A data-supervisory multi-center attribute-based encryption system and method

Abstract

The present invention relates to a data-supervisable multi-center attribute-based encryption system, including an auditor, several attribute key authorization centers, a message sender, and a message receiver; when the system is initialized, the auditor generates an audit key pair, each attribute key authorization center initializes an attribute-based key pair, and distributes a user attribute key to the receiver; when the message is transmitted, the message sender encrypts the message based on the attribute, and the plaintext data can be decrypted and restored when the attribute key of the message receiver matches; when suspicious ciphertext appears in the system, the auditor restores the message content with the help of the audit key. The present invention realizes fine-grained access to protect the data transmission process in a distributed environment and meets the regulatory requirements of tracking applications.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a data-supervisory multi-center attribute-based encryption system and method. Background Art

[0002] Attribute-based encryption (ABE) is a hot research topic in the field of cryptography in recent years. It provides a flexible way to achieve fine-grained access control and has been widely used in emerging fields such as cloud computing, edge computing, and blockchain. Traditional attribute-based encryption requires a single attribute key authorization center to distribute attribute keys to users. It has a key custody problem, and a single authorization center can arbitrarily generate legal keys for users. In order to solve the above problems, researchers have proposed a multi-authorization center attribute encryption scheme with different characteristics, which limits the capabilities of the authorization center and is suitable for distributed access control scenarios. However, in actual data sharing environments, the complete concealment of data leads to the arbitrary spread of illegal data, which makes it difficult for application managers to audit and track. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a data-supervisable multi-center attribute-based encryption system and method, where multiple attribute authorization centers manage different attribute sets, and only the system auditor has the audit key. Each attribute authorization center generates a corresponding attribute private key for the user. During the encryption and decryption process, the user with the attribute private key can decrypt and restore the plaintext information. When suspicious ciphertext appears in the system, the auditor can restore the plaintext data. The design of multiple authorization centers alleviates the problem of over-reliance on a single authorization center and key escrow, and the audit function effectively prevents the arbitrary spread of malicious data.

[0004] To achieve the above object, the present invention adopts the following technical solution:

[0005] A data-supervisory multi-center attribute-based encryption system includes an auditor TA, several attribute key authorization centers AIA, a message sender, and a message receiver. When the system is initialized, the auditor generates an audit key pair, and each attribute key authorization center initializes an attribute-based key pair and distributes a user attribute key to the receiver. When the message is transmitted, the message sender encrypts the message based on the attribute, and the plaintext data can be decrypted and restored if the attribute key of the message receiver matches. When suspicious ciphertext appears in the system, the auditor uses the audit key to restore the message content.

[0006] Further, the following steps are included:

[0007] (1) System initialization: TA and AIA generate system parameters

[0008]

[0009] Where N represents the number of AIAs in the system. After initialization, the parameters are made public through the system;

[0010] (2) Attribute key generation: AIA generates the attribute key of the user GID, and the user GID requests the key for attribute i from AIA;

[0011] (3) Message encryption: The message sender uses attributes For information m∈{0,1} * Encryption is performed;

[0012] (4) Message decryption: When the user CID receives the signed message, it performs a decryption operation to obtain the plaintext information.

[0013] Furthermore, the system initialization includes TA initialization and AIA initialization, which are as follows:

[0014] TA initialization: Selecting safe bilinear pairing parameters Next, choose a one-way hash function: TA randomly selects a private key Calculate TA public key tpk = g tsk , and expose the parameters

[0015] AIA Initialization: AIA k Random Selection And calculate For AIA k Each attribute i∈{1,…,l k}, AIA k Random Selection calculate AIA k with AIA j Shared Parameters Make r kj =r jk .AIA k Storing Private Keys Public key When all AIAs in the system are initialized, calculate Y = ∏Y k , get the system master public key

[0016] Furthermore, the AIA generates an attribute key of the user GID, as follows:

[0017] a) For j∈{1,…,N}\{k}, AIA k Random Selection And calculate Among them, when k>j, δkj =1, when k≤j, δ kj = -1;

[0018] b)AIA k Select d k Polynomial of degree p k (·), where p k (0) = v k -∑ j∈{1,…,N}{k} R kj , then calculate

[0019] c) After the user obtains all attribute keys from each AIA, the user calculates D u =∏ (k,j)∈{1,…,N}×{1,…,N}\{k} D kj , R u =∏ (k,j)∈{1,…,N}×{1,…,N}\{k} R kj , the user obtains the final attribute private key ({S k,i},D u ,R u ).

