Efficient and Fine-Grained Secure Sharing Methods for Streaming Data

Abstract

This invention proposes a method for efficient, fine-grained, and secure sharing of streaming data. Through the construction and optimization of data encryption and sharing, it can support fine-grained access control while ensuring secure and efficient data storage. The method includes: dividing the streaming data from the data producer into data blocks and pre-aggregating and calculating the statistical value of each data block; simultaneously, a key management module generates a keystream; both are encrypted and uploaded to the service provider; the service provider stores the ciphertext in two parts: the statistical value ciphertext is stored in a memory cache, and the original value ciphertext is stored on disk; the data owner generates an access control template based on the resource path, time range, and time granularity, and uses the template to encrypt the data producer's keystream; after authorization from the data owner, the data access user queries the data and decrypts the data within the authorized scope.

Description

Technical Field

[0001] This invention relates to a method for efficient, fine-grained, and secure sharing of streaming data, belonging to the field of information security technology. Background Technology

[0002] Currently, an increasing number of devices and services are collecting streaming data and uploading it to cloud storage centers. This growth has raised concerns among users about data protection and privacy. Given the expanding scale of privacy data breaches, data security technologies are constantly being strengthened, with encrypted databases emerging as an effective solution. Meanwhile, streaming data carries commercial and research value and often relies on access control technologies to share data with third parties, with attribute-based encryption (ABE) becoming a key technology for access control.

[0003] In the prior art, regarding encrypted databases, patent application number 202011374433.5 discloses a relational database encryption method and a query method for the encrypted database. In this method, after the data owner selects an encryption level on the client side, the plaintext data is sent to a security agent. The security agent encrypts the plaintext data according to the encryption scheme and encryption level, the key is stored in the security agent, and the ciphertext data is stored in the service provider. Patent application number 202110886135.2 discloses an encrypted database method supporting composable SQL queries. In this method, the user encrypts and preprocesses the data before uploading it to the service provider, who can then execute the user-defined SQL query and return the query results to the user. Patent application number 202010889829.7 discloses a database field encryption method, which configures encryption keys according to the database field category, encrypts the plaintext of each database field separately, and then stores the ciphertext in the service provider.

[0004] Regarding access control, patent application number 202110947484.0 discloses an APP user data access control system and method based on attribute encryption, which symmetrically encrypts plaintext data and uses attribute keys to encrypt symmetric keys, and then uploads the ciphertext to the service provider for storage, and determines whether the data access user has access rights based on the data access user's attributes; patent application number 201810200325.2 discloses an outsourced mandatory access control method based on hierarchical attribute encryption, which adopts a combination of hierarchical attribute encryption and mandatory access control, and supports data owners to control fine-grained data reading and writing as well as mandatory access control.

[0005] Regarding encrypted databases, existing technologies support the encryption and querying of relational data, but are insufficient to support the processing of large amounts of continuous streaming data. For example, patents 202011374433.5 and 202110886135.2 consider data encryption and ciphertext querying, but do not consider the scalability of data processing in conjunction with the data volume. Furthermore, existing technologies consider fine-grained encryption strategies for data, but do not integrate them with access control. For instance, patent 202010889829.7 encrypts different fields of the database separately to improve data security, but does not further consider fine-grained data sharing schemes.

[0006] Regarding access control, existing technologies often employ ABE-based encryption authorization schemes. However, ABE alone cannot address the scalability and homomorphic capabilities required for streaming data. For example, patent 202110947484.0 combines symmetric encryption with ABE encryption, but symmetric encryption does not support ciphertext computation, while ABE encryption has poor performance and cannot support encrypting a large number of symmetric keys. Furthermore, most existing ABE schemes rely on data visitor attributes for encryption, while streaming data sharing is often based on a publish-subscribe model. For instance, while patent 201810200325.2 establishes a hierarchical structure based on data visitor attributes, supporting fine-grained access control, it is unsuitable for scenarios where data visitors cannot be predicted in advance in streaming data. Summary of the Invention

[0007] This invention proposes a method for efficient, fine-grained, and secure sharing of streaming data. By constructing and optimizing data encryption and sharing, it can support fine-grained access control while ensuring secure and efficient data storage.

[0008] The present invention is achieved through the following technical solution.

