Fuzzy identification-based encryption system and method based on SM9 supporting large attributes

Abstract

This invention relates to a fuzzy identifier-based encryption system and method based on SM9 that supports large attributes. Without altering the overall architecture of the SM9 identifier encryption algorithm, it optimizes the user's identifier, allowing it to be represented by descriptive attributes. It utilizes secret sharing technology to implement fault-tolerant encryption or threshold access strategies, and employs Boneh and Boyen techniques to eliminate the calculation of attribute public and private keys during system parameter settings. This invention solves the fault-tolerant encryption or threshold access problems that traditional SM9 identifier encryption cannot achieve. Furthermore, removing T(X) from the scheme can achieve fully large-attribute fuzzy identifier-based encryption, demonstrating excellent scalability.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a fuzzy identification-based encryption system and method based on SM9 supporting large attributes. Background Art

[0002] In 2005, Sahai and Waters first proposed the concept of fuzzy identity-based encryption. As an extension of the identity-based encryption algorithm, the fuzzy identity-based encryption algorithm regards the user identity as a set of descriptive attributes. As long as two different identities ID and ID' are within a certain range through certain measurements, the user identified as ID can use its private key to decrypt the ciphertext encrypted by another identity ID', thereby achieving fault-tolerant encryption or threshold access control. In addition, fuzzy identity-based encryption is also the prototype of attribute-based encryption, which allows documents to be encrypted for all users with a specific set of attributes. Any user with an identity containing all these attributes can decrypt the document, which plays an important role in the study of fine-grained access control in distributed computing systems.

[0003] Fuzzy identifier-based encryption algorithms are divided into small attribute sets and large attribute sets. The fuzzy identifier-based encryption algorithm for small attribute sets requires a set of descriptive attributes to be determined when the system is established. The size of the attribute space is polynomially bounded, and the size of the public parameters in the system increases linearly with the increase in possible attributes. If the system needs to add attributes during operation and exceeds the limit set by the system initially, the system needs to be redeployed and all data needs to be re-encrypted, which will cause a lot of resource waste. If the possible attribute limit is set very large when the system is set up, but the actual need is very small, it will cause unnecessary burden on the system. Therefore, it is of great significance to design fuzzy identifier-based encryption that supports large attribute sets. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a fuzzy identifier-based encryption system and method based on SM9 supporting large attributes to solve the problem of unfeasible fault-tolerant encryption or threshold access.

[0005] To achieve the above object, the present invention adopts the following technical solution:

[0006] A fuzzy identification-based encryption system based on SM9 supporting large attributes includes an authority, an encryptor and a decryptor; the authority is connected to the encryptor and the decryptor respectively; the encryptor is also connected to the decryptor.

[0007] An encryption method based on a fuzzy identifier-based encryption system supporting large attributes in SM9 comprises the following steps:

[0008] Step S1, the authority sets the fault tolerance value d according to the system parameters of the SM9 algorithm, generates the system parameters of the large attribute fuzzy identifier base encryption algorithm, and discloses them to users in the system;

[0009] Step S2: The authority generates a master public key and a master private key of the system according to the selected maximum number of attributes n that can be used to encrypt the user identification, publishes the master public key, and stores the master private key;

[0010] Step S3, the key generation algorithm inputs the attribute set corresponding to the user identification and the system's master public and private keys, and outputs the identification private key corresponding to the attribute set;

[0011] Step S4, the encryption algorithm inputs the attribute set w' and the message M to be encrypted, and outputs the ciphertext C of the message M under the attribute set w';

[0012] Step S5: The decryption algorithm inputs the ciphertext C to be decrypted and the attribute set w. If and only if |w∩w'|≥d, the plaintext M can be decrypted, otherwise the decryption fails.

[0013] Furthermore, the step S1 is specifically: selecting an additive group G of order p 1 ,G 2 , multiplication group G T ;e:G 1 ×G 2 →G T is a bilinear map; hash function A byte representing the encryption generator function identifier hid, a random d∈Z p ; For a set S and i∈Z p , define the Lagrange coefficient as

[0014] Where p: cyclic group G 1 ,G 2 ,G T The order of, and p>2 191 Prime number of Z p : {0,1,2…p-1}; G 1 : additive cyclic group of order p; G 2 : additive cyclic group of order prime number p; G T : a multiplicative cyclic group of prime order p; e: from G 1 ×G 2 To G T Bilinear mapping of H 1 : {0,1} * arrive A cryptographic function derived from a cryptographic hash function; hid: an encryption key generation function identifier represented by one byte, selected and disclosed by the key generation center; S: an element taken from A collection of; Δ i,S (x): Lagrange coefficient; d: fault tolerance value.

