Ciphertext policy attribute-based encryption method supporting traitor tracing and tree access structure

Abstract

The present invention discloses a ciphertext policy attribute-based encryption method supporting traitor tracking and tree-shaped access structure, comprising the following steps: S1, initialization setting, generating public parameters and master keys of an authorized institution; S2, the authorized institution generates corresponding decryption private keys according to the identity mark and attributes of the user; S3, the encryption party formulates a tree-shaped access structure to express the access policy, and encrypts the plaintext into ciphertext according to the tree-shaped access structure; S4, if the attributes in the user's decryption private key meet the access policy in the ciphertext, the user can use the decryption private key to restore the ciphertext to plaintext, otherwise, the user's decryption private key cannot restore the ciphertext to plaintext; S5, if a user leaks his decryption private key to an unauthorized third party, then the leaked decryption private key is used for tracking to determine the identity of the leaker. The present invention is conducive to preventing the abuse of user decryption authority and improving the expression ability of access policy, and promoting the security and efficiency of attribute-based encryption.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a ciphertext policy attribute-based encryption method supporting traitor tracking and tree-shaped access structure. Background Art

[0002] In 2001, Boneh and Franklin proposed the first practical identity-based encryption scheme based on bilinear mapping technology. Later, bilinear mapping was widely used in the construction of identity-based encryption schemes and attribute-based encryption schemes. It can be used to achieve the mutual pairing of identities in ciphertext and decryption private keys, or the mutual pairing of attributes. The basic concept of bilinear mapping is: Let G and G T is a multiplicative cyclic group of prime order p, g is a generator of group G, Z p is the set of integers modulo p, the bilinear map e:G×G→G T Satisfies three properties: (1) Bilinear: for any a, b∈Z p , e(g a ,g b )=e(g,g) ab ; (2) Non-degeneracy: e(g,g)≠1; (3) Computability: bilinear mapping is computable in polynomial time.

[0003] In 2005, Sahai and Waters proposed the first attribute-based encryption scheme. In 2006, Goyal et al. divided attribute-based encryption into two categories: key-policy attribute-based encryption and ciphertext-policy attribute-based encryption. In ciphertext-policy attribute-based encryption, the ciphertext is related to the access policy, and the decryption private key is related to the attribute; in key-policy attribute-based encryption, the situation is just the opposite. Attribute-based encryption supports one-to-many encryption and fine-grained access control, and has broad application prospects in distributed data sharing.

[0004] However, there are still some problems in attribute-based encryption that need to be solved.

[0005] For example, in ciphertext policy attribute-based encryption, the user's attributes represent their decryption permissions. If a malicious user leaks their decryption permissions to an unauthorized third party, the unauthorized third party can decrypt the encrypted data, thereby damaging data security. However, in reality, multiple users may have the same attributes, so when the decryption permissions are leaked, it is impossible to determine who the real leaker (or "traitor") is. Therefore, it is necessary to establish a tracking mechanism that can track and determine the identity of the leaker based on the leaked decryption permissions, thereby preventing the leakage of decryption permissions and improving the security of encryption.

[0006] For example, in ciphertext policy attribute-based encryption, if the encryptor wants to share data with the target user, he needs to formulate an access policy based on the attribute characteristics of the target user and encrypt the plaintext into ciphertext based on the access policy. The role of the access policy is to specify which users with which attributes can decrypt and which users without these attributes cannot decrypt. The expressive power of the access policy should be rich, for example, it can express both the "and" relationship between attributes and the "or" relationship between attributes. The richer the expressive power of the access policy, the more flexible the encryptor is in defining the scope of the target users. In order to be able to define the scope of the target users in a detailed and flexible manner, measures need to be taken to improve the expressive power of the access policy.