[0009] A method for efficient, fine-grained, and secure sharing of streaming data includes: dividing the streaming data of a data producer into data blocks and pre-aggregating and calculating the statistical value of each data block; simultaneously, a key management module generates a key stream; both are encrypted and then uploaded to a service provider; the service provider stores the ciphertext in two parts: the ciphertext containing the statistical values ​​is stored in a memory cache, and the ciphertext containing the original values ​​is stored on a disk; the data owner generates an access control template based on the resource path, time range, and time granularity, and uses the template to encrypt the data producer's key stream; after authorization from the data owner, the data access user queries the data and decrypts the data within the authorized scope.

[0010] The beneficial effects of this invention are:

[0011] This invention starts with an efficient, fine-grained, secure sharing method for streaming data. Combining the characteristics of streaming data generation and querying, it pre-aggregates streaming data and homomorphically encrypts statistical values, then constructs an in-memory index to store the ciphertext of the statistical values, thus realizing ciphertext calculation and efficient querying of streaming data. At the same time, considering the attribute characteristics of streaming data resources, it adopts an identity-based wildcard key derivation scheme (WKD-IBE), which outperforms ABE and can realize an efficient, fine-grained, secure sharing scheme based on resources. Attached Figure Description

[0012] Figure 1 This is a flowchart of the efficient, fine-grained, secure sharing method for streaming data according to the present invention;

[0013] Figure 2 This is a flowchart of the encryption process of the streaming data encryption module in a specific embodiment of the present invention;

[0014] Figure 3 This is a schematic diagram of streaming data pre-aggregation in a specific embodiment of the present invention;

[0015] Figure 4 This is a schematic diagram illustrating the construction of a key derivation tree in a specific embodiment of the present invention;

[0016] Figure 5 This is a schematic diagram of the streaming data storage structure in a specific embodiment of the present invention. Detailed Implementation

[0017] The present invention will now be described in detail with reference to the accompanying drawings.

[0018] like Figure 1 As shown, the efficient, fine-grained, secure sharing method for streaming data according to a specific embodiment of the present invention includes the following steps:

[0019] Step 1: Divide the streaming data from the data producer into data blocks and pre-aggregate and calculate the statistical value of each data block. At the same time, the key management module generates a key stream. After the two are encrypted, the ciphertext is uploaded to the service provider.

[0020] In this embodiment, the pre-aggregation calculation of the statistical value of each data block is performed as follows: the streaming data is divided into data blocks {Chunk0,Chunk1,...} according to a predefined minimum aggregation granularity Δ, that is, the time interval of each data block is Δ=t. i+1 -t i Then, based on the data accessor's query requirements (e.g., average, minimum, maximum, etc.), the statistical values ​​{Stats0, Stats1, ...} for each data block are calculated. As shown in Figure 3, this approach avoids sharing raw data, thus protecting the privacy of data producers to some extent, and also optimizes the query speed of streaming data during subsequent data access.

[0021] In practice, after the streaming data is pre-aggregated in blocks, the encryption, querying, and access control of the streaming data are all based on data blocks as the smallest time granularity. The original data and statistical values ​​corresponding to each data block are encrypted using different keys. Due to the large volume and continuous nature of streaming data, symmetric encryption technology with good encryption efficiency is more suitable. However, symmetric encryption technology does not possess additive homomorphism and cannot support the addition of ciphertext to statistical values. Data access users often query the aggregated value of statistical values ​​within a certain time range rather than the statistical value of a single data block. Therefore, in this embodiment, the data encryption uses additively symmetric homomorphic encryption (ASHE) to encrypt the statistical values ​​of each data block. This approach is because AHSE supports ciphertext addition operations, its encryption efficiency is close to that of symmetric encryption technology, and it has no ciphertext expansion, meaning the ciphertext space size is equal to the plaintext space size.

[0022] The specific formula for encryption using the AHSE method is as follows:

[0023] The encryption process is as follows

[0024] The decryption process is as follows

[0025] Where k represents the shared key used by the entities responsible for encryption and decryption; i is the data block number of the stream data, i∈n, where n is the set of natural numbers, and m i Indicates plaintext, c i Indicates ciphertext;

[0026] In practice, if the predefined aggregation granularity is small, a large number of data blocks will be generated continuously. This necessitates the use of numerous different keys to encrypt each data block and its statistical values, forcing data producers to store a large number of keys. Therefore, a data structure is needed to create a mapping relationship between keys and ciphertext. This embodiment uses a balanced binary tree to construct a key derivation tree, establishing a symmetric mapping relationship between the keys and data blocks.