[0015] Furthermore, the step S2 is specifically as follows: randomly selecting a generator P 1 ∈G 1 ,P 2 ∈G 2 , where ψ(P 2 )=P 1 , randomly selected Computation Group G 2 The element P in pub =aP 2 , Group G T The element g=e(P 1 ,P pub ), let N = {1, 2, ..., n + 1}, from G 2 Randomly select n+1 different elements t from 1 , t 2 , ..., t n+1 , define the function The public parameter pk is: mpk = {P 1 ,P 2 ,P pub ,g,t 1 ,t 2 ,…t n+1}, the master private key is msk=a;

[0016] Among them, P 1 : Group G 1 Generator of P 2 : Group G 2 Generator of; ψ: from group G 2 To G 1 The mapping of Master key; P pub , t i : Group G 2 Elements in; g: group G T The elements in; n: a positive integer.

[0017] Furthermore, the step S3 is specifically as follows:

[0018] The key generation algorithm first selects a d-1 degree polynomial q(x) such that q(0) = a, and then for all i∈w, calculates h i =H 1 (i||hid,N) and select r i∈Z p ,calculate

[0019]

[0020] The output decryption key is D i∈w ={D i , d i} i∈w

[0021] Where w: attribute set of user identification; q: coefficient in Z p d-1 degree polynomial in; q(i): the value of the polynomial at the i-th position; q(0): the constant of the polynomial; "i"||hid: the concatenation of i and hid, where i and hid are bit strings or byte strings; h i : Hash function The value at i; r i :Z p A temporary variable randomly selected from; T(i): the value of T(X) at position i; D i ,d i : The partial private key corresponding to attribute i; D i∈w : The private key of attribute set w.

[0022] Furthermore, the step S4 is specifically as follows: the encryption algorithm inputs the plaintext message M∈G to be encrypted T2 , attribute set w', and then choose a random value Output ciphertext E: E=(w',E'=Mg s ,{E″ i =s(H 1 (i||hid,N)P 1 +Ψ(P pub )),E i =sT(i)} i∈w' );

[0023] Where M: the message to be encrypted; w′: the attribute set of the receiver; s: a temporary variable belonging to Z p Elements in E i ,E″ i : attribute ciphertext corresponding to attribute i; E': partial ciphertext; E: encrypted ciphertext.

[0024] Furthermore, the step S5 is specifically as follows:

[0025] The decryption algorithm takes as input a ciphertext E encrypted under the identifier w' and a key D corresponding to the identifier w. i∈w , and satisfy |w∩w'|≥d, then randomly select d identical elements from w and w' to form a set S, and then calculate

[0026]

[0027] Among them: |ω∩ω'|: the number of overlapping attributes of attribute set ω and attribute set ω'; S: any subset of ω∩ω' containing d elements; Δ i,S (0): The value of x=0 in the Lagrange coefficient.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. The present invention solves the problem of fault-tolerant encryption or threshold access that cannot be achieved by SM9 identification encryption;

[0030] 2. The present invention uses the Boneh and Boyen technology to eliminate the calculation of attribute public keys and private keys when setting system parameters, and solves the waste of a large amount of resources caused by resetting the system due to adding attributes in the later stage.

[0031] 3. If T(X) is removed, the present invention can realize fuzzy identification-based encryption of complete large attributes, which has good scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a system architecture diagram of the present invention;

[0033] Figure 2 This is a flowchart of an embodiment of the present invention;

[0034] Figure 3 It is a flow chart of a method in one embodiment of the present invention. DETAILED DESCRIPTION

[0035] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0036] Please refer to Figure 1 The present invention provides a fuzzy identification-based encryption system based on SM9 supporting large attributes, including an authority, an encryptor and a decryptor; the authority is connected to the encryptor and the decryptor respectively; the encryptor is also connected to the decryptor.

[0037] In this embodiment, an encryption method based on a fuzzy identifier-based encryption system supporting large attributes in SM9 is also provided, comprising the following steps:

[0038] Step S1, the authority sets the fault tolerance value d according to the system parameters of the SM9 algorithm, generates the system parameters of the large attribute fuzzy identifier base encryption algorithm, and discloses them to users in the system;

[0039] Step S2: The authority generates a master public key and a master private key of the system according to the selected maximum number of attributes n that can be used to encrypt the user identification, publishes the master public key, and stores the master private key;

[0040] Step S3, the key generation algorithm inputs the attribute set corresponding to the user identification and the system's master public and private keys, and outputs the identification private key corresponding to the attribute set;

[0041] Step S4, the encryption algorithm inputs the attribute set w' and the message M to be encrypted, and outputs the ciphertext C of the message M under the attribute set w';

[0042] Step S5: The decryption algorithm inputs the ciphertext C to be decrypted and the attribute set w. If and only if |w∩w'|≥d, the plaintext M can be decrypted, otherwise the decryption fails.