[0007] In the prior art, the existing ciphertext policy attribute-based encryption schemes either do not support traitor tracing (such as Bethencourt J, Sahai A, Waters B. Ciphertext-policy attribute-based encryption [C] / / 2007 IEEE symposium on security and privacy (SP'07). IEEE, 2007: 321-334.), or do not support tree-shaped access structures (Liu Z, Cao Z, Wong DS. White-box traceable ciphertext-policy attribute-based encryption supporting any monotone access structures [J]. IEEE Transactions on Information Forensics and Security, 2012, 8 (1): 76-88.). Therefore, it is necessary to design a new ciphertext policy attribute-based encryption method that can simultaneously support traitor tracing and tree-shaped access structures, so as to prevent the abuse of user decryption permissions and improve the expressiveness of access policies.

[0008] In addition, some existing ciphertext policy attribute-based encryption schemes are based on composite-order bilinear groups. Usually, these schemes run slowly in specific implementations. Some do not support the scalability of attribute scales and need to limit the size of attribute scales when the system is initialized. When new attributes are added, these schemes need to reinitialize the system, affecting the stability of system operation. Therefore, the new method should also ensure the running speed and support the scalability of attribute scales to meet the higher requirements of users. Summary of the invention

[0009] In view of the problems of the prior art, the present invention proposes a ciphertext policy attribute-based encryption method that supports both traitor tracking and tree-shaped access structure, which is beneficial to preventing the abuse of user decryption authority and improving the expressiveness of access policy. At the same time, the proposed method is based on a prime-order bilinear group, which is of great significance for promoting the safe and efficient application of attribute-based encryption. In addition, the proposed method can support the scalability of attribute scale, so that there is no need to limit the size of the attribute scale when the system is initialized, and the long-term stable operation of the system is maintained.

[0010] In order to achieve the above object, the technical solution of the present invention is as follows:

[0011] A ciphertext policy attribute-based encryption method supporting traitor tracing and tree-type access structure includes the following steps:

[0012] S1. Initialize settings and generate public parameters and the master key of the authorized institution;

[0013] S2. The authorization agency generates the corresponding decryption private key based on the user's identity mark and attributes;

[0014] S3, the encryption party formulates a tree-shaped access structure to express the access policy, and encrypts the plaintext into ciphertext according to the tree-shaped access structure;

[0015] S4. If the attribute in the user's decryption private key satisfies the access policy in the ciphertext, the user can use his decryption private key to restore the ciphertext to plaintext. Otherwise, the user's decryption private key cannot restore the ciphertext to plaintext.

[0016] S5. If a user leaks his / her decryption private key to an unauthorized third party, the leaked decryption private key can be used to track the leaker to determine his / her identity.

[0017] Furthermore, the initialization setting process in step S1 is as follows:

[0018] Let G and G T is a multiplicative cyclic group of order prime number p, Z p is the set of integers modulo p, e:G×G→G T is a bilinear map, g is a generator of group G, and defines a hash function H:{0,1} * →G, map the attributes to elements in group G; from Z p Randomly select three elements α, β and λ, and then generate common parameters (g, h = g β ,g λ ,e(g,g) α ) and master key (α, β, λ); set up tracking table

[0019] Furthermore, the user decryption private key generation process in step S2 is as follows:

[0020] First, the authorized agency A random element c is selected as a parameter associated with the user identity mark id. Indicates that from Z p The set obtained by removing element 0 from Z p Randomly select an element r from Z, and for each attribute j in the user attribute set S, p Randomly select an element r from j ;Finally, the authorized agency generates a decryption private key:

[0021]

[0022] Among them, 1 / (β+c) represents the inverse element of (β+c) modulo p; at the same time, the authorized agency stores the corresponding relationship (c, id) in the tracking table T.

[0023] Furthermore, the tree access structure in step S3 is formulated as follows:

[0024] Let x represent a node in the tree. If x is a leaf node, then att(x) represents the attribute represented by the leaf node. If x is a non-leaf node, then (t x ,n x ) represents the logic gate represented by the non-leaf node, where t x Indicates the threshold value, n x Represents the number of child nodes of x; parent(x) represents the parent node of x, and index(x) represents the sequence number of x as a child node, that is, x is the index(x)th child of its parent node.

