-1; and passes the private key. Disassembled into and

[0110] The first supervisory party selects two random numbers c1 and c2 from 0 to n-1; and passes the private key Disassembled into and

[0111] The second supervisor selects two random numbers d1 and d2 from 0 to n-1; and passes the private key Disassembled into and

[0112] G is the base point G on the elliptic curve, and is a publicly available system parameter;

[0113]

[0114] The sender calculates two elliptic curve points based on the base point G and random numbers a1 and a2. These two elliptic curve points are the sender's public key. Disassembled into and

[0115] The receiver calculates two elliptic curve points based on the base point G and random numbers b1 and b2. These two elliptic curve points are the receiver's public key, and the public key is then... Disassembled into and

[0116] The two elliptic curve points calculated by the first regulator based on the base point G and random numbers c1 and c2 represent the public key of the first regulator. Disassembled into and

[0117] The two elliptic curve points calculated by the second regulator based on the base point G and random numbers d1 and d2 represent the public key of the second regulator. Disassembled into and

[0118] It should be understood that, for ease of understanding when separating public and private keys, parentheses are used to distinguish between the parts before and after the separation. For example: public key... Disassembled into and actually and Both refer to the public key of the second regulatory body.

[0119] In this embodiment of the invention, step S102 employs an encryption algorithm to encrypt the data to be sent using the sender's private key, the receiver's public key, the first supervisor's public key, and the second supervisor's public key, including:

[0120] Using the sender's private key The message of arbitrary length m∈{0,1} in the data to be sent M is... * An arbitrary element and the recipient's public key, the first supervisor's public key, and the second supervisor's public key Perform the following calculations:

[0121]

[0122] C1:=γ, C2:=r·G,

[0123]

[0124] Generate ciphertext C = (C1, C2, C3), where || represents concatenating two data items into a single unit, which is then used as the input to the hash function;

[0125] r is a natural number between 0 and n-1, output by the hash function hash1;

[0126] It is the bitwise XOR operation in computers;

[0127] The portion of the public key corresponding to the recipient is obtained by multiplying the random number b1 by the base point G;

[0128] The portion of the public key corresponding to the recipient is obtained by multiplying the random number b2 by the base point G;

[0129] The portion of the public key corresponding to the first regulatory body is obtained by multiplying the random number c1 by the base point G;

[0130] The portion of the public key corresponding to the first regulatory body is obtained by multiplying the random number c2 by the base point G;

[0131] The portion of the public key corresponding to the second regulator is obtained by multiplying the random number d1 by the base point G.

[0132] The portion of the public key corresponding to the second regulator is obtained by multiplying the random number d2 by the base point G.

[0133] Alternatively, using the sender's private key The message of arbitrary length m∈{0,1} in the data to be sent M is... * An arbitrary element and the recipient's public key, the first supervisor's public key, and the second supervisor's public key Perform the following calculations:

[0134]

[0135] C1:=γ0, C2:=r·G,

[0136] Generate ciphertext C = (C1, C2, C3, C4, C5), where, This indicates that the private key is used as a random number to perform a multiplication operation (multiplication) on the elliptic curve point, where the elliptic curve point is the recipient's public key;

[0137] := represents assignment, assigning the value of the parameter on the right to the parameter on the left.

[0138] The superscript 'r' in the upper right corner refers to the bilinear mapping. After the calculation is complete, calculate the power of r.

[0139] like Figure 2 As shown, this embodiment of the invention also provides a decryption method with two independent supervisors, whereby ciphertext in a public system is encrypted using the method described above.

[0140] Step S201: The receiver obtains the ciphertext from the public system, uses a decryption algorithm, and decrypts the received ciphertext based on the receiver's private key, the sender's public key, the first supervisor's public key, and the second supervisor's public key to generate decrypted data.

[0141] Step S202: The first supervisor obtains the ciphertext from the public system, uses the supervisory algorithm, and decrypts the received ciphertext according to the private key of the first supervisor and the public key of the second supervisor to generate decrypted data;

[0142] Step S203: The second supervisor obtains the ciphertext from the public system, uses the supervisory algorithm, and decrypts the received ciphertext based on the second supervisor's private key and the first supervisor's public key to generate decrypted data.

[0143] In this embodiment of the invention, the method further includes:

[0144] Step S204: The receiver, the first supervisor, and the second supervisor each perform decryption consistency verification on the obtained decrypted data.

[0145] Step S201 of this embodiment of the invention involves the receiver using a decryption algorithm to decrypt the received ciphertext based on the receiver's private key, the sender's public key, the first supervisor's public key, and the second supervisor's public key.

