Attribute - based Outsourced Decryption and Its Verification Audit Method Based on Blockchain Payment Mechanism

Abstract

The present invention relates to an attribute-based outsourced decryption and its verification and auditing method based on a blockchain payment mechanism. By combining blockchain payment technology with attribute-based encryption, the functionality of attribute-based encryption is extended. The computing burden of lightweight devices with limited computing resources is reduced by adding outsourced computing. The correctness of the outsourced result is ensured by adding a verification function. The computing burden of lightweight devices with limited computing resources is further reduced by adding batch verification. The normal operation of the outsourced function is ensured by adding a payment function. The present invention conducts a public audit of the decryption result to prevent the cloud service center from obtaining payment rewards by forging the decryption result, and at the same time prevent the end user from refusing to recognize its correctness and evading payment rewards after obtaining the decryption result, so as to ensure the fairness of the transaction between the two parties.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and particularly relates to an attribute-based outsourced decryption and its verification and auditing method based on a blockchain payment mechanism. Background Art

[0002] For a long time, a large number of bilinear pairing operations have been an important factor affecting the encryption and decryption efficiency of attribute-based encryption (ABE) schemes. Although a lot of work has been done on the optimization of bilinear pairing operations, for end users (especially lightweight devices with limited computing resources), the current decryption operation is still a burden. Outsourced decryption is a way to solve the above problems. By outsourcing the decryption operation of attributes to a powerful cloud service center, while making full use of the powerful computing power of external devices, it alleviates the computing pressure of end users and improves the decryption efficiency. However, using a cloud service center for outsourced decryption is not free. End users need to pay the cloud service center a reward according to the outsourcing results. But in this process, both the cloud service center and the user have the possibility of default. The cloud service center may forge the outsourcing decryption results to obtain the reward, and the user may also obtain the outsourcing results but refuse to pay the reward. To solve the above problems, public auditing of user verification results has emerged to prevent the cloud service center from forging outsourcing results and prevent users from denying. But in actual use, the amount of outsourced data is usually very large, and the verification process of ciphertext still requires a huge amount of computing. Therefore, batch verification is used to reduce the burden on users, especially lightweight devices with limited computing resources. Thus, designing and implementing an attribute-based outsourced decryption and its verification and auditing method based on a blockchain payment mechanism has important research value. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide an attribute-based outsourced decryption and its verification and auditing method based on a blockchain payment mechanism to solve the problems of high requirements for the computing resources of end users and the payment of rewards for paid outsourcing in attribute-based encryption algorithms.

[0004] To achieve the above purpose, the present invention adopts the following technical solutions:

[0005] An attribute-based outsourced decryption method based on a blockchain payment mechanism provides a system including a key distribution center KGC, an end user, a data owner, and a cloud service center, and includes the following steps:

[0006] Step S101: The key distribution center KGC runs a system initialization function to generate system public parameters and a master private key, sends the system public parameters to the cloud service center and the end user, secretly stores the master private key. At the same time, the end user generates an end user master public and private key pair using the system public parameters and secretly stores the end user's master private key;

[0007] Step S102: The end user sends the end user's public master key to the key distribution center KGC and submits a key application. The KGC calls the user key generation algorithm to generate a user key for the end user;

[0008] Step S103: The end user uses the user key and runs the outsourced key generation function to generate an outsourced key and a decryption key. After the end user pays a deposit to the smart contract, the end user can publish an outsourcing task on the blockchain. When publishing the outsourcing task, the outsourced key is also uploaded to the blockchain, and the decryption key is secretly saved;

[0009] Step S104: The end user uses the user key and runs the verification key generation function to generate a verification key and an evidence key. After the end user pays a deposit to the smart contract, the end user can publish an outsourcing task on the blockchain. When publishing the outsourcing task, the verification key is also uploaded to the blockchain, and the evidence key is secretly saved;

[0010] Step S105: The data owner uses the system public master key and the ciphertext access policy to encrypt the plaintext to generate a ciphertext, and saves the ciphertext in the cloud service center;

[0011] Step S106: After the cloud service center pays a deposit to the smart contract, it can receive the outsourcing task from the blockchain. After receiving the outsourcing task, it uses the corresponding outsourced key and verification key of the task to decrypt the ciphertext data part to generate an outsourced decryption result and send it to the end user.