[0025] Furthermore, the encryption process in step S3 is as follows:

[0026] The encryption party uses the Shamir (t, n)-threshold scheme to implement the logic gates on non-leaf nodes: starting from the root node R of the tree access structure, a polynomial q is selected for each node x in the tree from top to bottom. x , where q x The number of times is d x , d x =t x -1,q x The constant term is denoted as q x (0);

[0027] For the root node R, first start from Z p Randomly select an element s and set q R (0) = s; then from Z pRandomly select d R elements as q R Other d R points; finally, Lagrange interpolation is used to obtain the polynomial q of R R ;

[0028] For other non-leaf nodes x, first set q x (0) = q parent(x) (index(x)); then from Z p Randomly select d x elements as q x Other d x points; finally, Lagrange interpolation is used to obtain the polynomial q of x x ;

[0029] For leaf node x, directly set q x =q x (0) = q parent(x) (index(x));

[0030] Let T represent the tree access structure, Y represent the set of all leaf nodes, i represent the leaf node, i∈Y, the encryption party encrypts the plaintext M∈G T The generated ciphertext is expressed as:

[0031]

[0032] Furthermore, the decryption process in step S4 is as follows:

[0033] Suppose the attribute set associated with the user's decryption private key SK is S, and the tree access structure in the ciphertext CT is T. For each node x in the tree access structure T, calculate a value F associated with the node x x , perform the following operations in different situations:

[0034] Case 1: x is a leaf node:

[0035] If att(x)∈S, then compute:

[0036]

[0037] if Then set F x =⊥, where ⊥ represents a special value;

[0038] Case 2: x is a non-leaf node:

[0039] Let z represent the child node of x. For each child node z, calculate the value F associated with the child node z. z , let Z xRepresents a set consisting of x's child nodes z, and satisfies Z x ={z|F z ≠⊥} and |Z x |=t x , if there exists such a set Z x , then define another set I accordingly x ={index(z)|z∈Z x}, and calculate:

[0040]

[0041] in is the Lagrange coefficient;

[0042] If there is no such set Z x , then F x =⊥;

[0043] If the attribute set S satisfies the tree access structure T, then based on the operations defined in Case 1 and Case 2 above, the user recursively calculates F R , can be obtained Where R is the root node in the tree access structure T;

[0044] Then, the user calculates according to the following formula:

[0045]

[0046] Finally, the user recovers the plaintext, i.e.

[0047] Furthermore, the tracking conditions in step S5 are as follows:

[0048] Assume that the leaked decryption private key is SK, whose components include (K, K', K0, {K j ,K' j} j∈S ), the attribute set associated with SK is S. If the decryption private key SK satisfies the following two format check conditions, the tracking operation is performed on the decryption private key SK; otherwise, the tracking operation does not need to be performed on the decryption private key SK.

[0049] Decryption private key format check conditions:

[0050] (1)K′∈Z p ,K,K0,K j ,K' j ∈G;

[0051] (2) There exists an attribute j∈S such that:

[0052]

[0053] Furthermore, the tracking process in step S5 is as follows:

[0054] Query c in the tracking table T, K'=c: if c exists, output the corresponding user identity mark id; otherwise, output a special symbol Indicates that the target you want to track is not stored in T.

[0055] Compared with the prior art, the present invention has the following beneficial effects:

[0056] 1. The ciphertext policy attribute-based encryption method proposed in the present invention supports traitor tracking. When a malicious user illegally leaks his decryption authority (decryption private key) to an unauthorized third party, the method proposed in the present invention can track and determine the identity of the original user based on the leaked decryption private key, thereby deterring the user's decryption authority leakage behavior, preventing the abuse of decryption authority, and improving the security of encryption.

[0057] 2. The ciphertext policy attribute-based encryption method proposed in the present invention supports a tree-shaped access structure. The tree-shaped access structure can express a rich set of logical relationships, including "and", "or" and thresholds. The tree-shaped access structure can help the encryption party flexibly formulate access policies and better define the scope of target users.

[0058] 3. The ciphertext strategy attribute-based encryption method proposed in the present invention is established based on a prime-order bilinear group. Compared with the scheme based on a composite-order bilinear group, its operating efficiency is greatly improved. The method proposed in the present invention also supports the scalability of attribute scale, so there is no need to limit the size of the attribute scale when the system is initialized. In this way, when new attributes are added in the future, the system does not need to be reinitialized, which is conducive to ensuring the long-term stable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments recorded in the present invention, and for those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0060] Figure 1 A flow chart of an encryption method provided by an embodiment of the present invention;

[0061] Figure 2 A schematic diagram of a tree access structure provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to better understand the technical solution, the method of the present invention is described in detail below with reference to the accompanying drawings.

