A fog computing access control method based on attribute-based encryption and trust model

Abstract

The application discloses a kind of based on attribute-based encryption and trust model's fog computing access control method, comprising: constructing fog node trust model: through direct trust, audit trust and peer entity trust three dimensions, the credit of fog node and the trust value of user terminal to fog node are calculated;Establish semantic optimization attribute-based encryption method: based on semantic reasoning attribute mapping, attribute-based encryption method is optimized, and access policy tree and user's character attribute mapping are converted into semantic attribute mapping;Access control in fog computing is carried out based on fog node trust model and semantic optimization attribute-based encryption method: data owner sets access control policy tree and privacy threshold, selects proxy fog node by weight load balancing algorithm based on trust, and outsourcing encryption and ciphertext upload are carried out by proxy fog node;Data accesser obtains the privacy threshold of target information, calls proxy fog node to carry out outsourcing decryption and obtains intermediate ciphertext, and the required plaintext is obtained by decrypting intermediate ciphertext.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a fog computing access control method based on attribute-based encryption and a trust model. BACKGROUND

[0002] Internet of Things (IoT) based interconnected devices and applications are growing and will continue to grow at an astonishing rate, bringing many new types of devices and applications that require lower latency, location awareness, mobility support, and the like. Centralized cloud computing has not met the requirements of the Internet of Things scenario, and fog computing has emerged. Fog computing is composed of a large number of fog nodes, and the fog nodes are distributed near user terminals, so they can provide faster request response speed, location awareness, real-time analysis function, and the like for terminal applications, meeting the low latency, location awareness, geographical distribution, and the like requirements of Internet of Things devices and applications.

[0003] While fog computing provides many benefits, it also faces various security and privacy problems. Privacy protection in fog computing is more challenging because, compared with remote cloud servers in the core network, fog server nodes adjacent to terminal nodes can collect sensitive data about identity, location, and utility usage, and the destruction of insecure edge nodes can be an entry point for intruders into the network. Once the intruder enters the network, he or she can mine and steal the private data exchanged between users and entities, and the communication between fog architectures can also cause privacy leakage. Although some existing solutions in the cloud computing environment can solve many security and privacy problems in fog computing, due to the unique characteristics of fog computing, such as strong mobility of terminal devices, extremely large number of devices, limited computing resources of fog nodes, and the like, these new characteristics will bring new security and privacy challenges. Therefore, the data security protection of users in the fog computing environment has important research significance.

[0004] In order to protect the data security in cloud computing, using access control to protect information is a common practice. Access control method refers to the use of various technologies to limit the access of external objects to subject data resources. In the traditional role-based access control scheme in cloud computing, the concept of "role" is set between the user and the right, the right of the role is set first, and then the authorization is carried out by assigning the role to the user. In the Internet of Things with a large number of terminals, the workload will be very large by using this authorization method, and the access control right is granted through the role, which is coarse-grained, so it is necessary to design an efficient and fine-grained access control method suitable for fog computing scenario. Ciphertext policy attribute-based encryption (CP-ABE) access control is a widely used access control method in distributed systems. In the CP-ABE system, the data owner uses the relevant policy formulated by the attribute set to encrypt, and the private key of each data accesser in the system depends on the attribute owned by itself. When the attribute in the user's private key matches the policy in the ciphertext, the information can be successfully decrypted to realize flexible fine-grained access control. However, the traditional attribute-based encryption technology cannot be directly applied to the fog computing scenario, and the main problems are as follows:

[0005] (1) The traditional attribute-based encryption technology is complex in calculation, and it is difficult for the Internet of Things devices with limited computing resources to bear;

[0006] (2) The attribute management of attribute-based encryption technology is complex, especially for the scene with a large number of devices such as the Internet of Things, the complexity will be greatly increased;

[0007] (3) It is difficult to build access policy, which needs to consider all attributes in the attribute set and various combination modes;

[0008] (4) Fog computing devices are not fully trusted, and it cannot be determined whether they will steal private information during data transmission;

[0009] (5) How to select fog nodes, and how to fully utilize the computing power of fog nodes under the premise of protecting information security is also a problem worth paying attention to.

[0010] Now there are some attribute-based encryption researches using fog nodes for outsourcing computing, but these researches pay less attention to the problems of attribute management, the complexity of building access policy, and the credibility measurement of fog nodes, the reasonable allocation of computing resources, etc.

[0011] In summary, it is of great significance to design a secure and efficient access control method suitable for cloud-fog computing architecture. SUMMARY

[0012] In view of the deficiencies in the prior art, the present application provides a fog computing access control method based on attribute-based encryption and a trust model.