[0146] The receiver parses the ciphertext C = (C1, C2, C3) obtained from the public system; using the receiver's private key... Local ciphertexts C1 and C3, including the sender's public key, the first supervisor's public key, and the second supervisor's public key. Perform the following calculations:

[0147]

[0148] Where r' is a natural number between 0 and n-1, output by the hash function hash1;

[0149] Alternatively, the recipient can parse the ciphertext C = (C1, C2, C3, C4, C5) obtained from the public system; using the recipient's private key. Local ciphertexts C1, C3, C4, C5, the sender's public key, the first supervisor's public key, and the second supervisor's public key. Perform the following calculations:

[0150]

[0151] Step S202 of this embodiment of the invention involves the first supervisor using a supervisory algorithm to decrypt the received ciphertext based on the first supervisor's private key and the second supervisor's public key, including:

[0152] The first supervisor parses the ciphertext C = (C1, C2, C3) obtained from the public system; using the first supervisor's private key... Second regulatory public key Perform the following calculations:

[0153]

[0154] Alternatively, the first supervisor can parse the ciphertext C = (C1, C2, C3, C4, C5) obtained from the public system; using the first supervisor's private key. Local ciphertext C2, C3, C4, C5 and the second supervisor's public key Perform the following calculations:

[0155]

[0156] Step S203 of this embodiment of the invention, where the second supervisor uses a supervisory algorithm to decrypt the received ciphertext based on the second supervisor's private key and the first supervisor's public key, includes:

[0157] The second supervisor parses the ciphertext C = (C1, C2, C3) obtained from the public system; using the second supervisor's private key... and the first regulatory party's public key Perform the following calculations:

[0158]

[0159] Alternatively, the second supervisory party can parse the ciphertext C = (C1, C2, C3, C4, C5) obtained from the public system; using the second supervisory party's private key. Local ciphertexts C2, C3, C4, C5 and the first supervisor's public key Perform the following calculations:

[0160]

[0161] Step S204 of this embodiment of the invention, in which the receiver, the first supervisor, and the second supervisor respectively perform decryption consistency verification on the obtained decrypted data, includes:

[0162] The receiver's decryption consistency verification process is as follows:

[0163]

[0164] or,

[0165]

[0166] The first regulatory body's decryption and consistency verification process is as follows:

[0167] or,

[0168]

[0169] The second regulator's decryption and consistency verification process is as follows:

[0170] or,

[0171]

[0172] It should be understood that c1 and c2, which are used as exponents in the formula, are two random numbers in the range of 0 to n-1.

[0173] An embodiment of the present invention provides a public key encryption and decryption system with two independent supervisory parties, comprising: a sender, a receiver, a first supervisory party, and a second supervisory party;

[0174] The sender obtains the receiver's public key, the first supervisor's public key, and the second supervisor's public key;

[0175] The sender uses an encryption algorithm to encrypt the data to be sent using the sender's private key, the receiver's public key, the first supervisor's public key, and the second supervisor's public key to generate ciphertext.

[0176] The sender transmits the ciphertext to a public system, enabling the receiver, the first supervisor, and the second supervisor to obtain the ciphertext by accessing the public system.

[0177] The receiver obtains the ciphertext from the public system, uses a decryption algorithm, and decrypts the received ciphertext based on the receiver's private key, the sender's public key, the first supervisor's public key, and the second supervisor's public key to generate decrypted data.

[0178] The first regulator obtains the ciphertext from the public system, uses a regulator algorithm, and decrypts the received ciphertext based on the first regulator's private key and the second regulator's public key to generate decrypted data.

[0179] The second regulator obtains the ciphertext from the public system, uses a regulator algorithm, and decrypts the received ciphertext using the second regulator's private key and the first regulator's public key to generate decrypted data.

[0180] In this embodiment of the invention, let For symmetric bilinear mappings G is a generator of group G1. G is a bilinear group T Generators; groups G1, G T The order of the integer is a prime number n; two hash functions, hash1 and hash2, map any length of data {0,...,n-1} to integers and data of length n, respectively. hash2:{0,1} * →{0,1} n The key derivation function (KDF) takes a random number of fixed length n as input and outputs a random number of arbitrary length KDF: {0, 1}. n →{0,1} * .