[0063] refer to Figure 1 As shown, the present invention provides a ciphertext policy attribute-based encryption method that supports traitor tracking and tree-type access structure, comprising the following steps:

[0064] S1. Initialize settings and generate public parameters and the master key of the authorized agency.

[0065] Specifically, the initialization setting process in step S1 is as follows:

[0066] The authorized agency sets three parameter spaces, namely G, G T and Z p Among them, G and G T is a multiplicative cyclic group of order prime number p, Z p is a set of integers modulo p. The three parameter spaces are public, and each participant in the system can select the required parameters from them. The authority defines a T The bilinear mapping of e:G×G→G T is a bilinear mapping, and the bilinear mapping e is a calculation that can be derived from the elliptic curve. At the same time, the authority defines a hash function H:{0,1} * →G, maps the attributes (which can be represented by binary bit strings) to elements in the group G. The bilinear map e and hash function H are also public and can be obtained and used by all participants in the system.

[0067] The authority selects a generator g from the group G and p Three elements α, β and λ are randomly selected from the , and the authorized agency calculates g λ , g β and e(g,g) α For the convenience of subsequent writing, the symbol h is used to represent g β The value of h = g β Then, the authority generates the public parameters (g,h = g β ,g λ ,e(g,g) α ) and the master key (α, β, λ), where the four parameters contained in the public parameters are public and can be obtained and used by all participants in the system; while the three parameters contained in the master key are confidential and only held and used by the authorized agency. Finally, the authorized agency sets the tracking table T to empty, that is,

[0068] S2. The authorization agency generates a corresponding decryption private key based on the user's identity mark and attributes.

[0069] Specifically, the user decryption private key generation process in step S2 is as follows:

[0070] The user submits his identity ID and the attribute set S he owns to the authorization agency, which generates the corresponding decryption private key SK for the user based on the ID and S. id,S . Let Z* p Indicates that from Z p The set obtained by removing element 0 from .

[0071] First, the authorized agency and Z p Select the required parameters from the Authorization Agency Randomly select an element c from Z p An element r is randomly selected from the set. Among them, c is called the tracking parameter, which is associated with the user's identity ID. r is called the randomization parameter, which is used to associate the various components in the same decryption private key. At the same time, r in different decryption private keys is different, so the existence of r can also prevent collusion between different decryption private keys. For each attribute j (j∈S) in the user attribute set S, the authorization agency selects from Z p Randomly select an element r from j Corresponding to it.

[0072] The authority then uses the public parameters, the master key, and the selected parameters (i.e., c, r, and {r j} j∈S ) Calculate the components of the decrypted private key as follows:

[0073] (where 1 / (β+c) is the inverse of (β+c) modulo p);

[0074] K' = c;

[0075]

[0076] For each attribute j∈S, and

[0077] Therefore, the decryption private key SK can be obtained id ,S=(K,K',K0,{K j ,K j '} j∈S ),Right now:

[0078]

[0079] Finally, the authority will decrypt the private key SK id,S is sent to the corresponding user through a secure channel, and the corresponding relationship (c, id) is stored in the tracking table T. If c is already in T, that is, the value of c conflicts with the value previously selected for other users, it is necessary to reselect the value of c and re-execute the above decryption private key generation process.

[0080] S3. The encryption party formulates a tree access structure to express the access policy, and encrypts the plaintext into ciphertext according to the tree access structure.

