Distributed identity-based encryption against key leakage

Abstract

The application discloses a kind of anti-key leakage distributed identity-based encryption method, by system initialization, key generation, key update, encryption, decryption step composition.In the key generation step, for the key escrow problem in identity-based encryption mechanism, the decryption key is calculated for user by distributed key generation technology, the privacy of user key is guaranteed, the problem that the right of key generation center is too large in traditional identity-based encryption is solved.In the key update step, by re-randomizing to the original key of user, the entropy loss of key caused by information leakage is filled, and the security and practicability of the scheme under continuous leakage attack are guaranteed.In the encryption step, by introducing the legality verification element of ciphertext, the ciphertext is not extensible, so that the scheme has the security of resisting selected ciphertext.The method of the application adopts anti-leakage cryptography mechanism and distributed key generation technology, and proposes a practical identity-based encryption scheme, which can be used in the field of access control technology.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of public key encryption technology, and particularly relates to a construction method based on identity-based encryption. BACKGROUND

[0002] In 1984, Shamir proposed an identity-based encryption idea, in which no certificate is used, and the identity of a user, such as an identity card number, a mailbox address or the like, is directly used as a public key to simplify the management of keys in a public key infrastructure. The identity-based encryption mechanism has an inherent defect, that is, a key escrow problem, in which a decryption key of a user is generated by a centralized key generation center. The key generation center can decrypt any ciphertext and forge a signature of any message, and thus the privacy of the user cannot be guaranteed. A distributed identity-based encryption mechanism divides the capability of the key generation center, and a user key is generated by multiple institutions to eliminate the untrustworthiness of the centralized institution.

[0003] The traditional identity-based encryption mechanism assumes that the internal state of an honest participant is completely secret to a malicious adversary, and does not consider the influence of an information leakage attack on the security of the mechanism. In a real application, a malicious adversary can obtain the internal state of an honest participant through various side-channel attacks, such as a cold start attack, spectrum analysis, power consumption and the like, which can enable the adversary to obtain relevant information of the secret state. In order to improve the practicability and security of a cryptographic scheme, a leakage-resistant cryptographic mechanism has attracted the attention of researchers.

[0004] In the existing identity-based encryption method, no method can simultaneously support leakage resistance and distributed key generation. Therefore, it is of great practical significance to study a distributed identity-based encryption technology scheme against key leakage. SUMMARY

[0005] The present application aims to overcome the defects of the prior art and provide a practical distributed identity-based encryption method against key leakage.

[0006] The technical scheme adopted to solve the above problems comprises the following steps:

[0007] (1) System initialization

[0008] 1) Set public parameters Params:

[0009] Params={q,G,G T ,g,g2,g3,U,V,e,H,H ′ ,KDF,Ext}

[0010] where G and G T are cyclic groups of orderq G, g is the generator of the cyclic group G, g2, g3, U, V are randomly selected elements from the cyclic group G, e is a bilinear map, H and H' are collision-resistant hash functions, and satisfy t is a finite positive integer, is a finite positive integer, q is an integer group, KDF is a key derivation function, satisfying Ext is a strong randomness extractor, satisfying Ext: G T ×{0,1} t →{0,1} k .

[0011] 2) Key generation center KGC and key privacy service center KPA i select their respective keys, 1≤i≤n, n represents the number of key privacy service centers KPA i , n is a finite positive integer, and the respective public keys are calculated as follows:

[0012] The key generation center KGC selects a random element s0 in the group as its own key, and sets the public key P0 of the key generation center KGC:

[0013]

[0014] The key privacy service center KPA i selects a random element s i as its own key in the group , and sets the public key P i of the key privacy service center KPA i :

[0015]

[0016] where 1≤i≤n, n represents the number of key privacy service centers KPA i , n is a finite positive integer.

[0017] The key generation center KGC and the key privacy service center KPA i get the intermediate parameter g1 as follows:

[0018]

[0019] The public parameters Params, the keys of the key generation center KGC and the key privacy service center KPA i are kept secret respectively. The system initialization step is completed.

