A trust-based attribute encryption access control system and method

Abstract

The present invention discloses a trust-based attribute encryption access control system, which relates to the field of information security technology, including a trusted measurement module, which assigns an initial trust value to a subject terminal, and calculates the trust value of the subject terminal according to the behavior information of the subject terminal; an access control module, which adjusts the encryption algorithm and access rights of the subject terminal in real time based on the trust value of the subject terminal; the trusted measurement module and the access control module are communicatively connected. The system also discloses a trust-based attribute encryption access control method, including: S100, calculating the trust value of the subject terminal; S200, adding a trust attribute set; S300, requesting a master key, a key, and a public key; S400, returning a master key, a key, and a public key; S500, encrypting plaintext; S600, verifying the trust attribute set; S700, generating a private key of the subject terminal; S800, decrypting ciphertext. The present invention takes into account both efficiency and security, and is more suitable for discrete collaborative manufacturing scenarios.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a trust-based attribute encryption access control system and method. Background Art

[0002] Access control is an effective means to ensure information security. By formulating security policies, the ability and scope of legitimate subject terminals to access information resources of object terminals is granted, preventing the subject terminals from damaging the system through illegal behaviors. This illegal behavior includes two aspects: one is that illegal subject terminals, such as intruders, obtain access rights to data resources in the system; the other is that legitimate subject terminals exceed their authority and obtain data access rights with higher authority requirements. Therefore, in order to meet security requirements, access control must implement two functions: first, verify the legitimacy of the access subject terminal and prohibit the access of illegal subject terminals; second, according to the information of the access subject terminal, grant the subject terminal authority according to the principle of least privilege and restrict the operation behavior of the subject terminal.

[0003] Early access control technologies were designed to address the access management issues of physically shared data on the same host, including Discretionary Access Control (DAC), Mandatory Access Control (MAC), and Role-Based Access Control (RBAC). Early access control models used static permissions, which were set by administrators during initialization. Once set, these permissions would not change with operations.

[0004] With the development of data and resource carriers and the Internet of Everything under the trend of openness and collaboration, access control systems are facing challenges of node growth, dynamics, and increased privacy, which are specifically manifested as follows:

[0005] (1) The number of users and terminals in the system has increased dramatically;

[0006] (2) As the mobility and autonomy of nodes increase, the mapping relationship between users and permissions becomes extremely complex;

[0007] (3) The collaboration between terminals is strengthened and the degree of information sharing is deepened, which means that it is necessary not only to control the user's access behavior but also to consider the protection of the data itself.

[0008] In this context, researchers have proposed access control models that can be applied to dynamic distributed scenarios, including task-based access control (TBAC), attribute-based access control (ABAC), and attribute-based encryption (ABE) access control.

[0009] Compared with traditional access control methods, TBAC takes into account the tasks and status currently executed by the system, and is task-centric. It completes the dynamic permission replacement of the access subject terminal and the object terminal based on the replacement of tasks. TBAC is "task-oriented", taking into account the life cycle of workflows and tasks, and completing the permission update of the access subject terminal in a more fine-grained manner. For each workflow, the TBAC model can set a specific access policy; for different tasks in the same workflow, the TBAC model can also set different access policies.

[0010] Compared with RBAC, ABAC mines the inherent information of the subject terminal and the object terminal as attributes, and uses the attributes as decision-making factors to manage access rights in a more fine-grained manner. Attributes can describe the key components in the access control system from multiple perspectives. Taking the access subject terminal as an example, the attributes can be information such as the brand of the device used by the user and the user's occupation. When the subject terminal initiates an access request, ABAC makes access control decisions based on the attribute information of the subject terminal and the access request. The concept of attributes makes the ABAC model highly expressive. When only role information is used as an attribute, RBAC is a special implementation of ABAC; when only identity information is used as an attribute, IBAC (Identity-Based Access Control) is a special implementation of ABAC.

[0011] ABAC introduces the concept of attributes, which has higher granularity and flexibility. However, it also faces problems such as attribute discovery and selection, association mapping between attributes and permissions, and permission updates.

[0012] Although typical ABAC can effectively control the access of the subject terminal to resources, it cannot maximize the protection of data confidentiality and privacy security. The access control method based on attribute encryption mechanism (ABE) uses asymmetric encryption technology to combine attribute information and user keys to encrypt plaintext data. At the same time, ABE uses attributes as the key to decryption and uses access structures to express authorized access sets. The access structure is equivalent to storing all access authorization sets. The access relationships that meet the access structure are authorized. Only when the ciphertext attributes and user attributes meet the access structure can the user successfully decrypt and obtain the plaintext data.

[0013] There are currently two main ABE mechanisms: Key-Policy ABE (KP-ABE) and Ciphertext-Policy ABE (CP-ABE). In KP-ABE, attribute sets are used to encrypt plaintext and access structures are used to generate keys. In this way, the data owner has weak control over the data and can only describe the data, but cannot set access control decisions. CP-ABE, on the contrary, uses access structures to encrypt plaintext and attribute sets to generate keys. In this way, the data owner sets access control decisions. The ciphertext can only be decrypted when the attributes of the access subject terminal completely match the access structure, that is, the data owner determines the users with access rights.

