Lightweight terminal access control method supporting CP-ABE in 5G scenario

Abstract

The application relates to the technical field of information security, in particular to a lightweight terminal access control method supporting CP-ABE in a 5G scenario, which comprises the following steps: based on a preset ciphertext policy attribute-based encryption (CP-ABE) method, an access control tree is established according to a first preset order according to an access control condition; based on a preset assignment strategy, root nodes, multiple leaf nodes and multiple transfer nodes of the access control tree are respectively assigned; based on a preset permission attribute set, the assigned access control tree is verified according to current attributes of a received user based on the preset permission attribute set, and when the user is determined to be a permitted user, an encrypted document is decrypted for the user to view. Thus, the problems that related technologies are low in efficiency, high in calculation cost and low in practicability in a PIR scheme are solved, a new CP-ABE construction method is provided, a lightweight CP-ABE method is realized, calculation time and space cost are reduced, and calculation efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and provides a low-power, lightweight, and fine-grained solution for the terminal access control and identity authentication requirements arising from the massive terminal access in 5G scenarios; in particular, it relates to a lightweight terminal access control that supports CP-ABE (Ciphertext-Policy Attribute-Based Encryption) in 5G scenarios. Background Technology

[0002] In the context of massive terminal access at the edge in 5G scenarios, 5G has the characteristics of high reliability, low latency, and low power consumption, while edge terminals have the characteristics of limited size, limited resources, and insufficient security design. This leads to the need for terminals to be designed to support low power consumption, lightweight, and fine-grained access control mechanisms.

[0003] To achieve fine-grained user control, the following related technologies exist: (1) Key policy (KP-ABE), where the access structure is defined by the data decryptor. The data decryptor can formulate the corresponding access structure according to its own needs. Whether a user can decrypt depends on whether it matches the set of attributes used to describe the ciphertext; (2) Ciphertext policy (CP-ABE), where the encryptor formulates different access structures for the data based on the confidentiality of the data file, and autonomously implements the access control permissions for the data. The CP-ABE scheme is generally chosen in cloud storage environments; (3) A practical CP-ABE scheme for outsourcing decryption in fog computing environments; (4) A novel CP-ABE scheme that transfers some overhead to fog nodes; (5) A traceable CP-ABE scheme that can provide protection for exposed keys.

[0004] However, the CP-ABE scheme in related technologies is based on bilinear mapping, which has low encryption or decryption efficiency and high space overhead. More importantly, the overhead increases dramatically with the complexity of the access policy, making it unbearable for end users with limited resources. Therefore, designing a CP-ABE access control mechanism that can be used in lightweight terminal devices is an urgent problem to be solved in cloud encrypted storage. Summary of the Invention

[0005] This application provides a lightweight terminal access control method supporting CP-ABE in 5G scenarios to solve the problems of low efficiency, high computational overhead, and poor practicality of related technologies in terminal access and access control schemes in 5G scenarios. A new CP-ABE construction method is proposed, realizing a lightweight CP-ABE method, reducing computation time and space overhead, and improving computational efficiency.

[0006] The first aspect of this application provides a lightweight terminal access control method supporting CP-ABE in a 5G scenario, comprising the following steps: encrypting the CP-ABE method based on a preset ciphertext policy attribute base; establishing an access control tree according to access control conditions in a first preset order; assigning values ​​to the root node, multiple leaf nodes, and multiple transit nodes of the access control tree based on a preset assignment policy; and verifying the assigned access control tree based on a preset permission attribute set and the received current attributes of the user, and decrypting the encrypted document for the user to view when the user is determined to be a permitted user.

[0007] Optionally, in some embodiments, the step of building an access control tree from top to bottom according to access control conditions includes: generating an access control tree structure according to the access control conditions; determining the root node, the plurality of leaf nodes, and the plurality of transit nodes in the access control tree structure; inserting virtual nodes at a first position and a second position of each transit node; and building the access control tree according to the root node, the plurality of leaf nodes, the plurality of transit nodes, and the virtual nodes.

[0008] Optionally, in some embodiments, assigning values ​​to the root node, multiple leaf nodes, and multiple transit nodes of the access control tree includes: assigning a randomly generated multidimensional binary code as a secret value to the root node; and generating a first multidimensional subkey corresponding to the child node based on a preset key distribution protocol and a threshold value corresponding to the root node; when assigning values ​​to the multiple child nodes, directly assigning the first multidimensional subkey to the corresponding child node; and when assigning values ​​to the multiple transit nodes, assigning the first multidimensional subkey to the virtual node at the first position of the current transit node, and calling... A multidimensional feature code is generated for the current transmission node using a preset encoding function. The first multidimensional subkey is assigned and XORed with the multidimensional feature code to generate a second multidimensional subkey. The second multidimensional subkey is then assigned to the virtual node at the second position of the current transmission node. The second multidimensional subkey is used as the secret value and recursively assigned to each leaf node, each transmission node, the virtual node at the first position of each transmission node, and the virtual node at the second position of each transmission node in the subtree, until each leaf node of the access control tree has been assigned a value.

