Industrial Internet Identification Resolution Access Control Method Based on Ciphertext Attribute Encryption

Abstract

The present invention claims protection for an industrial Internet identifier resolution access control method based on ciphertext-policy attribute encryption, which includes the following steps: First, by improving the CP-ABE access tree, permission nodes are added, and access permissions are added to non-root nodes and non-leaf nodes to ensure hierarchical access to information. Enterprise nodes sending identifier registration requests can customize the access tree settings according to the sensitivity of the identifier information, thus accessing the identifier information more flexibly. Secondly, during the encryption process, the entire identifier information is encrypted, and at the same time, the secret values of nodes with access permissions are recorded. Non-private identifier information is re-encrypted by permission nodes. Finally, during the decryption process, the secret values of permission nodes are first restored. If the non-private identity information can be restored, the secret value of the root node is decrypted by combining the secret values of permission nodes and other user attributes.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet identification and resolution, and relates to an access control method, which is applicable to the security scenario of the industrial Internet identification and resolution system. Background Art

[0002] The industrial Internet identification and resolution system is an important part of the industrial Internet network system and a nerve center supporting the interconnection of the industrial Internet. Its function is similar to the domain name resolution system (DNS) in the Internet field. The core of the industrial Internet identification and resolution system includes three parts: identification coding, identification resolution system, and identification data service. First, the identification coding is an identity symbol that can uniquely identify physical resources such as machines and products, and virtual resources such as algorithms, processes, and identification data, similar to an "ID card". Second, the identification resolution system is a system that can query the network location or relevant information of the target object according to the identification coding, and perform unique positioning and information query on machines and items. It is the premise and foundation for realizing the precise docking of the global supply chain system and the enterprise production system, product full life cycle management, and intelligent services. Third, the identification data service can carry out industrial identification data management and cross-enterprise, cross-industry, cross-region, and cross-country data sharing and sharing by means of identification coding resources and the identification resolution system.

[0003] The industrial Internet identification and resolution system includes a top-level node, a second-level node, a recursive node, and an enterprise node. The top-level node is the top-level identification service node within a country or region, which can provide top-level identification resolution services and management capabilities such as identification filing and identification authentication for the national scope. The national top-level node should not only be connected to the international root nodes of various identification systems but also be connected to various second-level and lower-level other identification service nodes in the country. The recursive node is a key entry facility of the identification and resolution system, which can improve the overall service performance through technical means such as caching. When receiving an identification resolution request from the client, the recursive node will first check whether there is a query result in the local cache. If not, it will query through the reply path returned by the identification resolution server until the address or information associated with the identification is finally queried, return it to the client, and cache the request result. The second-level node is a public node that provides identification services for a specific industry or multiple industries. The second-level node should not only be docked with the national top-level node upward but also allocate identification codes to industrial enterprises downward and provide identification registration, identification resolution, identification data services, etc. As the main starting point for promoting the large-scale development of the identification industry application, the second-level node is the key to creating valuable industry-level identification applications and exploring sustainable business models. The enterprise node refers to the identification service node within an enterprise, which can provide identification registration, identification resolution service, identification data service, etc. for a specific enterprise, and can be either independently deployed or used as a component of the enterprise information system.

[0004] From the perspective of the overall architecture definition and orientation of the industrial Internet, the industrial Internet identification and resolution system is used not only by internal enterprise personnel, but also by ordinary users, third-party supervisors, identification information administrators, etc. Different roles have different levels and types of permissions, and improper identity management in the identification and resolution system may cause violations of permissions or trust.