[0020] (2) Key generation

[0021] 1) Users in the group We select a random element x as the blinding factor and calculate the intermediate parameter X = g. x The (id,X) is sent to the key generation center KGC, where id is the user's identity information.

[0022] 2) The key generation center KGC receives (id, X) and in the group Select random elements t1, t2, and determine the partial key Q′0, Q″0, sk′ using the following formula. id,1 ,sk id,2 ,sk′ id,3 ,sk id,4 :

[0023]

[0024]

[0025]

[0026]

[0027]

[0028]

[0029] Key Generation Center KGC will (sk′ id,1 ,sk id,2 ,sk′ id,3 ,sk id,4 Send (Q′0,Q″0,id,X) to the Key Privacy Service Center (KPA) and send (Q′0,Q″0,id,X) to the user. i .

[0030] 3) Key Privacy Service Center (KPA) i After receiving (Q′0,Q″0,id,X), determine the intermediate parameter Q′ using the following formula. i intermediate parameter Q″ i :

[0031]

[0032]

[0033] Key Privacy Service Center (KPA) i Calculate sequentially, and finally (Q′) n ,Q″ n Send to the user.

[0034] 4) Users first determine the intermediate parameters themselves. and The specific calculation process is as follows:

[0035]

[0036]

[0037] The user determines his own key sk id :

[0038] sk id = (sk id,1 , sk id,2 , sk id,3 , sk id,4 )

[0039]

[0040]

[0041]

[0042]

[0043] The distributed key generation step is completed.

[0044] (3) Key update

[0045] The key generation center KGC selects a random element in the group Calculates the update key as follows:

[0046]

[0047]

[0048]

[0049]

[0050]

[0051] wherein, denotes the updated key of the jth round, denotes the updated user key of the j+1th round.

[0052] The key update step is completed.

[0053] (4) Encryption

[0054] The encrypter encrypts a message m for an identity user, m is represented as a k-long {0,1} string, k takes a value of 2 4~2 12 i.e. m e {0,1} k The encrypter randomly selects an element s e {0,1} and an element η e {0,1} t , t takes the value 2 4 ~2 12 and determines the encrypted information CT:

[0055] CT = (C1, C2, C3, v, η)

[0056]

[0057] C2 = g s

[0058] C3 = (U id V) s

[0059] v = sk1 + k2

[0060] where, denotes the XOR operation.

[0061] (k1, k2) = KDF(C4)

[0062]

[0063] β = H(C1, C2, C3, η)

[0064] The encryption step is completed.

[0065] (5) Decryption

[0066] After receiving the encrypted information CT, the user decrypts it using his own secret key sk id and calculates and outputs the message m according to the following formula:

[0067] β = H(C1, C2, C3, η)

[0068] X1 = e(sk id,1 , C2) x e(sk id,2 , C3)

[0069] X2 = e(sk id,3 , C2) x e(sk id,4 , C3)

[0070]

[0071] (k'1, k'2) = KDF(C'4)

[0072] Verify that g v ​whether equal, if equal, output message m as follows:

[0073]

[0074] if not equal, terminate calculation, output failure.

[0075] Complete anti-key leakage distributed identity-based encryption method.

[0076] In the (1) system initialization of the 2) step of the application, the key privacy service center KPA i selects respective keys, 1≤i≤n, n represents the number of key privacy service centers KPA i , n is best valued at [50, 100].

[0077] In the (1) system initialization of the 2) step of the application, the key privacy service center KPA i selects respective keys, 1≤i≤n, n represents the number of key privacy service centers KPA i , n is best valued at 75.

[0078] In the (4) encryption step of the application, the encrypter encrypts a message m for an identity based user, m is represented as a k-long {0,1} string, k is best valued at 2 8 , that is, m∈{0,1} k , the encrypter randomly selects an element s in , randomly selects an element η∈{0,1} t , t is best valued at 2 8 , and determines the encrypted information CT.

