A fine-grained, scalable identity-based broadcast encryption method and system

Abstract

The present invention discloses a fine-grained, scalable identity-based broadcast encryption method, which combines access control ideas and puncture encryption technology. It can grant more users decryption permissions without re-encrypting the data, and data owners can simultaneously achieve fine-grained data sharing. The maximum number of extended receiver sets can be determined by the data owner.

Description

Technical Field

[0001] The present invention belongs to the field of cloud computing security technology, relates to identity-based broadcast encryption, and in particular to an extensible identity-based broadcast encryption method and system capable of achieving fine-grained data sharing. Background Art

[0002] Cloud computing can provide computing and storage services based on the needs of individuals and organizations. Users outsource their data to cloud storage servers and share data with their partners. However, since the data is encrypted, it is not convenient to use it as plain text.

[0003] Existing encryption-based solutions often limit data sharing and access control flexibility. In particular, data owners want to preserve some data while sharing others, and flexible access control is required for encrypted data in cloud computing. Data owners can download and decrypt all data, then select a portion to share. However, this wastes computing and communication resources.

[0004] The Broadcast Encryption (BE) scheme provides a useful method for implementing multi-user data access control. The data owner selects a group of users and encrypts the data to be protected for them. Only designated users can retrieve the encryption key from the ciphertext and then obtain the plaintext. During the encryption phase, users who are not designated cannot decrypt the ciphertext even if they collude. The Identity-based Broadcast Encryption (IBBE) scheme inherits the advantages of identity-based cryptographic systems and eliminates the verification and management of certificates related to user public keys. The data owner encrypts the data using the identities of all target users. Designated users can access the data through the private key issued by the Privacy Key Generator (PKG). Unspecified users also cannot access the encrypted data during the encryption phase.

[0005] In 2022, Lai et al. proposed a data access control scheme for cloud computing that grants decryption permissions to more users. This scheme allows authorized users to expand the set of recipients specified in an IBBE ciphertext by adding new recipient sets. Users in both the original and expanded recipient sets can successfully decrypt the ciphertext. The maximum number of expandable recipient sets is determined by the data owner. However, this scheme does not enable fine-grained data sharing.

[0006] In 2016, Xu et al. proposed the Identity-based Broadcast Proxy Re-encryption (IBPRE) scheme, which allows a proxy with a re-encryption key to convert the initial ciphertext sent to a group of users into new ciphertext sent to another group of designated users. However, in this scheme, the data owner needs to generate a re-encryption key for the proxy, which then re-encrypts all ciphertexts generated by the data owner to grant decryption rights to the new user. This approach becomes prohibitively expensive when the number of ciphertexts is large and re-encryption is frequent. Summary of the Invention

[0007] Purpose of the invention: The purpose of the present invention is to propose a fine-grained, scalable identity-based broadcast encryption method and system, which can grant more users decryption permissions without re-encrypting data, while achieving more flexible fine-grained data sharing.

[0008] Technical Solution: The first aspect of the present invention provides a fine-grained, scalable identity-based broadcast encryption method, comprising:

[0009] (1) Configure the system public parameters PP and system master key MSK;

[0010] (2) Based on the key pair (PP, MSK) and the identity ID of each authorized data user i , get the private key SK0 of the cloud storage server and the initial private key SK of the authorized data user i ;

[0011] (3) Based on the system public parameters PP and private key SK i , get the puncture private key

[0012] (4) Based on the system public parameters PP, data M, and label set And the identity set of data users S = {ID1, ID2, ..., ID n}, we get the tuple (CT, K, m); where d≤w, w is the maximum number of tags allowed to be added to the ciphertext; n is the number of initial receivers; CT is the ciphertext, K is the data encryption key, and m is the maximum number of extended receivers;

[0013] (5) Based on the system public parameter PP, the ciphertext CT related to the identity set S, and the identity ID of the data user i and identity ID i Related puncture private key If ID i ∈S, then use the data encryption key K to decrypt the ciphertext CT to obtain the data M; if Then output ⊥;

[0014] (6) Based on the system public parameter PP, the ciphertext CT associated with the identity set S and the maximum number of extended receivers m, and the extended identity set S′, the extended ciphertext CT′ with respect to S∪S′ is obtained; the extended receiver set S′=(ID′1,ID′2,...,ID′ δ )=(ID n+1 ,ID n+2 ,...,ID n+δ ), where δ≤m,

