A method for access control with distinguished permissions based on attribute-based encryption
By using an attribute-based encryption access control method, which generates keys and ciphertext using attribute sets, the management difficulties and flexibility issues of traditional access control models under large-scale user data are solved, achieving fine-grained access control and efficient data encryption and decryption.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING INST OF COMP TECH & APPL
- Filing Date
- 2022-10-18
- Publication Date
- 2026-05-15
AI Technical Summary
Traditional access control models are difficult to manage and inflexible when there are many users and large amounts of data. Role-based access control models cannot achieve fine-grained access control.
An attribute-based encryption access control method is adopted, which generates a key and ciphertext through an attribute set, encrypts the data using a symmetric encryption mechanism, encrypts the symmetric key using an attribute-based encryption mechanism, and signs the data when the data owner generates the ciphertext to ensure the integrity and non-repudiation of the data.
It achieves fine-grained access control, reduces the complexity of access management, ensures the efficiency of data encryption and decryption, and supports flexible access control.
Smart Images
Figure CN115664753B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of attribute cryptography and access control technology, specifically relating to an access control method for distinguishing permissions based on attribute encryption. Background Technology
[0002] Access control is a method of explicitly granting or restricting the ability and scope of access to objects (such as data resources) by a subject. By restricting access to data resources, it prevents unauthorized intrusion by unauthorized users and damage caused by careless operations by authorized users, thereby ensuring the controlled and legitimate use of data resources. Traditional access control models have some shortcomings. Discretionary Access Control (DAC) and Mandatory Access Control (MAC) models become difficult and inflexible to manage when there are many users and large amounts of data. Role-Based Access Control (RBAC) simplifies access control management, but it cannot achieve fine-grained access control.
[0003] Attribute-based encryption describes users or ciphertext through attributes. Encrypting data does not require knowledge of the user's public key or identity information. It provides confidentiality and integrity while supporting fine-grained, flexible access control. In attribute-based encryption, ciphertext and keys are generated based on a set of attributes. An access structure is incorporated into the ciphertext and key; that is, the user's private key is associated with the attribute set, and the ciphertext with the access structure, or vice versa. The user's decryption capabilities are controlled through the user's attribute set and access structure, thus enabling the data owner to control access to the ciphertext and key. The data owner does not need to distribute attribute keys to each user; they only need to manage permissions through the access structure, significantly reducing the complexity of permission management, providing more flexible access control, and achieving "one-to-many" encrypted file access and control. Summary of the Invention
[0004] (a) Technical problems to be solved
[0005] The technical problem this invention aims to solve is how to provide an access control method based on attribute encryption to differentiate permissions, in order to address the difficulties and inflexibility of access control management in traditional access control models such as Discretionary Access Control (DAC) and Mandatory Access Control (MAC) when there are many users and large amounts of data; while Role-Based Access Control (RBAC) simplifies access control management but cannot achieve fine-grained access control.
[0006] (II) Technical Solution
[0007] To address the aforementioned technical problems, this invention proposes an access control method based on attribute encryption and differentiated permissions. This method is applied to an access control system, which comprises four parts: an authority center server, a data storage server, an access controller, and users. The method includes the following steps:
[0008] S1, System Initialization Phase
[0009] S11. The system administrator configures the user attribute set and permission attribute set, which are managed and maintained by the access controller server.
[0010] S12. The access controller server runs the system initialization algorithm, generates the system public key and the system master key, and sends the system public key to the user;
[0011] S2, Key Generation Phase
[0012] S21. The access controller server runs a user key generation algorithm to generate user private keys for different users based on the system master key and user attributes, and then sends them to the corresponding users.
[0013] S22. The access controller server runs the permission key generation algorithm, generates permission keys for different permissions based on the system master key and permission attributes, and sends them to the corresponding users.
[0014] S3, Data Sharing Phase
[0015] S31. Encrypting Data: The data owner encrypts shared data through the access controller client. The access controller client runs a symmetric encryption algorithm, using the symmetric key and the plaintext of the shared data as parameters to generate the ciphertext of the shared data.
[0016] S32. Encrypting the symmetric key: The data owner encrypts the symmetric key through the access controller client. The access controller client runs the attribute encryption algorithm, using the symmetric key and access control structure as parameters to generate the encrypted symmetric key.
[0017] S33, Signature: The data owner signs the encrypted shared data through the access controller client. The access controller client runs a signature algorithm, using the encrypted shared data and the data owner's user private key as parameters to generate a digital signature;
[0018] S34. Shared Data: The data owner shares data through the access controller client. The access controller client combines the ciphertext of the shared data, the encrypted symmetric key, and the digital signature into a shared data file and sends it to the data storage server.
[0019] S4, Data Access Phase
[0020] S41. Accessing Data: Data users access the data storage server through the access controller client to obtain the corresponding shared data files;
[0021] S42. Decrypt Data: The access controller client runs a data decryption algorithm, using the shared data file and the data user's permission key as parameters. First, it decrypts the data using the data user's permission key to obtain a symmetric key, and then uses the obtained symmetric key to decrypt the plaintext of the shared data.
