Key policy attribute-based encryption system and method based on SM9 supporting large attribute sets

Abstract

The present invention relates to a fuzzy identification-based encryption system and method supporting large attributes based on SM9. Without changing the overall architecture of the SM9 identification encryption algorithm, the user's identification is optimized so that it can be represented by some descriptive attributes, and a secret sharing technology is used to implement fault-tolerant encryption or threshold access strategy. The Boneh and Boyen technology is used to eliminate the calculation of attribute public keys and private keys when setting system parameters. The present invention can solve the fault-tolerant encryption or threshold access problems that cannot be achieved by traditional SM9 identification encryption. If T(X) is removed in the scheme, fuzzy identification-based encryption with completely large attributes can also be achieved, and the scheme has good expansibility.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a key strategy attribute-based encryption system and method based on SM9 supporting a large attribute set. Background Art

[0002] Traditional identity encryption can only share encrypted data securely with a certain user, but in large-scale distributed computing systems, encrypted data often needs to be shared with multiple users. As one of the most promising cryptographic primitives, attribute-based encryption can achieve fine-grained access control of encrypted data by setting access structures when distributing encrypted data or keys. According to the different locations of the access structures, attribute-based encryption can be divided into key-policy attribute-based encryption and ciphertext-policy attribute-based encryption.

[0003] Key policy attribute-based encryption means that the user's key corresponds to an access structure determined by the key distribution agency. When encrypting, the encryptor specifies a set of attributes to encrypt the plaintext. The user can perform the correct decryption operation if and only if the attribute set associated with the ciphertext satisfies the access structure associated with the user's decryption key.

[0004] In the key policy attribute-based encryption system, the key distribution agency determines the access structure corresponding to the user's key, that is, the key distribution agency determines "which attributes the user can decrypt the ciphertext with". It is suitable for access control of static data by a large number of changing users, such as pay TV systems, video on demand systems, database access and other query applications. One of the most important applications is to process audit logs, which have become the main target of hacker attacks because they contain detailed records of all activities in the system and network. Key policy attribute-based encryption provides an effective solution for audit logs, representing audit log entries with a set of attributes, such as the user's name, the date of the user's operation, and the type of data modified or accessed by the user. The key generation center distributes a key associated with access control to each auditor responsible for the investigation, which determines which log entries the auditor can access. This not only protects the content of the audit log, but also enables flexible access to the audit log.

[0005] Key policy attribute-based encryption is divided into supporting small attributes and large attributes. Key policy attribute-based encryption of small attribute sets determines all possible attributes when setting system parameters. If the attribute space is set too small, as the number of audit logs, archival materials or TV programs increases, the required attributes exceed the upper limit of the initial setting, and the system needs to be reset and all data needs to be re-encrypted, resulting in a large waste of resources. If the attribute space is set too large when the system is set, it will cause an increase in the system's public parameters, thereby bringing unnecessary efficiency burdens to other operations. Therefore, it is of great significance to design key policy attribute-based encryption that supports large attribute sets. Summary of the invention

[0006] In view of this, the purpose of the present invention is to provide a key policy attribute-based encryption system and method based on SM9 that supports a large attribute set, so as to achieve fine-grained access to encrypted data.

[0007] To achieve the above object, the present invention adopts the following technical solution:

[0008] A key policy attribute-based encryption system based on SM9 supporting a large attribute set includes a key generation center, an encryptor, a decryptor and a cloud server; the key generation center is connected to the encryptor and the decryptor respectively; the cloud server is connected to the encryptor and the decryptor respectively.

[0009] An encryption method for a key policy attribute-based encryption system based on SM9 supporting a large attribute set comprises the following steps:

[0010] Step S1: The key generation center runs the SM9 algorithm to generate system parameters, and makes the generated system parameters public to users in the system;

[0011] Step S2: The key generation center sets the function T(X) for calculating the attribute public key according to the maximum value n of the number of attributes in the encrypted attribute set γ, and publishes the generated public parameters to users in the system to keep the master key secret;

[0012] Step S3: The encryptor obtains the attribute set γ, the message M to be encrypted, and the system public key to encrypt the message M to obtain the ciphertext;

[0013] Step S4: The key generation center obtains the access tree T corresponding to the access structure of the encrypted data and the master private key of the system, and outputs the decryption key corresponding to the access tree T.