[0015] (7) Based on the system public parameter PP, identity set S, ciphertext CT related to identity set S, extended identity set S′, extended ciphertext CT′ related to extended identity set S′ and private key SK0, we calculate and in is the encryption key of the private key used to decrypt CT that has been punctured τ times, is the encryption key of the private key used to decrypt CT′ that has been punctured τ times; if Then output 1 and accept the extended ciphertext CT′; if Then output ⊥ and reject the extended ciphertext CT′.

[0016] Furthermore, step (1) includes:

[0017] Select a large prime number p, p factorial cyclic group and Bilinear map

[0018] Select a random element and three random values g is the group Generator, calculate g1=g α ;

[0019] Choosing a hash function For each i∈[1,N], calculate

[0020] System master key MSK = (g, α, β),

[0021] System public parameters

[0022] Furthermore, step (2) includes:

[0023] Given the identity ID0 of the cloud storage server, choose a random value Compute the private key of the cloud storage server

[0024] The identity ID of the given data user i , choose a random value and a distinguishing tag that is not used for encryption and puncture calculate sk 0,2 =g r ,

[0025] sk5=gv r , sk6=h r , sk7=u r ;

[0026] Data User ID i The private key SK i =({sk 0,1 ,sk 0,2 ,sk 0,3},sk4,sk5,sk6,sk7,t0).

[0027] Furthermore, step (3) includes:

[0028] Select an unpunctured label Assume that the punctured tag set T′={t1,...,t l-1}, where l≤w; let t l =t, then T=T′∪t={t1,...,t l-1 ,t l}; t is an unpunctured tag;

[0029] Given

[0030] Pick three random values calculate

[0031] sk′ 0,2 =sk 0,2 ·g r′ ,

[0032] as well as

[0033] Will Middle (sk 0,1 ,sk 0,2 ,sk 0,3 ) is replaced by (sk′ 0,1 ,sk′ 0,2 ,sk′ 0,3 ), and add (sk l,1 ,sk l,2 ,sk l,3), T′ is replaced by T, while keeping the other parts unchanged, and the punctured private key is obtained

[0034]

[0035] ; T is the set of punctured tags.

[0036] Furthermore, step (4) includes:

[0037] The data owner determines the authorized data user set S = {ID1, ID2, ..., ID n}, and determine that the maximum number of extended receivers is m, where n + m < N, where N is the maximum number of receivers;

[0038] The data owner performs message lock encryption MLE to calculate s = MLE (M), and then randomly selects Calculate the encryption key K = e(g,h λ ·u s ) k ;

[0039] Tag Collection Where d≤w; the encryption algorithm is a univariate polynomial Define a coefficient vector in When y∈[d+1,w], z y =0;

[0040] Calculate the encapsulated ciphertext part, C3=u s h k , C4=v s , C5=v k , C7=g k ;

[0041] Compute the receiver's extended suffix for j∈[1,m]

[0042] Ciphertext CT = ((C1,C2,C3,C4,C5,C6,C7),(D1,D2,...,D m ),m),

[0043] Send the ciphertext CT to the cloud storage server.

[0044] Furthermore, step (5) includes:

[0045] The puncture private key of the given data owner

[0046]

[0047] Let τ denote the number of times the private key is punctured, where for l∈1,...,τ, T={t1,t2,...,t τ},

[0048] Calculate the coefficient vector And for each t l ∈T, calculate

[0049] calculate

[0050] in ID0 is the identity of the cloud storage server and can be regarded as a public parameter of the system;

[0051] calculate

[0052] For l∈1,...,τ, calculate

[0053] Among them, when t0 and t l When ∈T is not a root of f(x), that is, Then f(t0)≠0, f(t l )≠0;

[0054] For a private key that has been punctured τ times, its encryption key is Authorized data users can use the encryption key K to recover M.