[0022] S43, Signature Verification: The access controller client runs a signature verification algorithm, using the signature in the shared data file, the plaintext of the shared data, and the system public key as parameters to obtain the signature verification result.
[0023] Furthermore, the access controller includes an access controller server and an access controller client.
[0024] Furthermore, users include system administrators, data owners, and data users.
[0025] Furthermore, the access controller server runs on the authority center server, while the access control program client runs on the user terminal.
[0026] Furthermore, in S21, the user attributes include name, age, address, department, role, and length of service.
[0027] Furthermore, in S22, the permission attributes include: read and write.
[0028] Furthermore, in step S31, the symmetric key is a randomly generated symmetric key.
[0029] Furthermore, in step S32, the data owner manages permissions through the access structure.
[0030] Furthermore, the ciphertext and key are generated based on the attribute set, and the access structure is incorporated into the ciphertext and key. That is, the user's private key is associated with the attribute set, and the ciphertext is associated with the access structure. The user's decryption ability is controlled through the user attribute set and the access structure.
[0031] Furthermore, a user can decrypt to obtain the symmetric key if and only if the user's key association attributes satisfy the access control policy, and then use the symmetric key to decrypt to obtain the shared data plaintext.
[0032] (III) Beneficial Effects
[0033] This invention proposes an access control method based on attribute encryption for differentiated permissions. The access control system employs a hybrid encryption mechanism: symmetric encryption is used to encrypt shared data, and attribute-based encryption is used to encrypt the symmetric key (used to encrypt shared data). A user can decrypt the symmetric key to obtain it only if the user's key association attributes satisfy the access control policy. The user then uses the symmetric key to decrypt the shared data in plaintext. To ensure the integrity and non-repudiation of the shared data, the data owner signs the ciphertext using their private key simultaneously. By employing both symmetric encryption and attribute-based encryption, this method achieves fine-grained, attribute-based access control while ensuring efficient encryption and decryption. Attached Figure Description
[0034] Figure 1 This is a schematic diagram of the access control system of the present invention. Detailed Implementation
[0035] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.
[0036] This invention relates to the fields of attribute cryptography and access control technology. In access control based on attribute encryption, users or ciphertext are described through attributes. Ciphertext is associated with attribute sets, and keys are associated with access structures. Users obtain access permissions based on specific attributes, realizing fine-grained dynamic authorization for a large number of users. This can solve the fine-grained access control problem in open and complex network information systems.
[0037] This invention implements access control based on attribute encryption, which can reduce the complexity of permission management and achieve more flexible and fine-grained access control.
[0038] The access control system described in this invention employs a hybrid encryption mechanism. It utilizes attribute-based encryption for data access control and symmetric encryption for data encryption and decryption. The access control system comprises four parts: an authority center server, a data storage server, access controllers (server and client), and users (system administrators, data owners, and data users). The access controller server runs on the authority center server, and the access control program client runs on the user terminal.
[0039] The specific implementation method is as follows, which mainly includes four stages: system initialization stage, key generation stage, data sharing stage, and data access stage.
[0040] S1, System Initialization Phase
[0041] S11. The system administrator configures the user attribute set and permission attribute set, which are managed and maintained by the access controller server.
[0042] S12. The access controller server runs the system initialization algorithm, generates the system public key and the system master key, and sends the system public key to the user.
[0043] S2, Key Generation Phase
[0044] S21. The access controller server runs a user key generation algorithm to generate user private keys for different users based on the system master key and user attributes (such as name, age, address, department, role, length of service, etc.) and sends them to the corresponding users.
[0045] S22. The access controller server runs the permission key generation algorithm, generates permission keys for different permissions based on the system master key and permission attributes (such as read, write, etc.), and sends them to the corresponding users.
[0046] S3, Data Sharing Phase
[0047] S31. Encrypting Data: The data owner encrypts shared data by accessing the controller client. The controller client runs a symmetric encryption algorithm, using a randomly generated symmetric key and the plaintext of the shared data as parameters to generate the ciphertext of the shared data.
[0048] S32. Encrypting the symmetric key: The data owner encrypts the symmetric key through the access controller client. The access controller client runs the attribute encryption algorithm, using the symmetric key and access control structure as parameters, to generate the encrypted symmetric key. The data owner manages permissions through the access structure.
[0049] S33, Signature: The data owner signs the encrypted shared data through the access controller client. The access controller client runs a signature algorithm, using the encrypted shared data and the data owner's user private key as parameters to generate a digital signature;
[0050] S34. Shared Data: The data owner shares data through the access controller client. The access controller client combines the ciphertext of the shared data, the encrypted symmetric key, and the digital signature into a shared data file and sends it to the data storage server.