[0005] Currently, the research on access control in the industrial Internet mainly focuses on attribute-based access control. However, this depends on cloud operations, and the security in the industrial Internet cannot be well guaranteed, and user access control is not flexible enough. Compared with other access control models, ciphertext-policy attribute encryption (CP-ABE) combined with encryption does not rely on the cloud. In CP-ABE, access policies can be formulated, the access policies are embedded in the ciphertext, and user attributes are embedded in the key. The user attribute key generated by users who meet the policy can be used for decryption. CP-ABE does not require, like other encryption methods such as RSA asymmetric encryption, knowing the identity information of the recipient every time encryption is performed and having to encrypt multiple times when sending to multiple users. CP-ABE only needs to set the access policy and perform encryption only once. When the attributes owned by the user conform to the policy described by the encryptor, the data user can decrypt. It can solve the problem of key leakage caused by the transmission of symmetric encryption keys. Currently, CP-ABE can achieve fine-grained access control for encrypted data, but there are still limitations in its use, that is, multi-permission access control is not considered when formulating access policies. For example, after encrypting a piece of information, the result decrypted by the attributes owned by an ordinary user is the non-private information among them, while the information decrypted by the user with permissions contains private information. In the application of the industrial Internet identification and resolution system, the identity permissions of users are often different. How to effectively implement hierarchical access control for industrial Internet identification information is an urgent problem to be solved.

[0006] The literature "A Multi-Cloud CP-ABE Access Control Scheme Based on Blockchain" (CN11130757A) proposed a method. This method first uses a symmetric encryption algorithm to encrypt the plaintext to obtain the data ciphertext, and then calls CP-ABE to encrypt the symmetric algorithm key to obtain the key ciphertext. At the same time, the access control tree is split. Send a part of the access control tree data ciphertext to the cloud server, send the key ciphertext to the blockchain network Hyperledger, and save the remaining part of the access control tree to the blockchain. Thus, the privacy of user attributes is effectively protected. However, in the above access control method, the access control is not flexible enough and cannot achieve hierarchical access control. Summary of the Invention

[0007] The present invention aims to solve the above problems of the prior art. A method for access control of industrial Internet identification and resolution based on ciphertext attribute encryption is proposed. The technical solution of the present invention is as follows:

[0008] An industrial Internet identification and resolution access control method based on ciphertext attribute encryption, which includes an identification registration stage and an identification resolution stage. Among them,

[0009] Identification registration stage: First, the enterprise constructs a hierarchical access control tree for ciphertext-policy attribute-based encryption (CP-ABE), and sends the hierarchical access control tree and the identification registration request to the secondary node through the enterprise node; at the same time, the enterprise generates different user attribute sets for different users; then, after receiving the identification code and the identification registration request returned by the top-level node, the secondary node combines the hierarchical access control tree and executes the CP-ABE hierarchical access control algorithm to encrypt the identification information; finally, perform a hash process on the identification information to generate a hash value of the identification information, splice the hash value to the security code block of the identification code, and return the hash code to the enterprise node;

[0010] Identification resolution stage: First, the user holding the user attribute set sends the attribute set, the identification code, and the identification resolution request to the secondary node; then, the secondary node combines the received user attribute set and executes the CP-ABE key generation algorithm to generate a user attribute key; secondly, the secondary node matches the hash value of the security code block in the identification code with the ciphertext in the database to query the ciphertext of the identification information corresponding in the ciphertext; then the secondary node combines the user attribute key and the ciphertext and executes the CP-ABE hierarchical access control algorithm to decrypt the identification information; finally, if the user attributes meet all or part of the access tree attribute requirements, the decryption algorithm can decrypt part or all of the identification information and return the identification information to the user; if the user attributes do not meet the access tree attribute requirements at all, then return a null value.