[0055] Furthermore, step (6) includes:

[0056] Authorized data users determine the data S = {ID1, ID2, ..., ID n The relevant ciphertext is CT = ((C1,C2,C3,C4,C5,C6,C7), (D1,D2,...,D m ),m), and the extended receiver set

[0057] S′=(ID′1,ID′2,...,ID′ δ )=(ID n+1 ,ID n+2 ,...,ID n+δ ), where δ≤m,

[0058] Obtain s in step (5) and choose a random value set up calculate C4=C4=v s , Then the extended ciphertext is CT′=(C′1, C′2, C′3, C′4, C′5, C′6, C′7); the authorized data user uploads (CT′, S′) to the cloud storage server.

[0059] Furthermore, step (7) includes:

[0060] The cloud storage server decrypts CT using its private key and calculates

[0061]

[0062] in

[0063] calculate And for each t l ∈T,

[0064] calculate

[0065] For l∈1,...,τ, calculate

[0066] Among them, when t0 and t l When ∈T is not a root of f(x), that is, Then f(t0)≠0, f(t l )≠0; for a private key that has been punctured τ times, its encryption key is

[0067] The cloud storage server uses its private key to decrypt CT′ and calculate

[0068]

[0069] in

[0070] calculate

[0071] And for l∈1,...,τ, calculate

[0072] Among them, when t0 and t l When ∈T is not a root of f(x), that is, Then f(t0)≠0, f(t l )≠0; for a private key that has been punctured τ times, its encryption key is

[0073] like The cloud storage server outputs 1 and updates the corresponding information; otherwise, it outputs 0 and refuses to extend the ciphertext.

[0074] A second aspect of the present invention provides a fine-grained, scalable identity-based broadcast encryption system, comprising:

[0075] The system parameter setting module is used to configure the system public parameter PP and the system master key MSK; send the system public parameter PP to the private key generation module, the puncture module, the encryption module, the decryption module, the expansion module and the integrity check module respectively; and send the system master key MSK to the private key generation module;

[0076] The private key generation module is used to generate a private key based on the key pair (PP, MSK) and the identity ID of each authorized data user. i , get the private key SK0 of the cloud storage server and the initial private key SK of the authorized data user i ; Send SK0 to the integrity check module and send SK i Send to the puncture module and decryption module;

[0077] Puncture module, used to calculate the system public parameters PP and private key SK i , get the puncture private key Pierce the private key Send to decryption module;

[0078] Encryption module, used to set public parameters PP, data M, and tags according to the system And the identity set of data users S = {ID1, ID2, ..., ID n}, obtain the tuple (CT, K, m); where d ≤ w, w is the maximum number of tags allowed to be added to the ciphertext; n is the number of initial receivers; CT is the ciphertext, K is the data encryption key, and m is the maximum number of extended receivers; then the ciphertext CT is sent to the decryption module, the expansion module, and the integrity check module;

[0079] Decryption module, used to decrypt data based on the system public parameter PP, the ciphertext CT related to the identity set S, and the identity ID of the data user. i and identity ID i Related puncture private key

[0080] If ID i ∈S, then use the data encryption key K to decrypt the ciphertext CT to obtain the data M; if Then output ⊥;

[0081] The expansion module is used to obtain the extended ciphertext CT′ about S∪S′ according to the system public parameter PP, the ciphertext CT related to the identity set S and the maximum number of extended receivers m, and the extended identity set S′; the extended receiver set S′=(ID′1,ID′2,...,ID′ δ )=(ID n+1,ID n+2 ,...,ID n+δ ), where δ≤m, Then the extended identity set S′ and the extended ciphertext CT′ are sent to the integrity check module;

[0082] The integrity check module is used to calculate the following: and in is the encryption key of the private key used to decrypt CT that has been punctured τ times, is the encryption key of the private key used to decrypt CT′ that has been punctured τ times; if Then output 1 and accept the extended ciphertext CT′; if Then output ⊥ and reject the extended ciphertext CT′.

[0083] This invention applies puncture encryption (PE), which allows data owners to selectively share data stored in the cloud. In PE, each data owner can generate a pair of public and private keys. Before outsourcing the data to the cloud, the data owner can encrypt the data using their public key and a set of descriptive tags (such as data type, collection time, and content keywords). If the data owner wishes to share some data with users while retaining other data, they can generate a custom key using the keys on certain tags. Users cannot access data whose tags have been punctured in the custom key, but can only access data whose tags have not been punctured.