[0079] In the key generation step of the application, aiming at the key escrow problem in the identity-based encryption mechanism, the distributed key generation method is used to calculate the decryption key for the user, which guarantees the privacy of the user key and solves the technical problem of excessive power of the key generation center in the traditional identity-based encryption. In the key update step, by re-randomizing the original key, the entropy loss of the key caused by information leakage is solved, and the security and practicability of the technical scheme under continuous leakage attack are guaranteed. In the encryption step, by introducing the ciphertext legality verification element, the ciphertext is made non-expandable, which ensures that the application has the security of resisting chosen ciphertext attack. The application method adopts the anti-leakage cryptography mechanism and the distributed key generation method, and proposes a practical identity-based encryption scheme. The application method has the advantages of security and practicability, and can be used in the technical field of access control. BRIEF DESCRIPTION OF DRAWINGS

[0080] Figure 1 is the flowchart of embodiment 1 of the application. Detailed Implementation

[0081] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments, but the present invention is not limited to the following embodiments.

[0082] Example 1

[0083] exist Figure 1 In this embodiment, the distributed identity base encryption method for preventing key leakage consists of the following steps.

[0084] (1) System initialization

[0085] 1) Set the public parameter Params:

[0086] Params = {q, G, G} T ,g,g2,g3,U,V,e,H,H ′ ,KDF,Ext}

[0087] Among them G and G T Is the order as q Let G be a cyclic group, g be a generator of the cyclic group G, g2, g3, U, V be elements randomly selected from the cyclic group G, e be a bilinear mapping, and H and H′ be collision-resistant hash functions that satisfy the following conditions: t is a finite positive integer. For model q The integer group, KDF is a key diffraction function that satisfies Ext is a strongly random extractor that satisfies Ext:G T ×{0,1} t →{0,1} k .

[0088] 2) Key Generation Center (KGC) and Key Privacy Service Center (KPA) i Choose your own key, 1 ≤ i ≤ n, where n represents the Key Privacy Service Center (KPA). i The number of public keys, n, is a finite positive integer. In this embodiment, n is 75, and the public keys for each key are calculated as follows:

[0089] Key Generation Center (KGC) in the group Choose a random element s0 as your key and set the public key P0 of the key generation center KGC:

[0090]

[0091] Key Privacy Service Center (KPA) i In the group Select random element s i Use it as your own key and set up the Key Privacy Service Center (KPA).i public key P i :

[0092]

[0093] Where 1≤i≤n, n represents the Key Privacy Service Center (KPA). i The number of elements, n takes the value [50, 100], and in this embodiment, n takes the value 75.

[0094] Key Generation Center (KGC) and Key Privacy Service Center (KPA) i The intermediate parameter g1 is obtained by the following formula:

[0095]

[0096] Publicly disclosed parameters (Params), Key Generation Center (KGC), and Key Privacy Service Center (KPA) i Each key is kept secret; the system initialization steps are completed.

[0097] (2) Key generation

[0098] 1) Users in the group We select a random element x as the blinding factor and calculate the intermediate parameter X = g. x The (id,X) is sent to the key generation center KGC, where id is the user's identity information.

[0099] 2) The key generation center KGC receives (id, X) and in the group Select random elements t1, t2, and determine the partial key Q′0, Q″0, sk′ using the following formula. id,1 ,sk id,2 ,sk′ id,3 ,sk id,4 :

[0100]

[0101]

[0102]

[0103]

[0104]

[0105]

[0106] Key Generation Center KGC will (sk′ id,1 ,sk id,2 ,sk′ id,3 ,skid,4 ) to the user, and sends (Q'0, Q"0, id, X) to the key privacy service center KPA i .

[0107] 3) The key privacy service center KPA i After receiving (Q'0, Q"0, id, X), the intermediate parameter Q' is determined according to the following formula i , and the intermediate parameter Q" i :

[0108]

[0109]

[0110] The key privacy service center KPA i is calculated in turn, and the final (Q' n , Q" n ) is sent to the user.

[0111] 4) The user first determines the intermediate parameters and The specific calculation process is as follows:

[0112]

[0113]

[0114] The user determines the key sk of itself id :

[0115] sk id = (sk id,1 , sk id,2 , sk id,3 , sk id,4 )

[0116]

[0117]

[0118]

[0119]

[0120] The distributed key generation step is completed.