[0181] In this embodiment of the invention, the private and public keys of the sender, receiver, first supervisor, and second supervisor are expressed as follows:

[0182] sender's private key and public key The expression is as follows:

[0183]

[0184] Recipient's private key and public key The expression is as follows:

[0185]

[0186] The private key of the first regulator and public key The expression is as follows:

[0187]

[0188] The private key of the second regulator and public key The expression is as follows:

[0189]

[0190] The sender enters their private key during encryption. Messages of arbitrary length m∈{0,1} in message space M * An arbitrary element Public keys of the recipient, the first regulator, and the second regulator The calculation is as follows:

[0191]

[0192] C1:=γ, C2:=r·G,

[0193]

[0194] The ciphertext is C = (C1, C2, C3). The sender sends the ciphertext to the receiver, the first supervisor, and the second supervisor. The receiver, the first supervisor, the second supervisor, and the sender can all independently decrypt the ciphertext using their private keys without any interaction protocol.

[0195] When the recipient decrypts, they parse the ciphertext C = (C1, C2, C3) and input their private key. Local ciphertexts C1 and C3, and the public keys of the sender, the first supervisor, and the second supervisor. The calculation is as follows:

[0196]

[0197] The decryption consistency process is as follows:

[0198]

[0199] If the calculated r' and m' are equal to the r and m used in encryption, the decryption algorithm is correct. Encryption encrypts data m, and decryption yields data m'; if m = m', then the data decryption was successful, and the correct data was obtained. Otherwise, the encryption algorithm is incorrect, and the correct data cannot be obtained through decryption.

[0200] When the first supervisor decrypts the ciphertext C = (C1, C2, C3), they parse it by inputting their private keys c1 and c2 and the second supervisor's public key. The calculation is as follows:

[0201]

[0202] The decryption consistency process is as follows:

[0203]

[0204] When the second supervisor decrypts the ciphertext C = (C1, C2, C3), they parse it by inputting their private keys d1 and d2 and the first supervisor's public key. The calculation is as follows:

[0205]

[0206] The decryption consistency process is as follows:

[0207]

[0208] In this embodiment of the invention, the addition of a hash checksum enhances the security of public key encryption.

[0209] The initialization process is the same as described above; the differences are only described below:

[0210] The sender enters their private key during encryption. Messages of arbitrary length m∈{0,1} in message space M * An arbitrary element Public keys of the recipient, the first regulator, and the second regulator The calculation is as follows:

[0211]

[0212] C1:=γ0, C2:=r·G,

[0213] The ciphertext is C = (C1, C2, C3, C4, C5), where C5 is used for consistency verification. The sender sends the ciphertext to a public system (such as a blockchain system or cloud service system), and the receiver and two regulatory parties can access the ciphertext in that system.

[0214] When the recipient decrypts, they parse the ciphertext C = (C1, C2, C3, C4, C5) and input their private key. Local ciphertexts C1, C3, C4, C5 and the public keys of the sender, the first supervisor, and the second supervisor. Calculate as follows

[0215]

[0216] If C5 = C5', then accept message m'; otherwise, reject.

[0217] The decryption consistency process is as follows:

[0218]

[0219] When the first supervisor decrypts the ciphertext C = (C1, C2, C3, C4, C5), they need to parse it and input their private key. Local ciphertext C2, C3, C4, C5 and the second supervisor's public key Calculate as follows

[0220]

[0221] If C5 = C5', then accept message m'; otherwise, reject.

[0222] The decryption consistency process is as follows:

[0223]

[0224] When the second supervisor decrypts the ciphertext C = (C1, C2, C3, C4, C5), they need to parse it and input their private key. Local ciphertexts C2, C3, C4, C5 and the first supervisor's public key The calculation is as follows:

[0225] If C5 = C5', then accept message m'; otherwise, reject.

[0226] The decryption consistency process is as follows:

[0227]

[0228] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0229] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A public key encryption method with two independent supervisors, comprising: obtaining a receiver public key, a first supervisor public key and a second supervisor public key; encrypting data to be sent using an encryption algorithm, using a sender's private key, the receiver public key, the first supervisor public key and the second supervisor public key, to generate ciphertext; sending the ciphertext to a public system, so that the receiver, the first supervisor and the second supervisor obtain the ciphertext by accessing the public system; the receiver obtains the ciphertext from the public system, and decrypts the received ciphertext using a decryption algorithm according to the receiver's private key, the sender's public key, the first supervisor public key and the second supervisor public key to generate decrypted data, comprising: The receiver parses the ciphertext C = (C1, C2, C3) obtained from the public system; uses the receiver's private key the local ciphertexts C1, C3, the sender's public key, the first supervisor's public key and the second supervisor's public key computes as follows: wherein r' is a natural number between 0 and n-1 output by a hash function hash1; Alternatively, the recipient parses the ciphertext C = (C1, C2, C3, C4, C5) obtained from the public system; uses the recipient's private key the local ciphertexts C1, C3, C4, C5, the sender's public key, the first supervisor's public key and the second supervisor's public key to perform the following calculations: wherein and denotes a point multiplication operation on an elliptic curve point with the receiver's private key as a random number, wherein the elliptic curve point is the sender's public key.

