An adaptively secure data sharing system supporting verifiable outsourced decryption

Abstract

The present invention provides an adaptive and secure data sharing system supporting verifiable outsourced decryption, comprising the following steps: S101: First, KGC takes security parameters as input and outputs public parameters, master public keys and master private keys; S102: Each data user generates public and private keys for himself; S103: KGC takes master private keys, user public keys and attribute sets as input and outputs attribute conversion keys; S104: Data owners take access control policies and messages as input and output ciphertext and verification keys; S105: Cloud service providers CSP take attribute conversion keys and ciphertext as input; S106: Data users take their private keys, converted ciphertext and verification keys as input. This technical solution utilizes the technologies of ABE, verifiable outsourced decryption and randomness extractor to support fine-grained access control, low-cost data sharing and high-entropy security assurance.

Description

Technical Field

[0001] The invention relates to the technical field of information security, and in particular to an adaptive and secure data sharing system that supports verifiable outsourced decryption. Background Art

[0002] Cloud computing allows its customers to enjoy on-demand data services and large amounts of remote storage. Since the client cannot physically control the outsourced data and the cloud service provider (CSP) is not fully trustworthy, the confidentiality of the outsourced data is vulnerable to threats. To ensure the security of outsourced data, researchers have proposed many encryption tools and deployed them in data sharing systems. In the traditional cloud-based data sharing model, the key generation center (KGC) needs to issue decryption permissions to each data user. Afterwards, the data owner can achieve controlled data sharing by specifying access policies for outsourced data. If the data user's decryption permissions meet the access policy associated with the outsourced data, he or she can access the encrypted sensitive data.

[0003] Although cryptographic tools provide data confidentiality for outsourced data, it is not compatible with resource-constrained end devices with limited memory, physical size, and battery. To address this issue, researchers have introduced server-assisted cryptographic systems, where the workload of end devices is outsourced to CSPs and sensitive data can be retrieved through lightweight computing. However, current server-assisted cryptographic systems have various problems that hinder the development of secure data communications in IoT and cloud computing.

[0004] In order to ensure the confidentiality of data, various encryption mechanisms such as public key encryption and identity-based encryption have been introduced. However, these methods only provide coarse-level access control, where the access model is a one-to-one data sharing model, and the data owner must declare the information of all data users, such as public keys, unique identifiers, and IP addresses, before the data is encrypted. In cloud environments, data is usually shared with a group of data users without knowing the size of the group and the identity information of each data user. To overcome the shortcomings of coarse-grained data sharing, attribute-based encryption (ABE) was introduced as a cryptographic primitive to support fine-grained data sharing. ABE provides a one-to-many data sharing mechanism, and the data owner can encrypt the data without specifying the detailed identity information of the group members in the dynamic data sharing group. However, traditional ABE has many limitations and is not practical in the real world.

[0005] In ABE, decryption authority is issued by KGC through a secret channel, which is very expensive to use and may hinder the scalability of the system. To solve this problem, some researchers have introduced a new method by outsourcing computing. In this method, the data user outsources his public key to KGC, and KGC returns the attribute conversion key through a public channel. If the key is not known, the corresponding attribute conversion key is useless. Therefore, the attribute conversion key can be outsourced to any party. For example, in order to reduce the decryption cost of the data user, the attribute conversion key can be outsourced to CSP for converting ciphertext. However, this method requires that the underlying ABE must be in the form of EL-Gamal type ABE. Existing EL-Gamal type ABE schemes only provide selective security, that is, the adversary must declare the target before launching an attack. Therefore, this method improves the scalability of the system by reducing security.

[0006] In order to avoid expensive data decryption and achieve fine-grained access control, server-assisted ABE (SA-ABE) is introduced. Most of the decryption workload is migrated from data users to CSPs, which are compatible with resource-constrained terminal devices. However, CSPs are not fully trustworthy and may dishonestly handle the decryption of outsourced data. Data users must decrypt the original ciphertext to verify the results of CSPs. Therefore, this approach poses various security threats and cannot deal with untrustworthy CSPs.