[0027] like Figure 4 As shown, the specific steps for constructing the key derivation tree are as follows: The key management module initializes the root node as a random secret seed, takes the root node as input, and uses different pseudo-random hash functions for the left and right nodes respectively. l () and hash r(), respectively generate two child nodes, and recursively call the above process until the predefined tree height is reached, where the leaf nodes are the key stream for encrypting data blocks; the pseudo-random function is implemented based on a one-way hash function, a node cannot calculate its ancestor node or sibling node, so data accessors cannot deduce the key outside the authorized range, ensuring the security of key sharing. In specific implementation, a large tree height is generally set to simulate a continuous key stream.

[0028] When dividing the streaming data from the data producer into data blocks and pre-aggregating and calculating the statistics for each data block, the key management module requests a key based on the path encoding from the root node to the corresponding leaf node, and generates a symmetric key k based on the key derivation tree. i Encrypt data blocks Chunk respectively i and statistics i And upload it to the service provider's storage.

[0029] In this embodiment, the statistical value Stats i Encrypted as Cstats i =(Stats i +k i ) mod n, when the data visitor queries the time range [t0, t n When the aggregated value of ) is obtained, the service provider performs ciphertext computation. It returns the encrypted aggregation result, and the data accessor obtains the corresponding authorization key {k0,k1,...,k n-1 The plaintext of the aggregation result can then be decrypted. Specifically as follows:

[0030] In specific implementation, when the data visitor queries within the time range of [t0, t...] n When aggregating the values ​​of a key, there are two problems: First, the number of keys n authorized to the data accessor is directly proportional to the size of the query time range n; second, the number of calculations performed locally by the data accessor is n+1, including n key aggregations. The performance of data decryption is proportional to the time range (n) of the query, similar to the performance of a single ciphertext decryption operation. Data users are typically resource-constrained clients with weaker communication and computing capabilities compared to service providers, resulting in lower data decryption performance.

[0031] This embodiment employs a key cancellation method to simultaneously address the two issues mentioned above. By using two keys to encrypt the statistical value of a data block, the internal keys can cancel each other out when the ciphertext of the statistical value is aggregated. The specific steps are as follows: The statistical value Stats of the data block... i Encrypted Cstats i =(Statsi +k i - k i+1 )mod n is uploaded to the service provider, and the data visitor queries the time range [t0,t] n When the aggregated value of ) is obtained, the service provider performs ciphertext computation. And return the aggregated result Encsum;

[0032] in

[0033] This approach shows that in this embodiment, [t0,t] n The aggregated value only used keys k0 and k n Therefore, the data visitor only needs to obtain k0 and k n The plaintext of the aggregation result can then be decrypted. In encryption and decryption processes based on key offsetting, regardless of the query time range, data users only need two symmetric keys and one calculation to obtain the aggregated plaintext value, thus greatly improving data decryption performance.

[0034] Step 2: The service provider stores the ciphertext in two parts: the statistical value ciphertext is stored in a memory cache, and the original value ciphertext is stored on the disk.

[0035] The principle behind this step is that the service provider is responsible for storing, retrieving, and aggregating data. Aggregated data within a specific time range is queried more frequently, and memory caching can ensure efficient data writing and reading. Therefore, encrypted statistical values ​​are stored in the memory cache, while less frequently accessed encrypted data blocks are stored on the disk.

[0036] like Figure 5 As shown, in this embodiment, the service provider stores the ciphertext in two parts, specifically using a k-ary tree-based data storage structure. The specific steps are as follows:

[0037] 2.1 The memory cache constructs an aggregated value ciphertext index based on time, wherein the leaf nodes store the encrypted statistics of the data block and point to the storage address of its original encrypted data block on the disk, and the non-leaf nodes store the aggregated value ciphertext of its k child nodes.

[0038] 2.2 Based on the key cancellation method, the key corresponding to the non-leaf node is only the two boundary keys of the time range, for example: time range [t0, t... k The aggregate value of Stats [0,k) The corresponding key is k0-k kWhen new encrypted data blocks and statistical values ​​need to be stored with the service provider, the encrypted statistical values ​​are inserted as leaf nodes of the memory index. Then, the aggregated value ciphertext of the non-leaf nodes is updated by ciphertext calculation, and the storage address of the encrypted data block is updated to the corresponding leaf node.

[0039] 2.3 Data visitor query time range [t0, t] n When calculating the aggregate value of ), directly traverse the k-ary tree to find the covering [t0, ... n The aggregated ciphertext can be obtained from the nodes of );

[0040] As can be seen from the above steps, this method can significantly reduce the response time of aggregate value queries.