[0014] Based on ABAC, the ABE mechanism sets up an encryption method to ensure data confidentiality and privacy protection. However, encryption and decryption have high requirements for computing resources and face the problem of balancing access control granularity and computing resources.

[0015] Although the access control model in dynamic scenarios has a good effect in large-scale, distributed systems, it cannot monitor the behavior of the access subject terminal after access, and there are still certain security risks in the open environment. With the increasing application of trust management and the increasing emphasis on the security measurement of behavior, more and more research will be conducted on the combination of trust and access control. However, there are not many studies in this direction at present. The calculation of trust values ​​in the proposed solutions is relatively rough and cannot accurately reflect the behavior of the access subject terminal; and most solutions combine trust with RBAC and ABAC, which does not maximize the protection of data privacy and security.

[0016] Therefore, technicians in this field are committed to developing a trust-based attribute encryption access control system and method. Summary of the invention

[0017] In view of the above-mentioned defects in the prior art, the technical problem to be solved by the present invention is how to ensure the security of dynamic access control between multiple terminals in a discrete system.

[0018] As the manufacturing industry presents a development trend of intelligence, openness and collaboration, physical resources and capabilities are digitized, and the discrete industrial field supports dynamic sharing and collaboration of devices with heterogeneous locations and functions on demand, integrating the intelligent analysis and decision-making of the industrial Internet platform, thereby realizing the transformation from the past single customization to flexible production and large-scale customized production mode that meets personalized needs. The discrete system in the present invention refers to the system in the above-mentioned discrete industrial field. The inventors have defined several terms used in the present invention. The subject terminal is a terminal that assumes the identity of a "visitor", and the object terminal is a terminal that assumes the identity of a "visitor". Trust attributes refer to information that can reflect the degree of trust, including historical interaction data, historical trust values, environmental data, etc. The trust attribute set is a set of multiple trust attributes. The present invention is applicable to the scenario where the subject terminal accesses a discrete system and accesses the object terminal inside the discrete system.

[0019] In one embodiment of the present invention, a trust-based attribute encryption access control system is provided, comprising:

[0020] The trust measurement module assigns an initial trust value to the subject terminal and calculates the trust value of the subject terminal based on the behavior information of the subject terminal;

[0021] The access control module adjusts the encryption algorithm and access rights of the subject terminal in real time based on the trust value of the subject terminal;

[0022] The trusted measurement module and the access control module are communicatively connected. In response to the subject terminal accessing the discrete system, the trusted measurement module assigns an initial trust value to the subject terminal and calculates the trust value of the subject terminal according to the behavior information of the subject terminal. In response to the trust value of the subject terminal output by the trusted measurement module, the access control module adjusts the encryption algorithm and access rights of the subject terminal in real time to complete the access control of the subject terminal to the object terminal.

[0023] Optionally, in the trust-based attribute encryption access control system in the above embodiment, the trust measurement module includes:

[0024] The trust initialization submodule assigns an initial trust value to the subject terminal;

[0025] The trust attribute selection and definition submodule selects the trust attributes of the subject terminal and models the trust value of the subject terminal;

[0026] The fusion calculation submodule of trust attributes calculates the trust value of the subject terminal;

[0027] The trust attribute selection and definition submodule is communicatively connected with the trust attribute fusion calculation submodule; in response to the subject terminal accessing the discrete system, the trust initialization submodule assigns an initial trust value to the subject terminal, the trust attribute selection and definition submodule selects the trust attribute of the subject terminal for modeling, and sends it to the trust attribute fusion calculation submodule, and the trust attribute fusion calculation submodule calculates the trust value of the subject terminal.

[0028] Optionally, in the trust-based attribute encryption access control system in any of the above embodiments, the trust value includes a direct trust value, an indirect trust value and a comprehensive trust value; the direct trust value is the degree of trust that the subject terminal obtains for the object terminal based on the direct interaction information with the object terminal; the indirect trust value is a trust value that the subject terminal has not had direct interaction with the object terminal and can only be calculated based on the reputation information of a third-party entity that has interacted with the subject terminal and the object terminal in the system; for an unfamiliar object terminal, the subject terminal adopts the reputation information of the trusted third-party entity that has had direct interaction with the object terminal and the object terminal to form an indirect trust relationship; the comprehensive trust value refers to the comprehensive trust value calculated by combining the direct trust value and the indirect trust value according to the trust aggregation algorithm.

[0029] Furthermore, in the trust-based attribute encryption access control system in the above embodiment, the subject terminal collects the service and behavior information of the object terminal in the interaction, and generates a trust value based on quantitative indicators. The closer the interaction between the subject terminal and the object terminal, the more accurate the direct trust value obtained.