[0007] A practical and secure outsourced data sharing system should be efficient, scalable, and device resource friendly, i.e., cryptographic primitives with fine-grained access control, key publishing without using any secret channels, and outsourced data decryption. It can be seen that the previous solutions cannot be regarded as practical and secure outsourced data sharing systems. Summary of the invention

[0008] In view of this, the purpose of the present invention is to provide an adaptively secure data sharing system that supports verifiable outsourced decryption, utilizing the technologies of ABE, verifiable outsourced decryption and randomness extractor to support fine-grained access control, low-cost data sharing and high-entropy security guarantees.

[0009] To achieve the above object, the present invention adopts the following technical solution: an adaptive and secure data sharing system supporting verifiable outsourced decryption, comprising the steps of:

[0010] S101: First, KGC takes the security parameter λ as input and outputs the public parameters pp, the master public mpk and the master private msk. The public parameters pp and the master public mpk are sent to all other users, and KGC holds the master private msk locally.

[0011] S102: Each data user generates a public and private Yue for himself. The user takes his identity id as input and outputs the public Yue pk id and private Yue sk id , among which Gongyue pk id Outsourced to CSP, private id Held secretly by locals;

[0012] S103: KGC uses the master private Yue msk and the user public Yue pk id and attribute set S as input, output attribute transformation key tk id , where the attribute conversion key tk id Outsourced to CSPs;

[0013] S104: The data owner takes the access control policy A and the message m as input, and outputs the ciphertext c and the verification key vk, where both the ciphertext c and the verification key vk are outsourced to the CSP;

[0014] S105: The cloud service provider CSP converts the key tk with the attribute id and ciphertext c as input, if the attribute set S owned by the user satisfies the access control policy A, the output is the transformed ciphertext Otherwise, output ⊥; then, CSP will transform the ciphertext Send to data user id;

[0015] S106: Data users use their private id , convert ciphertext and verification key vk as input, if the ciphertext is converted If it is reasonable, output message m; otherwise, output ⊥.

[0016] In a preferred embodiment, the step S101 specifically includes:

[0017] First, KGC runs the group to generate G(1 λ ) algorithm to generate Type-3 pairing type parameters (p, G, H, G T ,e,g,h), where p is a large prime number, G,G T are two multiplicative groups, H is a hash function, e is a pairing, g and h are the generators of the group;

[0018] After that, a random number a is selected from {1,2,...,p} 1 ,a 2 ,b 1 ,b 2 , select a random number d from {0, 1, ..., p} 1 ,d 2 ,d 3 ;

[0019] Choose three hash functions Where Τ is the label space, C SE is the symmetric encryption ciphertext space; select a semantically secure symmetric encryption scheme SE = {Enc, Dec}, and set as well as

[0020] Finally, KGC outputs the public parameters Master Yue mpk = (H 1 ,H 2 ,T 1 ,T 2 ) and the main private

[0021] In a preferred embodiment, the step S102 specifically includes: the data user id selects a random number α from {1, 2, ..., p} as its private number sk id , its public Yue pk id =g α .

[0022] In a preferred embodiment, the step S103 specifically includes:

[0023] First, KGC analyzes the main private After that, a random number r is selected from {0, 1, ..., p} 1 ,r 2 ,{σ y} y∈S and σ′, and set

[0024] For all y∈S and t=1,2, calculate And set

[0025] For t = 1, 2, calculate And set

[0026] Finally, KGC outputs the conversion key tk id =(tk 0 ,{tk y} y∈S ,tk′).