[0084] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages:

[0085] Compared with general identity-based broadcast encryption, this invention combines puncture encryption with access control, enabling fine-grained data sharing for data owners and empowering more users to access data. In addition, the maximum number of extended recipients can be determined by the data owner. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0087] Figure 1 This is a schematic diagram of the structure of the encryption system provided in the embodiment of the present application;

[0088] Figure 2 This is a schematic diagram of the user usage status of the encryption system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0089] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are not exhaustive. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative work shall fall within the scope of protection of the present invention.

[0090] The present invention provides a fine-grained, scalable identity-based broadcast encryption method, which includes the following steps:

[0091] (1) Configure the system public parameters PP and system master key MSK;

[0092] Specifically, the private key generator (PKG) inputs the security parameter λ, the maximum number of tags allowed to be added to the ciphertext w, and the maximum number of receivers N, and outputs the system public parameter PP and the system master key MSK; including:

[0093] Select a large prime number p, p factorial cyclic group and Bilinear map

[0094] Select a random element and three random values g is the group Generator, calculate g1=g α ;

[0095] Choosing a hash function For each i∈[1,N], calculate

[0096] System master key MSK = (g, α, β),

[0097] System public parameters

[0098] (2) PKG is based on the key pair (PP, MSK) and the identity ID of each authorized data user. i , get the private key SK0 of the cloud storage server and the initial private key SK of the authorized data user i ; Specifically include:

[0099] Given the identity ID0 of the cloud storage server, choose a random value Compute the private key of the cloud storage server

[0100] The identity ID of the given data user i , choose a random value and a distinguishing tag that is not used for encryption and puncture calculate sk 0,2 =g r ,

[0101] sk5=gv r , sk6=h r , sk7=u r ;

[0102] Data User ID i The private key SK i =({sk 0,1 ,sk 0,2 ,sk 0,3},sk4,sk5,sk6,sk7,t0).

[0103] (3) Based on the system public parameters PP and private key SK i , get the puncture private key Specifically include:

[0104] Select an unpunctured label Assume that the punctured tag set T′={t1,...,t l-1}, where l≤w; let t l =t, then T=T′∪t={t1,...,t l-1 ,t l}; t is an unpunctured tag;

[0105] Given

[0106] Pick three random values calculate

[0107] sk′ 0,2 =sk 0,2 ·g r′ ,

[0108] as well as

[0109] Will Middle (sk 0,1 ,sk 0,2 ,sk 0,3 ) is replaced by (sk′ 0,1 ,sk′ 0,2 ,sk′ 0,3), and add (sk l,1 ,sk l,2 ,sk l,3 ), T′ is replaced by T, while keeping the other parts unchanged, and the punctured private key is obtained

[0110]

[0111] ; T is the set of punctured tags.

[0112] (4) The data owner uses the system’s public parameters PP, data M, and label set And the identity set of data users S = {ID1, ID2, ..., ID n}, and obtain the tuple (CT, K, m); where d ≤ w, w is the maximum number of tags allowed to be added to the ciphertext; n is the number of initial receivers; CT is the ciphertext, K is the data encryption key, and m is the maximum number of extended receivers; specifically including:

[0113] The data owner determines the authorized data user set S = {ID1, ID2, ..., ID n}, and determine that the maximum number of extended receivers is m, where n + m < N, where N is the maximum number of receivers;

[0114] The data owner performs message-locked encryption (MLE) to calculate s = MLE (M), and then randomly selects Calculate the encryption key K = e(g,h λ ·u s ) k ;

[0115] Tag Collection Where d≤w; the encryption algorithm is a univariate polynomial Define a coefficient vector in When y∈[d+1,w], z y =0;

[0116] Calculate the encapsulated ciphertext part, C3=u s h k , C4=v s , C5=v k , C7=g k ;

[0117] Compute the receiver's extended suffix for j∈[1,m]

[0118] Ciphertext CT = ((C1,C2,C3,C4,C5,C6,C7),(D1,D2,...,D m ),m),

[0119] Send the ciphertext CT to the cloud storage server.