[0030] Optionally, in the trust-based attribute encryption access control system in any of the above embodiments, the access control module includes:

[0031] The policy authority submodule stores access control decisions;

[0032] The policy determination submodule makes access control decisions and gives access rights to the subject terminal;

[0033] The policy execution submodule constructs the access request of the subject terminal based on the trust attribute set, executes the access control decision, and generates the private key of the subject terminal;

[0034] The attribute authority submodule establishes, manages and stores the trust attribute set of the subject terminal, object terminal, access rights and environment; manages and stores the access structure of the subject terminal, which contains the access control decision output by the policy determination submodule; generates and manages the master key, secret key and public key in the access control process, among which the master key and public key are used for plaintext encryption, and the secret key is sent to the subject terminal and used in combination with the private key of the subject terminal generated by the policy execution submodule for ciphertext decryption;

[0035] The adaptive encryption submodule selects an encryption algorithm to encrypt plaintext data based on the trust value and access control decision of the subject terminal to ensure the security of information transmission;

[0036] The policy agency submodule, policy determination submodule, policy execution submodule, and attribute authority submodule are connected in communication in sequence, and the policy execution submodule is connected in communication with the adaptive encryption submodule; in response to the access request of the subject terminal, the policy execution submodule requests the attribute authority submodule for a trust attribute set, constructs an access request of the subject terminal based on the trust attribute set, the policy determination submodule obtains the access control decision from the policy agency submodule, makes the access control decision and sends it to the policy execution submodule for execution, and the adaptive encryption submodule selects an encryption algorithm to encrypt the plaintext data according to the trust value of the subject terminal and the access control decision.

[0037] Based on any of the above embodiments, in another embodiment of the present invention, a trust-based attribute encryption access control method is provided, comprising the following steps:

[0038] S100, calculating the trust value of the subject terminal. In response to the subject terminal initiating an access request to the object terminal, the trust measurement module calculates the trust value of the subject terminal in real time;

[0039] S200, adding a trust attribute set, the attribute authority submodule adds the trust attribute set of the subject terminal and updates the access structure of the subject terminal;

[0040] S300, requesting a master key, a secret key and a public key, the object terminal requests a master key, a secret key and a public key from the attribute authority submodule;

[0041] S400, return the master key, secret key and public key. The attribute authority submodule generates and returns the master key, secret key and public key based on the trust attribute set and the access control structure of the subject terminal. The secret key is sent to the subject terminal.

[0042] S500, encrypting the plaintext, the adaptive encryption submodule selects an encryption algorithm to encrypt the plaintext data using the master key and the public key based on the trust value of the subject terminal and the access control decision made by the policy determination submodule;

[0043] S600, verify the trust attribute set, use the trust attribute verification algorithm, when the subject terminal submits the trust attribute set, the trust measurement module directly verifies the trust value of the subject terminal; when the trust value of the subject terminal is greater than the given threshold of the object terminal, retain the public key and the master key, and execute S700; otherwise, execute S200;

[0044] S700, generating a private key of the subject terminal, the policy execution submodule generates a private key of the subject terminal based on the trust attribute set of the subject terminal and using a private key generation algorithm;

[0045] S800, decrypt the ciphertext using a decryption algorithm. If and only if the trust attribute set of the subject terminal satisfies the access structure, that is, the subject terminal has the access rights of the object terminal, decrypt using the private key of the subject terminal and the key generated by the attribute authority submodule to obtain the plaintext.

[0046] Optionally, in the trust-based attribute encryption access control method in the above embodiment, step S100 includes:

[0047] S110, calculating the direct trust value. The trust attribute fusion calculation submodule calculates the direct trust value according to the trust attribute selection and the trust attribute selected by the definition submodule. Based on the direct interaction data between the subject terminal and the object terminal, the subject terminal is calculated using formulas (1)-(3). For the object terminal Long-term direct trust value, short-term direct trust value and direct trust value:

[0048]

[0049]

[0050]

[0051] in, and They represent long-term direct trust value and short-term direct trust value respectively; Indicates a time window, recording the most recent The main terminal in the interaction For the object terminal Feedback; represents a long-term set of interactions; represents a collection of short-term interactions; represents the ratio of the interaction history set that adjusts the long-term direct trust value and the short-term direct trust value, ; Represents the subject terminal in the long-term interaction set With the object terminal The number of positive operations presented by the interaction; and Respectively represent the subject terminals in the short-term interaction set With the object terminal The number of positive and negative operations presented by the interaction; Indicates the main terminal For the object terminal The direct trust value of the subject terminal With the object terminal The long-term direct trust value and short-term direct trust value of are calculated by formula (3); and Represent the weights of long-term direct trust value and short-term direct trust value respectively;