[0014] Step S5: After the receiver obtains the ciphertext, if the attribute set of the ciphertext satisfies the access control tree of the key, the ciphertext can be decrypted and the message can be restored; otherwise, the decryption fails.

[0015] Furthermore, the step S1 is specifically as follows:

[0016] Choose additive groups G1, G2 and multiplicative groups G of order p T ;

[0017] e:G1×G2→G T is a bilinear map;

[0018] Hash function H1: One-byte encryption generation function identifier hid;

[0019] For a set S and i∈Z p , define the Lagrange coefficient as

[0020] Where p: cyclic group G1, G2, G T The order of, and p>2 191 Prime number of Z p : {0,1,2…p-1}; {1,2…p-1}; G1, G2: additive cyclic group of order prime number p; G T : Multiplicative cyclic group of prime order p; e: from G1×G2 to G T Bilinear mapping; H1: {0,1} * arrive A cryptographic function derived from a cryptographic hash function; hid: an encryption key generation function identifier represented by one byte, selected and disclosed by the key generation center; S: an element taken from A collection of; Δ i,S (x): Lagrange coefficient.

[0021] Furthermore, the step S2 is specifically as follows:

[0022] Randomly select generators P1∈G1,P2∈G2, where ψ(P2)=P1, randomly select Calculate the element P in group G2 pub =aP2, group G T The element g=e(P1,P pub );

[0023] Assume N = {1, 2, ..., n+1}, randomly select n+1 different elements t1, t2, ..., t n+1 , define the function The public parameter pk is: mpk = {P1, P2, P pub ,g,t1,t2,…t n+1}, the master private key is msk=a;

[0024] Where, P1: generator of group G1; P2: generator of group G2; ψ: mapping from group G2 to G1; Master key; P pub , t i : an element in group G2; g: group G T The elements in; n: a positive integer.

[0025] Furthermore, the step S3 is specifically as follows:

[0026] Enter the plaintext message to be encrypted The attribute set γ, and then choose a random value Output ciphertext E: E = (γ, E' = Mg s,{E″ i =s(h i P1+ψ(P pub )),E i =sT(i)} i∈γ );

[0027] Where M: the message to be encrypted, belonging to G T element; γ: attribute set used during encryption; s: temporary variable, belonging to Elements in E i ,E″ i : attribute ciphertext corresponding to attribute i, belonging to elements in G2 and G1 respectively; E': partial ciphertext, belonging to G T element; E: encrypted ciphertext; i: attribute in the attribute set used for encryption, belonging to Elements in; h i : The hash value of attribute i.

[0028] Furthermore, the step S4 is specifically as follows:

[0029] First, start from the root node r and traverse the tree from top to bottom, and build a polynomial q for each node x (including leaf nodes) x , where the threshold value of node x is k x , the number of child nodes is num x , and 0<k x ≤num x , the degree of the polynomial is d x =k x -1;

[0030] When the polynomials for all nodes are defined, the secret value is calculated for each leaf node x as follows:

[0031] First calculate h x =H1(x||hid,N), then select a random number r x ∈Z p calculate

[0032] d x =r x (h x P1+ψ(P pub )), i = att(x)

[0033] The final decryption key is D = {D x , d x};

[0034] Where, T: visit tree; r: root node; x: node; att(x): returns the attribute described by the node only when x is a leaf node; qx : The polynomial corresponding to node x; q x (0): constant term of the polynomial corresponding to node x; q parent(x) (index(x)): polynomial q parent(x) The value at index(x), where parent(x) represents the parent node of node x, and index(x) represents the number of node x in the sibling nodes; x||hid represents the concatenation of x and hid, where x and hid are bit strings or byte strings; h i :Hash function H1: The value at i; h x : The hash value of the attribute corresponding to node x; r x :Z p A temporary variable corresponding to each node is randomly selected in x , num x , d x : is an integer; T(i): the value of T(X) at position i; D x ,d x : The partial private key corresponding to node x belongs to the elements in groups G2 and G1 respectively; D: The private key corresponding to the access tree structure.