[0011] Furthermore, the construction of the CP-ABE hierarchical access control tree specifically includes:

[0012] Take a random number s as the secret value of the root node in the access tree, and share the secret value from the root node to the leaf nodes layer by layer according to the secret sharing scheme; assume that the threshold value of a non-leaf node is (k x , num x ), the secret value is s, where num x represents the total number of child nodes of this node, and k x represents the number of child nodes required for this node to recover its secret value; take k x -1 random numbers to construct k x -1 polynomials:

[0013]

[0014] Assume that the permission value of the root node T 1 is set to τ 1 , and the permission node T 2The child nodes of the non - leaf nodes that are root nodes have their permission values set to τ 2 , where τ 1 > τ 2 ; The entire identification information is M 1 , and the privacy identification information is M 2 , then the identification information of the part that needs to be re - encrypted by the permission node is M 0 =(M 2 - M 1 ); During the first encryption process, M 1 is encrypted starting from the root node, that is, the secret value s 1 of the root node is shared secretly layer by layer. When sharing to the permission node, the secret value s 2 of the permission node is recorded;

[0015] During the re - encryption stage, the secret value s 2 of the permission node of the hierarchical access tree is shared layer by layer to encrypt the non - private information M 0 . During the decryption process, first verify whether the user attributes can recover the secret value s 2 of the permission node. If it can be recovered, then M 0 can be decrypted. If it cannot be recovered, then return a null value; Then, combined with the remaining user attributes and the recovered secret value s 2 of the permission node, recover the secret value s 1 of the root node of the hierarchical access tree. If it can be recovered, then decrypt M 2 .

[0016] Furthermore, the steps of the CP - ABE hierarchical access control encryption algorithm specifically include:

[0017] (1) Setup(1 k ): Input the security parameter r, G 0 and G T are bilinear groups of prime order p, g is the generator of G 0 . Next, select two random exponents α, β ∈ P , and the system public key PK:

[0018] PK=(G, e(g, g) α , g β )

[0019] The master secret key MSK is MSK=(β, g α )

[0020] (2) Encrypt(PK, M 1 ) → CT 1 : When performing the encryption process, input all the identification information M 1 and the system public key PK. Select a random number s ∈ PThe secret value as the root node of the hierarchical access tree; Share the secret value s layer by layer through the hierarchical access tree, so the secret shard corresponding to the attribute i of the leaf nodes (leafNodes) is λ i ; Calculate its ciphertext component

[0021]

[0022] Encrypt M 1 The ciphertext of is:

[0023]

[0024] Finally, record the secret value s of the permission node 1 ;

[0025] (3)Re-encrypt(PK,M 0 )→CT 2 : Input M 0 and the system public key PK, with the secret value s 1 of the permission node as the root node, share the secret value s layer by layer 1 ; The secret shard corresponding to the attribute i of the leaf nodes in re-encryption is λ i , calculate its ciphertext component

[0026]

[0027] The ciphertext corresponding to re-encryption is:

[0028]

[0029] The ciphertext CT of the identification information encrypted this time is:

[0030]

[0031] Furthermore, the specific steps of the CP-ABE hierarchical access control decryption algorithm include:

[0032] (1)KeyGen(MSK,L)→SK L : In the user attribute key generation phase, input the master secret key MSK and the user attribute set L. Select a random number t in the real domain, t∈ P and calculate D = g α g βt , D 0 = g t ; For each attribute A i in the user attribute set L, first determine whether there is an attribute A i in A i1 that can be decrypted, then group the attributes and decrypt Attribute A of the private identification information i1 and Attribute A that can decrypt the normal identification information i2 ;

[0033] Calculate the user attribute key component Finally, output the user attribute key:

[0034]

[0035] (2) Decrypt(CT, SK L ) → M: In the decryption stage, input CT and SK L ; First, decrypt the permission node with the permission value τ 2 for A i2 and the overlapping attributes in the leaf node attribute set of the hierarchical access tree, calculate the decryption component P 1 :

[0036]

[0037] In addition, calculate If the attribute set A i2 satisfies the permission node T of the access control tree 2 , and the recovered T 2 secret value s 1 , it follows that:

[0038]

[0039] According to and CT, the plaintext M of the non-private identification information can be obtained 0 :

[0040]

[0041] If there exists A i1 = A i - A i2 , using A i1 and the secret value s of the permission node T 2 to continue to recover the secret value s of the root node T 1 and decrypt the identification information M 1 , calculate the decryption component P 1 and e(C 2 , D): 0 e(C