[0020] Furthermore, the message is encrypted as follows:

[0021] a) The message sender selects a random number Calculate E0 = M·e(tpk,Y) s ,E1=g s ;

[0022] b) Return ciphertext information

[0023] Furthermore, the decryption operation is specifically as follows:

[0024] a) For any AIA k ,k∈{1,…,N},

[0025] For any d k Attributes User Computing

[0026] Using Lagrange's interpolation theorem, we can calculate

[0027] b) When all AIAs have completed the above steps, calculate Then calculate

[0028] c) The user restores the plaintext information M=E0 / Z.

[0029] Furthermore, if a malicious user appears, TA will perform the following operations to track and recover the ciphertext data:

[0030] a) Obtaining ciphertext data CT related to malicious users;

[0031] b)TA calculation M = E0 / e(E1,Y) tsk .

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] 1. The present invention can supervise the multi-center attribute-based encryption method. Multiple attribute authorization centers manage different attribute sets. Each attribute authorization center generates a corresponding attribute private key for the user. During the encryption and decryption process, the user with the attribute private key can decrypt and restore the plaintext information. The design of multiple authorization centers alleviates the problem of excessive dependence on a single authorization center and key escrow.

[0034] 2. The present invention takes into account both "multi-center" and "supervisability", is suitable for distributed access control application scenarios, and provides data auditing functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic flow chart of the method of the present invention. DETAILED DESCRIPTION

[0036] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0037] Please refer to Figure 1 The present invention provides a data-supervisable multi-center attribute-based encryption system, including an auditor TA, several attribute key authorization centers AIA, a message sender, and a message receiver; when the system is initialized, the auditor generates an audit key pair, each attribute key authorization center initializes the attribute-based key pair, and distributes user attribute keys to the receiver; when the message is transmitted, the message sender encrypts the message based on the attribute, and the plaintext data can be decrypted and restored if the attribute key of the message receiver matches; when suspicious ciphertext appears in the system, the auditor uses the audit key to restore the message content.

[0038] In this embodiment, the symbols and definitions are as follows:

[0039] TA: Trusted Auditor.

[0040] AIA: Attribute Key Authority.

[0041] AIA k : The kth AIA.

[0042] N: The number of attribute key authorities.

[0043] GID: User identity identifier.

[0044] q: a large prime number.

[0045] The cyclic group of order is a prime number q.

[0046] g: group The generator of .

[0047] e(·,·): bilinear mapping relationship.

[0048] Bilinear pairing group, there exists

[0049] Secure cryptographic hashing function.

[0050] tsk: private key of the trusted auditor TA.

[0051] tpk: public key of the trusted auditor TA.

[0052] i: attribute number.

[0053] The set of attributes used by the ciphertext.

[0054] The set of attribute keys owned by the user.

[0055] SK k : AIA k The private key of

[0056] PK k : AIA k The public key of

[0057] PK: system master public key.

[0058] ({S k,i},D u ,R u ): User attribute key.

[0059] m: message to be encrypted.

[0060] CT: Message ciphertext.

[0061] v k ,Y k ,t k,i ,T k,i ,r kj ,r jk ,Y,R kj ,D kj ,s: intermediate variable of the algorithm.

[0062] In this embodiment, a data controllable multi-center attribute-based encryption method is also provided, comprising the following steps:

[0063] (1) System initialization: TA and AIA generate system parameters

[0064]

[0065] Where N represents the number of AIAs in the system. After initialization, the parameters are made public through the system;

[0066] (2) Attribute key generation: AIA generates the attribute key of the user GID, and the user GID requests the key for attribute i from AIA;

[0067] (3) Message encryption: The message sender uses attributes For information m∈{0,1} * Encryption is performed;

[0068] (4) Message decryption: When the user GID receives the signed message, it performs a decryption operation to obtain the plaintext information.

[0069] Preferably, in this embodiment, system initialization includes TA initialization and AIA initialization, which are as follows:

[0070] TA initialization: Selecting safe bilinear pairing parameters Next, choose a one-way hash function: TA randomly selects a private key Calculate TA public key tpk = g tsk , and expose the parameters

[0071] AIA Initialization: AIA k Random Selection And calculate For AIA k Each attribute i∈{1,…,l k}, AIA k Random Selection calculate AIA k with AIA j Shared Parameters Make r kj =r jk .AIA k Storing Private Keys Public key When all AIAs in the system are initialized, calculate Y = ∏Y k , obtain the system master public key

[0072] Preferably, in this embodiment, AIA generates an attribute key of the user GID as follows:

[0073] a) For j∈{1,…,N}\{k}, AIA k Random Selection And calculate Among them, when k>j, δ kj =1, when k≤j, δ kj = -1;

[0074] b)AIA k Select d k Polynomial of degree p k (·), where p k (0) = v k -∑ j∈{1,…,N}{k} R kj , then calculate

[0075] c) After the user obtains all attribute keys from each AIA, the user calculates D u =∏ (k,j)∈{1,…,N}×{1,…,N}\{k} D kj , R u =∏ (k,j)∈{1,…,N}×{1,…,N}\{k} R kj , the user obtains the final attribute private key ({S k,i},D u ,R u ).