[0009] Optionally, in some embodiments, the step of verifying the assigned access control tree based on a preset set of permission attributes and the received current attributes of the user includes: mapping the current attributes to the leaf nodes of the access control tree according to a second preset order based on the preset set of permission attributes, executing the protocol from bottom to top, attempting to recover the secret value child node corresponding to the root node, and obtaining the mapping result of the root node; if the generated mapping result is consistent with the previously assigned value corresponding to the root node, then the user is determined to be the permitted user; otherwise, the user is determined to be the unpermitted user.

[0010] A second aspect of this application provides a lightweight terminal access control system supporting CP-ABE in a 5G scenario, comprising: a control tree building module, which encrypts the CP-ABE method based on a preset ciphertext policy attribute base and builds an access control tree according to access control conditions in a first preset order; an assignment module, which assigns values ​​to the root node, multiple leaf nodes, and multiple transit nodes of the access control tree based on a preset assignment strategy; and a verification module, which verifies the assigned access control tree based on a preset permission attribute set and the current attributes of the received user, and decrypts the encrypted document for the user to view when the user is determined to be a permitted user.

[0011] Optionally, in some embodiments, the control tree building module includes: generating an access control tree structure based on the access control conditions; determining the root node, the plurality of leaf nodes, and the plurality of transit nodes in the access control tree structure; inserting virtual nodes at a first position and a second position of each transit node; and building the access control tree based on the root node, the plurality of leaf nodes, the plurality of transit nodes, and the virtual nodes.

[0012] Optionally, in some embodiments, the assignment module is further configured to: assign a randomly generated multidimensional binary code as a secret value to the root node, and generate a first multidimensional subkey corresponding to the child node based on a preset key distribution protocol and a threshold value corresponding to the root node; when assigning values ​​to the multiple leaf nodes, directly assign the first multidimensional subkey to the corresponding child node; when assigning values ​​to the multiple transmission nodes, assign the first multidimensional subkey to the virtual node at the first position of the current transmission node, and call a preset encoding function to generate a multidimensional feature code for the current transmission node, perform an XOR operation between the first multidimensional subkey assignment and the multidimensional feature code to generate a second multidimensional subkey, and assign the second multidimensional subkey to the virtual node at the second position of the current transmission node; recursively assign the second multidimensional subkey as the secret value to the lower subtree, assigning values ​​to each leaf node, each transmission node, the virtual node at the first position of each transmission node, and the virtual node at the second position of each transmission node, until each leaf node of the access control tree has been assigned a value.

[0013] Optionally, in some embodiments, the verification module is further configured to: map the current attribute to the child node of the access control tree according to a second preset order based on a preset set of permission attributes, execute the protocol from bottom to top, attempt to recover the secret value child node corresponding to the root node, and obtain the mapping result of the root node; if the generated mapping result is consistent with the previous assignment corresponding to the root node, then determine that the user is the permitted user, otherwise determine that the user is an unpermitted user.

[0014] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the program to implement a lightweight terminal access control method supporting CP-ABE in a 5G scenario as described in the above embodiments.

[0015] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement a lightweight terminal access control method supporting CP-ABE in a 5G scenario as described in the above embodiments.

[0016] Therefore, the embodiments of this application have the following beneficial effects:

[0017] (1) Design an access control tree based on access control requirements. Concepts such as virtual nodes and transit nodes are introduced into the access control tree. The transit node feature encoding generation function is GenFCode(Threshold). Node Secret inThis ensures both the sustainable allocation of subkeys for each node and the protection of the new key, Secret. out The randomness.

[0018] (2) Based on the key distribution protocol and binary encoding, an access control tree was generated, and the system proposed a new CP-ABE construction method.

[0019] (3) A lightweight CP-ABE method was implemented, abandoning the traditional high-overhead operation of Lagrange interpolation and bilinear mapping.

[0020] (4) Reduce computation time and space overhead and improve computation efficiency.

[0021] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0022] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0023] Figure 1 This is a scenario diagram of 5G+ access control in the related technology according to an embodiment of this application;

[0024] Figure 2 This is a schematic diagram of a PIR in the related art according to an embodiment of this application;

[0025] Figure 3 This is a flowchart of a lightweight terminal access control method supporting CP-ABE in a 5G scenario according to an embodiment of this application;

[0026] Figure 4 This is a schematic diagram of an access control tree in the related art according to an embodiment of this application;

[0027] Figure 5 This is a flowchart of a lightweight terminal access control method supporting CP-ABE in a 5G scenario according to an embodiment of this application;

[0028] Figure 6 This is a block diagram of a lightweight terminal access control system supporting CP-ABE in a 5G scenario according to an embodiment of this application.