[0035] Furthermore, except for the constant term, the other d x The coefficients are random in Select from , and set the constant term as follows:

[0036]

[0037] Where parent(x) represents the parent node of node x, and index(x) represents the number of node x in the sibling nodes.

[0038] Furthermore, the step S5 is specifically as follows:

[0039] Input ciphertext E and decryption key D, first define a recursive algorithm DecryptNode(E,D,x), whose input is ciphertext E=(γ,E',{E″ i ,E i} i∈γ ), decryption key D = {D x ,d x}(The access tree is ), The node x of the output group Elements on or ⊥;

[0040] Let i = attr(x). If x is a leaf node, calculate:

[0041]

[0042] If x is a non-leaf node, for each child node z of x, call the algorithm DecryptNode(E,D,z), and the algorithm output is recorded as F z ; Define the following two sets: (1) S x : Any size is k x And make F z ≠⊥The set of child nodes z; (2) S' x ={index(z):z∈S x}; If there is no S that meets the above conditions x , then output ⊥; otherwise, calculate

[0043]

[0044] The decryption algorithm calls the above function starting from the root node. If and only if the ciphertext satisfies the access tree, DecryptNode(E,D,r)=e(P1,P2) can be obtained. as =g s Finally, calculate E' / g s Get the plaintext M;

[0045] in: The value of the Lagrange coefficient when x=0.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] 1. The present invention solves the fine-grained access control of encrypted data that cannot be solved by SM9 identification encryption;

[0048] 2. The present invention eliminates the calculation of attribute public keys and private keys when setting system parameters, and solves the waste of a large amount of resources caused by the need to reset the system due to adding attributes in the later stage. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is the system architecture diagram of the present invention

[0050] Figure 2 It is a working flow diagram of the system of the present invention;

[0051] Figure 3 is a schematic diagram of a flow chart of an encryption method in one embodiment of the present invention;

[0052] Figure 4 The present invention is a programming implementation of an encryption method in one embodiment of the present invention. DETAILED DESCRIPTION

[0053] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0054] Please refer to Figure 1 The present invention provides a key policy attribute-based encryption system based on SM9 that supports a large attribute set, including a key generation center, an encryptor, a decryptor and a cloud server; the key generation center is connected to the encryptor and the decryptor respectively; the cloud server is connected to the encryptor and the decryptor respectively.

[0055] In this embodiment, an encryption method of a key policy attribute-based encryption system based on SM9 supporting a large attribute set is also provided, comprising the following steps:

[0056] Step S1: The key generation center runs the SM9 algorithm to generate system parameters, and makes the generated system parameters public to users in the system;

[0057] Step S2: The key generation center sets the function T(X) for calculating the attribute public key according to the maximum value n of the number of attributes in the encrypted attribute set γ, and publishes the generated public parameters to users in the system to keep the master key secret;

[0058] Step S3: The encryptor obtains the attribute set γ, the message M to be encrypted, and the system public key to encrypt the message M to obtain the ciphertext;

[0059] Step S4: The key generation center obtains the access tree T corresponding to the access structure of the encrypted data and the master private key of the system, and outputs the decryption key corresponding to the access tree T.

[0060] Step S5: After the receiver obtains the ciphertext, if the attribute set of the ciphertext satisfies the access control tree of the key, the ciphertext can be decrypted and the message can be restored; otherwise, the decryption fails.