[0121] In the key generation step, the present application solves the technical problem of excessive power of a key generation center in traditional identity-based encryption by calculating the decryption key for the user through a distributed key generation method, and ensures the privacy of the user key.

[0122] (3) Key update

[0123] The key generation center KGC selects a random element in the group Computes the update key As follows:

[0124]

[0125]

[0126]

[0127]

[0128]

[0129] wherein, denotes the updated key of the jth round, denotes the updated user key of the j+1th round.

[0130] The key update step is completed.

[0131] In the key update step, by re-randomizing the original key, the entropy loss of the key caused by information leakage is solved, and the security and practicability of the technical solution under continuous leakage attack are ensured.

[0132] (4) Encryption

[0133] The encrypter encrypts a message m for an identity user, m is represented as a k-long {0,1} string, that is, m∈{0,1} k , k takes a value of 2 4 ~2 12 , and in the embodiment, k takes a value of 2 8 The encrypter randomly selects an element s in , randomly selects an element η∈{0,1} t , t takes a value of 2 4 ~2 12 , and in the embodiment, t takes a value of 2 8 , and determines the encrypted information CT:

[0134] CT=(C1,C2,C3,v,η)

[0135]

[0136] C2=g s

[0137] C3=(U id V) s

[0138] v = sk1 + k2

[0139] wherein, denotes XOR operation.

[0140] (k1, k2) = KDF(C4)

[0141]

[0142] β = H(C1, C2, C3, η)

[0143] The encryption step is completed.

[0144] In the encryption step, by introducing ciphertext legitimacy verification element, the ciphertext is made non-extensible, ensuring that the present application has security against chosen ciphertext attack. The present application method adopts anti-leakage cryptography mechanism and distributed key generation method, and proposes a practical identity-based encryption scheme.

[0145] (5) Decryption

[0146] After receiving the encrypted information CT, the user decrypts with his own key sk id , calculates and outputs the message m according to the following formula:

[0147] β = H(C1, C2, C3, η)

[0148] X1= e(sk id,1 ,C2) × e(sk id,2 ,C3)

[0149] X2= e(sk id,3 ,C2) × e(sk id,4 ,C3)

[0150]

[0151] (k'1, k'2) = KDF(C'4)

[0152] Verify whether g v is equal to , if equal, output the message m as follows:

[0153]

[0154] If not equal, terminate the calculation and output failure.

[0155] The anti-key-leakage distributed identity-based encryption method is completed.

[0156] Embodiment 2

[0157] The anti-key-leakage distributed identity-based encryption method of the embodiment consists of the following steps.

[0158] (1) System initialization

[0159] 1) Set public parameters Params

[0160] This step is the same as that in Embodiment 1.

[0161] 2) Key generation center KGC and key privacy service center KPA i Select respective keys, 1≤i≤n, n represents the number of key privacy service centers KPA i , n is a finite positive integer, and calculate respective public keys as follows:

[0162] The key generation center KGC selects a random element s0 in the group as its own key, and sets the public key P0 of the key generation center KGC:

[0163]

[0164] The key privacy service center KPA i selects a random element s i in the group as its own key, and sets the public key P i of the key privacy service center KPA i :

[0165]

[0166] wherein 1≤i≤n, n represents the number of key privacy service centers KPA i , n takes a value of [50, 100], and n of the embodiment takes a value of 50.

[0167] The key generation center KGC and the key privacy service center KPA i obtain an intermediate parameter g1 according to the following formula:

[0168]

[0169] The public parameters Params, the keys of the key generation center KGC and the key privacy service center KPA i are respectively kept secret; and the system initialization step is completed.

[0170] (2) Key generation

[0171] This step is the same as that in Embodiment 1.

[0172] (3) Key update

[0173] This step is the same as that in Embodiment 1.

[0174] (4) Encryption

[0175] Encryptor for identity A user encrypts a message m, where m is a string of length k ∈ {0,1}. k k takes the value 2 4 ~2 12 In this embodiment, k is 2. 4 The encryptor Randomly select element s, and randomly select element η∈{0,1} t t takes the value 2 4 ~2 12 In this embodiment, t is taken as 2. 4 And determine the encrypted information CT:

[0176] CT=(C1,C2,C3,v,η)

[0177]

[0178] C2 = g s

[0179] C3=(U id V) s

[0180] v = sk1 + k2

[0181] in, This represents the XOR operation.

