Efficient attribute-based signcryption method and system based on commercial secret SM9

Abstract

The present invention relates to an efficient attribute-based signcryption method and system based on commercial secret SM9. The method comprises: the attribute authorization end inputs security parameters and outputs a master key and public parameters; the attribute authorization end inputs a master key, public parameters, a client attribute set and an access structure and outputs a client key; the sending end inputs a message, a public parameter, a sending end attribute set, a sending end key and a receiving end attribute set and outputs a signcrypted ciphertext; the receiving end inputs a signcrypted ciphertext, a public parameter, a sending end attribute set, a receiving end attribute set and a receiving end key. Plain text and signature are output. The method and system can perform encryption and signing operations simultaneously, and can obtain access control functions when realizing the anonymity of the signing end.

Description

Technical Field

[0001] The present invention belongs to the field of Internet security technology, and in particular relates to an efficient attribute-based signcryption method and system based on commercial secret SM9. Background Art

[0002] With the gradual maturity of IoT technology, IoT devices are also becoming intelligent and lightweight, such as embedded micro sensors, intelligent RFID devices and laser scanners. These devices usually use wireless network communication to connect people and objects, and objects and objects. Wireless networks use broadcast RF signals for communication. Once these signals are captured, they will be more vulnerable to various network attacks, such as unauthorized access, address spoofing or man-in-the-middle attacks. In order to protect the confidentiality, integrity and non-repudiation of communication data in the IoT, data encryption algorithms and digital signature algorithms can be deployed simultaneously on lightweight devices. Attribute-based signature (ABS) is an important method to solve the above problems. It plays an important role in privacy protection, access control and data authentication. However, in the ABS scheme, on the one hand, it is impossible to complete encryption and signature operations at the same time. On the other hand, in order to realize the development strategy of national cyberspace security autonomy and controllability, it is necessary to design a cryptographic scheme that meets national secret standards. Summary of the invention

[0003] The purpose of the present invention is to provide an efficient attribute-based signcryption method and system based on commercial secret SM9, which can perform encryption and signing operations simultaneously and comply with the commercial secret SM9 identification signature standard.

[0004] To achieve the above object, the technical solution of the present invention is: an efficient attribute-based signcryption method based on commercial secret SM9, comprising the following steps:

[0005] Step S1, the attribute authorization terminal inputs the security parameter λ, and outputs the master key msk and the public parameter params;

[0006] Step S2: The attribute authorization terminal inputs the master key msk, public parameter params, access policy A, and client attribute set ω j , output the client key

[0007] Step S3: The sender inputs the message M, the public parameter params, and the sender attribute set ω s , sender key And the receiving end attribute set ω r , output the signcrypted ciphertext CT;

[0008] Step S4: The receiving end inputs the signcrypted ciphertext CT, public parameter params, and the sending end attribute set ω s , receiving end attribute set ωr and the receiving end key If the decryption result is a valid signature data generated by the sender, the plaintext and signature (M,σ) are output; otherwise, the rejection symbol ⊥ is output.

[0009] In one embodiment of the present invention, the step S1 specifically includes the following steps:

[0010] Step S11: The attribute authorization terminal inputs the security parameter λ and generates a bilinear pairing tuple BP=(G1, G2, G T ,e,p), where e:G1×G2→G T , p is a large prime number, |p| = λ; the attribute authorization end randomly selects the generator P1 of G1 and the generator P2 of G2. In addition, there is an effective and publicly computable isomorphic mapping ψ between G1 and G2: G2→G1, such that ψ(P2) = P1; the attribute authorization end selects the system attribute domain U = {att1,att2,…,att u},in 1≤i≤u, u=|U|, Attribute Authorization End Definition Algorithm Convert the attribute set ω into a binary ID ω ,in Defined as: input attribute set ω, system attribute domain U; ​​let ID ω [i] indicates ID ω The i-th position of i ∈ω, let ID ω [i] = 1; otherwise, let ID ω [i] = 0; where 1 ≤ i ≤ u, u = |U|; finally, the algorithm outputs ID ω ;