[0012] Further, the step S101 is specifically as follows: The key distribution center KGC first selects a bilinear group D = (G, G T , e, p), where G is an additive cyclic group of prime order p, G T is a multiplicative cyclic group of prime order p, e is a bilinear mapping from G×G→G T , the generator of the group G is g, randomly selects u, h, w, v∈G, α∈Z p , and determines a hash function H: G→Z p . The key distribution center KGC secretly saves msk = α and publishes pp = (D, g, w, v, u, h, e(g, g) α , H). At the same time, the end user generates random numbers y, y′∈Z p , calculates Y = g y , Y′ = g y′ , sets the end user's public master key as pk u = (Y, Y'), and the end user's private master key as sk u = (y, y′), and publishes the user's public master key

[0013] Further, the step S102 is specifically as follows: Based on the end user's attribute set A = A1,..., A kand the public key pk of the end - user master u =(Y, Y′), generate random numbers r, r1, …, r k , r′, r′1, …, r′ k ∈Z p , calculate sk1 = Y α ·w r , sk2 = g r , sk′2 = Y ′r′ , Let serve as the end - user private key.

[0014] Furthermore, the step S103 is specifically: Given the user attribute set A = A1,..., A k , calculate tk1 = sk1, tk2 = sk2, tk i,3 = sk i,3 , tk i,4 = sk i,4 , Let serve as the outsourcing key and make it public, Let dk id = y serve as the decryption key and be secretly saved by the end - user.

[0015] Furthermore, the step S104 is specifically: Given the user attribute set A = A1, …, A k , calculate vk1 = (sk1·w r′ ) y′ , vk i,4 = (sk i,4 ·sk′ i,4 ) y , Let serve as the verification key and make it public, Let wk id = {y, r′, r′1, …, r′ k} serve as the evidence key and be secretly saved by the end - user.

[0016] Furthermore, the step S105 is specifically: The data owner determines the access policy (M, ρ) of the ciphertext and the information m to be encrypted; where M is an l×n matrix, ρ is a function that can map each row of M to an attribute, generate a random vector Calculate v i = M i · where M i is the i - th row of M; generate l random values μ1, …, μ l ∈Z p , calculate C0 = e(g, g) αμ·m, C1 = g μ , C5 = g H(m) ;

[0017] Let CT (M,ρ) = ((M, ρ), C0, C1, {C i,2 , C i,3 , C i,4}) i∈[1,l] , C5) be uploaded to the cloud service center as ciphertext for secret storage.

[0018] Furthermore, the step S106 is specifically: use {w i ∈Z p} i∈I to represent a set of constants, where w i satisfies: if {v i} is a valid share of μ for M, then ∑ i∈I w i v i = μ;

[0019] Calculate where V0 =

[0020] Calculate where V1 =

[0021] Let CT id = (C0, C′0, C′1) be sent to the end user as the outsourcing decryption result.

[0022] A verification method is specifically: the end user uses the system public parameters, decryption key, and ciphertext to batch verify the outsourcing decryption result. If the verification is correct, output 1; otherwise, output 0. At the same time, find the suspicious outsourcing decryption results. Upload the verification results, suspicious outsourcing decryption results, and evidence keys to the blockchain and publish an audit task on the blockchain, specifically including:

[0023] Determine the ciphertext and the outsourcing decryption result where Calculate m j = {C 0j / (C' 0j ) 1 / y} j∈[1,n] , if then the outsourcing decryption result passes the verification, output Otherwise, the outsourcing decryption result fails. Use the binary search method to find the suspicious outsourcing decryption result and output its number j, and at the same time output Upload the verification result, the suspicious outsourced decryption result, and the evidence key to the blockchain, and publish the audit task on the blockchain.