2. The method of claim 1, wherein obtaining a receiver public key, a first supervisor public key and a second supervisor public key comprises: Setting up a bilinear mapping wherein G is a generator of a group G1, is a generator of a bilinear group G T ; the order of the group G1,G T is a prime number n; An arbitrary long data {0,...,n-1} is mapped to an integer and a long data of length n by two hash functions hash1, hash2, respectively, i.e. hash1: {0,...,n-1} → {0,...,n-1} * hash2: {0,...,n-1} → {0,1} n ; Wherein, the input of the hash function hash1 is an arbitrary length of 0 or 1, and the output range is a natural number between 0 and n-1; the input of the hash function hash2 is an arbitrary length of 0 or 1, and the output length is an n-bit 0 or 1 random string; the * represents an arbitrary length of 0 / 1 bit;{0,1} * represents an arbitrary length of 0 / 1 bit data;{0,1} n represents a fixed length of 0 / 1 bit data; is a natural number between 0 and n-1. The input random number of fixed length n is mapped to an output random number of arbitrary length by using a key derivation function KDF, KDF: {0,1} n → {0,1} * ; The private key of the sender and the public key are expressed as follows: Recipient's private key and public key is expressed as follows: First regulator's private key and public key is expressed as follows: Second regulator's private key and public key is expressed as follows: The representative sender selects two random numbers a1, a2 in the range of 0 to n-1, and sends the private key to and The representative receiver selects 2 random numbers b1, b2 in the range of 0 to n-1; and the private key is split into and The first regulator selects two random numbers c1, c2 in the range 0 to n-1 on behalf of the first regulator; and sends the private key is split into and The second authority selects two random numbers d1, d2 in the range 0 to n-1 on behalf of the second authority; and sends the private key is split into and G is a base point G on an elliptic curve, which is a public system parameter; The two elliptic curve points calculated by the representative of the sending party based on the base point G and the random numbers a1 and a2 are the public key of the sending party, and the public key is sent to the receiving party split into and The two elliptic curve points calculated by the representative receiver based on the base point G and the random numbers b1 and b2 are the public key of the receiver, and the public key is sent to the sender and The two elliptic curve points calculated by the first supervisory party based on the base point G and the random numbers c1 and c2 are the public key of the first supervisory party, and the public key is sent to the second supervisory party The public key is sent to the second supervisory party And The two elliptic curve points calculated by the second supervisory party based on the base point G and the random numbers d1 and d2 are the public key of the second supervisory party, and the public key is sent to the first supervisory party and and 3. The method of claim 2, wherein the encryption algorithm is used to encrypt data to be sent using a sender's private key, the receiver public key, the first supervisor public key and the second supervisor public key, comprising: using the sender private key any length message m e {0,1} * , a random element and the receiver public key, the first supervisor public key and the second supervisor public key are computed as follows: C1: = γ, C2: = r·G, generating ciphertext C = (C1, C2, C3), wherein || represents concatenating two data to become a whole as input to a hash function; r is a natural number between 0 and n-1 output by a hash function hash1; is a bitwise XOR operation in a computer; representing a partial public key corresponding to the recipient, is a multiplication of a random number b1 and a base point G; representing a partial public key corresponding to the recipient, is a multiplication of a random number b2 and a base point G; a part of the first supervisor's public key is a random number c1 multiplied by the base point G; the partial public key corresponding to the first regulatory party is obtained by multiplying a random number c2 and the base point G; a representative of a portion of the second authority's corresponding partial public key is a multiplication of a random number d1 and the base point G the part of the second supervisor's corresponding part of the public key is a random number d2 multiplied by the base point G; Or, using the sender's private key any long message m e {0,1} * , one random element and the receiver's public key, the first supervisor's public key and the second supervisor's public key is computed as follows: A ciphertext C = (C1, C2, C3, C4, C5) is generated, where denotes a point multiplication of the private key as a random number on an elliptic curve point, where the elliptic curve point is the public key of the receiver, i.e. times : = represents assignment, assigning the value of the parameter on the right side of the symbol to the parameter on the left side of the symbol; The upper right corner of the subscript r, refers to the bilinear mapping After the calculation is completed, the r power is calculated again.