[0029] Figure 7 This is a schematic diagram of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0030] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0031] The following describes a lightweight terminal access control method supporting CP-ABE in a 5G scenario, based on embodiments of the present application, with reference to the accompanying drawings. Addressing the issues of low efficiency, high computational overhead, and limited practicality in 5G terminal access control schemes mentioned in the background section, this application provides a lightweight terminal access control method supporting CP-ABE in a 5G scenario. In this method, a CP-ABE method is encrypted based on a preset ciphertext policy attribute base. An access control tree is built according to access control conditions in a first preset order. Values ​​are assigned to the root node, multiple leaf nodes, and multiple transit nodes of the access control tree. Based on a preset set of permission attributes, the access control tree is verified according to the received user's current attributes. When the user is determined to be a permitted user, the encrypted document is decrypted for the user to view. This solves the problems of low efficiency, high computational overhead, and limited practicality in 5G terminal access control schemes, proposes a new CP-ABE construction method, implements a lightweight CP-ABE method, reduces computation time and space overhead, and improves computational efficiency.

[0032] Before introducing the lightweight terminal access control method supporting CP-ABE in the 5G scenario of this application embodiment, let's first introduce a typical PIR problem scenario as an example and explain the importance of PIR access control.

[0033] Formal definition of the PIR problem: A database contains files that are uniformly divided into N files, i.e., W1, W2, ..., Wn. N They are of equal length. User DU wants to retrieve one of the files. To protect privacy, the user does not want the database to know about their search, query, or content of interest. Therefore, the user must design their search request to the database that meets the following two conditions.

[0034] 1. Decryption conditions are met: Users can correctly decode and recover the target content based on the database response;

[0035] 2. Privacy protection conditions: When a user (DUs) enters a search request, the database cannot obtain the user's interest content from the search request.

[0036] 3. Users meet access control conditions: Users meet certain access conditions based on attributes.

[0037] When the search target is only a single database, there is only one way to satisfy both of the above conditions: download all the contents of the database (K files) to the DOS server and then filter them. It is evident that protecting user privacy requires a significant investment of communication and bandwidth. If multiple datasets are used to back up and store the relevant K files simultaneously, then by having the user input search requests into multiple databases and through special processing, it is possible to significantly reduce the download volume while ensuring that each database is completely unaware of the user's search privacy.

[0038] like Figure 1 As shown, we will use two of the simplest databases as examples to illustrate how to implement PIR: Assume that each record stored in the database is a finite field F. q The elements in the dataset are assumed to be related to the user's interest in W7. The user then privately generates two sets of h = [h1, h2, ..., h...]. k The vectors are sent to two databases respectively. The user requests database 1 to send back a linear combination. At the same time, request database 2 to send back a linear combination When i≠7, h i ′=h i h7′=h7+1. It can be seen that this retrieval request satisfies the decoding condition. Subtracting the linear combination from the linear combination returned by database 1 from the linear combination returned by database 2 yields the user's target retrieval content W7. Simultaneously, according to the property of underconstrained mathematical equations, each database cannot decipher the user's retrieval interests from a single set of retrieval requests. Assuming the storage space of each file is L, then the data stored in database 1 and database 2 are KL respectively, and the download volume of user DUs is 2KL. That is to say, PIR sacrifices communication traffic and bandwidth to achieve privacy protection; user DUs' download volume is 2K times the useful information. In the general case of this scheme, when the databases are expanded to N, each database sends a linear combination of data from K files to user DUs, who then recovers the target file W7 by solving the equation system. Therefore, a necessary prerequisite for the above PIR method is that the K files in each database are not corrupted or tampered with; otherwise, user DUs cannot accurately recover file W7 using the PIR method. The above traditional PIR scheme assumes that user DUs are completely trustworthy.

[0039] The importance of access control in PIR, such as Figure 2As shown, the basic assumptions of the PIR problem are: in the traditional PIR problem, the N databases do not communicate with each other, and existing PIR schemes all assume that the K files in the N databases are identical and that the files in the databases will not be corrupted or maliciously tampered with. These assumptions do not consider real security requirements and do not implement access control for end users, which results in the data stored in the distributed database DBi being completely exposed to users DUs. In particular, during each retrieval communication process, users DUs have absolute initiative and can download all data W from database DBi in any combination. i When user DUs is untrusted, DBi's data W... i The sequence (i = 1, 2, ..., N) will be leaked, which means that a highly secure access control mechanism is needed to implement fine-grained access control for end-user DUs. At the same time, in traditional PIR schemes, resource-constrained end-user DUs need to pursue lightweight and low-overhead computation and implementation mechanisms.

[0040] In summary, the PIR scheme requires the design of a special access control mechanism that satisfies the following points: First, the access control mechanism ensures the security of data in the database; second, an attribute-based access control mechanism (CP-ABE mechanism) is designed to implement access control; and third, the CP-ABE method needs to be implemented in a lightweight and low-overhead manner.

[0041] Specifically, Figure 3 This is a flowchart illustrating a lightweight terminal access control method supporting CP-ABE in a 5G scenario, provided as an embodiment of this application.