[0027] In a preferred embodiment, the step S104 specifically includes:

[0028] First, the data owner parses the access control policy A = (M, π), where M is n 1 ×n 2 matrix, π is a conversion function π:[n 1 ]→G;

[0029] Afterwards, in group G T Randomly select an element k from {0, 1, ..., p} and select a random number s from {0, 1, ..., p} 1 and 2 , and set For all i=1,...,n 1 and l=1,2,3, calculate the following values Among them, M i,j represents the i-th row and j-th column of matrix M; set c i =(c i,1 ,c i,2 ,c i.3 );

[0030] calculate and And run the symmetric encryption algorithm to generate the ciphertext c for message m SE ;

[0031] Finally, return the ciphertext and verification key

[0032] In a preferred embodiment, the step S105 specifically includes:

[0033] The cloud service provider CSP first resolves tk id =(tk 0 ,{tk y} y∈S ,tk′) and After that, find the i∈I γ i M i =(1,0,...,0){γ i} i∈I , where M i Represented as the i-th row of the matrix M;

[0034] calculate And set

[0035] Finally, CSP output

[0036] In a preferred embodiment, the step S106 specifically includes:

[0037] First, the data user parses the sk id =α, calculate if Return ⊥; then, calculate Finally, the data user runs the symmetric encryption algorithm to decrypt the message m.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] This paper proposes an adaptive and secure data sharing system with verifiable outsourced decryption by introducing a new attribute-based encryption with verifiable outsourced decryption (VO-ABE). The system provides: (1) data sharing at a fine-grained level; (2) an extensible key distribution protocol without using any secure channel; (3) a verifiable outsourced decryption mechanism compatible with resource-constrained terminal devices against malicious cloud service providers; and (4) adaptive security against real-world attacks. The present invention utilizes the traditional techniques of ABE, verifiable outsourced decryption, and randomness extractor to support fine-grained access control, low-cost data sharing, and high-entropy security guarantees. In addition, the present invention is proven to be secure in an adaptive model under standard assumptions, which provides stronger security guarantees because the state-of-the-art solutions are selectively secure under non-standard assumptions and are subject to various attacks in the real world. Experiments show that the present invention has better functionality and performance than related solutions. More importantly, the present invention is compatible with resource-constrained terminal devices because the decryption process only takes about 1.1ms, which is 22.7 times faster than the state-of-the-art solutions. Comprehensive evaluation shows that the proposed solution has better performance than the current state-of-the-art solutions and effectively promotes the widespread application of outsourced data sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is an architecture diagram of a data sharing system that supports verifiable outsourced decryption and is adaptively secure according to a preferred embodiment of the present invention;

[0041] Figure 2 Flow chart of a data sharing system that supports verifiable outsourced decryption and has adaptive security according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0042] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0043] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0044] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0045] Please refer to Figure 1-2 , a data sharing system that supports verifiable outsourced decryption and can be adaptively secured, characterized in that it includes the steps of:

[0046] S101. First, KGC takes the security parameter λ as input and outputs the public parameters pp, the master public mpk and the master private msk. The public parameters pp and the master public mpk can be sent to all other users, and KGC holds the master private msk locally.

[0047] S102. Each data user can generate public and private data for himself. The user takes his identity ID as input and outputs public data pk id and private Yue sk id , among which Gongyue pk id Outsourced to CSP, private id Held in secret locally.

[0048] S103, KGC uses the master private Yue msk and the user public Yue pk id and attribute set S as input, output attribute transformation key tk id , where the attribute conversion key tk id Outsourced to CSP.

[0049] S104: The data owner takes the access control policy A and the message m as input, and outputs the ciphertext c and the verification key vk, where both the ciphertext c and the verification key vk are outsourced to the CSP.

[0050] S105, the cloud service provider CSP converts the key tk with the attribute id and ciphertext c as input, if the attribute set S owned by the user satisfies the access control policy A, the output is the transformed ciphertext Otherwise, output ⊥. Afterwards, CSP will transform the ciphertext Send to data user id.

[0051] S106, data users use their private id , convert ciphertext and verification key vk as input, if the ciphertext is converted If it is reasonable, output message m; otherwise, output ⊥.

[0052] Furthermore, the above steps are detailed as follows:

[0053] The step S101 specifically includes:

[0054] First, KGC runs the group to generate G(1 λ ) algorithm to generate Type-3 pairing type parameters (p, G, H, G T ,e,g,h), where p is a large prime number, G,G T are two multiplicative groups, H is a hash function, e is a pairing, and g and h are the generators of the group.