[0043] In this embodiment, preferably, step S1 specifically includes: selecting an additive group G of order p 1 ,G 2 , multiplication group G T ;e:G 1 ×G 2 →G T is a bilinear map; hash function A byte representing the encryption generator function identifier hid, a random d∈Z p ; For a set S and i∈Z p , define the Lagrange coefficient as

[0044] Where p: cyclic group G 1 ,G 2 ,G T The order of, and p>2 191 Prime number of Z p : {0,1,2…p-1}; G 1 : additive cyclic group of order prime number p; G 2 : additive cyclic group of order prime number p; G T : a multiplicative cyclic group of prime order p; e: from G 1 ×G 2 To G T Bilinear mapping of H 1 : {0,1} * arrive A cryptographic function derived from a cryptographic hash function; hid: an encryption key generation function identifier represented by one byte, selected and disclosed by the key generation center; S: an element taken from A collection of; Δ i,S (x): Lagrange coefficient; d: fault tolerance value.

[0045] In this embodiment, preferably, step S2 specifically includes: randomly selecting a generator P 1 ∈G 1 ,P 2 ∈G2 , where ψ(P 2 )=P 1 , randomly selected Computation Group G 2 The element P in pub =aP 2 , Group G T The element g=e(P 1 ,P pub ), let N = {1, 2, ..., n + 1}, from G 2 Randomly select n+1 different elements t from 1 , t 2 , ..., t n+1 , define the function The public parameter pk is: mpk = {P 1 ,P 2 ,P pub ,g,t 1 ,t 2 ,…t n+1}, the master private key is msk=a;

[0046] Among them, P 1 : Group G 1 Generator of P 2 : Group G 2 Generator of; ψ: from group G 2 To G 1 The mapping of Master key; P pub , t i : Group G 2 Elements in; g: group G T The elements in; n: a positive integer.

[0047] In this embodiment, preferably, step S3 is specifically:

[0048] The key generation algorithm first selects a d-1 degree polynomial q(x) such that q(0) = a, and then for all i∈w, calculates h i =H 1 (i||hid,N) and select r i ∈Z p ,calculate

[0049]

[0050] The output decryption key is D i∈w ={D i , d i} i∈w

[0051] Where w: attribute set of user identification; q: coefficient in Zp d-1 degree polynomial in; q(i): the value of the polynomial at the i-th position; q(0): the constant of the polynomial; "i"||hid: the concatenation of i and hid, where i and hid are bit strings or byte strings; h i : Hash function The value at i; r i :Z p A temporary variable randomly selected from; T(i): the value of T(X) at position i; D i ,d i : The partial private key corresponding to attribute i; D i∈w : The private key of attribute set w.

[0052] In this embodiment, preferably, step S4 is specifically as follows: the encryption algorithm inputs the plaintext message M∈G to be encrypted T2 , attribute set w', and then choose a random value Output ciphertext E: E = (w', E' = Mg s ,{E″ i =s(H 1 (i||hid,N)P 1 +Ψ(P pub )),E i =sT(i)} i∈w' );

[0053] Where M: the message to be encrypted; w′: the attribute set of the receiver; s: a temporary variable belonging to Z p Elements in E i ,E″ i : attribute ciphertext corresponding to attribute i; E': partial ciphertext; E: encrypted ciphertext.

[0054] In this embodiment, preferably, step S5 is specifically as follows:

[0055] The decryption algorithm takes as input a ciphertext E encrypted under the identifier w' and a key D corresponding to the identifier w. i∈w , and satisfy |w∩w'|≥d, then randomly select d identical elements from w and w' to form a set S, and then calculate

[0056]

[0057] Among them: |ω∩ω'|: the number of overlapping attributes of attribute set ω and attribute set ω'; S: any subset of ω∩ω' containing d elements; Δ i,S (0): The value of x=0 in the Lagrange coefficient.

[0058] The above description is only a preferred embodiment of the present invention. All equivalent changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the present invention.