[0041] Step 3: The data owner generates an access control template based on the resource path, time range, and time granularity, and uses the template to encrypt the data producer's key stream; this step is used to consider how to share the data producer's symmetric encryption key with the data accessor.

[0042] In this embodiment, the generated access control template adopts WKD-IBE-based fine-grained access control for streaming data URIs and time ranges, and combines the data sharing time granularity set by the data owner to report the aggregated value of data blocks according to the time granularity.

[0043] In this embodiment, data encryption is divided into two parts: data block symmetric encryption and statistical value ASHE encryption. These two parts use different symmetric keys, and data access users can authorize access to each part separately. The statistical value ASHE encryption provides time-granularity-based access control. For example, if the time length of each data block is 1 second, then the finest time granularity for authorized access is 1 second. Based on this, data access users are restricted to accessing data at time granularities of seconds, minutes, hours, and days.

[0044] The access control adopts WKD-IBE, which supports fine-grained access control based on both stream data URIs and time ranges (TimeRange). This approach addresses the issue that existing time-based access control considers individual stream data, while a data owner typically generates multiple streams, each containing different fields. Therefore, a URI is assigned to each stream, represented as client / stream data / field. Furthermore, considering that time-range authorization is a common access control method, and that time ranges can be represented as a hierarchical structure similar to URIs (e.g., year / month / day / hour), this embodiment uses an identity-based wildcard key derivation method. It employs a common key authorization template, specifically: first, a key is generated based on an identity string vector, where elements can be replaced with wildcards. Then, other identity strings in the vector are matched to derive the key. For example, a school administrator can derive a key for each college administrator's email address (sysadmin@*.univ.edu), where * represents a wildcard that can match any string. Therefore, the school administrator can derive keys for all college administrators. WKD-IBE specifically consists of the following four steps:

[0045] Setup(l k ,I λ →Params,MasterKey (1)

[0046]

[0047] Enc(Params,Pattern,m)→Ciphertext Pattern,m (3)

[0048] Dec(Key Pattern Ciphertext Pattern,m → m (4)

[0049] (1) This indicates that the data owner publishes the public parameters Params and the storage master key MasterKey;

[0050] (2) indicates that the condition is satisfied. Is it MasterKey or Template Pattern? A Matching template Pattern B One of the two conditions can be used to define the pattern of the data visitor. B Derived key;

[0051] (3) This indicates that the data owner obtains the ciphertext Ciphertext by encrypting the plaintext m according to Params and the template Pattern;

[0052] (4) Indicates the key used by the data accesser based on the Pattern. Pattern Decrypting Ciphertext yields the plaintext m.

[0053] The four steps above are not strictly ordered. In the access control step, the data owner executes (1) and (3), while in the data sharing step, the data accessor executes (2) and (4).

[0054] For example, the template length is p = p1 + p2. The first p1 elements represent the maximum depth of the URI hierarchy, and the last p2 elements represent the maximum depth of the TimeRange hierarchy. Taking the URI: ClientA / HealthStream / heart, and TimeRange: 2021 / 12 / 15 / 08 as an example... For collision-resistant hash functions, the corresponding generation vector P is used. The URI is split into three elements and a terminator $, represented as ("ClientId", "HealthStream", "heart", "$"). H is used to map the four elements to... Then it is placed in the first p1 positions of the template, represented as: P(1) = H(“ClientId”), P(2) = H(“HealthStream”), P(3) = H(“heart”), P(4) = H($). TimeRange is placed in the last p2 positions using the same hash mapping method. The minimum granularity of TimeRange is set to hours and is fixed at four levels, so no terminating symbol $ is needed, represented as: P(5) = H(“year”), P(6) = H(“month”), P(7) = H(“day”), P(8) = H(“hour”). Therefore, P is used as the Pattern in step (3) to encrypt the AshE key of the heart data in HealthStream generated by ClientA within 8:00 on December 15, 2021.