[0055] After that, a random number a is selected from {1,2,...,p} 1 ,a 2 ,b 1 ,b 2 , select a random number d from {0, 1, ..., p} 1 ,d 2 ,d 3 .

[0056] Choose three hash functions Where Τ is the label space, C SE is the symmetric encryption ciphertext space. Select a semantically secure symmetric encryption scheme SE = {Enc, Dec} and set as well as

[0057] Finally, KGC outputs the public parameters Master Yue mpk = (H 1 ,H 2 ,T 1 ,T 2 ) and the main private

[0058] The step S102 specifically includes:

[0059] The data user id selects a random number α from {1,2,...,p} as its private sk id , its public Yue pk id =g α .

[0060] The step S103 specifically includes:

[0061] First, KGC analyzes the main private After that, a random number r is selected from {0, 1, ..., p} 1 ,r 2 ,{σ y} y∈S and σ′, and set

[0062] For all y∈S and t=1,2, calculate And set

[0063] For t = 1, 2, calculate And set

[0064] Finally, KGC outputs the conversion key tk id =(tk 0 ,{tk y} y∈S ,tk′).

[0065] The step S104 specifically includes:

[0066] First, the data owner parses the access control policy A = (M, π), where M is n 1 ×n 2 matrix, π is a conversion function π:[n 1 ]→G.

[0067] Afterwards, in group G T Randomly select an element k from {0, 1, ..., p} and select a random number s from {0, 1, ..., p} 1 and 2 , and set For all i=1,...,n 1 and l=1,2,3, calculate the following values Among them, M i,j represents the i-th row and j-th column of the matrix M. Set c i =(c i,1 ,c i,2 ,c i.3 ).

[0068] calculate and And run the symmetric encryption algorithm to generate the ciphertext c for message m SE .

[0069] Finally, return the ciphertext and verification key

[0070] The step S105 specifically includes:

[0071] The cloud service provider CSP first resolves tk id =(tk 0 ,{tk y} y∈S ,tk′) and After that, find the i∈I γi M i =(1,0,...,0){γ i} i∈I , where M i Represented as the i-th row of the matrix M.

[0072] calculate And set

[0073] Finally, CSP output

[0074] The step S106 specifically includes:

[0075] First, the data user parses the sk id =α, calculate if Returns ⊥. Afterwards, calculate Finally, the data user runs the symmetric encryption algorithm to decrypt the message m.

[0076] Summary of symbols and definitions: λ: security parameter; pp: public parameter; mpk: public parameter; msk: private parameter; id: data user identity information; pk id : The public name of the data user id; sk id : private information of the data user id; S: attribute set; U: attribute value space; tk id : attribute conversion key; A: access control policy; m: a message; c: ciphertext; vk: verification key; Convert ciphertext.

[0077] As can be seen from the above description, the present invention proposes an adaptive and secure data sharing system that supports verifiable outsourced decryption by introducing a new attribute-based encryption that supports verifiable outsourced decryption (VO-ABE). The system provides: (1) data sharing at a fine-grained level; (2) an extensible key distribution protocol that does not use any secure channel; (3) a verifiable outsourced decryption mechanism that is compatible with resource-constrained terminal devices against malicious cloud service providers; and (4) adaptive security against real-world attacks. The present invention utilizes the traditional ABE, verifiable outsourced decryption, and randomness extractor technologies to support fine-grained access control, low-cost data sharing, and high-entropy security guarantees. In addition, the present invention is proven to be secure in an adaptive model under standard assumptions, which provides stronger security guarantees because the most advanced solutions are selectively secure under non-standard assumptions and are subject to various attacks in the real world. Experiments show that the present invention has better functionality and performance than related solutions. More importantly, the present invention is compatible with resource-constrained terminal devices because the decryption process only takes about 1.1ms, which is 22.7 times faster than the most advanced solutions.