[0120] (5) The data user uses the system public parameter PP, the ciphertext CT related to the identity set S, and the data user's identity ID i and identity ID i Related puncture private key

[0121] If ID i ∈S, then use the data encryption key K to decrypt the ciphertext CT to obtain the data M; if Then output ⊥;

[0122] Specifically include:

[0123] The puncture private key of the given data owner

[0124]

[0125] Let τ denote the number of times the private key is punctured, where for l∈1,...,τ, T={t1,t2,...,t τ},

[0126] Calculate the coefficient vector And for each t l ∈T, calculate

[0127] calculate

[0128] in ID0 is the identity of the cloud storage server and can be regarded as a public parameter of the system;

[0129] calculate

[0130] For l∈1,...,τ, calculate

[0131] Among them, when t0 and t l ∈T is not a root of f(x) (i.e. ), then f(t0)≠0, f(t l )≠0;

[0132] For a private key that has been punctured τ times, its encryption key is Authorized data users can then use the encryption key K to recover M.

[0133] (6) The authorized data user obtains the extended ciphertext CT′ about S∪S′ based on the system public parameter PP, the ciphertext CT related to the identity set S and the maximum number of extended receivers m, and the extended identity set S′; the extended receiver set S′=(ID′1,ID′2,...,ID′ δ )=(ID n+1 ,ID n+2 ,...,ID n+δ ), where δ≤m, Specifically include:

[0134] Authorized data users determine the data S = {ID1, ID2, ..., ID n The relevant ciphertext is CT = ((C1,C2,C3,C4,C5,C6,C7), (D1,D2,...,D m ),m), and the extended receiver set

[0135] S′=(ID′1,ID′2,...,ID′ δ )=(ID n+1 ,ID n+2 ,...,ID n+δ ), where δ≤m,

[0136] Obtain s in step (5) and choose a random value set up calculate C4=C4=v s , The extended ciphertext is CT′=(C′1, C′2, C′3, C′4, C′5, C′6, C′7); then the authorized data user uploads (CT′, S′) to the cloud storage server.

[0137] (7) The cloud storage server (CSS) calculates the following according to the system public parameters PP, identity set S, ciphertext CT related to identity set S, extended identity set S′, extended ciphertext CT′ related to extended identity set S′ and private key SK0: and in is the encryption key of the private key used to decrypt CT that has been punctured τ times, is the encryption key of the private key used to decrypt CT′ that has been punctured τ times; if Then output 1 and accept the extended ciphertext CT′; if Then output ⊥, rejecting the extended ciphertext CT′; specifically including:

[0138] The cloud storage server decrypts CT using its private key and calculates

[0139]

[0140] in

[0141] calculate And for each t l ∈T,

[0142] calculate

[0143] For l∈1,...,τ, calculate

[0144] Among them, when t0 and t l ∈T is not a root of f(x) (i.e. ), then f(t0)≠0, f(t l )≠0; for a private key that has been punctured τ times, its encryption key is

[0145] The cloud storage server uses its private key to decrypt CT′ and calculate

[0146]

[0147] in

[0148] calculate

[0149] And for l∈1,...,τ, calculate

[0150] Among them, when t0 and t l ∈T is not a root of f(x) (i.e. ), then f(t0)≠0, f(t l )≠0; for a private key that has been punctured τ times, its encryption key is

[0151] like The cloud storage server outputs 1 and updates the corresponding information; otherwise, it outputs 0 and refuses to extend the ciphertext.

[0152] The present application also provides a fine-grained, scalable identity-based broadcast encryption system. Figure 1 As shown, the system includes various functional modules that execute the scalable identity-based broadcast encryption method described in the embodiment of the present application. Specifically,

[0153] The scalable identity-based broadcast encryption system includes:

[0154] In the system parameter setting module, the private key generator (PKG) inputs the security parameter λ, the maximum number of tags allowed to be added to the ciphertext w, and the maximum number of recipients N, and outputs the system public parameter PP and the system master key MSK. The system public parameter PP is sent to the private key generation module, the puncture module, the encryption module, the decryption module, the expansion module, and the integrity check module respectively; and the system master key MSK is sent to the private key generation module.