[0013] The present application discloses a fog computing access control method based on attribute-based encryption and a trust model, comprising:

[0014] A fog node trust model is constructed:

[0015] The fog nodes are divided into fog groups, and the management nodes in the fog groups calculate the reputation of the fog nodes and the trust value of the user terminals to the fog nodes through three dimensions of direct trust, audit trust and peer entity trust;

[0016] A semantic optimization attribute-based encryption method is established:

[0017] The attribute mapping based on semantic reasoning optimizes the attribute-based encryption method, and converts the access policy tree and the character attribute mapping of the user into semantic attribute mapping;

[0018] The fog node trust model and the semantic optimization attribute-based encryption method are used for access control in fog computing:

[0019] The data owner sets the access control policy tree and the privacy threshold, selects the proxy fog node through the trust-based weight load balancing algorithm, and performs outsourcing encryption and ciphertext uploading by the proxy fog node;

[0020] The data accesser first obtains the privacy threshold of the target information, then calls the trust-based weight load balancing algorithm to select the proxy fog node to perform outsourcing decryption to obtain intermediate ciphertext, and finally decrypts the intermediate ciphertext to obtain the required plaintext;

[0021] The plaintext is verified for integrity through a short signature algorithm, and the verification result is uploaded to the fog management node as one of the trust evaluation bases.

[0022] As a further improvement of the present application,

[0023] The reputation of the fog node k is calculated by the following formula: k

[0024]

[0025] In the formula, w α and w β are weights and w α +w β =1, trust b (k) is the audit trust value of the fog node k, trust b (i') is the recommended node list {node1, node2,..., node p ​The audit trust value of};

[0026] The overall trust value T of user terminal i for fog node k i,k for:

[0027] T i,k =w a ·trust a (i,k)+w b ·trust b (k)+w c ·trust c (i,k)

[0028] In the formula, w a w b w c For weights and w a +w b +w c =1, trust a (i,k) represents the direct trust that user terminal i has in fog node k. b (k) represents the audit trust value of fog node k. c (i,k) represents peer entity trust.

[0029] As a further improvement of the present invention

[0030] Direct trust value a The formula for calculating (i,k) is:

[0031] trust a (i,k)=dim1·w1+dim2·w2+dim3·w3

[0032] In the formula, w1, w2, and w3 are the weights of availability, reliability, and data integrity, respectively, and w1 + w2 + w3 = 1. dim1, dim2, and dim3 are the availability, reliability, and data integrity of fog node k for user terminal i, respectively.

[0033] Audit Trust Value b The formula for calculating (k) is:

[0034]

[0035] In the formula, L is the list of access devices for fog node k;

[0036] peer-to-peer trust c The formula for calculating (i,k) is:

[0037]

[0038] In the formula, n is the first n terminals with the most interaction times with the fog node k.

[0039] As a further improvement of the application, the calculation formulas of dim1, dim2 and dim3 are respectively:

[0040]

[0041]

[0042]

[0043] In the formula, Acc is the number of times that the fog node k accepts the request of the terminal i, Sub is the number of times that the terminal submits the request, Fin is the number of times that the fog node completes the request of the terminal and returns the result, and Tru is the number of times that the result returned by the fog node passes the data integrity verification.

[0044] As a further improvement of the application, the mapping of the access policy tree and the character attribute of the user into a semantic attribute mapping comprises:

[0045] The semantic mapping of the attribute to be used in the policy tree is performed, the attribute is converted into a concept attribute in the attribute universe through semantic reasoning, and then the concept attribute is used to set the threshold value access policy tree;

[0046] The attribute in the attribute list of the user is mapped onto the concept attribute in the attribute universe through the semantic reasoning based on WordNet, the synonym set and the superordinate word set of the attribute value x of the user are obtained through WordNet reasoning, the IDs of the synonym set and the superordinate word set are combined through WordNet, and the concept attribute set of the user is obtained.

[0047] As a further improvement of the application, the selection method of the proxy fog node comprises:

[0048] The nodes with the reputation value greater than or equal to ε in the fog node list L0 are screened to obtain a new fog node list L;

[0049] The comprehensive trust value of the user terminal device to the fog nodes in L is calculated according to the fog node trust model, the weight of the fog node is calculated in combination with the idle resource condition of the fog node, and then the proxy fog node is selected in the list L through the weight random load balancing algorithm; first, the idle resource amount of the fog nodes in L is normalized, and the converted idle resource amount is {RS(1), RS(2),..., RS(n)}, and the interval is [0, 1];

[0050] The weight calculation formula of the fog node k is:

[0051] weight(k)=∝·T i,k +β·RS(k)

[0052] wherein, a, b are weight factors and a+b=1.

[0053] As a further improvement of the present application, the decrypted information is verified for integrity using the BLS signature verification algorithm.