Claims

1. An encryption method based on SM9 supporting large attribute fuzzy identification based encryption system, characterized in that: The following steps are involved: Step S1, the authority sets the fault tolerance value d according to the system parameters of the SM9 algorithm, generates the system parameters of the large attribute fuzzy identifier base encryption algorithm, and discloses them to users in the system; Step S2: The authority generates a master public key and a master private key of the system according to the selected maximum number of attributes n that can be used to encrypt the user identification, publishes the master public key, and stores the master private key; Step S3, the key generation algorithm inputs the attribute set corresponding to the user identification and the system's master public and private keys, and outputs the identification private key corresponding to the attribute set; Step S4, the encryption algorithm inputs the attribute set w' of the receiver and the message M to be encrypted, and outputs the ciphertext C of the message M under the attribute set w'; Step S5: The decryption algorithm inputs the ciphertext C to be decrypted and the attribute set w of the user identifier. The plaintext M can be decrypted only when |w∩w'|≥d, otherwise the decryption fails; The step S3 is specifically as follows: The key generation algorithm first selects a d-1 degree polynomial q(x) such that q(0) = a, and then for all i∈w, calculates h i =H1(i||hid,N) and select r i ∈Z p ,calculate The output decryption key is D i∈w ={D i , d i } i∈w in, Master key; Z p : {0,1,2…p-1}; w: attribute set of user identification; q: coefficient in Z p d-1 degree polynomial in; q(i): the value of the polynomial at the i-th position; q(0): the constant of the polynomial; i||hid: the concatenation of i and hid, where i and hid are bit strings or byte strings; h i : Hash function The value at i; r i :Z p A temporary variable randomly selected in; T(i): the value of function T(X) at position i; D i ,d i : The partial private key corresponding to attribute i; D i∈w : private key of attribute set w; N = {1, 2, ..., n + 1}; P1: generator of group G1; P2: generator of group G2; G1: additive cyclic group of order p; G2: additive cyclic group of order p; ψ: mapping from group G2 to G1; P pub : An element in group G2.

2. The encryption method according to claim 1, characterized in that: The step S1 specifically comprises: selecting additive groups G1, G2 and multiplicative groups G of order p. T ; e:G1×G2→G T is a bilinear map; hash function A byte representing the encryption generator function identifier hid, a random d∈Z p ; For a set S and i∈Z p , define the Lagrange coefficient as Where p: cyclic group G1, G2, G T The order of, and p>2 191 Prime number of Z p : {0,1,2…p-1}; G1: additive cyclic group of order p; G2: additive cyclic group of order p; G T : Multiplicative cyclic group of prime order p; e: from G1×G2 to G T Bilinear mapping; H1: {0,1} * arrive A cryptographic function derived from a cryptographic hash function; hid: an encryption key generation function identifier represented by one byte, selected and disclosed by the key generation center; S: an element taken from A collection of; Δ i,S (x): Lagrange coefficient; d: fault tolerance value.

3. The encryption method according to claim 2, characterized in that: The step S2 specifically includes: randomly selecting generators P1∈G1, P2∈G2, where ψ(P2)=P1, and randomly selecting Calculate the element P in group G2 pub =aP2, group G T The element g=e(P1,P pub ), let N = {1, 2, ..., n+1}, randomly select n+1 elements t1, t2, ..., t2 from G2 that are different from each other n+1 , define the function The public parameter pk is: mpk = {P1, P2, P pub ,g,t1,t2,…t n+1 }, the master private key is msk=a; Where, P1: generator of group G1; P2: generator of group G2; ψ: mapping from group G2 to G1; Master key; P pub , t i : an element in group G2; g: group G T The elements in; n: a positive integer.

4. The encryption method according to claim 3, characterized in that: The step S4 is specifically as follows: the encryption algorithm inputs the plaintext message to be encrypted attribute set w', and then choose a random value Output ciphertext E: E = (w', E' = Mg s ,{E i ”=s(H1(i||hid,N)P1+Ψ(P pub )),E i =sT(i)} i∈w' ); Where M: the message to be encrypted; w′: the attribute set of the receiver; s: a temporary variable belonging to Elements in E i ,E i ”: attribute ciphertext corresponding to attribute i; E’: partial ciphertext; E: encrypted ciphertext.

5. The encryption method according to claim 4, characterized in that: The step S5 is specifically as follows: The decryption algorithm takes as input a ciphertext E encrypted under the identifier w' and a key D corresponding to the identifier w. i∈w , and satisfy |w∩w'|≥d, then randomly select d identical elements from w and w' to form a set S, and then calculate Where: |w∩w'|: the number of overlapping attributes between the attribute set w of the user identifier and the attribute set w' of the receiver; S: any subset of w∩w' containing d elements; Δ i,S (0): The value of x=0 in the Lagrange coefficient.

6. A fuzzy identifier-based encryption system based on SM9 supporting large attributes, characterized in that: The system is implemented by the encryption method described in any one of claims 1 to 5, and includes an authority, an encryptor and a decryptor; the authority is connected to the encryptor and the decryptor respectively; The encryptor is also connected to the decryptor.

Images