[0052] S120, calculating the indirect trust value, the fusion calculation submodule of the trust attribute calculates the indirect trust value according to the trust attribute selection and the trust attribute selected by the definition submodule, based on the object terminal The interaction data of other subject terminals with interactive behaviors are calculated based on the reward and punishment mechanism using formulas (4)-(5) for the object terminal. Indirect trust value of:

[0053]

[0054]

[0055] in, express exist Change in the number of negative operations in the short-term interaction history during the time period, Time represents the object terminal There has been recent malicious activity; Indicated in Time period and object terminal A collection of other subject terminals with which there is interaction; express Object terminal at the moment The number of negative operations in the short interaction history; Indicates the system's access to the object terminal The indirect trust value of and Represent the decrease rate factor and increase rate factor of the indirect trust value respectively; Indicates the object terminal exist Changes in the number of positive operations in the short-term interaction history within the time period;

[0056] S130, calculating the comprehensive trust value based on the object terminal The number of malicious operations of the subject terminal is calculated using formula (6). For the object terminal The comprehensive trust value of:

[0057]

[0058] in, Indicates the main terminal For the comprehensive trust value; and Represent the weights of direct trust value and indirect trust value respectively.

[0059] Optionally, in the trust-based attribute encryption access control method in the above embodiment, step S200 further includes the attribute authority submodule updating the access structure of the subject terminal using the following formula:

[0060]

[0061] in, Represents the access structure before adding trust as an attribute, and outputs the new access structure , For operation with The trust value of the subject terminal is calculated in real time by the trust measurement module.

[0062] Optionally, in the trust-based attribute encryption access control method in any of the above embodiments, step S400 includes:

[0063] S410, select two prime numbers Bilinear group of order and ,satisfy ,in is a bilinear map, The generator of ;from Select Random numbers ,in is a positive integer, indicating the number of attributes in the system;

[0064] S420, Random Selection ,calculate ;

[0065] S430, use formula (7) and (8) to calculate the public key respectively and the master key :

[0066]

[0067]

[0068] Among them, PK represents the public key, MSK represents the master key; e is a bilinear mapping, g is the generator of G, and Y is an intermediate quantity, whose value is equal to , are 3n random numbers in G, is a random integer less than p.

[0069] Optionally, in the trust-based attribute encryption access control method in any of the above embodiments, step S500 includes:

[0070] S510: For plain text data , randomly selected , calculated using formulas (9) and (10):

[0071]

[0072]

[0073] Among them, C, C 1 is the intermediate quantity, M is the plaintext data, and s is a random integer less than p;

[0074] S520, calculate the ciphertext according to formulas (11) and (12) :

[0075]

[0076]

[0077] Among them, C 2 is the intermediate quantity, CT is the ciphertext, , is a set of integers, .

[0078] Optionally, in the trust-based attribute encryption access control method in any of the above embodiments, the ciphertext is decrypted using the formula in step S800:

[0079]

[0080] in, .

[0081] The present invention combines trust measurement and access control, and dynamically adjusts access rights in real time based on the measurement results, thereby improving security granularity. Using the dynamic trust measurement method of the subject terminal based on feedback, the measurement results are more accurate and have higher robustness. The present invention takes into account both efficiency and security, and combined with adaptive encryption, it is more suitable for discrete collaborative manufacturing scenarios.

[0082] The concept, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings to fully understand the purpose, characteristics and effects of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Figure 1 is a structural diagram illustrating a trust-based attribute encryption access control system according to an exemplary embodiment;

[0084] Figure 2 is a flow chart illustrating a trust-based attribute encryption access control method according to an exemplary embodiment. DETAILED DESCRIPTION

[0085] The following describes several preferred embodiments of the present invention with reference to the drawings in the specification, so that the technical content is clearer and easier to understand. The present invention can be embodied in many different forms of embodiments, and the protection scope of the present invention is not limited to the embodiments mentioned in the text.

[0086] In the drawings, components with the same structure are indicated by the same numerical reference numerals, and components with similar structures or functions are indicated by similar numerical reference numerals. The size and thickness of each component shown in the drawings are arbitrarily shown, and the present invention does not limit the size and thickness of each component. In order to make the illustration clearer, the thickness of the components is schematically exaggerated in some places in the drawings.

[0087] The inventors have designed a trust-based attribute encryption access control system, such as Figure 1 As shown, including:

[0088] The trust measurement module assigns an initial trust value to the subject terminal and calculates the trust value of the subject terminal according to the behavior information of the subject terminal. The trust value includes direct trust value, indirect trust value and comprehensive trust value. The direct trust value is the degree of trust that the subject terminal obtains for the object terminal based on the direct interaction information with the object terminal. The subject terminal collects the service and behavior information of the object terminal in the interaction and generates a trust value based on quantitative indicators. The closer the interaction between the subject terminal and the object terminal, the more accurate the direct trust value obtained. The indirect trust value is the trust value that the subject terminal has not directly interacted with the object terminal and can only be calculated based on the reputation information of the third-party entity that has common interaction with the subject terminal and the object terminal in the system. For unfamiliar object terminals, the subject terminal adopts the reputation information of the trusted third-party entity and the object terminal that have direct interaction with the object terminal to form an indirect trust relationship. The comprehensive trust value refers to the comprehensive trust value calculated by the direct trust value and the indirect trust value according to the trust aggregation algorithm. The trust measurement module includes:

[0089] The trust initialization submodule assigns an initial trust value to the subject terminal;

[0090] The trust attribute selection and definition submodule selects the trust attributes of the subject terminal and models the trust value of the subject terminal;

[0091] The fusion calculation submodule of trust attributes calculates the trust value of the subject terminal;

[0092] The trust attribute selection and definition submodule is in communication connection with the trust attribute fusion calculation submodule; in response to the subject terminal accessing the discrete system, the trust initialization submodule assigns an initial trust value to the subject terminal, the trust attribute selection and definition submodule selects the trust attribute of the subject terminal for modeling, and sends it to the trust attribute fusion calculation submodule, and the trust attribute fusion calculation submodule calculates the trust value of the subject terminal;

[0093] The access control module adjusts the encryption algorithm and access rights of the subject terminal in real time based on the trust value of the subject terminal; the access control module includes:

[0094] The policy authority submodule stores access control decisions;

[0095] The policy determination submodule makes access control decisions and gives access rights to the subject terminal;

[0096] The policy execution submodule constructs the access request of the subject terminal based on the trust attribute set, executes the access control decision, and generates the private key of the subject terminal;

[0097] The attribute authority submodule establishes, manages and stores the trust attribute set of the subject terminal, object terminal, access rights and environment; manages and stores the access structure of the subject terminal, which contains the access control decision output by the policy determination submodule; generates and manages the master key, secret key and public key in the access control process, among which the master key and public key are used for plaintext encryption, and the secret key is sent to the subject terminal and used in combination with the private key of the subject terminal generated by the policy execution submodule for ciphertext decryption;

[0098] The adaptive encryption submodule selects an encryption algorithm to encrypt plaintext data based on the trust value and access control decision of the subject terminal to ensure the security of information transmission;

[0099] The policy agency submodule, policy determination submodule, policy execution submodule, and attribute authority submodule are sequentially connected in communication, and the policy execution submodule is connected in communication with the adaptive encryption submodule; in response to an access request from a subject terminal, the policy execution submodule requests a trust attribute set from the attribute authority submodule, constructs an access request of the subject terminal based on the trust attribute set, the policy determination submodule obtains an access control decision from the policy agency submodule, makes an access control decision and sends it to the policy execution submodule for execution, and the adaptive encryption submodule selects an encryption algorithm to encrypt plaintext data according to the trust value of the subject terminal and the access control decision;

[0100] The trusted measurement module and the access control module are communicatively connected. In response to the subject terminal accessing the discrete system, the trusted measurement module assigns an initial trust value to the subject terminal and calculates the trust value of the subject terminal according to the behavior information of the subject terminal. In response to the trust value of the subject terminal output by the trusted measurement module, the access control module adjusts the encryption algorithm and access rights of the subject terminal in real time to complete the access control of the subject terminal to the object terminal.

[0101] Based on the above embodiments, the inventor provides a trust-based attribute encryption access control method, such as Figure 2 As shown, the following steps are included:

[0102] S100, calculating the trust value of the subject terminal. In response to the subject terminal initiating an access request to the object terminal, the trust measurement module calculates the trust value of the subject terminal in real time; including:

[0103] S110, calculating the direct trust value. The trust attribute fusion calculation submodule calculates the direct trust value according to the trust attribute selection and the trust attribute selected by the definition submodule. Based on the direct interaction data between the subject terminal and the object terminal, the subject terminal is calculated using formulas (1)-(3). For the object terminal Long-term direct trust value, short-term direct trust value and direct trust value:

[0104]

[0105]

[0106]

[0107] in, and They represent long-term direct trust value and short-term direct trust value respectively; Indicates a time window, recording the most recent The main terminal in the interaction For the object terminal Feedback; represents a long-term set of interactions; represents a collection of short-term interactions; represents the ratio of the interaction history set that adjusts the long-term direct trust value and the short-term direct trust value, ; Represents the subject terminal in the long-term interaction set With the object terminal The number of positive operations presented by the interaction; and Respectively represent the subject terminals in the short-term interaction set With the object terminal The number of positive and negative operations presented by the interaction; Indicates the main terminal For the object terminal The direct trust value of the subject terminal With the object terminal The long-term direct trust value and short-term direct trust value of are calculated by formula (3); and Represent the weights of long-term direct trust value and short-term direct trust value respectively;

[0108] S120, calculating the indirect trust value, the fusion calculation submodule of the trust attribute calculates the indirect trust value according to the trust attribute selection and the trust attribute selected by the definition submodule, based on the object terminal The interaction data of other subject terminals with interactive behaviors are calculated based on the reward and punishment mechanism using formulas (4)-(5) for the object terminal. Indirect trust value of:

[0109]

[0110]

[0111] in, express exist Change in the number of negative operations in the short-term interaction history during the time period, Time represents the object terminal There has been recent malicious activity; Indicated in Time period and object terminal A collection of other subject terminals with which there is interaction; express Object terminal at the moment The number of negative operations in the short interaction history; Indicates the system's access to the object terminal The indirect trust value of and Represent the decrease rate factor and increase rate factor of the indirect trust value respectively; Indicates the object terminal exist Changes in the number of positive operations in the short-term interaction history within the time period;

[0112] S130, calculating the comprehensive trust value based on the object terminal The number of malicious operations of the subject terminal is calculated using formula (6). For the object terminal The comprehensive trust value of:

[0113]

[0114] in, Indicates the main terminal For the comprehensive trust value; and Represent the weights of direct trust value and indirect trust value respectively;

[0115] S200, adding a trust attribute set, the attribute authority submodule adds the trust attribute set of the subject terminal, updates the access structure of the subject terminal, and uses the following formula:

[0116]

[0117] in, Represents the access structure before adding trust as an attribute, and outputs the new access structure , For operation with The trust value of the subject terminal calculated in real time by the trust measurement module

[0118] S300, requesting a master key, a secret key and a public key, the object terminal requests a master key, a secret key and a public key from the attribute authority submodule;

[0119] S400: Return the master key, secret key and public key. The attribute authority submodule generates and returns the master key, secret key and public key based on the trust attribute set and the access control structure of the subject terminal. The secret key is sent to the subject terminal. Specifically, it includes:

[0120] S410, select two prime numbers Bilinear group of order and ,satisfy ,in is a bilinear map, The generator of ;from Select Random numbers ,in is a positive integer, indicating the number of attributes in the system;

[0121] S420, Random Selection ,calculate ;

[0122] S430, use formula (7) and (8) to calculate the public key respectively and the master key :

[0123]

[0124]

[0125] Among them, PK represents the public key, MSK represents the master key; e is a bilinear mapping, g is the generator of G, and Y is an intermediate quantity, whose value is equal to , are 3n random numbers in G, is a random integer less than p;

[0126] S500: Encrypt the plaintext. The adaptive encryption submodule selects an encryption algorithm to encrypt the plaintext data using a master key and a public key based on the trust value of the subject terminal and the access control decision made by the policy determination submodule. Specifically, the following steps are included:

[0127] S510: For plain text data , randomly selected , calculated using formulas (9) and (10):

[0128]

[0129]

[0130] Among them, C, C 1 is the intermediate quantity, M is the plaintext data, and s is a random integer less than p;

[0131] S520, calculate the ciphertext according to formulas (11) and (12) :

[0132]

[0133]

[0134] Among them, C 2 is the intermediate quantity, CT is the ciphertext, , is a set of integers, .

[0135] S600, verify the trust attribute set, use the trust attribute verification algorithm, when the subject terminal submits the trust attribute set, the trust measurement module directly verifies the trust value of the subject terminal; when the trust value of the subject terminal is greater than the given threshold of the object terminal, retain the public key and the master key, and execute S700; otherwise, execute S200;

[0136] S700, generating a private key of the subject terminal, the policy execution submodule generates a private key of the subject terminal based on the trust attribute set of the subject terminal and using a private key generation algorithm;

[0137] S800, decrypt the ciphertext, using the decryption algorithm, if and only if the trust attribute set of the subject terminal satisfies the access structure, that is, the subject terminal has the access rights of the object terminal, use the private key of the subject terminal and the key generated by the attribute authority submodule to decrypt and obtain the plaintext, and use the formula for decrypting the ciphertext:

[0138]

[0139] in, .