[0061] In this embodiment, preferably, step S1 is specifically:

[0062] Choose additive groups G1, G2 and multiplicative groups G of order p T ;

[0063] e:G1×G2→G T is a bilinear map;

[0064] Hash function H1: One-byte encryption generation function identifier hid;

[0065] For a set S and i∈Z p , define the Lagrange coefficient as

[0066] Where p: cyclic group G1, G2, G T The order of, and p>2 191 Prime number of Z p : {0,1,2…p-1}; {1,2…p-1}; G1, G2: additive cyclic group of order prime number p; G T : Multiplicative cyclic group of prime order p; e: from G1×G2 to G T Bilinear mapping; H1: {0,1} * arrive A cryptographic function derived from a cryptographic hash function; hid: an encryption key generation function identifier represented by one byte, selected and disclosed by the key generation center; S: an element taken from A collection of; Δ i,S (x): Lagrange coefficient.

[0067] In this embodiment, preferably, step S2 is specifically:

[0068] Randomly select generators P1∈G1,P2∈G2, where ψ(P2)=P1, randomly select Calculate the element P in group G2 pub =aP2, group G T The element g=e(P1,P pub );

[0069] Assume N = {1, 2, ..., n+1}, randomly select n+1 different elements t1, t2, ..., t n+1 , define the function The public parameter pk is: mpk = {P1, P2, P pub ,g,t1,t2,…t n+1}, the master private key is msk=a;

[0070] Where, P1: generator of group G1; P2: generator of group G2; ψ: mapping from group G2 to G1; Master key; P pub , t i : an element in group G2; g: group G T The elements in; n: a positive integer.

[0071] In this embodiment, preferably, step S3 is specifically:

[0072] Enter the plaintext message to be encrypted The attribute set γ, and then choose a random value Output ciphertext E: E = (γ, E' = Mg s ,{E i ”=s(h i P1+ψ(P pub )),E i =sT(i)} i∈γ );

[0073] Where M: the message to be encrypted, belonging to G T element; γ: attribute set used during encryption; s: temporary variable, belonging to Elements in E i ,E″ i : attribute ciphertext corresponding to attribute i, belonging to elements in G2 and G1 respectively; E': partial ciphertext, belonging to G T element; E: encrypted ciphertext; i: attribute in the attribute set used for encryption, belonging to Elements in; h i : The hash value of attribute i.

[0074] In this embodiment, preferably, step S4 is specifically as follows:

[0075] First, start from the root node r and traverse the tree from top to bottom, and build a polynomial q for each node x (including leaf nodes) x , where the threshold value of node x is k x , the number of child nodes is num x , and 0<k x ≤num x , the degree of the polynomial is d x =k x -1;

[0076] When the polynomials for all nodes are defined, the secret value is calculated for each leaf node x as follows:

[0077] First calculate h x =H1(x||hid,N), then select a random number r x ∈Z p calculate

[0078] d x =r x (h x P1+ψ(P pub )), i = att(x)

[0079] The final decryption key is D = {D x , d x};

[0080] Where, T: visit tree; r: root node; x: node; att(x): returns the attribute described by the node only when x is a leaf node; q x : The polynomial corresponding to node x; q x (0): constant term of the polynomial corresponding to node x; q parent(x) (index(x)): polynomial q parent(x)The value at index(x), where parent(x) represents the parent node of node x, and index(x) represents the number of node x in the sibling nodes; x||hid represents the concatenation of x and hid, where x and hid are bit strings or byte strings; h i :Hash function H1: The value at i; h x : The hash value of the attribute corresponding to node x; r x :Z p A temporary variable corresponding to each node is randomly selected in x , num x , d x : is an integer; T(i): the value of T(X) at position i; D x ,d x : The partial private key corresponding to node x belongs to the elements in groups G2 and G1 respectively; D: The private key corresponding to the access tree structure.

[0081] In this embodiment, preferably, other d except the constant term in the polynomial x The coefficients are random in Select from , and set the constant term as follows:

[0082]

[0083] Where parent(x) represents the parent node of node x, and index(x) represents the number of node x in the sibling nodes.