[0042] like Figure 3 As shown, the lightweight terminal access control method supporting CP-ABE in this 5G scenario includes the following steps:

[0043] In step S301, the CP-ABE method, which is based on a preset ciphertext policy attribute base encryption, is used to establish an access control tree according to the access control conditions and in a first preset order.

[0044] Optionally, in some embodiments, an access control tree is built from top to bottom according to access control conditions, including: generating an access control tree structure according to access control conditions; determining a root node, multiple leaf nodes, and multiple transit nodes in the access control tree structure; inserting virtual nodes at a first position and a second position of each transit node; and building an access control tree based on the root node, multiple leaf nodes, multiple transit nodes, and virtual nodes.

[0045] In this embodiment of the application, the access control tree has three types of nodes: root node, child node, and transit node, as well as hypothetical virtual nodes.

[0046] 1. Root node: The topmost node is the root node, and each access control tree has only one root node.

[0047] 2. Child nodes: The outermost nodes of the access control tree are child nodes. Each leaf node has a different encoded value and is assigned different attributes, such as PhD, information security, big data laboratory, passing qualification exam, etc. Each encoded value is mapped to an attribute.

[0048] 3. Transit Nodes: Non-child nodes and the root node are transit nodes. Each transit node is assigned a unique feature code, the value of which is not publicly disclosed. The feature codes of transit nodes are shown within the dashed box in the diagram. Different transit nodes can have the same or different feature codes. Without feature codes, the input code (subkey) of a node may not satisfy the threshold segmentation mechanism. For example, the threshold mechanism for Node(2,1) is (s=2, n=3), and the input Secret... in =010001, which can only be divided into a maximum of 2 parts, and cannot satisfy the requirement of dividing into 10 parts. Requirements for the number of copies; operations on node (2,1) at this time: The output sub-secret satisfies the partitioning requirement. Furthermore, the XOR operation possesses symmetry.

[0049] 4. Virtual Nodes: These are not real nodes. In this embodiment, a virtual node is added above and below each transmitting node. This way, the secret value of the upper-level node is decomposed to generate a leaf secret. in First, it is placed on a virtual node, and then XORed with the feature code of the transmitting node to generate a new secret. out The new secret value is used for subsequent key distribution calculations.

[0050] In step S302, values ​​are assigned to the root node, multiple leaf nodes, and multiple transit nodes of the access control tree. During the access control establishment phase, the protocol is executed sequentially from top to bottom on the access control tree.

[0051] Optionally, in some embodiments, assigning values ​​to the root node, multiple leaf nodes, and multiple transit nodes of the access control tree includes: assigning a randomly generated multidimensional binary code as a secret value to the root node; generating a first multidimensional subkey corresponding to the child node based on a preset key distribution protocol and a threshold value corresponding to the root node; when assigning values ​​to multiple leaf nodes, directly assigning the first multidimensional subkey to the corresponding child node; when assigning values ​​to multiple transit nodes, assigning the first multidimensional subkey to the virtual node at the first position of the current transit node, and calling a preset encoding function to generate a multidimensional feature code for the current transit node; performing an XOR operation between the first multidimensional subkey assignment and the multidimensional feature code to generate a second multidimensional subkey, and assigning the second multidimensional subkey to the virtual node at the second position of the current transit node; recursively assigning the second multidimensional subkey as a secret value to the lower subtrees, assigning values ​​to each leaf node, each transit node, the virtual node at the first position of each transit node, and the virtual node at the second position of each transit node, until each leaf node of the access control tree has been assigned a value.

[0052] It is important to understand that the key distribution principle in this application embodiment is as follows: For key distribution with a threshold of (s,n): if n=5 and s=3, the access key K (secret value) is split into C(n,s-1)=C(5,2)=10 parts, and each person holds C(n-1,s-1)=6 parts of the key. This application embodiment requires splitting into C(5,2)=10 sub-keys, that is, dividing the original access key K into 10 sub-keys. Let B0, B1, B2, ..., B9 represent the 10 sub-keys. Ultimately, each administrator A1 (child node) holds 6 keys, and the key distribution is shown in Table 1.

[0053] Table 1

[0054] administrator Distributed key Binary representation <![CDATA[A1]]> B0, B1, B2, B3, B4, B5 1111110000 <![CDATA[A2]]> B0, B1, B2, B6, B7, B8 1110001110 <![CDATA[A3]]> B0, B3, B4, B6, B7, B9 1001101101 <![CDATA[A4]]> B01, B3, B5, B6, B8, B9 0101011011 <![CDATA[A5]]> B2, B4, B5, B7, B8, B9 0010110111

[0055] In the access control tree, the access key K is represented as a secret value in m-dimensional binary encoding, and the subkeys at each level are represented as subsecrets in m-dimensional binary encoding. A fundamental property is that the access key K (secret value) can be divided into C(5,2) = 10 parts if and only if: the access key K is represented as a binary secret value K = 0101001100…10000011 (a total of m bits), where there are at least C(5,2) = 10 non-zero bits.