[0042]

[0043] e(C 0 , D) = e(g, g) αs e(g, g) βts

[0044] Finally, calculate the plaintext M of the identification information 1 :

[0045] M 1 = M 1 e(g, g) αs / e(g, g) αs 。

[0046] The advantages and beneficial effects of the present invention are as follows:

[0047] (1) In the industrial Internet, the users using the identification resolution system are not only the internal personnel of the enterprise, but also ordinary users, third-party supervisors, identification information administrators, etc. The access rights they have are different. For example, for a commodity, the information queried by ordinary users using the industrial Internet identification resolution system includes basic information such as production date, production place, raw materials, etc.; compared with ordinary users, commodity maintenance personnel have higher permissions. When using the industrial Internet identification resolution system to query information, they can also query privacy information such as production processes in addition to the basic information of the commodity. Therefore, for the hierarchical access tree construction method proposed in claim 2, it is reflected in the permission nodes of the hierarchical access tree for users with different permissions.

[0048] (2) In the formal definition of CP-ABE, encryption and decryption are only executed once. If the user attribute key does not meet the access policy contained in the ciphertext, a null value is returned and decryption cannot be performed. Although fine-grained access control can be achieved, it is not flexible enough. Therefore, claims 3 and 4 for the hierarchical access control of different-permission users in the industrial Internet introduce re-encryption in the encryption stage of identification registration. For the entire identification information, the access tree starts from the root node for secret sharing to obtain the secret shards of all leaf nodes, that is, attributes; at the same time, the secret value of the permission node is recorded when sharing to the permission node. After the first encryption is completed, re-encryption is performed. Non-private information performs secret sharing with the permission node as the root node and then performs encryption again. In the decryption stage of identification resolution, first group the user attributes. The leaf nodes under the permission node are in one group, and the remaining attributes are in another group; secondly, when decrypting, first restore the secret value of the permission node and decrypt the non-private information. If the secret value of the permission node can be restored, then combine the secret value of the permission node and the other group of attributes to restore the secret value of the root node and decrypt the entire identification information. Finally, if the secret value of the permission node cannot be restored, directly return null; if the secret value of the permission node can be restored and the secret value of the root node cannot be restored, return non-private data; if the secret value of the root node is restored, return the entire identification information. In this process, hierarchical access control of identification information is realized, that is, different information is accessed according to different permissions. Description of the Drawings

[0049] Figure 1 is a hierarchical access control tree constructed by the preferred embodiments provided by the present invention;

[0050] Figure 2 is the flow chart of the hierarchical access control for industrial Internet of Things identification resolution. Specific Embodiments

[0051] Next, the technical solutions in the embodiments of the present invention will be clearly and detailedly described with reference to the accompanying drawings in the embodiments of the present invention. The described embodiments are only a part of the embodiments of the present invention.

[0052] The technical solution of the present invention to solve the above technical problems is:

[0053] A method for hierarchical access control of industrial Internet of Things identification resolution based on ciphertext-policy attribute encryption, and the flow chart of this method is as Figure 1 shown. The technical solution of the present invention is as follows:

[0054] The method for hierarchical access control of industrial Internet of Things identification resolution is divided into an identification registration stage and an identification resolution stage. Identification registration stage: First, an enterprise constructs a hierarchical access control tree of CP-ABE and sends the access tree and the identification registration request to a secondary node through the enterprise node; at the same time, the enterprise generates different user attribute sets for different users; then, after receiving the identification code and the identification registration request returned by the top-level node, the secondary node combines the hierarchical access tree and executes the CP-ABE hierarchical access control algorithm to encrypt the identification information; finally, hash processing is performed on the identification information to generate a hash value of the identification information, and the hash value is concatenated to the security code block of the identification code, and the hash code is returned to the enterprise node.