[0055] This approach takes into account that ASHE's encryption efficiency is superior to WKD-IBE. Therefore, it is designed to rely on ASHE encryption most of the time and call WKD-IBE encryption less frequently. For example, ASHE encrypts the statistical value of the data block every 1 second, while WKD-IBE encrypts the ASHE key every 1 hour. Depending on the shared time granularity set by the data owner, the ASHE key set encrypted by WKD-IBE varies. Taking hourly, minutely, and secondly time granularities as examples, if the authorized time granularity is hourly, then WKD-IBE only needs to encrypt one key every 1 hour, for example, [t0, t...]. 3600 The hourly aggregated value key within the range of k0-k is only k0-k 3600If the authorization time granularity is in minutes, then WKD-IBE needs to encrypt 60 keys every hour, for example, [t0,t...]. 3600 The set of minute-based aggregated value keys within the range is {k0-k}. 60 k 60 -k 120 ,....,k 3540 -k 3600 If the authorization time granularity is seconds, since seconds are the smallest aggregation granularity, to avoid sharing a large number of statistical value keys, WKD-IBE encrypts the root node key set of the subtree corresponding to the time range every hour, and two pseudo-random functions (hash). l and hash r Once authorized, data access users can generate their own leaf nodes, which correspond to statistical key values ​​at the second level. In practical applications, the TimeRange hierarchy can be dynamically adjusted based on the time granularity authorized by the data owner to optimize overall encryption efficiency.

[0056] Step 4: After obtaining authorization from the data owner, the data accessor queries and decrypts the data within the authorized scope;

[0057] Specifically, the data owner determines the content of the WKD-IBE template based on the authorized scope and generates a key set. Then, the data accessor obtains the key set and derives keys within other authorized scopes. This key-sharing method significantly reduces the amount of communication between the data owner and the data accessor.

[0058] In this embodiment, the data owner determines the content of the WKD-IBE template and generates a key set based on the authorization scope. Specifically, when a data accessor requests streaming data resources, the data owner maps the authorization scope to a hierarchical structure of URI and TimeRange, fills the template according to the hierarchical structure to generate multiple resource attribute vectors, and then calls WKD-IBE to convert the vectors into keys. For example, the data owner authorizes the data accessor to access HealthStream on December 14, 2021, and at 22:00 on December 15, 2021, with corresponding URIs of ClientId / HealthStream / * and TimeRanges of 2021 / 12 / 14 / * and 2021 / 12 / 15 / 22. The data owner then converts the two vectors P1 and P2 generated from the template into a key set. The key set can be securely sent to the data accessor in a variety of ways, such as the Transport Layer Security (TLS) protocol widely used in one-to-one communication schemes, or public-private key encryption mechanisms.

[0059] P1: H(″Clientid″)H(″Healthstream″)H((″*″)H(″$″)H(″2021″)H(″Dec″)H(″ 14″)H(″*″)

[0060] P2: H(″Clientld″)H(″HealthStream″)H(″*″)H(″$″)H(″2021″)H(″Dec″)H(″ 15″)H(″22″)

[0061] P3: H("Clierrtld")H("HealthStream")H("heart")H("$")H("202r")H("Dec")H (″14″)H(″20″)

[0062] P4: H(″Clientld″)H(″sportStream″)H(″walk″)H(″$″)H(″2021″)H(″Dec″)H(″ 14″)H(″20″)

[0063] In this embodiment, after obtaining the key set, the data accessor derives keys within other authorized ranges. Specifically, the data accessor receives and stores the key set. Then, when accessing streaming data resources stored on the service provider's website, it converts the access range into multiple templates and determines whether the resource attribute vector matches these templates. If they match, a key can be derived. For example, if a certain access range is converted into P3, and P3 matches P1, then a key is derived. If a certain access range is converted to P4, and P4 does not match P1 and P2, then a key cannot be derived. Data users can derive the WKD-IBE key within the authorized scope and decrypt the ASHE key, thereby accessing statistical values ​​within the authorized scope according to a predefined time granularity.