[0056] As can be seen from the data properties, no s-1 individuals can recover the access key K (secret value) because they are always missing a set of data, which has been distributed to the other n-(s-1) individuals. However, any s individuals can open the document. Based on this principle, this application proposes a lightweight terminal access control method supporting CP-ABE in 5G scenarios, which is a CP-ABE method based on the theoretical design of key distribution.

[0057] Specifically, in the embodiments of this application, such as Figure 4 As shown, following the traditional CP-ABE method, an access control tree is built from top to bottom based on access control conditions. First, the shared key K is represented as a secret value (e.g., 110011) and assigned to the root node. Simultaneously, each non-leaf node has a corresponding threshold value. The key distribution protocol described above is executed at each non-leaf node, and finally, each leaf node... i They will all get an encoded value Leaf i (Subkey). Node(x,y) represents the x-th and y-th node in the access control tree. For example, Node(1,1) is the root node with a threshold of (s=3,n=3), Node(2,1) is the transit node (feature code 101111) with a threshold of (s=2,n=3), and Node(4,1) is the leaf node (Big Data Lab).

[0058] In summary, in the actual execution of this application embodiment, a multi-dimensional binary code is first randomly generated as a secret value and assigned to the root node; then, a subkey is generated based on the key distribution protocol, and the subkey is assigned to the lower-level child nodes respectively; wherein, when the subkey is assigned to a leaf node, it is a direct assignment; when the subkey is assigned to a transmission node, the subkey is assigned to the virtual node above the transmission node, and GenFCode(Threshold) is executed. Node Secret in The function generates feature codes (Code). Feature and the secret value of the subkey. in With feature encoding Code Feature Perform an XOR operation to generate a new subkey, Secret. out The new subkey value is assigned to the virtual node below the transmitting node, and this new key value is used as the secret value. This process is then recursively repeated downwards through each transmitting node (and its upper and lower virtual nodes) and leaf node in the access control tree, until all child nodes have been assigned a value. This continues until each leaf node... i Each is assigned an m-dimensional binary code Leaf iEach of them is assigned an access control tree in step S303, which is based on a preset set of permission attributes and verifies the current attributes of the user received. When the user is determined to be a licensed user, the encrypted document is decrypted and made available for the user to view.

[0059] Those skilled in the art should understand that the CP-ABE in this application embodiment functions as follows: When establishing access control, a key distribution protocol is executed from top to bottom, distributing and mapping layer by layer, until each leaf node receives a value (attribute); during verification, each attribute is mapped to a leaf value, and a key recovery protocol is executed from bottom to top, recovering layer by layer, attempting to recover the value of the root node. If recovery is successful, permission is granted. Furthermore, this application embodiment adds feature encoding and XOR operations to the intermediate transmission nodes, increasing the randomness and divisibility of node values.

[0060] Optionally, in some embodiments, the access control tree is verified based on a preset set of permission attributes and the current attributes of the received user are verified, including: mapping the current attributes to the leaf nodes of the access control tree according to a second preset order based on the preset set of permission attributes; executing a key recovery protocol from bottom to top to recover the values ​​of each layer of the tree's transmission nodes; finally obtaining the value of the root node; and obtaining the mapping result. If the recovered mapping result is consistent with the previous assignment corresponding to the root node, the user is determined to be a licensed user; otherwise, the user is determined to be a non-licensed user.

[0061] The preset licensed dataset can be Att={att1,att2,…,att t The tree has t leaf nodes: Leafnode = {leafnode1, leafnode2, ..., leafnode}. t}, corresponding to the t leaf node codes Leaf={Leaf1,Leaf2,…,Leaf t}, for each attribute at i Injection to Leaf Encoding i Leaf i =f(att) i ).

[0062] During the user access control verification phase, the protocol is executed sequentially from bottom to top along the access control tree. Specifically, in this embodiment, the access control module receives the attribute DU that identifies the terminal user DUs. A and the attribute DU A Mapping to leaf i The computation protocol is executed from bottom to top. If the secret value of the root node can be recovered (e.g., 110011), the user is considered a licensed user; otherwise, they are not. For example, a user's attribute is...

[0063]

[0064] At this point: based on the attributes of "Information Security Major" and "PhD", we can obtain...

[0065] The output encoding of Node(2,1) is 111100 = the encoding of Node(3,2) ∨ the encoding of Node(3,3); thus, it can be...

[0066] The input encoding for Node(2,1) is... From the "Artificial Intelligence Lab" attribute, we obtain the input code (000010) for Node(2,3); from the "Passed the Qualification Exam" attribute, we obtain the code (100000) for Node(2,2). Recursively restoring these codes, we finally obtain the root node Node(1,1) code value 110011 = Node(2,1) input code 111100 ∨ Node(2,2) code 100000 ∨ Node(2,3) input code 000010. When the obtained root node code matches the secret value, it means that the attribute set meets the access conditions.