[0155] Private key generation module, PKG generates private key based on the key pair (PP, MSK) and the identity ID of each authorized data user. i , get the private key SK0 of the cloud storage server and the initial private key SK of the authorized data user i ; Send SK0 to the integrity check module and send SK i Send to the puncture module and decryption module;

[0156] Puncture module, data owner or authorized data user according to the system public parameter PP and private key SK i , get the puncture private key Pierce the private key Send to decryption module;

[0157] Encryption module, data owner according to the system public parameters PP, data M, label set And the identity set of data users S = {ID1, ID2, ..., ID n}, obtain the tuple (CT, K, m); where d ≤ w, w is the maximum number of tags allowed to be added to the ciphertext; n is the number of initial receivers; CT is the ciphertext, K is the data encryption key, and m is the maximum number of extended receivers; then the ciphertext CT is sent to the decryption module, the expansion module, and the integrity check module;

[0158] Decryption module, data users use the system public parameter PP, the ciphertext CT related to the identity set S, and the identity ID of the data user i and identity ID i Related puncture private key If ID i ∈S, then use the data encryption key K to decrypt the ciphertext CT to obtain the data M; if Then output ⊥;

[0159] In the extension module, the authorized data user obtains the extended ciphertext CT′ about S∪S′ based on the system public parameter PP, the ciphertext CT related to the identity set S and the maximum number of extended receivers m, and the extended identity set S′; the extended receiver set S′=(ID′1,ID′2,...,ID′ δ )=(IDn+1 ,ID n+2 ,...,ID n+δ ), where δ≤m, Then the extended identity set S′ and the extended ciphertext CT′ are sent to the integrity check module;

[0160] Integrity check module, the cloud storage server (CSS) calculates the integrity check module based on the system public parameters PP, identity set S, ciphertext CT related to identity set S, extended identity set S′, extended ciphertext CT′ related to extended identity set S′ and private key SK0. and in is the encryption key of the private key used to decrypt CT that has been punctured τ times, is the encryption key of the private key used to decrypt CT′ that has been punctured τ times; if Then output 1 and accept the extended ciphertext CT′; if Then output ⊥ and reject the extended ciphertext CT′.

[0161] The above-mentioned scalable identity-based broadcast encryption system is a modular virtual system. The encryption entity system is introduced below.

[0162] like Figure 2 As shown, the scalable identity-based broadcast encryption system provided in the embodiment of the present application involves four entities, including:

[0163] Private Key Generation Center (PKG): Responsible for establishing the system, generating system public parameters, and generating private keys for each data user after checking the validity of user identity information, granting new data users the ability to decrypt data.

[0164] Cloud Storage Server (CSS): Stores encrypted data. Additionally, upon receiving the extended ciphertext from the recipient, it performs an integrity check. If the extended ciphertext is legitimate, it is added to the CSS.

[0165] Data owner: Encrypt the data and limit the number of extended recipients.

[0166] Data Users: Authorized data users can download encrypted data in the CSS. In addition, authorized data users are allowed to expand the recipient set by adding new data users without re-encrypting the data.

[0167] The following describes an example scenario in which the scalable identity-based broadcast encryption method and system for fine-grained data sharing described in the application embodiments are applied to cloud computing.

[0168] Suppose a company's CEO wants to share business data M with several department managers and uses tags to describe the outsourced data. For example, a salesperson might use the tags {"milk," "sales volume," "August 2022"} to represent the sales volume of milk produced in August 2022. Company managers sometimes need to share encrypted data with department employees to facilitate collaborative work, so department employees need to access and decrypt the data. Therefore, the department manager needs to expand the set of recipients without re-encrypting the data, allowing department employees to access the data through a cloud storage server (CSS). However, this shared data may contain extremely sensitive data, and if accessed by company employees or managers, it could pose a significant security risk to the company. Therefore, the CEO needs to decide which data can be shared. Furthermore, the CEO does not want his data to be shared indiscriminately, so for the sake of the company's interests, he limits the number of recipients.