[0024] An audit method, specifically: after the miner on the blockchain accepts the audit task, the miner can use the outsourcing key, the verification key, the evidence key, the ciphertext, and the suspicious outsourced decryption result to audit the verification result of the end user. If the audit passes, output 1; otherwise, output 0 / ⊥ / T according to the situation, specifically including:

[0025] The miner audits the verification result of the user. If the verification result of the user Then the audit result If the verification result of the user Then conduct an audit. For the suspicious outsourced decryption result numbered j

[0026] If Then recalculate And name it If Then Otherwise

[0027] If Then recalculate And name it If Otherwise Finally, if the audit result is It means that the outsourcing transaction proceeds normally, and the end user pays the outsourcing remuneration to the cloud service center normally. The smart contract returns the deposits of the end user and the cloud service center respectively; if the audit result is It means that the outsourcing transaction fails, and the smart contract returns the deposits of the cloud service center and the end user respectively; if the audit result is It means that the outsourcing transaction fails due to the cloud service center, and the cloud service center pays the audit remuneration to the miner. The smart contract deducts the audit remuneration from the deposit of the cloud service center and pays it to the miner, and returns the deposit of the end user.

[0028] The present invention has the following beneficial effects compared with the prior art:

[0029] Without changing the attribute - based encryption, the present invention adds an outsourcing decryption mechanism and a blockchain - based payment mechanism. At the same time, the outsourcing decryption mechanism is optimized, the key generation algorithm is adjusted, and batch verification is used to further reduce the computational complexity of end - users when generating outsourcing keys and verifying outsourcing results, enabling attribute - based encryption to be applied to lightweight devices with limited computing resources, which helps the wide application of attribute - based encryption algorithms. Brief Description of the Drawings

[0030] Figure 1 is the flowchart of the method of the present invention;

[0031] Figure 2 is the schematic diagram of the process in an embodiment of the present invention. Detailed Embodiments

[0032] To describe the technical content, achieved objectives and effects of the present invention in detail, the following is described in conjunction with the embodiments and with reference to the drawings.

[0033] The symbols and definitions related to the present invention are as follows:

[0034] KGC: Key Generation Center.

[0035] D: Bilinear group.

[0036] G: Additive cyclic group of order prime number p.

[0037] G T : Multiplicative cyclic group of order prime number p.

[0038] e: Bilinear mapping from G×G→G1.

[0039] g: Generator of group G.

[0040] u, h, w, v: Random elements in group G.

[0041] Z p : Set of residue classes modulo prime number p.

[0042] α: A random integer, and α∈Z p .

[0043] H: Cryptographic hash function.

[0044] pp: System public master key.

[0045] msk: System private master key.

[0046] y, y′: Random integers, and y, y′∈Z p .

[0047] pk u : User public master key.

[0048] sk u : The user's master private key.

[0049] A: The set of user attributes.

[0050] A1,…,A k : User attributes. 2

[0051] r,r1,…,r k ,r′,r′1,…,r′ k : Random integers, and r,r1,…,r k ,r′,r′1,…,r′ k ∈Z p .

[0052] User key.

[0053] Outsourced key.

[0054] dk id : Decryption key.

[0055] Verification key

[0056] wk id : Proof key.

[0057] (M,ρ): Access policy.

[0058] M: Access control matrix.

[0059] ρ: A function that maps each row of M to an attribute.

[0060] M: Plaintext information.

[0061] A random vector composed of random values.

[0062] μ,y2,…,y n : Random integers, and

[0063] M i : The i-th row of M.

[0064] CT (M,ρ) : The ciphertext encrypted using the access policy (M,ρ), which belongs to an element in the multiplicative group G T in.

[0065] CT id : The result of outsourced decryption, which belongs to an element in the multiplicative group G T in.

[0066] Please refer to Figure 1, the present invention provides an attribute-based outsourced decryption and its verification and auditing method based on a blockchain payment mechanism, including the steps:

[0067] S101. The key distribution center KGC runs the system initialization function to generate system public parameters and a master private key, sends the system public parameters to the cloud service center and the end user, and secretly stores the master private key. At the same time, the end user uses the system public parameters to generate an end user master public-private key pair and secretly stores the end user's master private key;

[0068] S102. The end user sends the end user's master public key to the key distribution center KGC and submits a key application. The KGC calls the user key generation algorithm to generate a user key for the end user;

[0069] S103. The end user uses the user key and runs the outsourced key generation function to generate an outsourced key and a decryption key. After the end user pays a deposit to the smart contract, the end user can publish an outsourced task on the blockchain. When publishing the outsourced task, the outsourced key is also uploaded to the blockchain, and the decryption key is secretly stored;