[0067] Since the above operations are all naive binary operations, their computational complexity is relatively low, and they have higher computational efficiency compared to traditional methods.

[0068] It should be noted that in the embodiments of this application, when an untrusted terminal user is detected, or when a user causes attribute leakage, updating the attribute encoding of the child node can discard the untrusted terminal user DUs.

[0069] To enable those skilled in the art to further understand the lightweight terminal access control method supporting CP-ABE in 5G scenarios according to the embodiments of this application, the following description is provided in conjunction with specific embodiments.

[0070] Figure 5 This is a flowchart illustrating a lightweight terminal access control method supporting CP-ABE in a 5G scenario, as described in this application, including the following steps:

[0071] I. Generate the access control tree:

[0072] 1. Generate an access control tree structure based on access control conditions;

[0073] 2. Determine the root node, leaf nodes, and transmit nodes in the data structure;

[0074] 3. Insert virtual nodes on the upper and lower adjacent sides of each transmission node;

[0075] II. Assigning values ​​to the access control tree:

[0076] 1. Randomly generate a high-dimensional binary code as the secret value (m-dimensional) and assign it to the root node.

[0077] 2. Based on the threshold corresponding to the node, generate a subkey (m-dimensional) according to the above key distribution protocol, and assign the subkey to the lower-level child node (child node or transmission node);

[0078] 3. When assigning the subkey to the leaf node in step 2 above, simply assign the value and then break.

[0079] 4. When the subkey from step 2 above is assigned to the leaf node, the specific process is as follows: First, the subkey Secret is... in Assign the value to the virtual node above this passing node; then, call GenFCode(Threshold). Node Secret in The function generates an m-dimensional feature code for this transmission node. Feature Finally, the subkey Secret in With feature encoding Code Feature Perform an XOR operation to generate a new subkey, Secret. out The new subkey Secret out Assign the value to the virtual node below the transmitting node. The new subkey Secret from step 4) out As a secret value, repeat steps 1), 2), and 3) recursively downwards, assigning values ​​to each transmission node (and its upper and lower virtual nodes) and child nodes in the access control tree.

[0080] 5. Repeat step 5 until all leaf nodes of the access control tree have been assigned values; at this point, each leaf node... i Each is assigned an m-dimensional binary code Leaf i ;

[0081] 6. Permission attribute set Att = {att1, att2, ..., att} t The tree has t leaf nodes: Leafnode = {leafnode1, leafnode2, ..., leafnode}. t}, corresponding to the t leaf node codes Leaf={Leaf1,Leaf2,…,Leaf t}, for each attribute at i Injection to Leaf Encoding i Leaf i =f(att)i ).

[0082] 7. In step 4, the node feature encoding generation function GenFCode(Threshold) is passed. Node Secret in Code Feature Enter the threshold value for this transmission node. Node The assignment of the Secret value to the virtual node above. in Output a feature code Feature Generate feature encoding code. Feature The following constraints must be met: First, based on Secret in and Code Feature The newly generated secret value Secret out It can be split into C(n,s-1) parts, which are the new secret values. out First, there are at least C(n, s-1) non-zero bits; second, when the new secret value Secret... out The value is directly assigned to the child node Leaf. i At that time, Secret out It cannot have the same encoding as an existing child node.

[0083] III. Validation of the access control tree:

[0084] 1. The access control module receives and identifies the attribute DU of the terminal user DUs. A ;

[0085] 2. Set attribute DU A Mapping to leaf i The computation protocol is executed from bottom to top, attempting to restore the value of each node at each level, and finally restore the value of the root node.

[0086] 3. If the secret value of the root node can be recovered (e.g., 110011), the user is considered a licensed user; if the secret value of the root node cannot be recovered, the user is not a licensed user.

[0087] The lightweight terminal access control method supporting CP-ABE in 5G scenarios proposed in this application embodiment uses a CP-ABE method based on a preset encrypted policy attribute base. An access control tree is built according to access control conditions in a first preset order. Based on a preset replication policy, values ​​are assigned to the root node, multiple leaf nodes, and multiple transit nodes of the access control tree. Based on a preset set of permission attributes, the assigned access control tree is verified according to the received user's current attributes. When the user is determined to be a permitted user, the encrypted document is decrypted for the user to view. This solves the problems of low efficiency, high computational overhead, and limited practicality in 5G access control schemes associated with related technologies. A new CP-ABE construction method is proposed, realizing a lightweight CP-ABE method that reduces computation time and space overhead and improves computational efficiency.

[0088] Next, referring to the accompanying drawings, a lightweight terminal access control system supporting CP-ABE in a 5G scenario is described according to an embodiment of this application.

[0089] Figure 6 This is a block diagram of a lightweight terminal access control system supporting CP-ABE in a 5G scenario according to an embodiment of this application.