[0084] In this embodiment, preferably, step S5 is specifically as follows:

[0085] Input ciphertext E and decryption key D (including access tree ), first define a recursive algorithm DecryptNode(E,D,x), whose input is the ciphertext E=(γ,E',{E″ i ,E i} i∈γ ), decryption key D = {D x ,d x}(The access tree is ), The node x of the output group Elements on or ⊥;

[0086] Let i = attr(x). If x is a leaf node, calculate:

[0087]

[0088] If x is a non-leaf node, for each child node z of x, call the algorithm DecryptNode(E,D,z), and the algorithm output is recorded as Fz ; Define the following two sets: (1) S x : Any size is k x And make F z ≠⊥The set of child nodes z; (2) S' x ={index(z):z∈S x}; If there is no S that meets the above conditions x , then output ⊥; otherwise, calculate

[0089]

[0090] The decryption algorithm calls the above function starting from the root node. If and only if the ciphertext satisfies the access tree, DecryptNode(E,D,r)=e(P1,P2) can be obtained. as =g s Finally, calculate E' / g s Get the plaintext M;

[0091] in: The value of the Lagrange coefficient when x=0.

[0092] refer to Figure 4 In this embodiment, the key strategy attribute-based encryption method based on SM9 that supports large attribute sets is programmed and implemented in two real-life examples. Example 1: Assume that a school has 25 colleges, each college has 4 majors, and the academic affairs system has issued a notice requiring that only second-year graduate students can access it; Example 2: In the television broadcasting system, we encrypt each program by the channel, type, and time of the program. Now assume that there are 30 channels, each channel has 3 types of programs, and each program is broadcast in the morning and afternoon. Now someone has purchased the morning and afternoon sessions of any two programs on 5 channels at the same time. The programming results are as follows: Figure 4 As shown, the results show that in practical applications, the present invention can effectively implement encryption applications.

[0093] The above description is only a preferred embodiment of the present invention. All equivalent changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the present invention.

Claims

1. An encryption method based on a key policy attribute-based encryption system supporting a large attribute set based on SM9, characterized in that: The following steps are involved: Step S1: The key generation center runs the SM9 algorithm to generate system parameters, and makes the generated system parameters public to users in the system; Step S2: The key generation center sets the function T(X) for calculating the attribute public key according to the maximum value n of the number of attributes in the encrypted attribute set γ, and publishes the generated public parameters to users in the system to keep the master key secret; Step S3, the encryptor obtains the attribute set γ, the message M to be encrypted, and the system public key to encrypt the message M to obtain the ciphertext; Step S4: The key generation center obtains the access tree T corresponding to the access structure of the encrypted data and the master private key of the system, and outputs the decryption key corresponding to the access tree T; Step S5: After the receiver obtains the ciphertext, if the attribute set of the ciphertext satisfies the access tree of the key, the ciphertext can be decrypted and the message can be restored; otherwise, the decryption fails. The step S1 is specifically as follows: Choose additive groups G1, G2 and multiplicative groups G of order p T ; e:G1×G2→G T is a bilinear map; Hash Functions One-byte encryption generation function identifier hid; For a set S and i∈Z p , define the Lagrange coefficient as Where p: cyclic group G1, G2, G T The order of, and p>2 191 Prime number of Z p : {0,1,2…p-1}; G1, G2: additive cyclic group of order p; G T : The multiplicative cyclic group of order prime number p; e: From G1×G2 to G T Bilinear mapping; H1: {0,1} * arrive A cryptographic function derived from a cryptographic hash function; hid: an encryption key generation function identifier represented by one byte, selected and disclosed by the key generation center; S: an element taken from A collection of; Δ i,S (x): Lagrange coefficient; The step S2 is specifically as follows: Randomly select generators P1∈G1,P2∈G2, where ψ(P2)=P1, randomly select Calculate the element P in group G2 pub =aP2, group G T The element g=e(P1,P pub ); Assume N = {1, 2, ..., n+1}, randomly select n+1 elements t1, t2, ..., t2 from G2 that are different from each other. n+1 , define the function The public parameter mpk is: mpk = {P1, P2, P pub ,g,t1,t2,…t n+1 }, the master private key is msk=a; Where, P1: generator of group G1; P2: generator of group G2; ψ: mapping from group G2 to G1; Master key; P pub , t i : an element in group G2; g: group G T The elements in; n: a positive integer; The step S3 is specifically as follows: Enter the plaintext message to be encrypted The attribute set γ, and then choose a random value Output ciphertext E: E = (γ, E' = Mg s ,{E” i =s(h i P1+ψ(P pub )),E i =sT(i)} i∈γ ); Where M: the message to be encrypted, belonging to G T element; γ: attribute set used during encryption; s: temporary variable, belonging to Elements in E i ,E i ”: attribute ciphertext corresponding to attribute i, belonging to elements in G2 and G1 respectively; E': partial ciphertext, belonging to G T element; E: encrypted ciphertext; i: attribute in the attribute set used for encryption, belonging to Elements in; h i : The hash value of attribute i.