[0070] S104. The end user uses the user key and runs the verification key generation function to generate a verification key and an evidence key. After the end user pays a deposit to the smart contract, the end user can publish an outsourced task on the blockchain. When publishing the outsourced task, the verification key is also uploaded to the blockchain, and the evidence key is secretly stored;

[0071] S105. The data owner encrypts the plaintext using the system master public key and the ciphertext access policy to generate a ciphertext, and stores the ciphertext in the cloud service center;

[0072] S106. After the cloud service center pays a deposit to the smart contract, it can receive the outsourced task from the blockchain. After receiving the outsourced task, it can use the corresponding outsourced key and verification key of the task, decrypt a part of the ciphertext data to generate an outsourced decryption result, and send it to the end user.

[0073] In this embodiment, in step S101, the key distribution center KGC runs the system initialization function to generate system public parameters and a master private key, sends the system public parameters to the cloud service center and the end user, and secretly stores the master private key. At the same time, the end user uses the system public parameters to generate an end user master public-private key pair and secretly stores the end user's master private key, which specifically includes:

[0074] The key distribution center KGC first selects a bilinear group D = (G, G T , e, p), where G is an additive cyclic group of prime order p, G T is a multiplicative cyclic group of prime order p, e is a bilinear mapping from G×G→G T The generator of the group G is g, and randomly selects u, h, w, v ∈ G, α ∈ Zp , and determine a hash function \(H: G ightarrow \mathbb{Z}\) p , the Key Generation Center (KGC) secretly stores \(msk = lpha\) and publicly discloses \(pp=(D, g, w, v, u, h, e(g, g)\) α , \(H\) to generate random numbers \(y, y' \in \mathbb{Z}\) p , meanwhile, the end - user computes \(Y = g\) y , \(Y' = g\) y′ , set the end - user's public master key as \(pk\) u =(Y, Y'), and the end - user's private master key as \(sk\) u =(y, y'), and publicly disclose the user's public master key.

[0075] In this embodiment, in step S102, the end - user sends the end - user's public master key to the Key Generation Center (KGC) and submits a key application. The KGC calls the user key generation algorithm to generate a user key for the end - user, which specifically includes:

[0076] Given the end - user's attribute set \(A = A_1,\cdots,A\) k and the end - user's public master key \(pk\) u =(Y, Y'), generate random numbers \(r,r_1,\cdots,r\) k ,r',r'_1,\cdots,r' k \(\in \mathbb{Z}\) p , compute \(sk_1 = Y\) α \cdot w r , \(sk_2 = g\) r , sk'_2 = Y ′r′ , Let be the end - user's private key.

[0077] In this embodiment, in step S103, the end - user uses the user key and runs the outsourcing key generation function to generate an outsourcing key and a decryption key. After the end - user pays a deposit to the smart contract, the outsourcing task can be published on the blockchain. When publishing the outsourcing task, the outsourcing key is also uploaded to the blockchain, and the decryption key is secretly stored, which specifically includes:

[0078] Given the user's attribute set \(A = A_1,\cdots,A\) k , compute \(tk_1 = sk_1, tk_2 = sk_2, tk\) i,3 = sk i,3 , tk i,4 = sk i,4 , let be the outsourcing key and make it public, and let \(dk\) id = y be the decryption key secretly stored by the end - user.

[0079] In this embodiment, in step S104, the end user uses the user key and runs the verification key generation function to generate the verification key and the proof key. After the end user pays the deposit to the smart contract, the outsourcing task can be published on the blockchain. When publishing the outsourcing task, the verification key is also uploaded to the blockchain, and the proof key is secretly saved. Specifically, it includes::

[0080] Given the set of user attributes A = A1,…,A k , calculate vk1 = (s k1 ·w r′ ) y′ , vk i,4 = (sk i,4 ·sk′ i,4 ) y , let be used as the verification key and made public, and let wk id = {y,r′,r′1,…,r′ k} be used as the proof key and secretly saved by the end user.