[0090] like Figure 6 As shown, the lightweight terminal access control system 10 supporting CP-ABE in this 5G scenario includes: a control tree establishment module 100, an assignment module 200, and a verification module 300.

[0091] The system includes a control tree building module 100, which uses a preset ciphertext policy attribute base encryption CP-ABE method to build an access control tree according to the access control conditions and in a first preset order; an assignment module 200, which assigns values ​​to the root node, multiple leaf nodes, and multiple transit nodes of the access control tree; and a verification module 300, which verifies the assigned access control tree based on a preset permission attribute set and the current attributes of the received user, and decrypts the encrypted document for the user to view when the user is determined to be a licensed user.

[0092] Optionally, in some embodiments, the control tree building module 100 includes: generating an access control tree structure based on access control conditions; determining a root node, multiple leaf nodes, and multiple transit nodes in the access control tree structure; inserting virtual nodes at a first position and a second position of each transit node; and building an access control tree based on the root node, multiple leaf nodes, multiple transit nodes, and virtual nodes.

[0093] Optionally, in some embodiments, the assignment module 200 is further configured to: assign a randomly generated multidimensional binary code as a secret value to the root node; and generate a first multidimensional subkey corresponding to the child node based on a preset key distribution protocol and a threshold value corresponding to the root node; when assigning values ​​to multiple leaf nodes, directly assign the first multidimensional subkey to the corresponding child node; when assigning values ​​to multiple transmission nodes, assign the first multidimensional subkey to the virtual node at the first position of the current transmission node, and call a preset encoding function to generate a multidimensional feature code for the current transmission node; perform an XOR operation between the first multidimensional subkey assignment and the multidimensional feature code to generate a second multidimensional subkey, and assign the second multidimensional subkey to the virtual node at the second position of the current transmission node; recursively assign the second multidimensional subkey as a secret value to the lower subtree, assigning values ​​to each leaf node, each transmission node, the virtual node at the first position of each transmission node, and the virtual node at the second position of each transmission node, until each leaf node of the access control tree has been assigned a value.

[0094] Optionally, in some embodiments, the verification module 300 is further configured to: based on a preset set of permission attributes, map the current attribute to the child node of the access control tree according to a second preset order, execute the protocol from bottom to top, attempt to recover the secret value child node corresponding to the root node, and obtain the mapping result of the root node; if the recovered mapping result is consistent with the previous assignment corresponding to the root node, then determine that the user is a licensed user, otherwise determine that the user is a non-licensed user.

[0095] It should be noted that the foregoing explanation of the lightweight terminal access control method embodiment supporting CP-ABE in 5G scenarios also applies to the lightweight terminal access control system supporting CP-ABE in 5G scenarios of this embodiment, and will not be repeated here.

[0096] The lightweight terminal access control system supporting CP-ABE in 5G scenarios proposed in this application embodiment uses a CP-ABE encryption method based on a preset encrypted policy attribute base. An access control tree is built according to access control conditions in a first preset order. Values ​​are assigned to the root node, multiple leaf nodes, and multiple transit nodes of the access control tree. Based on a preset set of permission attributes, the system verifies the assigned access control tree according to the current attributes of the received user. When the user is determined to be a permitted user, the encrypted document is decrypted for the user to view. This solves the problems of low efficiency, high computational overhead, and limited practicality in 5G access control schemes associated with related technologies. A new CP-ABE construction method is proposed, realizing a lightweight CP-ABE method that reduces computation time and space overhead and improves computational efficiency.

[0097] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include:

[0098] The memory 701, the processor 702, and the computer program stored on the memory 701 and executable on the processor 702.

[0099] When the processor 702 executes the program, it implements the lightweight terminal access control method supporting CP-ABE in the 5G scenario provided in the above embodiments.

[0100] Furthermore, electronic devices also include:

[0101] Communication interface 703 is used for communication between memory 701 and processor 702.

[0102] The memory 701 is used to store computer programs that can run on the processor 702.

[0103] The memory 701 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0104] If the memory 701, processor 702, and communication interface 703 are implemented independently, then the communication interface 703, memory 701, and processor 702 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0105] Optionally, in a specific implementation, if the memory 701, processor 702, and communication interface 703 are integrated on a single chip, then the memory 701, processor 702, and communication interface 703 can communicate with each other through an internal interface.

[0106] The processor 702 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0107] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the lightweight terminal access control method supporting CP-ABE in a 5G scenario as described above.