[0051] S4, Data Access Phase
[0052] S41. Accessing Data: Data users access the data storage server through the access controller client to obtain the corresponding shared data files;
[0053] S42. Decrypt Data: The access controller client runs a data decryption algorithm, using the shared data file and the user's permission key as parameters. First, it decrypts the data using the user's permission key to obtain a symmetric key (this key is used to encrypt the shared data), and then uses the obtained symmetric key to decrypt the plaintext of the shared data.
[0054] S43, Signature Verification: The access controller client runs a signature verification algorithm, using the signature in the shared data file, the plaintext of the shared data, and the system public key as parameters to obtain the signature verification result.
[0055] The access control system of this invention employs a hybrid encryption mechanism. It uses a symmetric encryption scheme to encrypt shared data and an attribute-based encryption scheme to encrypt the symmetric key (used to encrypt shared data). A user can decrypt the symmetric key to obtain it if and only if the user's key association attributes satisfy the access control policy. The user then uses the symmetric key to decrypt the shared data in plaintext. To ensure the integrity and non-repudiation of the shared data, the data owner signs the ciphertext using their private key. By employing both a symmetric encryption mechanism and an attribute-based encryption scheme, it achieves both attribute-based, fine-grained access control and ensures efficient data encryption and decryption.
[0056] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. An access control method based on attribute encryption for differentiated permissions, characterized in that, This method is applied to an access control system, which consists of four parts: an authority center server, a data storage server, an access controller, and users. The method includes the following steps: S1, System Initialization Phase S11. The system administrator configures the user attribute set and permission attribute set, which are managed and maintained by the access controller server. S12. The access controller server runs the system initialization algorithm, generates the system public key and the system master key, and sends the system public key to the user; S2, Key Generation Phase S21. The access controller server runs a user key generation algorithm to generate user private keys for different users based on the system master key and user attributes, and then sends them to the corresponding users. S22. The access controller server runs the permission key generation algorithm, generates permission keys for different permissions based on the system master key and permission attributes, and sends them to the corresponding users. S3, Data Sharing Phase S31. Encrypting Data: The data owner encrypts shared data through the access controller client. The access controller client runs a symmetric encryption algorithm, using the symmetric key and the plaintext of the shared data as parameters to generate the ciphertext of the shared data. S32. Encrypting the symmetric key: The data owner encrypts the symmetric key through the access controller client. The access controller client runs the attribute encryption algorithm, using the symmetric key and access control structure as parameters to generate the encrypted symmetric key. S33, Signature: The data owner signs the encrypted shared data through the access controller client. The access controller client runs a signature algorithm, using the encrypted shared data and the data owner's user private key as parameters to generate a digital signature; S34. Shared Data: The data owner shares data through the access controller client. The access controller client combines the ciphertext of the shared data, the encrypted symmetric key, and the digital signature into a shared data file and sends it to the data storage server. S4, Data Access Phase S41. Accessing Data: Data users access the data storage server through the access controller client to obtain the corresponding shared data files; S42. Decrypt Data: The access controller client runs a data decryption algorithm, using the shared data file and the data user's permission key as parameters. First, it decrypts the data using the data user's permission key to obtain a symmetric key, and then uses the obtained symmetric key to decrypt the plaintext of the shared data. S43, Signature Verification: The access controller client runs a signature verification algorithm, using the signature in the shared data file, the plaintext of the shared data, and the system public key as parameters to obtain the signature verification result.
2. The access control method for differentiated permissions based on attribute encryption as described in claim 1, characterized in that, The access controller includes the access controller server and the access controller client.
3. The access control method for differentiated permissions based on attribute encryption as described in claim 1, characterized in that, Users include system administrators, data owners, and data users.
4. The access control method for differentiated permissions based on attribute encryption as described in claim 1, characterized in that, The access controller server runs on the authority center server, while the access control program client runs on the user terminal.
5. The access control method for differentiated permissions based on attribute encryption as described in claim 1, characterized in that, In S21, user attributes include name, age, address, department, role, and length of service.
6. The access control method for differentiated permissions based on attribute encryption as described in claim 1, characterized in that, In S22, the permission attributes include: read and write.
7. The access control method for differentiated permissions based on attribute encryption as described in claim 1, characterized in that, In step S31, the symmetric key is a randomly generated symmetric key.
8. The access control method for differentiated permissions based on attribute encryption as described in claim 1, characterized in that, In step S32, the data owner manages permissions through the access structure.
9. The access control method for differentiated permissions based on attribute encryption as described in any one of claims 1-8, characterized in that, The ciphertext and key are generated based on the attribute set, and the access structure is incorporated into the ciphertext and key. That is, the user's private key is associated with the attribute set, and the ciphertext is associated with the access structure. The user's decryption ability is controlled through the user attribute set and the access structure.
10. The access control method for differentiated permissions based on attribute encryption as described in claim 9, characterized in that, A user can decrypt to obtain the symmetric key if and only if the user's key association attributes satisfy the access control policy, and then use the symmetric key to decrypt to obtain the plaintext of the shared data.