[0081] In this embodiment, in step S105, the data owner uses the system public key and the ciphertext access policy to encrypt the plaintext to generate the ciphertext, and saves the ciphertext in the cloud service center; among them, the calculation process of generating the ciphertext specifically includes::

[0082] The data owner determines the access policy (M,ρ) of the ciphertext and the information M to be encrypted. Where M is an l×n matrix, and ρ is a function that can map each row of M to an attribute, generating a random vector Calculate Where M i is the i-th row of M. Generate l random values μ1,…,μ l ∈ Z p , calculate C0 = e(g,g) αμ ·M, C1 = g μ , C5 = g H(M) . Let CT (M,ρ) = ((M,ρ),C0,C1,{C i,2 ,C i,3 ,C i,4}} i∈[1,l] ,C5) be used as the ciphertext and uploaded to the cloud service center for storage.

[0083] In this embodiment, after the cloud service center pays a deposit to the smart contract in step S106, it can receive an outsourcing task from the blockchain. After receiving the outsourcing task, it can use the outsourcing key and verification key corresponding to the task to decrypt the ciphertext data part to generate an outsourcing decryption result and send it to the end user. Specifically, it includes:

[0084] Use {w i ∈Z p} i∈I to represent a set of constants, where w i satisfies: If {v i} is a valid share of μ for M, then

[0085] Calculate where

[0086] Calculate where

[0087] Let CT id =(C0, C′0, C′1) be sent to the end user as the outsourcing decryption result.

[0088] In this embodiment, a verification method is also provided. Specifically: The end user uses the system public parameters, decryption key, and ciphertext to batch verify the outsourcing decryption result. If the verification is correct, output 1; otherwise, output 0; and at the same time find out the suspicious outsourcing decryption results. Upload the verification result, the suspicious outsourcing decryption result, and the evidence key to the blockchain, and publish an audit task on the blockchain. Specifically, it includes:

[0089] Determine the ciphertext and the outsourcing decryption result where Calculate If then the outsourcing decryption result passes the verification, output Otherwise, the outsourcing decryption result fails. Use the binary search method to find the suspicious outsourcing decryption result and output its number j, and at the same time output Upload the verification result, the suspicious outsourcing decryption result, and the evidence key to the blockchain, and publish an audit task on the blockchain.

[0090] In this embodiment, an auditing method is further provided, specifically: after a miner on the blockchain accepts an auditing task, the miner can use the outsourcing key, verification key, evidence key, ciphertext, and suspicious outsourcing decryption result to audit the verification result of the end user. If the audit passes, 1 is output; otherwise, 0 / ⊥ / T is output according to the situation, which specifically includes:

[0091] The miner audits the verification result of the user. If the verification result of the user then the audit result If the verification result of the user then an audit is performed, specifically:

[0092] For the suspicious outsourcing decryption result numbered j

[0093] If then recalculate and name it If then Otherwise

[0094] If then recalculate and name it If then Otherwise

[0095] If the audit result is it means that the outsourcing transaction proceeds normally, and the end user pays the outsourcing remuneration to the cloud service center normally. The smart contract returns the deposits of the end user and the cloud service center respectively; if the audit result is it means that the outsourcing transaction fails, and the smart contract returns the deposits of the cloud service center and the end user respectively; if the audit result is it means that the outsourcing transaction fails due to the cloud service center, and the cloud service center pays the audit remuneration to the miner. The smart contract deducts the audit remuneration from the deposit of the cloud service center and pays it to the miner, and returns the deposit of the end user.