[0011] Step S12: attribute authorization terminal randomly selects Calculate P pub =αP2, g = e(P1,P pub );

[0012] Step S13: The attribute authorization terminal selects three cryptographic hash functions and H3:G1×G T ×{0,1} u →{0,1} n , where n represents the size of access policy A, that is, A={A1,A2,…,A n},in 1≤i≤n, n=|A|, and randomly select a 1-bit key generation function identifier hid∈{0,1};

[0013] Step S14: The attribute authorization terminal outputs the master key msk=α and public parameters params=(BP, P1, P2, P pub ,g,U,hid,H1,H2,H3).

[0014] In one embodiment of the present invention, step S2 specifically includes the following steps:

[0015] Step S21: The attribute authorization terminal inputs access policy A = {A1, A2, ..., A n},in 1≤i≤n, n=|A|, algorithm Client property set Master key msk and public parameters params;

[0016] Step S22: Attribute authorization end uses algorithm Set access policy A = {A1, A2, ..., A n} and the client property set ω j Convert to a binary identifier set and binary identification

[0017] Step S23: Random selection of attribute authorization end Calculate the client secret key in,

[0018] Step S24: The attribute authorization terminal outputs the client key

[0019] In one embodiment of the present invention, step S3 specifically includes the following steps:

[0020] Step S31: The sender inputs public parameters params and the sender key Receiver attribute set ω r , sender attribute set ω s and message M;

[0021] Step S32: The sending end uses an algorithm Set the receiving end attribute set ω r Convert to a binary identifier

[0022] Step S33: The sending end calculates

[0023] Step S34: The sending end randomly selects Calculate w = g r ; h = H2(M||w,p);

[0024] Step S35: The sending end outputs the signcrypted ciphertext CT = (c, S, T).

[0025] In an embodiment of the present invention, step S4 specifically includes the following steps:

[0026] Step S41: The receiving end inputs public parameters params, the signcrypted ciphertext CT = (c, S, T), and the receiving end key Receiver attribute set ω r And the sender attribute set ω s ;

[0027] Step S42: The receiving end uses an algorithm Set the sender attribute set ω s , the receiving end attribute set ω r Convert to binary identifiers and

[0028] Step S43: Calculation at the receiving end h′=H2(M′||w′,p); t=g h′ ;

[0029] Step S44, the receiving end checks whether the equation e(S, P)·t=w' holds; if the equation holds, outputs the plaintext data M' and the signature σ=(h', S); otherwise, outputs a rejection symbol ⊥.

[0030] An efficient attribute-based signcryption system based on commercial secret SM9 for implementing the method as described above, comprising:

[0031] The attribute authorization end is used to generate the master key msk and public parameter params according to the security parameter λ; it is used to generate the master key msk, public parameter params, and client attribute set ω according to the master key msk, public parameter params, and client attribute set ω. j And access structure A to generate the client key

[0032] The sender is used to calculate the sender attribute set ω according to the message M, public parameter params, and sender attribute set ω. s , sender key And the receiving end attribute set ω r , generate the signcrypted ciphertext CT;

[0033] as well as

[0034] The receiving end is used to calculate the encrypted ciphertext CT, public parameters params, and the sender attribute set ω s , receiving end attribute set ω r and the receiving end key Recover the plaintext and signature (M,σ).

[0035] Compared with the prior art, the present invention has the following beneficial effects: The present invention is designed based on the commercial secret SM9 identification signature algorithm, which conforms to the national cyberspace security independent and controllable development strategy. The use of signcryption technology enables the signature end to simultaneously implement encryption and signature operations. The attribute-based signature scheme ensures that the client can generate a valid signature only when the client attribute set satisfies the access policy. Therefore, the proposed method and system have strong practicality and broad application prospects in data authentication and privacy protection access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 FIG. 4 is a system architecture diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings.