[0054] Compared with the prior art, the present application has the following beneficial effects:

[0055] The present application optimizes the existing attribute-based encryption scheme through attribute mapping based on semantic reasoning, simplifies attribute management, and uses the optimized attribute-based encryption technology to realize fine-grained access control of private information in fog computing. BRIEF DESCRIPTION OF DRAWINGS

[0056] Figure 1 The system model diagram for realizing the fog computing access control method disclosed by an embodiment of the present application is shown in the figure.

[0057] Figure 2 The access policy tree diagram disclosed by an embodiment of the present application is shown in the figure.

[0058] In the figure:

[0059] CSP: cloud service provider, mainly responsible for information storage and providing interfaces for user access;

[0060] FN: fog node, with geographical location characteristics, mainly responsible for providing outsourcing computing capability to nearby user equipment;

[0061] FN Manage Node: fog management node, auditing the historical interaction behavior of the terminal and the fog node, and evaluating and managing the trust value of the fog node;

[0062] Data Owner: data owner;

[0063] Data User: data user;

[0064] CA: central authority, generating public parameters and master keys for the whole system.

[0065] AA: attribute authority, responsible for attribute management and user key generation of the system. DETAILED DESCRIPTION

[0066] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0067] The present invention will now be described in further detail with reference to the accompanying drawings:

[0068] This invention provides a fog computing access control method based on attribute-based encryption and a trust model, comprising:

[0069] 1. System Initialization

[0070] Set the system public parameters PP and master key MK; the attribute authorization agency sets the attribute set S and optimizes the attribute set through the semantic reasoning module to reduce the number of attributes in the system. Then, it generates an attribute public key and an attribute private key for each attribute in the attribute set managed by the attribute authorization agency.

[0071] The semantic reasoning module optimizes the entire set of attributes by dividing the entire set of attributes into parts using a set of synonyms in the semantic knowledge base, merging attributes with the same semantic meaning, using a unique number from the set of synonyms to represent the merging result, and each merged attribute representing a concept in the semantic knowledge base, and these concept attributes together form a new set of attributes.

[0072] 2. Fog node registration, IoT device registration

[0073] Fog node registration is as follows:

[0074] Fog nodes register themselves, generating a unique identifier (nid) for each node, recording node information, and initializing their reputation value. Fog node registration can be recommended by other registered fog nodes in the system, with a maximum of m recommended fog nodes, and the initial reputation value of each fog node is C. FN Related to the reputation value of recommended fog nodes.

[0075] The specific steps for registering IoT devices are as follows:

[0076] like Figure 1 In the system shown, IoT devices can be logically divided into data owners (DO) and data users (DU). Data owner registration only requires generating a unique identifier (uid), while data user registration also requires terminal attribute verification and generating an attribute list (S). uidIn actual systems, an Internet of Things device can be both a data owner and a data user. In the following, unless otherwise specified, users, data accessers represent Internet of Things terminal devices with data access functions.

[0077] 3. User key generation

[0078] The system authenticates the user terminal, and after successful authentication, obtains the attribute set of the user in the system.

[0079] The attributes in the user's attribute list are mapped to the concept attributes in the attribute universe using WordNet-based semantic reasoning. Starting from the user's attribute value x, the synonym set and the hypernym set of x are inferred through WordNet, and the IDs of these synonym sets and hypernym sets are merged using WordNet to obtain the user's concept attribute set.

[0080] Then the attribute authority generates a user key for the user using the intersection of the attribute set and the attribute universe, including outsourcing decryption keys and user decryption keys.

[0081] 4. Data upload

[0082] 4.1 Set access control policy and privacy threshold

[0083] Use the threshold value access policy tree as shown in the accompanying Figure 2 The leaf nodes represent attributes, the non-leaf nodes represent threshold values, and the root node stores a secret value s. Secret value distribution is performed on the child nodes, and only attribute set keys that meet the attribute conditions can decrypt the secret value of the root node. First, perform semantic mapping on the attributes to be used in the policy tree, and convert these attributes to concept attributes in the attribute universe through semantic reasoning, and then use these concept attributes to set the threshold value access policy tree. According to the degree of privacy emphasis on uploaded information, set a privacy threshold ε as the label of the ciphertext.

[0084] 4.2 Proxy fog node load balancing algorithm

[0085] Assume that the fog node list in the fog group is L0, and the fog management node selects an optimal fog node as the proxy of the terminal device through the following steps:

[0086] Step 1, filter the nodes in the fog node list L0 whose reputation value is greater than or equal to ε to obtain a new fog node list L. If L is empty, it means that there is no suitable proxy fog node nearby, and DO performs information encryption and upload itself; otherwise, perform step 2;

[0087] Step 2, calculate the comprehensive trust value of the user terminal device to the fog nodes in L according to the fog node trust model, combine the idle resource situation of the fog nodes to calculate the weight of the fog nodes, and then use the weight random load balancing algorithm to select the proxy fog node in the list L. First, normalize the idle resource amount of the fog nodes in L, and the converted idle resource amount is {RS(1), RS(2),..., RS(n)}, the interval is [0, 1]. The weight calculation formula of fog node k is:

[0088] weight(k) = a · T i,k + b · RS(k)

[0089] Where a and b are weight factors and a + b = 1.