[0076] Preferably, in this embodiment, the message is encrypted as follows:

[0077] a) The message sender selects a random number Calculate E0 = M·e(tpk,Y) s ,E1=g s ;

[0078] b) Return ciphertext information

[0079] Preferably, in this embodiment, the decryption operation is specifically:

[0080] a) For any AIA k ,k∈{1,…,N},

[0081] For any d k Attributes User Computing

[0082] Using Lagrange's interpolation theorem, we can calculate

[0083] b) When all AIAs have completed the above steps, calculate Then calculate

[0084] c) The user restores the plaintext information M=E0 / Z.

[0085] Preferably, in this embodiment, if a malicious user appears, the TA performs the following operations to track and recover the ciphertext data:

[0086] a) Obtaining ciphertext data CT related to malicious users;

[0087] b)TA calculation M = E0 / e(E1,Y) tsk .

[0088] The above description is only a preferred embodiment of the present invention. All equivalent changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the present invention.

Claims

1. An encryption method for a data-supervisable multi-center attribute-based encryption system, characterized in that: The following steps are involved: (1) System initialization: TA and AIA generate system parameters Where N represents the number of AIAs in the system. After initialization, the parameters are made public through the system; (2) Attribute key generation: AIA generates the attribute key of the user GID, and the user GID requests the key for attribute i from AIA; (3) Message encryption: The message sender uses attributes For information m∈{0,1} * Encryption is performed; (4) Message decryption: When the user CID receives the signed message, it performs a decryption operation to obtain the plaintext information; The system initialization includes TA initialization and AIA initialization, which are as follows: TA initialization: Selecting safe bilinear pairing parameters Next, choose a one-way hash function: TA randomly selects a private key Calculate TA public key tpk = g tsk , and expose the parameters AIA Initialization: AIA k Random Selection And calculate For AIA k Each attribute i∈{1,…,l k }, AIA k Random Selection calculate AIA k with AIA j Shared Parameters Make r kj =r jk ;AIA k Storing Private Keys Public key When all AIAs in the system are initialized, calculate Y = ∏Y k , obtain the system master public key The AIA generates the attribute key of the user GID as follows: a) For j∈{1,…,N}\{k}, AIA k Random Selection And calculate Among them, when k>j, δ kj =1, when k≤j, δ kj = -1; b)AIA k Select d k Polynomial of degree p k (·), where p k (0) = v k -∑ j∈{1,…,N}{k} R kj , then calculate c) After the user obtains all attribute keys from each AIA, the user calculates D u =∏ (k,j)∈{1,…,N}×{1,…,N}\{k} D kj , R u =∏ (k,j)∈{1,…,N}×{1,…,N}\{k} R kj , the user obtains the final attribute private key ({S k,i },D u ,R u ); The message encryption is as follows: a) The message sender selects a random number Calculate E0 = M·e(tpk,Y) s ,E1=g s ; b) Return ciphertext information The decryption operation is specifically as follows: a) For any AIA k ,k∈{1,…,N}, For any d k Attributes User Computing Using Lagrange's interpolation theorem, we can calculate b) When all AIAs have completed the above steps, calculate Then calculate c) The user restores the plaintext information M=E0 / Z; If a malicious user appears, TA will perform the following operations to track and recover the ciphertext data: a) Obtaining ciphertext data CT related to malicious users; b)TA calculation M = E0 / e(E1,Y) tsk .

2. A data-supervisable multi-center attribute-based encryption system, characterized in that: The system is implemented using the encryption method as described in claim 1, including an auditor TA, several attribute key authorization centers AIA, a message sender, and a message receiver; when the system is initialized, the auditor generates an audit key pair, each attribute key authorization center initializes an attribute base key pair, and distributes a user attribute key to the receiver; when the message is transmitted, the message sender encrypts the message based on the attribute, and the plaintext data can be decrypted and restored if the attribute key of the message receiver matches; when suspicious ciphertext appears in the system, the auditor uses the audit key to restore the message content.

Images