[0038] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0039] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0040] This embodiment provides an efficient attribute-based signcryption method based on commercial secret SM9, comprising the following steps:

[0041] Step S1: The attribute authorization end inputs the security parameter λ and outputs the master key msk and the public parameter params.

[0042] In this embodiment, step S1 specifically includes the following steps:

[0043] Step S11: The attribute authorization terminal inputs the security parameter λ and generates a bilinear pairing tuple BP=(G1, G2, G T ,e,p), where e:G1×G2→G T, p is a large prime number, |p| = λ; the attribute authorization end randomly selects the generator P1 of G1 and the generator p2 of G2. In addition, there is an effective and publicly computable isomorphic mapping ψ between G1 and G2: G2→G1, such that ψ(P2) = P1; the attribute authorization end selects the system attribute domain U = {att1,att2,…,att u},in 1≤i≤u, u=|U|, Attribute Authorization End Definition Algorithm Convert the attribute set ω into a binary ID ω ,in Defined as: input attribute set ω, system attribute domain U; ​​let ID ω [i] indicates ID ω The i-th position of i ∈ω, let ID ω [i] = 1; otherwise, let ID ω [i] = 0; where 1 ≤ i ≤ u, u = |U|; finally, the algorithm outputs ID ω .

[0044] Step S12: attribute authorization terminal randomly selects Calculate P pub =αP2, g = e(P1,P pub );

[0045] Step S13: The attribute authorization terminal selects three cryptographic hash functions and H3:G1×G T ×{0,1} u →{0,1} n , where n represents the size of access policy A, that is, A={A1,A2,…,A n},in 1≤i≤n, n=|A|, and randomly select a 1-bit key generation function identifier hid∈{0,1};

[0046] Step S14: The attribute authorization terminal outputs the master key msk=α and public parameters params=(BP, P1, P2, P pub ,g,U,hid,H1,H2,H3).

[0047] Step S2: The attribute authorization terminal inputs the master key msk, public parameter params, and client attribute set ω j And access structure A, output client key

[0048] In this embodiment, step S2 specifically includes the following steps:

[0049] Step S21: The attribute authorization terminal inputs access policy A = {A1, A2, ..., A n},in 1≤i≤n, n=|A|, algorithm Client property set Master key msk and public parameters params;

[0050] Step S22: Attribute authorization end uses algorithm Set access policy A = {A1, A2, ..., A n} and the client property set ω j Convert to a binary identifier set and binary identification

[0051] Step S23: Random selection of attribute authorization end Calculate the client secret key in,

[0052] Step S24: The attribute authorization terminal outputs the client key

[0053] Step S3: The sender inputs the message M, public parameters params, and the sender attribute set ω s , the sender key And the receiving end attribute set ω r , output the signcrypted ciphertext CT.

[0054] In this embodiment, step S4 specifically includes the following steps:

[0055] Step S31: The sender inputs public parameters params and the sender key Receiver attribute set ω r , the sender attribute set ω s and message M;

[0056] Step S32: The sending end uses an algorithm Set the receiving end attribute set ω r Convert to a binary identifier

[0057] Step S33: The sending end calculates

[0058] Step S34: The sending end randomly selects Calculate w = g r ; h = H2(M||w,p);

[0059] Step S35, the sending end outputs the signcrypted ciphertext CT=(c, S, T);

[0060] Step S4: The receiving end inputs the signcrypted ciphertext CT, public parameter params, and the sending end attribute set ω s , the receiving end attribute set ω r and the receiving end key If the decryption result is a valid signature data generated by the sender, the plaintext and signature (M,σ) are output.