Claims

1. A method for efficient, fine-grained, secure sharing of streaming data, characterized in that, include: The streaming data from data producers is divided into data blocks, and the statistical value of each data block is pre-aggregated and calculated. Specifically, the streaming data is divided into data blocks according to a predefined minimum aggregation granularity; then, the statistical value of each data block is calculated according to the query requirements of data visitors; the encryption, query, and access control of the streaming data are all based on the data block as the minimum time granularity, and the original data and statistical value corresponding to each data block are encrypted using different keys. Simultaneously, the key management module generates a key stream, and after data encryption, the ciphertext is uploaded to the service provider. The encryption of the stream data uses the additive symmetric homomorphic encryption method (AHSE) to encrypt the statistical value of each data block, with the specific formula as follows: The encryption process is as follows The decryption process is as follows Where k represents the shared key used by the entities responsible for encryption and decryption; i is the data block number of the stream data, i∈n, where n is the set of natural numbers, and m i Indicates plaintext, c i Indicates ciphertext; A key derivation tree based on a balanced binary tree is used to establish a symmetric mapping relationship between the key and the data block. The specific steps are as follows: The key management module initializes the root node as a random secret seed. The root node is used as input, and the left and right nodes are generated with different pseudo-random functions. The above process is recursively called until the predefined tree height is reached. The leaf nodes are the key stream for encrypting the data blocks. The streaming data from the data producer is divided into data blocks, and the statistical value of each data block is pre-aggregated and calculated. The key is requested based on the path encoding from the root node to the corresponding leaf node. The key management module generates a symmetric key based on the key derivation tree, encrypts the data blocks and statistical values ​​respectively, and uploads them to the service provider's storage. The service provider stores the ciphertext in two parts: the statistical value ciphertext is stored in a memory cache, and the original value ciphertext is stored on the disk. The data owner generates an access control template based on the resource path, time range, and time granularity, and uses the template to encrypt the data producer's key stream. After being authorized by the data owner, the data accessor queries the data and decrypts the data within the authorized scope.

2. The efficient, fine-grained, secure sharing method for streaming data as described in claim 1, characterized in that, The statistics of the data block (Stats) i Encrypted Cstats i =(Stats i +k i -k i+1 )mod n is uploaded to the service provider, and the data visitor queries the time range [t0,t] n When the aggregated value of ) is obtained, the service provider performs ciphertext computation. And return the aggregation result; in, 3. The efficient, fine-grained, secure sharing method for streaming data as described in claim 2, characterized in that, The service provider stores the ciphertext in two parts, specifically using a k-ary tree-based data storage structure. The specific steps are as follows: 2.1 The memory cache constructs an aggregated value ciphertext index based on time, wherein the leaf nodes store the encrypted statistics of the data block and point to the storage address of its original encrypted data block on the disk, and the non-leaf nodes store the aggregated value ciphertext of its k child nodes. 2.2 Based on the key cancellation method, the key corresponding to the non-leaf node is only the two boundary keys of the time range. When a new encrypted data block and statistical value need to be stored in the service provider, the encrypted statistical value is inserted as the leaf node of the memory index. Then, the aggregate value ciphertext of the non-leaf node is updated by ciphertext calculation, and the storage address of the encrypted data block is updated in the corresponding leaf node. 2.3 When a data visitor queries the aggregated value for a time range, the aggregated value ciphertext can be obtained by directly traversing the k-ary tree to find the node covering the time range.

4. The efficient, fine-grained, secure sharing method for streaming data as described in claim 3, characterized in that, The access control adopts a WKD-IBE-based approach to perform fine-grained access control of streaming data URIs and time ranges, and combines the data sharing time granularity set by the data owner to report the aggregated value of data blocks according to the time granularity.

5. The efficient, fine-grained, secure sharing method for streaming data as described in claim 4, characterized in that, The access control adopts WKD-IBE, which supports fine-grained access control based on both streaming data URI and time range (TimeRange).

6. The efficient, fine-grained, secure sharing method for streaming data as described in claim 5, characterized in that, The WKD-IBE adopted is an identity-based wildcard key derivation method, which uses a general key authorization template. Specifically, it first generates a key based on an identity string vector, where elements in the identity string vector can be replaced by wildcards. Then, it derives keys based on the key by matching other identity strings in the vector.

7. The efficient, fine-grained, secure sharing method for streaming data as described in claim 6, characterized in that, The data owner determines the content of the WKD-IBE template according to the authorization scope and generates a key set. Then, the data accessor obtains the key set and derives keys from other authorization scopes.

8. The efficient, fine-grained, secure sharing method for streaming data as described in claim 7, characterized in that, The data owner determines the content of the WKD-IBE template and generates a key set according to the authorization scope. Specifically, when a data visitor requests streaming data resources, the data owner maps the authorization scope to the hierarchical structure of URI and TimeRange, fills the template according to the hierarchical structure to generate multiple resource attribute vectors, and then calls WKD-IBE to convert the vectors into keys.

9. The efficient, fine-grained, secure sharing method for streaming data as described in claim 8, characterized in that, After obtaining the key set, the data accesser derives other keys within the authorized scope. Specifically, the data accesser receives and stores the key set, and when accessing streaming data resources stored in the service provider, it converts the access scope into multiple templates, determines whether the resource attribute vector matches these templates, and if they match, it can derive keys.

Images