[0108] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0109] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0110] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0111] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0112] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0113] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0114] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0115] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A lightweight terminal access control method supporting CP-ABE in a 5G scenario, characterized in that, The method comprises the following steps: Based on the preset ciphertext policy attribute-based encryption CP-ABE method, an access control tree is established according to an access control condition in a first preset order; Based on a preset assignment strategy, the root node, the plurality of leaf nodes and the plurality of transfer nodes of the access control tree are respectively assigned values; And Based on a preset set of permission attributes, the assigned access control tree is verified according to the current attributes of the received user, and when it is determined that the user is a permitted user, the encrypted document is decrypted for the user to view, The assignment of the root node, the plurality of leaf nodes and the plurality of transfer nodes of the access control tree comprises: a randomly generated multi-dimensional binary code is assigned as a secret value to the root node, and based on a preset key distribution protocol, a first multi-dimensional sub-key corresponding to a child node is generated according to a threshold value corresponding to the root node; when assigning values to the plurality of leaf nodes, the first multi-dimensional sub-key is directly assigned to the corresponding child node; when assigning values to the plurality of transfer nodes, the first multi-dimensional sub-key is assigned to a virtual node at a first position of a current transfer node, a preset encoding function is called to generate a multi-dimensional feature code for the current transfer node, a second multi-dimensional sub-key is generated by performing an exclusive OR operation on the first multi-dimensional sub-key and the multi-dimensional feature code, and the second multi-dimensional sub-key is assigned to a virtual node at a second position of the current transfer node; The second multi-dimensional sub-key is recursively assigned as the secret value to the lower sub-tree, and each leaf node, each transfer node, a virtual node at a first position of each transfer node and a virtual node at a second position of each transfer node of the sub-tree are assigned values until each leaf node of the access control tree is assigned values.

2. The method of claim 1, wherein, The establishment of the access control tree from top to bottom according to the access control condition comprises: Generating an access control tree structure according to the access control condition; Determining the root node, the plurality of leaf nodes and the plurality of transfer nodes in the access control tree structure; Inserting virtual nodes at the first position and the second position of each transfer node, and establishing the access control tree according to the root node, the plurality of leaf nodes, the plurality of transfer nodes and the virtual nodes.

3. The method of claim 1, wherein, The verification of the assigned access control tree according to the current attributes of the received user based on the preset set of permission attributes comprises: The current attributes are mapped to the leaf nodes of the access control tree in a second preset order based on the preset set of permission attributes, a protocol is executed from bottom to top, an attempt is made to recover a secret value corresponding to the root node, and a mapping result of the root node is obtained; If the generated mapping result is consistent with the previously assigned value corresponding to the root node, it is determined that the user is the permitted user, otherwise it is determined that the user is a non-permitted user. 4.A lightweight terminal access control system supporting CP-ABE in a 5G scenario, characterized in that, It comprises: A control tree establishment module, which establishes an access control tree according to an access control condition in a first preset order based on a preset ciphertext policy attribute-based encryption CP-ABE method; An assignment module, which is configured to respectively assign values to the root node, the plurality of leaf nodes and the plurality of transfer nodes of the access control tree based on a preset assignment strategy; And The verification module verifies the access control tree after the assignment based on a preset permission attribute set according to the received current attribute of the user, and decrypts the encrypted document for the user to view when determining that the user is a permitted user, The assignment module is specifically configured to: assign a randomly generated multi-dimensional binary code as a secret value to the root node, and generate a first multi-dimensional sub-secret key corresponding to a sub-node based on a preset key distribution protocol according to a threshold value corresponding to the root node; when assigning the plurality of leaf nodes, directly assign the first multi-dimensional sub-secret key to the corresponding sub-node; when assigning the plurality of transfer nodes, assign the first multi-dimensional sub-secret key to a virtual node at a first position of a current transfer node, and generate a multi-dimensional feature code for the current transfer node by calling a preset encoding function, generate a second multi-dimensional sub-secret key by performing an exclusive or operation on the first multi-dimensional sub-secret key and the multi-dimensional feature code, and assign the second multi-dimensional sub-secret key to a virtual node at a second position of the current transfer node; The second multi-dimensional sub-secret key is recursively assigned as the secret value to the sub-tree in sequence, and each leaf node, each transfer node, a virtual node at a first position of each transfer node, and a virtual node at a second position of each transfer node of the sub-tree are assigned, until each leaf node of the access control tree is assigned.

5. The system of claim 4, wherein, The control tree establishment module comprises: generating an access control tree structure according to the access control condition; determining the root node, the plurality of leaf nodes, and the plurality of transfer nodes in the access control tree structure; inserting virtual nodes at first and second positions of each transfer node, and establishing the access control tree according to the root node, the plurality of leaf nodes, the plurality of transfer nodes, and the virtual nodes.

6. The system of claim 3, wherein, The verification module is further configured to: map the current attribute to the leaf node of the access control tree in a second preset sequence based on the preset permission attribute set, execute a protocol from bottom to top, attempt to recover a secret value of a sub-node corresponding to the root node, and obtain a mapping result of the root node; if the generated mapping result is consistent with the assignment corresponding to the root node, it is determined that the user is the permitted user, otherwise it is determined that the user is a non-permitted user.

7. An electronic device, comprising: comprise: a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor executing the program to implement the lightweight terminal access control method supporting CP-ABE in the 5G scenario as claimed in any one of claims 1-3.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the lightweight terminal access control method supporting CP-ABE in the 5G scenario as claimed in any one of claims 1-3.

Images