[0081] The encryption party formulates an access policy based on the attribute characteristics of the target user, thereby defining which users can decrypt and access the encrypted ciphertext and which users cannot decrypt and access it. The encryption party uses a tree access structure to express the policy. Specifically, the tree access structure of the present invention is formulated as follows:

[0082] In the tree access structure, leaf nodes represent attributes, while non-leaf nodes represent logic gates. Define the symbols in the tree access structure: Let x represent a node in the tree. If x is a leaf node, then att(x) represents the attribute represented by the leaf node; if x is a non-leaf node, then (t x ,n x ) represents the logic gate represented by the non-leaf node, where t x Indicates the threshold value, n x Represents the number of child nodes of x; parent(x) represents the parent node of x, and index(x) represents the sequence number of x as a child node, that is, x is the index(x)th child of its parent node.

[0083] The encryption process in step S3 is as follows:

[0084] The encryption party uses the Shamir (t, n)-threshold scheme to implement the logic gates on non-leaf nodes: starting from the root node R of the tree access structure, a polynomial q is selected for each node x in the tree from top to bottom. x , where q x The number of times is d x , d x =t x -1,q x The constant term is denoted as q x (0);

[0085] For the root node R, first start from Z p Randomly select an element s and set q R (0) = s; then from Z p Randomly select d R elements as q R Other d R points; finally, Lagrange interpolation is used to obtain the polynomial q of R R ;

[0086] For other non-leaf nodes x, first set q x (0) = q parent(x) (index(x)); then from Z p Randomly select d x elements as q x Other d x points; finally, Lagrange interpolation is used to obtain the polynomial q of x x ;

[0087] For leaf node x, directly set q x =q x (0) = q parent(x) (index(x));

[0088] Let T represent the tree access structure, Y represent the set of all leaf nodes, i represent the leaf node, i∈Y, then, for a plaintext M(M∈G T ), the encryption party encrypts it into a ciphertext CT based on the tree access structure T. Specifically, the encryption method of each component in CT is as follows:

[0089]

[0090] C0=g s

[0091] C0'=h s

[0092] For each leaf node i∈Y, and

[0093] So, we can get the ciphertext The tree access structure T is also included in the ciphertext.

[0094] S4. If the attributes in the user's decryption private key meet the access policy in the ciphertext, the user can use its decryption private key to restore the ciphertext to plaintext. Otherwise, the user's decryption private key cannot restore the ciphertext to plaintext.

[0095] Specifically, the decryption process is as follows:

[0096] Suppose the user's decryption private key is SK, the attribute set associated with the decryption private key SK is S, the ciphertext to be decrypted by the user is CT, and the tree access structure in the ciphertext CT is T. If S satisfies T, SK can decrypt CT and thus restore the plaintext M. If S does not satisfy T, SK cannot decrypt CT. The case where the attribute set satisfies the tree access structure is shown in the attached figure. Figure 2 shown. Figure 2In the graph, letters a, b, c, d, and f are used to represent attributes, and the access strategy expressed by the tree access structure is "(a∧b)∧(c∨d)∧f" (the symbol ∧ represents "and" and the symbol ∨ represents "or"). Therefore, the set {a,b,c,f} satisfies the tree access structure in the graph, while the set {a,d,f} does not satisfy the tree access structure in the graph. If S does not satisfy T, the decryption process terminates. If S satisfies T, the user uses SK to decrypt CT as follows.

[0097] For each node x in the tree access structure T, the user calculates a value F associated with the node x. x Specifically, perform the following operations in different situations:

[0098] Case 1: x is a leaf node. If att(x)∈S, then calculate:

[0099]

[0100] if Then set F x =⊥, where ⊥ represents a special value.

[0101] Case 2: x is a non-leaf node.

[0102] Let z represent the child node of x. For each child node z, calculate the value F associated with the child node z. z , let Z x Represents a set consisting of x's child nodes z, and satisfies Z x ={z|F z ≠⊥} and |Z x |=t x , if there exists such a set Z x , then define another set I accordingly x ={index(z)|z∈Z x}, and calculate:

[0103]

[0104] in is the Lagrange coefficient;

[0105] If there is no such set Z x , then F x =⊥;

[0106] If the attribute set S satisfies the tree access structure T, then based on the operations defined in Case 1 and Case 2 above, the user recursively calculates the value F corresponding to the root node R RSpecifically, starting from the root node R of T, the corresponding value of each node is calculated layer by layer from top to bottom. When the leaf node is calculated, the corresponding value of the leaf node is calculated according to the operation method of case 1, and the value is returned to the parent node of the leaf node one layer up. Then, the corresponding value of the parent node of the leaf node is calculated according to the operation method of case 2, and the value is returned to the node on the next layer up. After that, the corresponding values ​​of the nodes are returned layer by layer, and finally traced back to the root node R. Therefore, for the root node R, the operation method of case 2 is used to calculate and get

[0107] Then, the user calculates according to the following formula:

[0108]

[0109] Finally, the user recovers the plaintext, i.e.