[0182] (k1,k2)=KDF(C4)

[0183]

[0184] β=H(C1,C2,C3,η)

[0185] Complete the encryption steps.

[0186] The other steps are the same as in Example 1. This completes the distributed identity-based encryption method resistant to key leakage.

[0187] Example 3

[0188] The distributed identity base encryption method against key leakage in this embodiment consists of the following steps.

[0189] (1) System initialization

[0190] 1) Set public parameter Params

[0191] The steps are the same as in Example 1.

[0192] 2) Key Generation Center (KGC) and Key Privacy Service Center (KPA) i Choose your own key, 1 ≤ i ≤ n, where n represents the Key Privacy Service Center (KPA). i The number of keys, n, takes values ​​of [50, 100]. In this embodiment, n is 100, and the public keys for each key are calculated as follows:

[0193] Key Generation Center (KGC) in the group Choose a random element s0 as your key and set the public key P0 of the key generation center KGC:

[0194]

[0195] Key Privacy Service Center (KPA) i In the group Select random element s i Use it as your own key and set up the Key Privacy Service Center (KPA). i public key P i :

[0196]

[0197] Where 1≤i≤n, n represents the Key Privacy Service Center (KPA). i The number of elements, n takes the value [50, 100], and in this embodiment, n takes the value 100.

[0198] Key Generation Center (KGC) and Key Privacy Service Center (KPA) i The intermediate parameter g1 is obtained by the following formula:

[0199]

[0200] Publicly disclosed parameters (Params), Key Generation Center (KGC), and Key Privacy Service Center (KPA) i Each key is kept secret; the system initialization steps are completed.

[0201] (2) Key generation

[0202] The steps are the same as in Example 1.

[0203] (3) Key update

[0204] The steps are the same as in Example 1.

[0205] (4) Encryption

[0206] Encryptor for identity The user encrypts a message m, where m is a string of length k, {0,1}, and k is a value of 2. 4 ~2 12i.e.m∈{0,1} k The k of the embodiment is 2 12 The encrypter randomly selects an element s in and randomly selects an element η∈{0,1} t The t of the embodiment is 2 4 ~2 12 The t of the embodiment is 2 12 And determines the encrypted information CT:

[0207] CT=(C1,C2,C3,v,η)

[0208]

[0209] C2=g s

[0210] C3=(U id V) s

[0211] v=sk1+k2

[0212] Wherein, Indicates the XOR operation.

[0213] (k1,k2)=KDF(C4)

[0214]

[0215] β=H(C1,C2,C3,η)

[0216] The encryption step is completed.

[0217] The other steps are the same as those in Embodiment 1. The anti-key-leakage distributed identity-based encryption method is completed.