[0078] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. An adaptively secure data sharing method supporting verifiable outsourced decryption, characterized in that: Includes steps: S101: First, KGC takes the security parameter λ as input and outputs the public parameter pp, the master public mpk and the master private msk. The public parameter pp and the master public mpk are sent to all other users, and KGC holds the master private msk locally. S102: Each data user generates a public and private Yue for himself. The user takes his identity id as input and outputs the public Yue pk id and private Yue sk id , among which Gongyue pk id Outsourced to CSP, private id Held secretly by locals; S103: KGC uses the master private Yue msk and the user public Yue pk id and attribute set S as input, output attribute transformation key tk id , where the attribute conversion key tk id Outsourced to CSPs; S104: The data owner takes the access control policy A and the message m as input, and outputs the ciphertext c and the verification key vk, where both the ciphertext c and the verification key vk are outsourced to the CSP; S105: The cloud service provider CSP converts the key tk with the attribute id and ciphertext c as input, if the attribute set S owned by the user satisfies the access control policy A, the output is the transformed ciphertext Otherwise, output ⊥; then, CSP will transform the ciphertext Send to data user id; S106: Data users use their private id , convert ciphertext and verification key vk as input, if the ciphertext is converted If it is reasonable, output message m; otherwise, output ⊥.

2. According to claim 1, a data sharing method for supporting verifiable outsourced decryption with adaptive security, characterized in that: The step S101 specifically includes: First, KGC runs the group to generate G(1 λ ) algorithm to generate Type-3 pairing type parameters (p, G, H, G T ,e,g,h), where p is a large prime number, G,G T are two multiplicative groups, H is a hash function, e is a pairing, g and h are the generators of the group; Afterwards, random numbers a1, a2, b1, b2 are selected from {1, 2, ..., p}, and random numbers d1, d2, d3 are selected from {0, 1, ..., p}; Choose three hash functions Where Τ is the label space, C SE is the symmetric encryption ciphertext space; select a semantically secure symmetric encryption scheme SE = {Enc, Dec}, and set as well as Finally, KGC outputs the public parameters Lord Yue mpk = (H1, H2, T1, T2) and Lord Private Yue 3. According to claim 2, a data sharing method for supporting verifiable outsourced decryption with adaptive security, characterized in that: The step S102 specifically includes: the data user id selects a random number α from {1, 2, ..., p} as its private number sk id , its public Yue pk id =g α .

4. According to claim 3, a data sharing method for supporting verifiable outsourced decryption with adaptive security, characterized in that: The step S103 specifically includes: First, KGC analyzes the main private After that, random numbers r1, r2, {σ y } y∈S and σ′, and set For all y∈S and t=1,2, calculate And set For t = 1, 2, calculate And set Finally, KGC outputs the conversion key tk id =(tk0,{tk y } y∈S ,tk′).

5. The adaptively secure data sharing method supporting verifiable outsourced decryption according to claim 4, characterized in that: The step S104 specifically includes: First, the data owner parses the access control policy A = (M, π), where M is a matrix of n1×n2 and π is a transformation function π: [n1] → G; Afterwards, in group G T Randomly select an element k from {0, 1, ..., p}, select random numbers s1 and s2 from {0, 1, ..., p}, and set For all i = 1, ..., n1 and l = 1, 2, 3, calculate the following values Among them, M i,j represents the i-th row and j-th column of matrix M; set c i =(c i,1 ,c i,2 ,c i.3 ); calculate and And run the symmetric encryption algorithm to generate the ciphertext c for message m SE ; Finally, return the ciphertext and verification key 6. The adaptively secure data sharing method supporting verifiable outsourced decryption according to claim 5, characterized in that: The step S105 specifically includes: The cloud service provider CSP first resolves tk id =(tk0,{tk y } y∈S ,tk′) and After that, find the i∈I γ i M i =(1,0,...,0){γ i } i∈I , where M i Represented as the i-th row of the matrix M; calculate And set Finally, CSP output 7. The adaptively secure data sharing method supporting verifiable outsourced decryption according to claim 6, characterized in that: The step S106 specifically includes: First, the data user parses the sk id =α, calculate if Return ⊥; then, calculate Finally, the data user runs the symmetric encryption algorithm to decrypt the message m.

Images