[0110] S5. If a user leaks his / her decryption private key to an unauthorized third party, the leaked decryption private key can be used to track the leaker to determine his / her identity.

[0111] The tracking conditions are as follows:

[0112] Assume that the leaked decryption private key is SK, whose components include (K, K', K0, {K j ,K' j} j∈S ), the attribute set associated with SK is S. If the decryption private key SK satisfies the following two format check conditions, the tracking operation is performed on the decryption private key SK; otherwise, there is no need to perform the tracking operation on the decryption private key SK, because the decryption private key that cannot meet the format check does not have the ability to correctly decrypt the ciphertext.

[0113] Decryption private key format check conditions:

[0114] (1)K′∈Z p ,K,K0,K j ,K' j ∈G;

[0115] (2) There exists an attribute j∈S such that:

[0116]

[0117] The tracking process is as follows:

[0118] Perform a tracking operation on SK and query c in the tracking table T, K'=c: if c exists, output the corresponding user identity mark id (this determines the identity of the leaker); otherwise, output a special symbol Indicates that the target you want to track is not stored in T.

[0119] The ciphertext policy attribute-based encryption method proposed in the present invention supports traitor tracking. When a malicious user illegally leaks his decryption authority (decryption private key) to an unauthorized third party, the method proposed in the present invention can track and determine the identity of the original user based on the leaked decryption private key, thereby deterring the user's decryption authority leakage behavior, preventing the abuse of decryption authority, and improving the security of encryption.

[0120] The ciphertext policy attribute-based encryption method proposed in the present invention supports a tree-shaped access structure. The tree-shaped access structure can express a rich set of logical relationships, including "and", "or" and thresholds. The tree-shaped access structure can help the encryption party flexibly formulate access policies and better define the scope of target users.

[0121] In addition, the ciphertext policy attribute-based encryption method proposed in the present invention is established based on a prime-order bilinear group, and its operating efficiency is better than that of a scheme established based on a composite-order bilinear group. The method proposed in the present invention also supports the scalability of attribute scale, so that the size of the attribute scale does not need to be limited when the system is initialized. In this way, when new attributes are added in the future, the system does not need to be reinitialized, which is conducive to ensuring the long-term stable operation of the system.