[0140] The preferred specific embodiments of the present invention are described in detail above. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A trust-based attribute encryption access control system, characterized in that: include: A trust measurement module assigns an initial trust value to the subject terminal and calculates the trust value of the subject terminal according to the behavior information of the subject terminal; An access control module, which adjusts the encryption algorithm and access rights of the subject terminal in real time based on the trust value of the subject terminal; The trustworthy measurement module comprises: A trust initialization submodule assigns an initial trust value to the subject terminal; A trust attribute selection and definition submodule selects the subject terminal trust attribute and performs trust value modeling of the subject terminal; A trust attribute fusion calculation submodule calculates the trust value of the subject terminal; The trust attribute selection and definition submodule is communicatively connected with the trust attribute fusion calculation submodule; In response to the subject terminal accessing the discrete system, the trust initialization submodule assigns an initial trust value to the subject terminal, the trust attribute selection and definition submodule selects the trust attribute of the subject terminal for modeling, and sends it to the trust attribute fusion calculation submodule, and the trust attribute fusion calculation submodule calculates the trust value of the subject terminal; The trust value includes direct trust value, indirect trust value and comprehensive trust value; The trust measurement module is used to calculate the trust value of the subject terminal in real time: The trust measurement module is used to calculate the direct trust value. The trust attribute fusion calculation submodule calculates the direct trust value according to the trust attribute selection and definition submodule. Based on the direct interaction data between the subject terminal and the object terminal, the subject terminal d is calculated using formulas (1)-(3). a For the object terminal d b The long-term direct trust value, the short-term direct trust value and the direct trust value: in, and They represent long-term direct trust value and short-term direct trust value respectively; Indicates a time window, recording the most recent The subject terminal d in the interaction a For the object terminal d b Feedback; represents a long-term set of interactions; represents a collection of short-term interactions; represents the proportion of the interaction history set that adjusts the long-term direct trust value and the short-term direct trust value, 0.5<μ<1; Represents the subject terminal d in the long-term interaction set a With the object terminal d b The number of positive operations presented by the interaction; and They represent the subject terminals d in the short-term interaction set. a With the object terminal d b The number of positive and negative operations presented by the interaction; Indicates the main terminal d a For the object terminal d b The direct trust value of the subject terminal d a With the object terminal d b The long-term direct trust value and short-term direct trust value of are calculated by formula (3); and Represent the weights of long-term direct trust value and short-term direct trust value respectively; The trust measurement module is used to calculate the indirect trust value. The trust attribute fusion calculation submodule calculates the indirect trust value according to the trust attribute selection and definition submodule selected trust attribute, and based on the interaction data of other subject terminals that have interaction behaviors with the object terminal and based on the reward and punishment mechanism, uses formulas (4)-(5) to calculate the indirect trust value of the object terminal: in, Indicates d b The change in the number of negative operations in the short-term interaction history during the period [t1, t2], >0 represents the object terminal d b Malicious behavior has occurred recently; C represents the communication with the object terminal d in the time period [t1, t2]. b A collection of other subject terminals with which there is interaction; represents the object terminal d at time t2 b The number of negative operations in the short interaction history; Indicates the system's access to the object terminal d b The indirect trust value of and Represent the decrease rate factor and increase rate factor of the indirect trust value respectively; Indicates the object terminal d b Change in the number of positive operations in the short-term interaction history during the period [t1, t2]; The trust measurement module is used to calculate the comprehensive trust value. Based on the number of malicious operations of the object terminal, the comprehensive trust value of the subject terminal to the object terminal is calculated using formula (6): in, Indicates the main terminal d b For the comprehensive trust value; and Represent the weights of direct trust value and indirect trust value respectively; The trusted metric module is communicatively connected to the access control module. In response to the subject terminal accessing the discrete system, the trusted metric module assigns an initial trust value to the subject terminal and calculates the trust value of the subject terminal according to the behavior information of the subject terminal. In response to the trust value of the subject terminal output by the trusted metric module, the access control module adjusts the encryption algorithm and access rights of the subject terminal in real time to complete the access control of the subject terminal to the object terminal.

2. The trust-based attribute encryption access control system according to claim 1, characterized in that: The access control module comprises: The policy authority submodule stores access control decisions; A policy determination submodule makes access control decisions and provides access rights to the subject terminal; A policy execution submodule, constructing an access request of the subject terminal based on a trust attribute set, executing the access control decision, and generating a private key of the subject terminal; The attribute authority submodule establishes, manages and stores the trust attribute set of the subject terminal, object terminal, access rights and environment; Manage and store the access structure of the subject terminal, which includes the access control decision output by the policy determination submodule; Generate and manage master keys, secret keys and public keys in the access control process; An adaptive encryption submodule selects an encryption algorithm to encrypt plaintext data based on the trust value of the subject terminal and the access control decision to ensure the security of information transmission; The policy mechanism submodule, the policy determination submodule, the policy execution submodule, and the attribute authority submodule are sequentially connected in communication, and the policy execution submodule is connected in communication with the adaptive encryption submodule; In response to the access request of the subject terminal, the policy execution submodule requests the trust attribute set from the attribute authority submodule, and constructs the access request of the subject terminal based on the trust attribute set. The policy determination submodule obtains the access control decision from the policy agency submodule, makes the access control decision and sends it to the policy execution submodule for execution. The adaptive encryption submodule selects an encryption algorithm to encrypt the plaintext data according to the trust value of the subject terminal and the access control decision.