[0169] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or alternatives that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention are intended to be covered by the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A fine-grained, scalable identity-based broadcast encryption method, characterized in that include: (1) Configure the system public parameters PP and system master key MSK; (2) Based on the key pair (PP, MSK) and the identity ID of each authorized data user i , get the private key SK0 of the cloud storage server and the initial private key SK of the authorized data user i ; (3) Based on the system public parameters PP and private key SK i , get the puncture private key (4) Based on the system public parameters PP, data M, and label set And the identity set of data users S = {ID1, ID2, ..., ID n ], and obtain the tuple (CT, K, m); where d≤w, w is the maximum number of tags allowed to be added to the ciphertext; n is the number of initial receivers; CT is the ciphertext, K is the data encryption key, and m is the maximum number of extended receivers; (5) Determine whether the data user is a member of the identity set S. If the data user's identity ID i ∈S, then according to the system public parameter PP, the ciphertext CT related to the identity set S, and the identity ID of the data user i and identity ID i Related puncture private key Use the data encryption key K to decrypt the ciphertext CT to obtain the data M; if Then output ⊥; (6) Based on the system public parameter PP, the ciphertext CT associated with the identity set S and the maximum number of extended receivers m, and the extended identity set S′, the extended ciphertext CT′ with respect to S∪S′ is obtained; the extended receiver set S′=(ID′1,ID′2,...,ID′ δ )=(ID n+1 ,ID n+2 ,...,ID n+δ ), where δ≤m, (7) Based on the system public parameter PP, identity set S, ciphertext CT related to identity set S, extended identity set S′, extended ciphertext CT′ related to extended identity set S′ and private key SK0, we calculate and in is the encryption key of the private key used to decrypt CT that has been punctured τ times, is the encryption key of the private key used to decrypt CT′ that has been punctured τ times; if Then output 1 and accept the extended ciphertext CT′; if Then output ⊥ and reject the extended ciphertext CT′.

2. The scalable identity-based broadcast encryption method according to claim 1, characterized in that: Step (1) includes: Select a large prime number p, p factorial cyclic group and Bilinear map Select a random element and three random values g is the group Generator, calculate g1=g α ; Choosing a hash function For each i∈[1,N], calculate System master key MSK = (g, α, β), System public parameters 3. The scalable identity-based broadcast encryption method according to claim 2, characterized in that: Step (2) includes: Given the identity ID0 of the cloud storage server, choose a random value Compute the private key of the cloud storage server The identity ID of the given data user i , choose a random value and a distinguishing tag that is not used for encryption and puncture calculate sk5=gv r ,sk6=h r ,sk7=u r ; Data User ID i The private key SK i =({sk 0,1 ,sk 0,2 ,sk 0,3 },sk4,sk5,sk6,sk7,t0).

4. The scalable identity-based broadcast encryption method according to claim 3, characterized in that: Step (3) includes: Select an unpunctured label Assume that the punctured tag set T′={t1,...,t l-1 }, where l≤w; let t l =t, then T=T′∪t={t1,...,t l-1 ,t l }; t is an unpunctured tag; Given Pick three random values calculate as well as Will Middle (sk 0,1 ,sk 0,2 ,sk 0,3 ) is replaced by (sk′ 0,1 ,sk′ 0,2 ,sk′ 0,3 ), and add (sk l,1 ,sk l,2 ,sk l,3 ), T′ is replaced by T, while keeping the other parts unchanged, and the punctured private key is obtained ； T is the set of punctured tags.

5. The scalable identity-based broadcast encryption method according to claim 4, characterized in that: Step (4) includes: The data owner determines the authorized data user set S = {ID1, ID2, ..., ID n }, and determine that the maximum number of extended receivers is m, where n + m < N, where N is the maximum number of receivers; The data owner performs message lock encryption MLE to calculate s = MLE (M), and then randomly selects Calculate the encryption key K = e(g,h λ ·u s ) k ; Tag Collection Where d≤w; the encryption algorithm is a univariate polynomial Define a coefficient vector in When y∈[d+1,w], z y =0; Calculate the encapsulated ciphertext part, C3=u s h k , C4=v s , C5=v k , C7=g k ; Compute the receiver's extended suffix for j∈[1,m] Ciphertext CT = ((C1,C2,C3,C4,C5,C6,C7),(D1,D2,...,D m ),m), Send the ciphertext CT to the cloud storage server.