[0122] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A ciphertext policy attribute-based encryption method supporting traitor tracking and tree access structure, characterized in that: The steps include: S1. Initialize settings and generate public parameters and the master key of the authorized institution; S2. The authorization agency generates the corresponding decryption private key based on the user's identity mark and attributes; S3, the encryption party formulates a tree-shaped access structure to express the access policy, and encrypts the plaintext into ciphertext according to the tree-shaped access structure; The tree access structure is formulated as follows: Let x represent a node in the tree. If x is a leaf node, then att(x) represents the attribute represented by the leaf node. If x is a non-leaf node, then (t x ,n x ) represents the logic gate represented by the non-leaf node, where t x Indicates the threshold value, n x Indicates the number of child nodes of x; parent(x) indicates the parent node of x, and index(x) indicates the sequence number of x as a child node, that is, x is the index(x)th child of its parent node; The encryption process is as follows: The encryption party uses the Shamir (t, n)-threshold scheme to implement the logic gates on non-leaf nodes: starting from the root node R of the tree access structure, a polynomial q is selected for each node x in the tree from top to bottom. x , where q x The number of times is d x , d x =t x -1,q x The constant term is denoted as q x (0); For the root node R, first start from Z p Randomly select an element s and set q R (0) = s; then from Z p Randomly select d R elements as q R Other d R points; finally, Lagrange interpolation is used to obtain the polynomial q of R R ; For other non-leaf nodes x, first set q x (0) = q parent(x) (index(x)); then from Z p Randomly select d x elements as q x Other d x points; finally, Lagrange interpolation is used to obtain the polynomial q of x x ; For leaf node x, directly set q x =q x (0) = q parent(x) (index(x)); Let T represent the tree access structure, Y represent the set of all leaf nodes, i represent the leaf node, i∈Y, the encryption party encrypts the plaintext M∈G T The generated ciphertext is expressed as: The decryption process is as follows: Suppose the attribute set associated with the user's decryption private key SK is S, and the tree access structure in the ciphertext CT is T. For each node x in the tree access structure T, calculate a value F associated with the node x x , perform the following operations in different situations: Case 1: x is a leaf node: If att(x)∈S, then compute: if Then set F x =⊥, where ⊥ represents a special value; Case 2: x is a non-leaf node: Let z represent the child node of x. For each child node z, calculate the value F associated with the child node z. z , let Z x Represents a set consisting of x's child nodes z, and satisfies Z x ={z|F z ≠⊥} and |Z x |=t x , if there exists such a set Z x , then define another set I accordingly x ={index(z)|z∈Z x }, and calculate: in is the Lagrange coefficient; If there is no such set Z x , then F x =⊥; If the attribute set S satisfies the tree access structure T, then based on the operations defined in Case 1 and Case 2 above, the user recursively calculates F R , can be obtained Where R is the root node in the tree access structure T; Then, the user calculates according to the following formula: Finally, the user recovers the plaintext, i.e. S4. If the attribute in the user's decryption private key satisfies the access policy in the ciphertext, the user can use his decryption private key to restore the ciphertext to plaintext. Otherwise, the user's decryption private key cannot restore the ciphertext to plaintext. S5. If a user leaks his / her decryption private key to an unauthorized third party, the leaked decryption private key can be used to track the leaker to determine his / her identity.

2. According to claim 1, a ciphertext policy attribute-based encryption method supporting traitor tracing and tree access structure is characterized in that: The initialization setting process in step S1 is as follows: Let G and G T is a multiplicative cyclic group of order prime number p, Z p is the set of integers modulo p, e:G×G→G T is a bilinear map, g is a generator of group G, and defines a hash function H:{0,1} * →G, map the attributes to elements in group G; from Z p Randomly select three elements α, β and λ, and then generate common parameters (g, h = g β ,g λ ,e(g,g) α ) and master key (α, β, λ); set up tracking table 3. A ciphertext policy attribute-based encryption method supporting traitor tracing and tree-based access structure according to claim 2, characterized in that: The process of generating the user decryption private key in step S2 is as follows: First, the authorized agency A random element c is selected as a parameter associated with the user identity id. Indicates that from Z p The set obtained by removing element 0 from Z p Randomly select an element r from Z, and for each attribute j in the user attribute set S, p Randomly select an element r from j ;Finally, the authorized agency generates a decryption private key: Among them, 1 / (β+c) represents the inverse element of (β+c) modulo p; at the same time, the authorized agency stores the corresponding relationship (c, id) in the tracking table T.

4. The ciphertext policy attribute-based encryption method supporting traitor tracing and tree-based access structure according to claim 1, characterized in that: The tracking conditions in step S5 are as follows: Assume that the leaked decryption private key is SK, whose components include (K, K', K0, {K j ,K' j } j∈S ), the attribute set associated with SK is S; if the decryption private key SK satisfies the following two format check conditions, the tracking operation is performed on the decryption private key SK; otherwise, the tracking operation does not need to be performed on the decryption private key SK; Decryption private key format check conditions: (1)K'∈Z p ,K,K0,K j ,K' j ∈G; (2) There exists an attribute j∈S such that:

5. A ciphertext policy attribute-based encryption method supporting traitor tracing and tree-structured access structure according to claim 4, characterized in that: The tracking process in step S5 is as follows: Query c in the tracking table T, K'=c: if c exists, output the corresponding user identity mark id; otherwise, output a special symbol Indicates that the target you want to track is not stored in T.

Images