[0055] Identification resolution stage: First, a user holding a user attribute set sends the attribute set, the identification code, and the identification resolution request to the secondary node; then, the secondary node combines the received user attribute set and executes the CP-ABE key generation algorithm to generate a user attribute key; secondly, the secondary node matches the hash value in the security code block of the identification code with the ciphertext in the database to query the ciphertext of the identification information corresponding to the ciphertext; then the secondary node combines the user attribute key and the ciphertext and executes the CP-ABE hierarchical access control algorithm to decrypt the identification information; finally, if the user attributes meet all or part of the access tree attribute requirements, the decryption algorithm can decrypt part or all of the identification information and return the identification information to the user. If the user attributes do not meet the access tree attribute requirements at all, a null value is returned.

[0056] Furthermore, the method for constructing the CP-ABE hierarchical access control tree is as Figure 2 shown. The specific steps for constructing the hierarchical access control tree include:

[0057] Take a random number s as the secret value of the root node in the access tree, and share the secret value layer by layer from the root node to the leaf nodes according to the secret sharing scheme. Assume that the threshold of a non-leaf node is (k x , num x ), the secret value is s, where num x represents the total number of child nodes of this node, and k x represents the number of child nodes required for this node to recover its secret value. Take k x -1 random numbers to construct k x -1 polynomials:

[0058]

[0059] Assume that the permission value of the root node T 1 is set to τ 1 , and the permission node T 2 is a child node of a non-leaf node of the root node, and the permission value is set to τ 2 , where τ 1 > τ 2 ; the entire identification information is M 1 , and the privacy identification information is M 2 , then the identification information of the part that needs to be re-encrypted by the permission node is M 0 = (M 2 - M 1 ). In the first encryption process, M 1 is encrypted from the root node, that is, it is secretly shared layer by layer by the secret value s 1 of the root node. When sharing to the permission node, the secret value s 2 of the permission node is recorded.

[0060] In the re-encryption stage, it is shared layer by layer by the secret value s 2 of the permission node of the hierarchical access tree, and the non-private information M 0 is encrypted. In the decryption process, first verify whether the user attributes can recover the secret value s 2 of the permission node. If it can be recovered, then M 0 can be decrypted. If it cannot be recovered, then return a null value. Then combine the remaining user attributes and the recovered secret value s 2 of the permission node to recover the secret value s 1 of the root node of the hierarchical access tree. If it can be recovered, then decrypt M 2 .

[0061] Furthermore, the specific steps of the CP-ABE hierarchical access control encryption algorithm include:

[0062] (1) Setup(1 k ): Input the security parameter r, G0 and G T are bilinear groups of prime order p, and g is a generator of G 0 . Next, select two random exponents α, β ∈ P . The system public key PK is:

[0063] PK = (G, e(g, g) α , g β )

[0064] The master secret key MK is MSK = (β, g α )

[0065] (2) Encrypt(PK, M 1 ) → CT 1 : Input all identification information M 1 and the system public key PK. Select a random number s ∈ P in the real domain as the secret value of the root node of the hierarchical access tree. Share the secret value s layer by layer through the hierarchical access tree, so the secret shard corresponding to the attribute i of the leaf node is λ i . Calculate:

[0066]

[0067] The ciphertext component for encrypting M 1 is:

[0068]

[0069] Finally, record the secret value s 1 .

[0070] (3) Re - encrypt(PK, M 0 ) → CT 2 : Input M 0 and the system public key PK. Using the secret value s 1 of the permission node as the root node, share the secret value s 1 layer by layer. The secret shard corresponding to the attribute i of the leaf node in the re - encryption is λ i . Calculate:

[0071]

[0072] The ciphertext component corresponding to the re - encryption is:

[0073]

[0074] The ciphertext CT of the identification information encrypted this time is:

[0075]

[0076] Furthermore, the specific steps of the CP-ABE hierarchical access control decryption algorithm are as follows:

[0077] (1) KeyGen(MSK, L) → SK L : Select a random number t in the real domain, t ∈ P And calculate D = g α g βt , D 0 = g t . For each attribute A in the user attribute set A i , first determine whether there is an attribute A in A i that can be decrypted, and then group the attributes. The attribute A that decrypts the private identification information i1 and the attribute A that can decrypt the normal identification information i1 . Calculate i2 . Finally, output the user attribute key:

[0078]

[0079] (2) Decrypt(CT, SK(2) Decrypt(CT, SK L ) → M: Input CT and SK L . First, decrypt the permission node with permission τ 2 . For the overlapping attributes of A i2 and the leaf node attribute set in the hierarchical access tree, calculate P 1 :

[0080]

[0081] In addition, calculate If the attribute set A i2 satisfies the permission node T of the access control tree 2 , and the recovered T 2 secret value s 1 , obtain:

[0082]

[0083] According to and CT, the plaintext M of the non-privacy identification information can be obtained 0 :

[0084]

[0085] If there exists A i1 = A i - A i2 , with A i1 and the secret value s of the permission node T 2 1 ​Continue to restore the root node T 1 's secret value s and decryption identification information M 1 . Calculate P 2 and e(C 0 , D):

[0086]

[0087] e(C 0 , D) = e(g, g) αs e(g, g) βts

[0088] Finally, calculate the plaintext M of the identification information 1 :

[0089] M 1 = M 1 e(g, g) αs / e(g, g) αs

[0090] The systems, devices, modules or units illustrated in the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0091] It should also be noted that the term "including", "comprising" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or elements inherent to such process, method, commodity or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of another identical element in the process, method, commodity or device including the said element.

[0092] The above embodiments should be understood as being only for illustrative purposes of the present invention and not for limiting the protection scope of the present invention. After reading the content recorded in the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent changes and modifications also fall within the scope defined by the claims of the present invention.