[0096] Please refer to Figure 2 , a schematic diagram of the attribute-based outsourcing decryption and its verification audit process based on the blockchain payment mechanism, from Figure 2 it can be seen that the decryption process is divided into 20 steps in total, specifically: first, the system public parameters, the master public key pp, and the user attribute A need to be obtained, and the first step is started. Random numbers y and y' are generated, and Y = g y , Y' = g y'; Execute Step 2 to generate random numbers r, r1, …, r k , r', r'1, …, r' k , calculate sk1 = Y α ·w r , sk2 = g r , sk′2 = Y′ r′ , Execute Step 3, calculate tk1 = sk1, tk2 = sk2, tk i,3 = sk i,3 , tk i,4 = sk i,4 , Execute Step 4, generate random numbers μ1, …, μ l , calculate C0 = e(g, g) αμ ·M, C1 = g μ , C5 = g H(M) , execute Step 5, calculate Execute Step 6, calculate After the first 6 steps are completed, execute Step 7 and output the outsourced decryption result CT id = (C0, C'0, C'1); Next, the ciphertext (CT (M,ρ)j ) j∈[1,n] , the outsourced decryption result (CT (M,ρ)j ) j∈[1,n] and the decryption key dk id = z u are used as the input for the subsequent steps. Start executing Step 8 and calculate the j-th plaintext M j Judge Whether it holds. If it holds, When verify = 0, execute Step 9 and jump to Step 11 or 12; when verify = 1, execute Step 10, audit = 1, and end; if Execute Step 11, calculate Jump to Step 13 or 15. If Execute Step 12, calculate Jump to Step 14 or 16. According to the audit result, execute Step 17, 18, 19, 20 to determine the payment of the remuneration and complete the outsourced transaction.

[0097] As can be seen from the above description, without changing the attribute-based encryption, the present invention adds an outsourcing decryption mechanism and a blockchain-based payment mechanism. At the same time, the outsourcing decryption mechanism is optimized, the key generation algorithm is adjusted, and batch verification is adopted to further reduce the computational amount of end users when generating outsourcing keys and verifying outsourcing results, enabling attribute-based encryption to be applied to lightweight devices with limited computing resources, which helps the wide application of attribute-based encryption algorithms.

[0098] The above are only the preferred embodiments of the present invention, and all equivalent changes and modifications made according to the scope of the patent application of the present invention shall fall within the scope covered by the present invention.

Claims

1. An attribute-based outsourced decryption method based on a blockchain payment mechanism, providing a system including a key distribution center KGC, an end user, a data owner, and a cloud service center, characterized in that, It includes the following steps: Step S101: The Key Generation Center (KGC) runs the system initialization function to generate system public parameters and the master private key. It sends the system public parameters to the cloud service center and the end user, and secretly stores the master private key. Meanwhile, the end user generates the end user's master public-private key pair using the system public parameters and secretly stores the end user's master private key; Step S102: The end user sends the end user's master public key to the Key Generation Center (KGC) and submits a key application. The KGC calls the user key generation algorithm to generate a user key for the end user; Step S103: The end user uses the user key and runs the outsourced key generation function to generate the outsourced key and the decryption key. After the end user pays a deposit to the smart contract, it can publish an outsourcing task on the blockchain. When publishing the outsourcing task, it also uploads the outsourced key to the blockchain and secretly stores the decryption key; Step S104: The end user uses the user key and runs the verification key generation function to generate the verification key and the evidence key. After the end user pays a deposit to the smart contract, it can publish an outsourcing task on the blockchain. When publishing the outsourcing task, it also uploads the verification key to the blockchain and secretly stores the evidence key; Step S105: The data owner encrypts the plaintext using the system master public key and the ciphertext access policy to generate the ciphertext, and stores the ciphertext in the cloud service center; Step S106: After paying a deposit to the smart contract, the cloud service center can receive the outsourcing task from the blockchain. After receiving the outsourcing task, it uses the corresponding outsourced key and verification key of the task to decrypt the ciphertext data part to generate the outsourced decryption result and sends it to the end user; The specific steps of step S101 are as follows: First, the Key Generation Center (KGC) selects a bilinear group \(D=(G, G T , e, p)\), where \(G\) is an additive cyclic group of prime order \(p\), \(G T \) is a multiplicative cyclic group of prime order \(p\), \(e\) is a bilinear mapping from \(G\times G\rightarrow G T \), the generator of group \(G\) is \(g\), randomly select \(u, h, w, v\in G\), \(\alpha\in\mathbb{Z} p \), and determine a hash function \(H:G\rightarrow\mathbb{Z} p \). The Key Generation Center (KGC) secretly stores \(msk = \alpha\) and publishes \(pp=(D, g, w, v, u, h, e(g, g) α , H)\). At the same time, the end user generates random numbers \(y, y'\in\mathbb{Z} p \), calculates \(Y = g y \), \(Y' = g y′ \), sets the end user's public master key as \(pk u =(Y, Y')\), and the end user's private master key as \(sk u =(y, y')\), and publishes the user's public master key. The specific content of step S102 is as follows: Based on the set of end - user attributes \(A = A_1,\ldots,A\) k and the end - user's public master key \(pk\) u =(Y,Y'), generate random numbers \(r,r_1,\ldots,r\) k ,r',r'_1,\ldots,r' k \(\in\mathbb{Z}\) p and calculate \(sk_1 = Y\) α \(\cdot w\) r , \(sk_2 = g\) r , \(sk'_2 = Y\) ′r , Let serve as the end - user's private key; The specific content of step S103 is as follows: Given the set of terminal user attributes A = A1,…,A k , calculate tk1 = sk1, tk2 = sk2, tk i,3 = sk i,3 , tk i,4 = sk i,4 , let be used as the outsourced key and made public, and let dk id = y be used as the decryption key and secretly saved by the terminal user; The specific content of step S104 is as follows: Given the set of end-user attributes A = A1, …, A k , calculate vk i,4 =(sk i,4 ·sk′ i,4 ) y , and let be used as the verification key and made public. Let wk id ={y, r′, r′1, …, r′ k} be used as the evidence key and secretly saved by the end-user; The specific steps of step S105 are as follows: The data owner determines the access policy (M, ρ) of the ciphertext and the information m to be encrypted; where M is an l×n matrix, and ρ is a function that can map each row of M to an attribute, generating a random vector Calculate where M i is the i-th row of M; generate l random values μ1,…,μ l ∈Z p , calculate C0 = e(g, g) αμ ·m, C1 = g μ , C5 = g H (m) ; Let CT (M,ρ) = ((M, ρ), C0, C1, {C i,2 , C i,3 , C i,4} i∈[1,l] , C5) be uploaded to the cloud service center as ciphertext for secret storage; The specific step S106 is as follows: Use {w i ∈Z p} i∈I to represent a set of constants, where w i satisfies: If {v i} is the valid share of μ with respect to M, then ∑ i∈I w i v i = μ; Calculation Wherein Calculation wherein Let CT id =(C0, C'0, C'1) be sent to the end user as the outsourcing decryption result.