[0090] 4.3 Data owner encryption

[0091] First, a symmetric key k is randomly generated, and the symmetric encryption algorithm is used to symmetrically encrypt the information to obtain the ciphertext CT1, then two secret values are generated, and the system public parameter and the secret value are used to encrypt k to obtain the ciphertext CT2, and one of the secret values and the access tree T are sent to the proxy fog node for outsourcing calculation. A pair of public and private keys is generated through the BLS short signature algorithm, and the information is encrypted with the private key to generate a signature, which is embedded in the ciphertext together with the public key and uploaded.

[0092] 4.4 Fog node outsourcing calculation

[0093] The proxy fog node is responsible for the access strategy tree preprocessing and secret value distribution in the encryption process, and obtains the ciphertext CT3. In particular, if a suitable fog node is not found through the fog node load balancing algorithm, the data owner completes all encryption calculations. Finally, the ciphertext CT1, CT2, CT3, digital signature, signature public key and privacy threshold are merged into the final ciphertext CT and uploaded to the cloud server.

[0094] 5. Data access

[0095] The user requests the ciphertext from the cloud server, selects the proxy fog node using the fog node load balancing algorithm in step 4, and if there is a fog node that meets the credit condition, sends the outsourcing key to the fog node for outsourcing decryption to obtain the intermediate ciphertext, then uses the user key to perform a decryption operation with small calculation overhead to obtain the symmetric key k set by the data owner, and finally uses k to decrypt the ciphertext to obtain the final plaintext information; Otherwise, the user device completes all decryption operations.

[0096] 6. Ciphertext verification

[0097] The BLS signature verification algorithm is used to verify the integrity of the decrypted information to ensure that it has not been tampered with, and the verification result is fed back to the fog management node.

[0098] BLS short signature algorithm defines a hash function H:{0,1} * →G, G is a prime order multiplicative cyclic group with order p and generator g. The specific steps are as follows:

[0099] Step 1, key generation: the data owner selects a random number x Z p * , calculates v = g x , then the public key is v, and the private key is x;

[0100] Step 2, signature: the data owner operates on the plaintext m as follows: σ = H(m) x , σ and v are embedded in the ciphertext and uploaded together;

[0101] Step 3, verification: the data access user uses e(σ, g) = e(H(m), v) to verify whether m is tampered.

[0102] 7. Fog node trust model

[0103] The interaction behavior of the terminal device of the application to the fog node includes outsourcing encryption request, outsourcing decryption request and data transmission request. The trust of the terminal device to the fog node is composed of direct trust and indirect trust. The direct trust depends on the historical interaction result of the terminal and the fog node; the indirect trust includes audit trust value and peer entity trust value, the audit trust value is obtained by auditing the historical interaction result of the fog node and all terminals; the peer entity trust value is obtained by selecting some terminal devices through peer selection strategy and calculating the trust of the terminal devices to the fog node.

[0104] The historical interaction result of the terminal device and the fog node is evaluated from the three dimensions of availability, reliability and data integrity. i k The availability is the response ability of the fog node to the terminal request, the reliability is the ability of the fog node to complete the accepted request within the specified time, and the data integrity is the correctness of the outsourcing decryption result of the fog node. The specific calculation method is as follows:

[0105]

[0106]

[0107]

[0108] Among them, dim1, dim2 and dim3 are respectively k for device i ​the availability, reliability and data integrity of the fog node k, Acc is the number of times that the fog node k accepts the request of the terminal i, Sub is the number of times that the terminal submits the request, Fin is the number of times that the fog node completes the request of the terminal and returns the result, and Tru is the number of times that the result returned by the fog node passes the data integrity verification.

[0109] ①Direct trust value

[0110] Terminal device i For the fog node node k The direct trust value trust a (i, k) is:

[0111] trust a (i, k) = dim1 w1 + dim2 w2 + dim3 w3

[0112] w1, w2 and w3 are weights of the availability, reliability and data integrity respectively, and w1 + w2 + w3 = 1. In particular, when the historical interaction behavior of the terminal i and the fog node k has no outsourcing decryption, the corresponding weight w3 is set to 0. If the terminal i has no interaction record with the fog node k, the direct trust value is null.

[0113] ②Audit trust value

[0114] The audit trust value reflects the evaluation of all terminal devices in the system on the fog node. Assuming that the access device list of the fog node k is L, trust b (k) represents the audit trust value of the fog node k, and the calculation method is:

[0115]

[0116] ③Peer entity trust value

[0117] The first n terminal devices with the most interactions with the fog node k are selected as peer entities, and the peer entity trust value is calculated as follows:

[0118]

[0119] The peer entity trust value reflects the trust of the representative terminal devices in the system on the fog node k.