3. A trust-based attribute encryption access control method, using the trust-based attribute encryption access control system as claimed in claim 2, characterized in that: The steps include: S100, calculating the trust value of the subject terminal. In response to the subject terminal initiating an access request to the object terminal, the trust measurement module calculates the trust value of the subject terminal in real time; The step S100 includes: S110, calculating a direct trust value, wherein the trust attribute fusion calculation submodule calculates the direct trust value according to the trust attribute selection and definition submodule selected trust attribute, and calculates the direct trust value of the subject terminal d based on the direct interaction data between the subject terminal and the object terminal using formulas (1)-(3). a For the object terminal d b The long-term direct trust value, the short-term direct trust value and the direct trust value: in, and They represent long-term direct trust value and short-term direct trust value respectively; Indicates a time window, recording the most recent The subject terminal d in the interaction a For the object terminal d b Feedback; represents a long-term set of interactions; represents a collection of short-term interactions; represents the proportion of the interaction history set that adjusts the long-term direct trust value and the short-term direct trust value, 0.5<μ<1; Represents the subject terminal d in the long-term interaction set a With the object terminal d b The number of positive operations presented by the interaction; and They represent the subject terminals d in the short-term interaction set. a With the object terminal d b The number of positive and negative operations presented by the interaction; Indicates the main terminal d a For the object terminal d b The direct trust value of the subject terminal d a With the object terminal d b The long-term direct trust value and short-term direct trust value of are calculated by formula (3); and Represent the weights of long-term direct trust value and short-term direct trust value respectively; S120, calculating an indirect trust value. The trust attribute fusion calculation submodule calculates the indirect trust value according to the trust attribute selection and the trust attribute selected by the definition submodule, and based on the interaction data of other subject terminals that have interaction behaviors with the object terminal and based on the reward and punishment mechanism, uses formulas (4)-(5) to calculate the indirect trust value of the object terminal: in, Indicates d b The change in the number of negative operations in the short-term interaction history during the period [t1, t2], >0 represents the object terminal d b Malicious behavior has occurred recently; C represents the communication with the object terminal d in the time period [t1, t2]. b A collection of other subject terminals with which there is interaction; represents the object terminal d at time t2 b The number of negative operations in the short interaction history; Indicates the system's access to the object terminal d b The indirect trust value of and Represent the decrease rate factor and increase rate factor of the indirect trust value respectively; Indicates the object terminal d b Change in the number of positive operations in the short-term interaction history during the period [t1, t2]; S130, for calculating a comprehensive trust value, based on the number of malicious operations of the object terminal, using formula (6) to calculate the comprehensive trust value of the subject terminal to the object terminal: in, Indicates the main terminal d b For the comprehensive trust value; and Represent the weights of direct trust value and indirect trust value respectively; S200, adding a trust attribute set, the attribute authority submodule adds the trust attribute set of the subject terminal and updates the access structure of the subject terminal; S300, requesting a master key, a secret key and a public key, the object terminal requests a master key, a secret key and a public key from the attribute authority submodule; S400, returning a master key, a secret key and a public key, the attribute authority submodule generates and returns the master key, the secret key and the public key based on the trust attribute set and the access control structure of the subject terminal, and the secret key is sent to the subject terminal; S500, encrypting the plaintext, the adaptive encryption submodule selects an encryption algorithm to encrypt the plaintext data using the master key and the public key based on the trust value of the subject terminal and the access control decision made by the policy determination submodule; S600, verifying the trust attribute set, using the trust attribute verification algorithm, when the subject terminal submits the trust attribute set, the trust measurement module directly verifies the trust value of the subject terminal; when the trust value of the subject terminal is greater than the given threshold of the object terminal, retaining the public key and the master key, and executing S700; otherwise, executing S200; S700, generating a private key of a subject terminal, the policy execution submodule generating a private key of the subject terminal based on a trust attribute set of the subject terminal using a private key generation algorithm; S800, decrypt the ciphertext using a decryption algorithm, and obtain plaintext using the private key of the subject terminal and the key generated by the attribute authority submodule when and only when the trust attribute set of the subject terminal satisfies the access structure, that is, the subject terminal has the access rights of the object terminal.

4. The trust-based attribute encryption access control method according to claim 3, characterized in that: The step S200 also includes the attribute authority submodule updating the access structure of the subject terminal using the following formula: in, Represents the access structure before adding trust as an attribute, and outputs the new access structure , For operation with The trust value of the subject terminal is calculated in real time by the trust measurement module.

5. The trust-based attribute encryption access control method according to claim 3, characterized in that: The step S400 further includes: S410, select two prime numbers Bilinear group of order and ,satisfy ,in is a bilinear map, The generator of ;from Select Random numbers ,in is a positive integer, indicating the number of attributes in the system; S420, Random Selection ,calculate ; S430, using formulas (7) and (8) to calculate the public key and the master key respectively: in, represents the public key, Represents the master key; is a bilinear map, for The generator of is an intermediate quantity, whose value is equal to , for In A random number, is less than A random integer.

6. The trust-based attribute encryption access control method according to claim 3, characterized in that: The step S500 includes: S510: For plaintext data, randomly select , calculated using formulas (9) and (10): in, , is the intermediate quantity, is plain text data, is a random integer less than p; S520, calculate the ciphertext according to formulas (11) and (12) : in, is the intermediate quantity, is the ciphertext, , is a set of integers, .

7. The trust-based attribute encryption access control method according to claim 3, characterized in that: The formula used to decrypt the ciphertext in step S800 is: in, .

Images