2. A verification method for the attribute-based outsourced decryption method of the blockchain payment mechanism described in claim 1, characterized in that, The end user uses the system public parameters, the decryption key, and the ciphertext to perform batch verification on the outsourced decryption result. If the verification is correct, it outputs 1; otherwise, it outputs 0. At the same time, it finds the suspicious outsourced decryption results; Upload the verification result, the suspicious outsourced decryption results, and the evidence key to the blockchain, and publish an audit task on the blockchain, specifically including: Determine the ciphertext and the outsourced decryption result where Calculate If then the outsourced decryption result passes the verification, output Otherwise, the outsourced decryption result fails. Use the binary search method to find the suspicious outsourced decryption result and output its number j, and at the same time output Upload the verification result, the suspicious outsourced decryption result and the evidence key to the blockchain, and publish an audit task on the blockchain.

3. An auditing method based on the verification method described in claim 2, characterized in that, After the miner on the blockchain accepts the audit task, the verification result of the end user can be audited by using the outsourcing key, verification key, evidence key, ciphertext, and suspicious outsourcing decryption result. If the audit passes, 1 is output; otherwise, depending on the situation, Specifically, it includes: The miner audits the verification result of the user. If the verification result of the user then the audit result If the verification result of the user then conduct an audit.

4. The auditing method according to claim 3, wherein The suspicious outsourced decryption result with the number j If recalculate and name it If then otherwise If recalculate and name it If then otherwise Then, if the audit result is it means that the outsourcing transaction proceeds normally, and the end user pays the outsourcing remuneration to the cloud service center normally. The smart contract returns the deposits of the end user and the cloud service center respectively; if the audit result is it means that the outsourcing transaction fails. The smart contract returns the deposits of the cloud service center and the end user respectively; if the audit result is it means that the outsourcing transaction fails due to the cloud service center, and the cloud service center pays the audit remuneration to the miner. The smart contract deducts the audit remuneration from the deposit of the cloud service center and pays it to the miner, and returns the deposit of the end user.

Images