[0120] Next, according to the calculation methods of the above three trust values, the reputation of the fog node and the comprehensive trust degree of the terminal device i on the fog node k are represented.

[0121] The reputation value Reputation k of the fog node k: Assuming that the recommended node list of the fog node k is {node1, node2,..., node pAccording to ②, respectively calculate the audit trust value trust b (k) of the fog node k b (node1),trust b (node2),...,trust b (node p )} of the recommended node list, and then calculate:

[0122]

[0123] w α and w β are weights and w α +w β =1.

[0124] The trust values of ①, ② and ③ are merged to obtain the comprehensive trust value T i,k of the terminal i to the node k:

[0125] T i,k =w a ·trust(device i ,node k )+w b ·trust(device L ,node k )+w c ·trust(device i ,node FL )

[0126] Wherein, w a , w b , w c are corresponding weights and w a +w b +w c =1. It should be noted that when there is a null direct trust value or a null recommended node trust value, the corresponding part is removed when calculating the comprehensive trust value, that is, the corresponding weight is set to 0.

[0127] The main function of the model is to calculate the reputation value Reputation k of the fog node k in the system and the comprehensive trust value T i,k of the terminal device i to the node k.

[0128] Embodiment:

[0129] The application provides a fog computing access control method based on attribute-based encryption and a trust model, comprising:

[0130] 1. System initialization

[0131] 1.1 Public parameters and master key generation

[0132] CA first selects a bilinear map e: G*G→G0 according to random security parameters τ, where G is a multiplicative cyclic group of prime order p with generator g, and randomly selects α, β∈Z p , h∈G, and a hash function: H: {0,1}*→Z p . Denote the public parameters PP=(G, G0, p, g, g α , h, H, e(g, g) β ), and the master key MK={α, g β}.

[0133] 1.2 Attribute set preprocessing

[0134] The attribute set is preprocessed, and for each attribute authority, the attribute set managed by the attribute authority is set. The attribute set managed by each attribute authority is preprocessed using a WordNet semantic reasoning module. The attribute set is divided by a synonym set in WordNet, attributes with the same semantics are merged, and the merged result is represented by a unique number (Lexicographer ID) of the synonym set. Each attribute after merging represents a concept in the semantic knowledge base. These concept attributes form a new attribute set.

[0135] The beneficial effect of this processing is that a standardized semantic attribute set is established, which facilitates the setting of access policies and the mapping of user attributes, greatly reduces the number of attributes in the attribute set, and thus reduces the complexity and computational overhead of attribute management.

[0136] 1.3 Attribute authority initialization

[0137] Suppose there are N attribute authorities in total, and each attribute authority manages an attribute set S i (i∈N), and the attribute sets are mutually exclusive. Each attribute authority selects a random number t i ∈Z p , and for each attribute x in S i , a random number b x ∈Z p is selected, and is generated and

[0138] 2. Fog node registration, Internet of Things device registration

[0139] The fog node registration is specifically:

[0140] The fog node performs fog node registration, generates a unique identifier nid for the fog node, records node information and initializes a reputation value for the fog node. The fog node registration can be recommended by other registered fog nodes in the system, the recommended fog nodes are at most m, and the initial reputation value C FN is related to the reputation value of the recommended fog node.

[0141] The Internet of Things device registration is specifically:

[0142] In the system, the Internet of Things device can be logically divided into data owner DO and data user DU. The data owner registration only needs to generate a unique identifier uid, and the data user registration also needs to perform terminal attribute verification and generate its attribute list S uid .

[0143] 3. Key generation

[0144] (uid, PP, ASK) -> {SK, SK'}

[0145] 3.1 Semantic mapping of user attributes based on WordNet

[0146] First, according to the uid, the attribute list S registered by the user is queried uid , then the attributes in the attribute list of the user are mapped to the concept attributes in the attribute set based on WordNet semantic reasoning, the attribute value x of the user is taken as the starting point, the synonym set and the superordinate word set of x are inferred through WordNet, the IDs of the synonym set and the superordinate word set are merged through WordNet, and a new attribute list S' uid .

[0147] 3.2 User key generation

[0148] AA i For each attribute x∈S i ∩S' uid , calculate Let the attribute private key SK AA of the user be {D' x}, AA i Send SK AA to CA for the next step, after the CA receives the attribute private key of the user, select a random number λ, θ∈Z p , calculate D=g β+α , D1=g αλ h θ , D2=g θ , Output the private key SK and the outsourcing key SK' of the user as:

[0149] SK={D=g β+αλ}

[0150]

[0151] 4. Data uploading

[0152] 4.1 Setting access strategy and privacy threshold

[0153] Firstly, the semantic mapping of the attributes to be used in the strategy tree is performed, and these attributes are converted into concept attributes in the attribute set through semantic reasoning, and then the concept attribute set is used to set the threshold value access strategy tree. According to the degree of privacy emphasis on the uploaded information, a privacy threshold value ε is set, and it is used as the label of the uploaded content.