[0061] In this embodiment, step S4 specifically includes the following steps:

[0062] Step S41: The receiving end inputs public parameters params, the signcrypted ciphertext CT = (c, S, T), and the receiving end key Receiver attribute set ω r And the sender attribute set ω s ;

[0063] Step S42: The receiving end uses an algorithm Set the sender attribute set ω s , the receiving end attribute set ω r Convert to binary identifiers and

[0064] Step S43: Calculation at the receiving end h′=H2(M′||w′,p); t=g h′ ;

[0065] Step S44: The receiving end checks whether the equation e(S, P)·t=w' holds. If the equation holds, the plaintext data M' and the signature σ=(h', S) are output. Otherwise, a rejection symbol ⊥ is output.

[0066] like Figure 1 As shown, this embodiment also provides an efficient attribute-based signcryption system based on commercial secret SM9 for the above method, including:

[0067] The attribute authorization end is used to generate the master key msk and public parameter params according to the security parameter λ; it is used to generate the master key msk, public parameter params, and client attribute set ω according to the master key msk, public parameter params, and client attribute set ω. j And access structure A to generate the client key

[0068] The sender is used to expose the parameter params and the sender attribute set ω according to the message M. s , the sender key And the receiving end attribute set ω r, generate the signcrypted ciphertext CT;

[0069] as well as

[0070] The receiving end is used to publicize the parameter params and the sender attribute set ω according to the signed ciphertext CT. s , the receiving end attribute set ω r and the receiving end key Recover the plaintext and signature (M,σ).

[0071] like Figure 1 As shown, the implementation process of the system in this embodiment is specifically as follows:

[0072] 1. The sender and receiver set the attribute set ω s ,ω r Sent to the attribute authorization end, which calculates the sender / receiver key using the following algorithm

[0073] (1) Using Algorithms Set access policy A = {A1, A2, ..., A n} and the sender and receiver attribute sets ω s ,ω r Convert to a binary identifier set Binary Identification and

[0074] (2) Random selection Calculate the sender and receiver keys in

[0075] (3) Output the sender and receiver keys

[0076] 2. The sender obtains the message M, public parameters params, and the sender attribute set ω s , the sender key And the receiving end attribute set ω r Afterwards, the signcrypted ciphertext CT is generated in the following way:

[0077] (1) The sender uses the algorithm Set the receiving end attribute set ω r Convert to a binary identifier

[0078] (2) Calculation

[0079] (3) Random selection Calculate w = gr ; h = H2(M||w,p); T = rQ;

[0080] (4) Output the signcrypted ciphertext CT = (c, S, T).

[0081] 3. The receiving end obtains the signed ciphertext CT, public parameters params, and the sender attribute set ω s , the receiving end attribute set ω r and the receiving end key After that, decryption is performed as follows:

[0082] (1) Using Algorithms Set the sender attribute set ω s , the receiving end attribute set ω r Convert to binary identifiers and

[0083] (2) Calculation h'=H2(M'||w',p); t=g h′ ;

[0084] (3) Check whether the equation e(S,P)·t=w' holds. If the equation holds, output the plaintext data M' and the signature σ=(h',S); otherwise, output the rejection symbol ⊥.

[0085] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0086] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0087] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0089] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims

1. An efficient attribute-based signcryption method based on commercial secret SM9, characterized in that: The steps include: Step S1, the attribute authorization terminal inputs the security parameter λ, and outputs the master key msk and the public parameter params; Step S2: The attribute authorization terminal inputs the master key msk, public parameter params, access policy A, and client attribute set ω j , output the client key Step S3: The sender inputs the message M, the public parameter prams, the sender attribute set ωs, and the sender key And the receiving end attribute set ω r , output the signcrypted ciphertext CT; Step S4: The receiving end inputs the signcrypted ciphertext CT, public parameter params, and the sending end attribute set ω s , receiving end attribute set ω r and the receiving end key If the decryption result is a valid signature data generated by the sender, then the plaintext and signature (M, σ) are output; Otherwise, output the rejection symbol ⊥; The step S1 specifically includes the following steps: Step S11: The attribute authorization terminal inputs the security parameter λ and generates a bilinear pairing tuple BP=(G1, G2, G T ,e,p), where e:G1×G2→G T , p is a large prime number, |p| = λ; the attribute authorization end randomly selects the generator P1 of G1 and the generator P2 of G2; in addition, there is an effective and publicly computable isomorphic mapping ψ between G1 and G2: G2 → G1, such that ψ(P2) = P1; the attribute authorization end selects the system attribute domain U = {att1,att2,…,att u },in 1≤i≤u, u=|U|, Attribute Authorization End Definition Algorithm Convert the attribute set ω into a binary ID ω ,in Defined as: input attribute set ω, system attribute domain U; ​​let ID ω [i] indicates ID ω The i-th position of i ∈ω, let ID ω [i] = 1; otherwise, let ID ω [i] = 0; where 1 ≤ i ≤ u, u = |U|; finally, the algorithm outputs ID ω ; Step S12: attribute authorization terminal randomly selects Calculate P pub =αP2, g = e(P1,P pub ); Step S13: The attribute authorization terminal selects three cryptographic hash functions and H3:G1×G T ×{0,1} u →{0,1} n , where n represents the size of access policy A, that is, A={A1,A2,…,A n },in 1≤i≤n, n=|A|, and randomly select a 1-bit key generation function identifier hid∈{0,1}; Step S14: The attribute authorization terminal outputs the master key msk=α and public parameters params=(BP, P1, P2, P pub ,g,U,hid,H1,H2,H3); The step S2 specifically includes the following steps: Step S21: The attribute authorization terminal inputs access policy A = {A1, A2, ..., A n },in 1≤i≤n, n=|A|, algorithm Client property set Master key msk and public parameters params; Step S22: Attribute authorization end uses algorithm Set access policy A = {A1, A2, ..., A n } and the client property set ω j Convert to a binary identifier set and binary identification Step S23: Random selection of attribute authorization terminals Calculate the client secret key in, Step S24: The attribute authorization terminal outputs the client key The step S3 specifically comprises the following steps: Step S31: The sender inputs public parameters params and the sender key Receiver attribute set ω r , sender attribute set ω s and message M; Step S32: The sending end uses an algorithm Set the receiving end attribute set ω r Convert to a binary identifier Step S33: The sending end calculates Step S34: The sending end randomly selects Calculate w = g r ; h = H2(M||w,p); T = rQ; Step S35: The sending end outputs the signcrypted ciphertext CT = (c, S, T).

2. The efficient attribute-based signcryption method based on commercial secret SM9 according to claim 1, characterized in that: The step S4 specifically comprises the following steps: Step S41: The receiving end inputs public parameters params, the signcrypted ciphertext CT = (c, S, T), and the receiving end key Receiver attribute set ω r And the sender attribute set ω s ; Step S42: The receiving end uses an algorithm Set the sender attribute set ω s , the receiving end attribute set ω r Convert to binary identifiers and Step S43: Calculation at the receiving end h'=H2(M'||w',p); t=g h′ ; Step S44, the receiving end checks whether the equation e(S, P)·t=w' holds; if the equation holds, outputs the plaintext data M' and the signature σ=(h', S); otherwise, outputs a rejection symbol ⊥.

3. An efficient attribute-based signcryption system based on commercial secret SM9 for implementing the method as claimed in claim 1 or 2, characterized in that: include: The attribute authorization end is used to generate the master key msk and public parameter params according to the security parameter λ; it is used to generate the master key msk, public parameter params, and client attribute set ω according to the master key msk, public parameter params, and client attribute set ω. j And access structure A to generate the client key The sender is used to calculate the sender attribute set ω according to the message M, public parameter params, and sender attribute set ω. s , sender key And the receiving end attribute set ω r , generate the signcrypted ciphertext CT; as well as The receiving end is used to calculate the encrypted ciphertext CT, public parameters params, and the sender attribute set ω s , receiving end attribute set ω r and the receiving end key Recover the plaintext and signature (M,σ).

Images