4. A decryption method with two independent regulators, comprising: the ciphertext in the public system is encrypted by any one of the methods of claims 1 to 3; the receiver obtains the ciphertext from the public system, and decrypts the received ciphertext using a decryption algorithm according to the receiver's private key, the sender's public key, the first supervisor public key and the second supervisor public key to generate decrypted data; the first supervisor obtains the ciphertext from the public system, and decrypts the received ciphertext using a supervisor algorithm according to the first supervisor's private key and the second supervisor's public key to generate decrypted data; the second supervisor obtains the ciphertext from the public system, and decrypts the received ciphertext using a supervisor algorithm according to the second supervisor's private key and the first supervisor's public key to generate decrypted data.

5. The method of claim 4, further comprising: the receiver, the first supervisor and the second supervisor respectively decrypt the obtained decrypted data for consistency verification.

6. The method of claim 4, wherein the first supervisor decrypts the received ciphertext using a supervisor algorithm according to the first supervisor's private key and the second supervisor's public key, comprising: The first regulator parses the ciphertext C = (C1, C2, C3) obtained from the public system; using the first regulator's private key and the second regulator's public key computes as follows: wherein c1 and c2 as exponents are two random numbers in the range of 0 to n-1; Alternatively, the first regulator parses the ciphertext C = (C1, C2, C3, C4, C5) obtained from the public system; uses the first regulator's private key the partial ciphertexts C2, C3, C4, C5 and the second regulator's public key to compute as follows:

7. The method of claim 4, wherein the second supervisor decrypts the received ciphertext using a supervisor algorithm according to the second supervisor's private key and the first supervisor's public key, comprising: The second regulator parses the ciphertext C = (C1, C2, C3) obtained from the public system; using the second regulator's private key and the first regulator's public key computes as follows: Alternatively, the second regulator parses the ciphertext C = (C1, C2, C3, C4, C5) obtained from the public system; uses the second regulator's private key the partial ciphertexts C2, C3, C4, C5 and the first regulator's public key to compute as follows:

8. The method of claim 5, wherein the receiver, the first supervisor and the second supervisor respectively decrypt the obtained decrypted data for consistency verification, comprising: the receiver consistency verification process is as follows: Or, The first regulator decryption consistency verification process is as follows: Or, The second supervisor consistency verification process is as follows: Or, Wherein, c1 and c2 as the index are two random numbers in the range of 0 to n-1.

9. A public key encryption and decryption system with two independent regulators, comprising: Sender, receiver, first supervisor and second supervisor; The sender obtains the receiver public key, the first supervisor public key and the second supervisor public key; The sender uses the encryption algorithm to encrypt the data to be sent using the sender's private key, the receiver public key, the first supervisor public key and the second supervisor public key, and generates the ciphertext; The sender sends the ciphertext to the public system, so that the receiver, the first supervisor and the second supervisor obtain the ciphertext by accessing the public system; The receiver obtains the ciphertext from the public system, uses the decryption algorithm, and decrypts the received ciphertext according to the receiver private key, the sender public key, the first supervisor public key and the second supervisor public key to generate the decrypted data; The first supervisor obtains the ciphertext from the public system, uses the supervision algorithm, and decrypts the received ciphertext according to the first supervisor private key and the second supervisor public key to generate the decrypted data; The second supervisor obtains the ciphertext from the public system, uses the supervision algorithm, and decrypts the received ciphertext according to the second supervisor private key and the first supervisor public key to generate the decrypted data; The receiver obtains the ciphertext from the public system, uses the decryption algorithm, and decrypts the received ciphertext according to the receiver private key, the sender public key, the first supervisor public key and the second supervisor public key to generate the decrypted data, including: The receiver parses the ciphertext C = (C1, C2, C3) obtained from the public system; uses the receiver's private key the local ciphertexts C1, C3, the sender's public key, the first supervisor's public key and the second supervisor's public key computes as follows: Wherein, r' is a natural number between 0 and n-1 output by the hash function hash1; Alternatively, the recipient parses the ciphertext C = (C1, C2, C3, C4, C5) obtained from the public system; uses the recipient's private key the local ciphertexts C1, C3, C4, C5, the sender's public key, the first supervisor's public key, and the second supervisor's public key to compute as follows: wherein and denotes a point multiplication operation on an elliptic curve point with the receiver's private key as a random number, wherein the elliptic curve point is the sender's public key.

Images