[0154] 4.2 Proxy fog node load balancing algorithm

[0155] Suppose the fog node list L0 in the fog group, the fog management node selects an optimal fog node as the proxy of the terminal device through the following steps:

[0156] Step 1, filter the nodes with reputation value greater than or equal to ε in the fog node list L0, and get a new fog node list L. If L is empty, it means that there is no suitable proxy fog node nearby, and DO performs information encryption and uploading by itself; otherwise, step 2 is performed;

[0157] Step 2, calculate the comprehensive trust value of the user terminal device to the fog nodes in L according to the fog node trust model, combine the idle resource condition of the fog nodes to calculate the weight of the fog nodes, and then use the weight random load balancing algorithm to select the proxy fog node in the list L. First, normalize the idle resource amount of the fog nodes in L, and the converted idle resource amount is {RS(1), RS(2),..., RS(n)}, the interval is [0, 1]. The weight calculation formula of fog node k is:

[0158] weight(k) = a · T i,k + β · RS(k)

[0159] Wherein, a and β are weight factors and a + β = 1.

[0160] The beneficial effect of this node load balancing algorithm is to combine the information privacy level, the reputation value of the fog node in the system, the trust value of the user to the fog node, and the idle resource condition to select a high-quality fog node as the proxy.

[0161] 4.3 DO encryption algorithm

[0162] DO first selects a symmetric key k to perform symmetric encryption on the data information M, and gets the ciphertext SE k (M), then randomly selects u, v ∈ Z p , satisfying s = u + v, s ∈ Zp Calculate C = k·e(g,g) βs C' = g s C1 = g v C2 = h v σ=H(M) s Generate ciphertext CT1 = {SE k (M),σ,C,C',C1,C2}.

[0163] If the DO finds a proxy fog node that meets the reputation criteria after the node selection algorithm, it sends {T,u} to that fog node for outsourced encryption; otherwise, the DO calculates CT2 itself, and the calculation method of CT2 is described in 4.4.

[0164] 4.4 Fog Node Encryption Algorithm

[0165] First, select a polynomial Q for each node i in T. i , where the polynomial Q i number of times f i The threshold value n of node i i The relationship is f i =n i -1. For the root node R, let the constant term of its polynomial be u, and then choose f. R A random value for Q R The definition is complete; for other nodes, Q i (0)=Q parent(i) (index(i)), and then randomly select f. i The values ​​complete the polynomial definition. Here, parent(i) is the parent node of node i, and index(i) is the index value of node i.

[0166] Let S be the set of leaf nodes in access strategy T. attr For S attr Each leaf node in the definition Output partial ciphertext

[0167] Ultimately, the user merged the two ciphertext parts into one. The CT scans are uploaded to a cloud server for storage.

[0168] 5. Data Access

[0169] The user requests ciphertext from the cloud server. The load balancing algorithm in section 4.2 is used to select a fog node. If a fog node that meets the criteria exists, the outsourced key is sent to that fog node for outsourced decryption; otherwise, all decryption steps are performed locally on the user's computer.

[0170] 5.1 Outsourcing Decryption

[0171] The process of outsourcing decryption is as follows:

[0172] User's outsourcing key Define the recursive algorithm DfsNode(T,SK',x) to represent the decryption result of any node x in the access tree and the user's concept attribute set.

[0173] If x is a leaf node, assume that attr(x)∈S attr , calculate If F x is null.

[0174] If x is a non-leaf node, S x represents the set of nodes in the child nodes of x that satisfy F≠null, assume that the number of nodes in S x is less than the threshold value of x, F x is null; otherwise, according to the Lagrange interpolation method, the following calculation is performed:

[0175]

[0176] Where i=index(z), S' x ={index(z):z∈S},

[0177] Call this recursive algorithm on the root node R, if the user's attribute set meets the access policy T, then:

[0178]

[0179]

[0180] Generate the intermediate ciphertext CT'={SE k (M),σ,C,C',IT} and send it to the user.

[0181] 5.2 User decryption

[0182] The user calculates Then use the symmetric key k to decrypt SE k (M) to get the plaintext.

[0183] 6. Ciphertext verification

[0184] The user verifies the correctness of the decrypted information through the following equation:

[0185] e(σ,g)=e(H(M),C')

[0186] If the equation is true, then plaintext M is correct; otherwise, the verification fails, and the user uploads the failure record to the reputation management server. The failure record includes the user ID, fog node ID, and ciphertext ID.