Claims

1. A distributed identity-based encryption method resistant to key leakage, characterized in that... It consists of the following steps: (1) System initialization 1) Set the public parameter Params: Params={q,G,G T ,g,g2,g3,U,V,e,H,H ′ ,KDF,Ext} Among them G and G T Is the order as q Let G be a cyclic group, g be a generator of the cyclic group G, g2, g3, U, V be elements randomly selected from the cyclic group G, e be a bilinear mapping, and H and H′ be collision-resistant hash functions that satisfy H: t is a finite positive integer. For model q The integer group, H′: KDF is a key diffraction function that satisfies KDF: Ext is a strongly random extractor that satisfies Ext:G T ×{0,1} t →{0,1} k ; 2) Key Generation Center (KGC) and Key Privacy Service Center (KPA) i Choose your own key, 1 ≤ i ≤ n, where n represents the Key Privacy Service Center (KPA). i The number of keys, where n is a finite positive integer, is determined, and the public keys for each key are calculated as follows: Key Generation Center (KGC) in the group Choose a random element s0 as your key and set the public key P0 of the key generation center KGC: Key Privacy Service Center (KPA) i In the group Select random element s i Use it as your own key and set up the Key Privacy Service Center (KPA). i public key P i : Where 1≤i≤n, n represents the Key Privacy Service Center (KPA). i The number of elements, where n is a finite positive integer; Key Generation Center (KGC) and Key Privacy Service Center (KPA) i The intermediate parameter g1 is obtained by the following formula: Publicly disclosed parameters (Params), Key Generation Center (KGC), and Key Privacy Service Center (KPA) i Each key is kept secret; the system initialization steps are completed; (2) Key generation 1) Users in the group We select a random element x as the blinding factor and calculate the intermediate parameter X = g. x Send (id,X) to the key generation center KGC, where id is the user's identity information; 2) The key generation center KGC receives (id, X) and in the group Select random elements t1, t2, and determine the partial key Q′0, Q″0, sk′ using the following formula. id,1 ,sk id,2 ,sk′ id,3 ,sk id,4 : Key Generation Center KGC will (sk′ id,1 ,sk id,2 ,sk′ id,3 ,sk id,4 Send (Q′0,Q″0,id,X) to the Key Privacy Service Center (KPA) and send (Q′0,Q″0,id,X) to the user. i ; 3) Key Privacy Service Center (KPA) i After receiving (Q′0,Q″0,id,X), determine the intermediate parameter Q′ using the following formula. i intermediate parameter Q″ i : Key Privacy Service Center (KPA) i Calculate sequentially, and finally (Q′) n ,Q″ n Send to the user; 4) Users first determine the intermediate parameters themselves. and The specific calculation process is as follows: The user determines their own key sk id : en id =(en id,1 ,sk id,2 ,sk id,3 ,sk id,4 ) Complete the distributed key generation step; (3) Key update Key Generation Center (KGC) in the group Select random element r1 j+1 r2 j+1 Calculate the update key as follows: in, This represents the key after the j-th round update. This represents the user key after the (j+1)th round update; Complete the key update steps; (4) Encryption Encryptor for identity The user encrypts a message m, where m is a string of length k, {0,1}, and k is a value of 2. 4 ~2 12 That is, m∈{0,1} k The encryptor Randomly select element s, and randomly select element η∈{0,1} t t takes the value 2 4 ~2 12 And determine the encrypted information CT: CT=(C1,C2,C3,v,η) C2=g s C3=(U id V) s v = sk1 + k2 in, Represents the XOR operation; (k1,k2)=KDF(C4) C4=e(g1,g3) s e(g1,g2) βs β=H(C1,C2,C3,η) Complete the encryption steps; (5) Decryption After receiving the encrypted message CT, the user uses their own key sk id To decrypt, calculate and output message m using the following formula: β = H(C1, C2, C3, η) X1=e(sk d，1 ,C2)×e(sk id，2 ,C3) X2=e(sk id，3 ,C2)×e(sk id，4 ,C3) (k′1, k′2) = KDF(C′4) Verify g v and If they are equal, output message m as follows: If they are not equal, the calculation will terminate and output "Failure". Complete a distributed identity-based encryption method that is resistant to key leakage.

2. The distributed identity-based encryption method against key leakage according to claim 1, characterized in that: In step 2) of system initialization (1), the Key Privacy Service Center (KPA) is mentioned. i Choose your own key, 1 ≤ i ≤ n, where n represents the Key Privacy Service Center (KPA). i The number of elements, where n takes the value [50, 100].

3. The distributed identity-based encryption method against key leakage according to claim 1 or 2, characterized in that: In step 2) of system initialization (1), the Key Privacy Service Center (KPA) is mentioned. i Choose your own key, 1 ≤ i ≤ n, where n represents the Key Privacy Service Center (KPA). i The number of elements, where n takes the value 75.

4. The distributed identity-based encryption method against key leakage according to claim 1, characterized in that: In step (4), the encryptor is an identity. The user encrypts a message m, where m is a string of length k, consisting of {0, 1}, and k is a number with a value of 2. 8 That is, m∈{0,1} k The encryptor Randomly select element s, and randomly select element η∈{0,1} t t takes the value 2 8 And determine the encrypted information CT.

Images