Claims

1. An industrial Internet identification resolution access control method based on ciphertext attribute encryption, characterized in that, it includes an identification registration stage and an identification resolution stage, where, Identification registration stage: First, an enterprise constructs a hierarchical access control tree for ciphertext-policy attribute-based encryption (CP-ABE), and sends the hierarchical access control tree and an identification registration request to a secondary node through the enterprise node; at the same time, the enterprise generates different user attribute sets for different users; then, after receiving the identification code and the identification registration request returned by the top-level node, the secondary node combines the hierarchical access control tree and executes the CP-ABE hierarchical access control algorithm to encrypt the identification information; finally, perform a hash processing on the identification information to generate a hash value of the identification information, splice the hash value to the security code block of the identification code, and return the hash code to the enterprise node; Identification resolution stage: First, a user holding a user attribute set sends the attribute set, the identification code, and an identification resolution request to the secondary node; then, the secondary node combines the received user attribute set and executes the CP-ABE key generation algorithm to generate a user attribute key; secondly, the secondary node matches the hash value in the security code block of the identification code with the ciphertext in the database to query the ciphertext of the identification information corresponding to the ciphertext; then the secondary node combines the user attribute key and the ciphertext and executes the CP-ABE hierarchical access control algorithm to decrypt the identification information; finally, if the user attributes meet all or part of the access tree attribute requirements, the decryption algorithm can decrypt part or all of the identification information and return the identification information to the user; if the user attributes do not meet the access tree attribute requirements at all, then return a null value; The construction of the CP-ABE hierarchical access control tree specifically includes: Take the random number s as the secret value of the root node in the access tree, and share the secret value layer by layer from the root node to the leaf nodes according to the secret sharing scheme; assume that the threshold of a non-leaf node is (k x ,num x ), the secret value is s, where num x represents the total number of child nodes of this node, and k x represents the number of child nodes required for this node to recover its secret value; take k x -1 random numbers to construct k x -1 polynomials: Assume that the permission value of the root node T 1 is set to τ 1 , and the permission node T 2 is a child node of a non-leaf node of the root node, and the permission value is set to τ 2 , where τ 1 >τ 2 ; the entire identification information is M 1 , and the privacy identification information is M 2 , then the identification information of the part that needs to be re-encrypted by the permission node is M 0 =(M 2 -M 1 ); in the first encryption process, M 1 is encrypted from the root node, that is, the secret value s 1 of the root node is shared secretly layer by layer, and the secret value s 2 of the permission node is recorded when sharing to the permission node; The re-encryption phase shares the secret value s of the permission nodes of the hierarchical access tree layer by layer and encrypts the non-private information M 2 ; In the decryption process, first verify whether the user attributes can recover the secret value s of the permission nodes 0 . If it can be recovered, then M can be decrypted 2 . If it cannot be recovered, return a null value; then combine the remaining user attributes and the recovered secret value s of the permission nodes 0 to recover the secret value s of the root node of the hierarchical access tree 2 . If it can be recovered, then decrypt M 1 . 2 ​ 2. The industrial Internet identification resolution access control method based on ciphertext attribute encryption according to claim 1, characterized in that, the steps of the CP-ABE hierarchical access control encryption algorithm specifically include: (1)Setup(1 k ): Input security parameters r, G 0 and G T are bilinear groups of prime order p, g is a generator of G 0 , and then select two random exponents System public key PK: PK = (G, e(g, g) α , g β ) The master secret key MSK is MSK = (β, g α ) (2) Encrypt(PK, M 1 ) → CT 1 : When performing the encryption process, input all the identification information M 1 and the system public key PK, and select a random number in the real domain as the secret value of the root node of the hierarchical access tree; share the secret value s layer by layer through the hierarchical access tree, so the secret shard corresponding to the attribute i of the leaf node (leafNodes) is λ i ; calculate its ciphertext component Encrypted M 1 The ciphertext is: Finally, record the secret value s of the permission node 1 ; (3)Re-encrypt(PK, M 0 ) → CT 2 : Input M 0 and the system public key PK, with the secret value s of the permission node 1 as the root node, share the secret value s layer by layer 1 ; The secret shard corresponding to the attribute i of the leaf node in re-encryption is λ i , calculate its ciphertext component Re-encrypt the corresponding ciphertext as: The ciphertext CT of the identification information encrypted this time is:

3. The industrial Internet identification resolution access control method based on ciphertext attribute encryption according to claim 2, characterized in that, the specific steps of the CP-ABE hierarchical access control decryption algorithm include: (1) KeyGen(MSK, L) → SK L : In the user attribute key generation phase, the master key MSK and the user attribute set L are input; a random number is selected in the real domain and calculate D = g α g βt , D 0 = g t ; For each attribute A in the user attribute set L i , first determine whether there is an attribute A in A i that can be decrypted, then group the attributes, the attribute A that decrypts the private identification information i1 and the attribute A that can decrypt the normal identification information i1 ; i2 ; Calculate the user attribute key component Finally output the user attribute key: (2) Decrypt(CT, SK L ) → M: In the decryption phase, input CT and SK L ; First, decrypt the authorization node with the authorization value τ 2 For the attributes that overlap between A i2 and the set of leaf node attributes in the hierarchical access tree, calculate the decryption component P 1 : In addition, calculate If the attribute set A i2 satisfies the permission node T of the access control tree 2 , and the restored T 2 secret value s 1 , it is concluded that: According to and CT, the plaintext M of the non-privacy identification information can be obtained 0 : If A exists i1 = A i -A i2 , with A i1 and the secret value s of the permission node T 2 continue to recover the secret value s and the decryption identification information M of the root node T 1 1 1 , calculate the decryption component P 2 and e(C 0 , D): 0 ,D): e(C 0 ,D) = e(g,g) αs e(g,g) βts Finally, calculate the plaintext M of the identification information 1 : M 1 = M 1 e(g, g) αs / e(g, g) αs .

Images