[0187] 7. Fog Node Trust Model

[0188] In this scheme, the interaction behavior of terminal devices with fog nodes includes outsourced encryption requests, outsourced decryption requests, and data transmission requests. The trust of terminal devices in fog nodes consists of direct trust and indirect trust. Direct trust depends on the historical interaction results between the terminal and the fog node; indirect trust includes audit trust values ​​and peer entity trust values. The audit trust value is obtained by auditing the historical interaction results between the fog node and all terminals; the peer entity trust value is calculated by selecting some terminal devices through a peer selection strategy and calculating the trust these terminal devices have in the fog node.

[0189] Evaluate terminal devices from three dimensions: availability, reliability, and data integrity. i and fog node k The historical interaction results. Availability is the fog node's ability to respond to terminal requests; reliability is the fog node's ability to complete accepted requests within a specified time; and data integrity is the correctness of the fog node's outsourced decryption results. The specific calculation method is as follows:

[0190]

[0191]

[0192]

[0193] Where dim1, dim2, and dim3 are nodes k For device i The availability, reliability, and data integrity of fog node k are defined as follows: Acc is the number of times fog node k accepts requests from terminal i, Sub is the number of requests submitted by the terminal, Fin is the number of times fog node completes the terminal's requests and returns results, and Tru is the number of times the results returned by fog node pass data integrity verification.

[0194] ① Direct Trust Value

[0195] terminal device i For fog nodes k direct trust value a (i,k) is:

[0196] trust a (i,k)=dim1·w1+dim2·w2+dim3·w3

[0197] w1, w2, w3 are the weights of availability, reliability, data integrity, respectively, and w1+w2+w3=1. In particular, when the historical interaction behavior of terminal i and fog node k has no outsourcing decryption, the corresponding weight w3 is set to 0. If terminal i has no interaction record with fog node k, the direct trust value is null.

[0198] ②Audit trust value

[0199] The audit trust value reflects the evaluation of all terminal devices in the system to the fog node. Assuming that the access device list of fog node k is L, the audit trust value of fog node k is calculated as follows: b (k) represents the audit trust value of fog node k, and the calculation method is as follows:

[0200]

[0201] ③Peer entity trust value

[0202] The top n terminal devices with the most interactions with fog node k are selected as peer entities, and the peer entity trust value is calculated as follows:

[0203]

[0204] The peer entity trust value reflects the trust of other representative terminal devices in the system to fog node k.

[0205] The following is the calculation method of the above three trust values, and the reputation of the fog node and the comprehensive trust degree of terminal device i to fog node k are represented.

[0206] Reputation value of fog node k: Assuming that the recommended node list of fog node k is {node1, node2,..., node p}, the audit trust value of fog node k trust b (k) and the audit trust value of the recommended node list {trust b (node1), trust b (node2),..., trust b (node p )} are calculated according to ②, and then:

[0207]

[0208] w α and w β are weights and w α +w β =1.

[0209] The trust values of ①②③ are combined to obtain the comprehensive trust value T i,k of terminal i to node k:

[0210] T i,k = w a ·trust(device i ,node k ) + w b ·trust(device L ,node k ) + w c ·trust(device i ,node FL )

[0211] wherein w a , w b , w c are corresponding weights and w a +w b +w c =1.It needs to be noted that when there is a direct trust value of null or a recommended node trust value of null, the corresponding part is removed when calculating the comprehensive trust value, that is, the corresponding weight is set to 0.

[0212] The main innovation of the present application is embodied in:

[0213] 1. The attribute mapping scheme based on wordnet: simplifies attribute management, reduces the difficulty of access policy construction, and indirectly improves encryption and decryption efficiency by reducing the number of attributes;

[0214] 2. Constructing a fog node trust model: risk estimation of the fog node is performed through trust measurement, and the reputation of the fog node and the comprehensive trust value of the terminal to the node are calculated through multiple dimensions;

[0215] 3. Fog node load balancing scheme combining reputation value and trust degree: first, filter out nodes that do not meet the privacy threshold through the reputation value, then assign weights to the fog nodes through the trust degree and the idle resources of the nodes, and then select proxy fog nodes through the weight random load balancing algorithm.

[0216] The advantages of the present application are:

[0217] The present application optimizes the existing attribute-based encryption scheme through attribute mapping based on semantic reasoning, simplifies attribute management, and realizes fine-grained access control of private information in fog computing using the optimized attribute-based encryption technology;

[0218] For the current situation of device attribute explosion in the Internet of Things environment, the present application combines the characteristics of heterogeneous attributes in different systems, designs an attribute management method based on semantic reasoning, which not only makes it more convenient for users to set access structures and their own attributes, but also greatly reduces the number of attributes in the attribute universe, thereby improving the efficiency of access control.

[0219] Since the fog node is used for outsourcing calculation and requesting agent, it is necessary to judge the security risk of the fog node, therefore, the trust model of the fog node is designed, which increases the security of access control, and brings a reference standard for the terminal device to select the fog node, and according to the trust value weight load balancing algorithm, the computing capacity of the fog computing node is more fully utilized.