2. The encryption method according to claim 1, wherein the encryption method is characterized in that: The step S4 is specifically as follows: First, start from the root node r and traverse the tree from top to bottom, building a polynomial q for each node x x , where the threshold value of node x is k x , the number of child nodes is num x , and 0<k x ≤num x , the degree of the polynomial is d x =k x -1; When the polynomials of all nodes are defined, the secret value is calculated for each leaf node x as follows: First calculate h x =H1(x||hid,N), then select a random number r x ∈Z p calculate d x =r x (h x P1+ψ(P pub )),i=att(x) The final decryption key is D = {D x , d x }; Where, T: visit tree; r: root node; x: node; att(x): returns the attribute described by the node only when x is a leaf node; q x : The polynomial corresponding to node x; q x (0): constant term of the polynomial corresponding to node x; q parent(x) (index(x)): polynomial q parent(x) The value at index(x), where parent(x) represents the parent node of node x, and index(x) represents the number of node x in the sibling nodes; x||hid represents the concatenation of x and hid, where x and hid are bit strings or byte strings; h i : Hash function The value at i; h x : The hash value of the attribute corresponding to node x; r x :Z p A temporary variable corresponding to each node is randomly selected in x , num x , d x : is an integer; T(i): the value of T(X) at position i; D x ,d x : The partial private key corresponding to node x belongs to the elements in groups G2 and G1 respectively; D: The private key corresponding to the access tree structure.

3. The encryption method according to claim 2, characterized in that: In the polynomial, except for the constant term, other d x The coefficients are random in Select from , and set the constant term as follows: Where parent(x) represents the parent node of node x, and index(x) represents the number of node x in the sibling nodes.

4. The encryption method according to claim 1, characterized in that: The step S5 is specifically as follows: Input ciphertext E and decryption key D, first define a recursive algorithm DecryptNode(E,D,x), whose input is ciphertext E=(γ,E',{E” i ,E i } i∈γ ), decryption key D = {D x ,d x }、 The node x of the output group Elements on or ⊥; Let i = attr(x). If x is a leaf node, calculate: If x is a non-leaf node, for each child node z of x, call the algorithm DecryptNode(E,D,z), and the algorithm output is recorded as F z ; Define the following two sets: (1) S x : Any size is k x And make F z ≠⊥The set of child nodes z; (2) S' x ={index(z):z∈S x }; If there is no S that meets the above conditions x , then output ⊥; Otherwise, calculate The decryption algorithm calls the above function starting from the root node. If and only if the ciphertext satisfies the access tree, DecryptNode(E,D,r)=e(P1,P2) can be obtained. as =g s Finally, calculate E' / g s Get the plaintext M; in: The value of the Lagrange coefficient when x=0.

5. A key policy attribute-based encryption system based on SM9 supporting a large attribute set, characterized in that: The system is implemented by an encryption method of a key policy attribute-based encryption system based on SM9 supporting a large attribute set as described in any one of claims 1 to 4, including a key generation center, an encryptor, a decryptor, and a cloud server; The key generation center is connected to the encryptor and the decryptor respectively; the cloud server is connected to the encryptor and the decryptor respectively.

Images