6. The scalable identity-based broadcast encryption method according to claim 5, characterized in that: Step (5) includes: The puncture private key of the given data owner Let τ denote the number of times the private key is punctured, where for l∈1,...,τ, T={t1,t2,...,t τ }, Calculate the coefficient vector And for each t l ∈T, calculate calculate in ID0 is the identity of the cloud storage server and can be regarded as a public parameter of the system; calculate For l∈1,...,τ, calculate Among them, when t0 and t l When ∈T is not a root of f(x), that is, Then f(t0)≠0, f(t l )≠0; For a private key that has been punctured τ times, its encryption key is Authorized data users can use the encryption key K to recover M.

7. The scalable identity-based broadcast encryption method according to claim 6, characterized in that: Step (6) includes: Authorized data users determine the data S = {ID1, ID2, ..., ID n The relevant ciphertext is CT = ((C1,C2,C3,C4,C5,C6,C7), (D1,D2,...,D m ),m), and the extended receiver set S = (ID′1, ID′2,..., ID′ δ ) = (ID n+1 , ID n+2 ,..., ID n+δ ), where δ ≤ m, Obtain s in step (5) and choose a random value set up calculate C4=C4=v s , Then the extended ciphertext is CT′=(C′1,C′2,C′3,C′4,C′5,C′6,C′7); the authorized data user uploads (CT′,S) to the cloud storage server.

8. The scalable identity-based broadcast encryption method according to claim 7, characterized in that: Step (7) includes: The cloud storage server decrypts CT using its private key and calculates in calculate And for each t l ∈T, calculate For l∈1,...,τ, calculate Among them, when t0 and t l When ∈T is not a root of f(x), that is, Then f(t0)≠0, f(t l )≠0; for a private key that has been punctured τ times, its encryption key is The cloud storage server uses its private key to decrypt CT′ and calculate in calculate And for l∈1,...,τ, calculate Among them, when t0 and t l When ∈T is not a root of f(x), that is, Then f(t0)≠0, f(t l )=0; for a private key that has been punctured τ times, its encryption key is like The cloud storage server outputs 1 and updates the corresponding information; otherwise, it outputs 0 and refuses to extend the ciphertext.

9. A fine-grained, scalable identity-based broadcast encryption system, characterized in that include: System parameter setting module, used to configure system public parameters PP and system master key MSK; The system public parameter PP is sent to the private key generation module, puncture module, encryption module, decryption module, expansion module and integrity check module respectively; the system master key MSK is sent to the private key generation module; The private key generation module is used to generate a private key based on the key pair (PP, MSK) and the identity ID of each authorized data user. i , get the private key SK0 of the cloud storage server and the initial private key SK of the authorized data user i ; Send SK0 to the integrity check module and send SK i Send to the puncture module and decryption module; Puncture module, used to calculate the system public parameters PP and private key SK i , get the puncture private key Pierce the private key Send to decryption module; Encryption module, used to set public parameters PP, data M, and tags according to the system And the identity set of data users S = {ID1, ID2, ..., ID n }, we get the tuple (CT, K, m); where d≤w, w is the maximum number of tags allowed to be added to the ciphertext; n is the number of initial receivers; CT is the ciphertext, K is the data encryption key, and m is the maximum number of extended receivers; Then the ciphertext CT is sent to the decryption module, expansion module and integrity check module; The decryption module is used to determine whether the data user is a member of the identity set S. If the data user's identity ID i ∈S, then according to the system public parameter PP, the ciphertext CT related to the identity set S, and the identity ID of the data user i and identity ID i Related puncture private key Use the data encryption key K to decrypt the ciphertext CT to obtain the data M; if Then output ⊥; The expansion module is used to obtain the extended ciphertext CT′ about S∪S′ according to the system public parameter PP, the ciphertext CT related to the identity set S and the maximum number of extended receivers m, and the extended identity set S′; the extended receiver set S′=(ID′1,ID′2,...,ID′ δ )=(ID n+1 ,ID n+2 ,...,ID n+δ ), where δ≤m, Then the extended identity set S′ and the extended ciphertext CT′ are sent to the integrity check module; The integrity check module is used to calculate the following: and in is the encryption key of the private key used to decrypt CT that has been punctured τ times, is the encryption key of the private key used to decrypt CT′ that has been punctured τ times; if Then output 1 and accept the extended ciphertext CT′; if Then output ⊥ and reject the extended ciphertext CT′.

Images