[0220] The above is only the preferred embodiment of the present application, and is not used to limit the present application, and for those skilled in the art, the present application can have various changes and changes. Any modification, equivalent replacement, improvement, etc. within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. An attribute-based encryption and trust model based fog computing access control method, characterized in that, The application relates to a fog node trust model, a semantic optimization attribute-based encryption method, and a trust-based weight load balancing algorithm. The fog node trust model is constructed as follows: Fog nodes are divided into fog groups, and the management nodes in the fog groups calculate the reputation of the fog nodes and the trust value of the user terminals to the fog nodes through three dimensions of direct trust, audit trust and peer entity trust; The semantic optimization attribute-based encryption method is established as follows: The attribute mapping based on semantic reasoning is used to optimize the attribute-based encryption method, and the attribute mapping of the access policy tree and the user is converted into semantic attribute mapping; The access control in the fog computing is carried out based on the fog node trust model and the semantic optimization attribute-based encryption method: The data owner sets the access control policy tree and the privacy threshold, selects the proxy fog node through the trust-based weight load balancing algorithm, and performs outsourcing encryption and ciphertext uploading by the proxy fog node; The data accesser acquires the privacy threshold of the target information, then selects the proxy fog node through the trust-based weight load balancing algorithm to perform outsourcing decryption to obtain intermediate ciphertext, and finally decrypts the intermediate ciphertext to obtain the required plaintext; The short signature algorithm is used to verify the integrity of the plaintext, and the verification result is uploaded to the fog management node as one of the trust evaluation bases. wherein the reputation Reputation of the fog node k is calculated by the formula: k ​ where w α and w β are weights and w α + w β = 1, trust b (k) is the audit trust value of the fog node k, trust b (i') is the audit trust value of the recommended node list {node1, node2,..., node p} of the fog node k; User terminal i's overall trust value T for fog node k i,k is: T i,k = w a • trust a (i, k) + w b • trust b (k) + w c • trust c (i, k) where w a , w b , and w c are weights and w a + w b + w c = 1, trust a (i, k) is the direct trust of user terminal i to fog node k, trust b (k) is the audit trust value of fog node k, and trust c (i, k) is the peer entity trust. direct trust value trust a The formula for calculating (i, k) is: trust a (i, k) = dim1 • w1 + dim2 • w2 + dim3 • w3 In the formula, w1, w2 and w3 are the weights of the availability, reliability and data integrity respectively, and w1+w2+w3=1; dim1, dim2 and dim3 are the availability, reliability and data integrity of the fog node k to the user terminal i respectively. audit trust value trust b The formula for (k) is: In the formula, L is the access device list of the fog node k. Peer entity trust c The formula for calculating (i, k) is: In the formula, n is the top n terminals with the most interaction times with the fog node k. 2.The fog computing access control method of claim 1, wherein, The calculation formulas of dim1, dim2 and dim3 are as follows: In the formula, Acc is the number of times that the fog node k accepts the request of the terminal i, Sub is the number of times that the terminal submits the request, Fin is the number of times that the fog node completes the request of the terminal and returns the result, and Tru is the number of times that the result returned by the fog node passes the data integrity verification. 3.The fog computing access control method of claim 1, wherein, The conversion of the attribute mapping of the access policy tree and the user into semantic attribute mapping comprises the following steps: The attributes used in the policy tree are subjected to semantic mapping, the attributes are converted into concept attributes in the attribute universe through semantic reasoning, and then the concept attributes are used to set the threshold value access policy tree; The attributes in the attribute list of the user are mapped onto the concept attributes in the attribute universe through the semantic reasoning based on WordNet, the concept attribute set of the user is obtained by taking the attribute value x of the user as a starting point, merging the IDs of the synonym set and the hypernym set of x through WordNet, and the concept attribute set of the user is obtained. 4.The fog computing access control method of claim 1, wherein, The selection method of the proxy fog node comprises the following steps: Nodes with a reputation value greater than or equal to epsilon in the fog node list L0 are screened to obtain a new fog node list L; The comprehensive trust value of the user terminal device to the fog nodes in L is calculated according to the fog node trust model, the weight of the fog node is calculated in combination with the idle resource condition of the fog node, and then the proxy fog node is selected in the list L through the weight random load balancing algorithm; first, the idle resource amount of the fog nodes in L is normalized, and the converted idle resource amount is {RS(1), RS(2),..., RS(n)}, the interval being [0, 1]; The weight calculation formula of the fog node k is: weight(k) = a - T i,k + β - RS(k) In the formula, a and β are weight factors and a+β=1. 5.The fog computing access control method of claim 1, wherein, The decrypted information is verified for integrity using a BLS signature verification algorithm.

Images