A multi-center attribute-based encryption method, a computer readable storage medium and a device

Abstract

The present application relates to a data encryption method, in particular to a multi-center attribute-based encryption method supporting privacy protection for a smart medical system, a computer readable storage medium and equipment, which is used to solve the defects of single authorization center, insecure sensitive information, key abuse, and inability to guarantee the confidentiality and integrity of data based on attribute-based encryption technology in the smart medical system. The multi-center attribute-based encryption method uses the decentralized characteristics of the block chain, adopts multiple accounting nodes BN θ as a plurality of attribute authorization agencies to distribute keys, effectively avoiding the single point bottleneck problem; at the same time, the consensus node generates an anonymous identity certificate AIC for the data user DU to protect the sensitive information of the data user DU from being leaked. The present application can accurately track and revoke malicious data users DU, and can realize accountability to malicious data users DU and corrupt centers through tracking smart contracts.

Description

Technical Field

[0001] This invention relates to data encryption methods, specifically to a privacy-preserving multi-center attribute-based encryption method, computer-readable storage medium, and device for smart healthcare systems. Background Technology

[0002] 5G, as an emerging technology, features high speed, low latency, and high connectivity. The widespread adoption of the Internet of Things (IoT) has driven the development of smart healthcare. Smart healthcare utilizes 5G IoT technology to create regional medical information platforms for health records. Patients can record their personal health data using 5G-enabled industrial IoT devices, which are then uploaded to cloud servers for storage and sharing. Medical staff can access patient information as needed to provide effective treatment plans, thereby facilitating interaction between patients, medical staff, medical institutions, and medical equipment, leading to better diagnosis and treatment. However, while smart healthcare brings convenience, it also raises a series of security issues. For example, when patients upload large amounts of health data to cloud servers, the potential unreliability of cloud servers could lead to data leaks, compromising data confidentiality and user privacy.

[0003] Traditional attribute-based encryption techniques not only support fine-grained access control but also ensure data security. However, they still have many shortcomings, which greatly limit their application scenarios. The main problems in smart healthcare systems include:

[0004] (1) Single authorization center defects: Electronic health records need to be shared in different institutions or departments. The traditional single authorization center is too burdened and is prone to single point bottlenecks. The single authorization center is responsible for the key distribution of all users and has too much power. Once corruption occurs, it will be fatal to the leakage of patient data.

[0005] (2) Security of sensitive information: When medical personnel request keys from authorized institutions, they need to provide information such as identity and attributes, which directly infringes on the user's privacy. Traditional access structures upload data to cloud servers in plaintext, which, if obtained by unauthorized individuals, will seriously affect the patient's personal life and medical care.

[0006] (3) Key misuse problem: Authorized users may expose decryption keys to others for their own benefit. If they are not held accountable and their accounts revoked in a timely manner, it may result in a large amount of data leakage.

[0007] (4) Data confidentiality and integrity: Cloud servers are semi-trusted and may delete ciphertext to save storage space. In addition, they may tamper with ciphertext or return incorrect decryption results to users, which may seriously endanger the health and safety of patients. Summary of the Invention

[0008] The purpose of this invention is to address the shortcomings of attribute-based encryption technology in smart medical systems, such as the single authorization center defect, lack of security for sensitive information, key abuse, and inability to guarantee the confidentiality and integrity of data. Therefore, this invention provides a multi-center attribute-based encryption method, computer-readable storage medium, and device.

[0009] To address the shortcomings of the existing technology, the present invention provides the following technical solution:

[0010] A multi-center attribute-based encryption method, characterized by employing an encryption system comprising a blockchain BC, and data owners DO, data users DU, and a cloud server CSP interconnected with the blockchain BC. The data owners DO and CSP, and the data users DU and CSP, are all interconnected. The blockchain BC includes consensus nodes and multiple ledger nodes BN interconnected with the consensus nodes. θ ;

[0011] The multi-center attribute-based encryption method includes the following steps:

[0012] Step 1: Consensus nodes generate the public parameters (GP) and master key (MSK) for the encryption system; each ledger node generates a BN. θ Using the public parameter GP, calculate and generate your respective public key PK. θ and private key SK θ The cloud server CSP and the data owner DO set their own key pairs (PK). CSP SK CSP ) and (PK DO SK DO The signature is used for verification during the interaction and consensus phases; the data user DU submits its identity GID and attribute set S to the consensus node to complete the registration, and the consensus node generates an anonymous identity credential AIC for the data user DU;

[0013] Step 2, BN (Bill of Names) θ Verify the anonymous identity credential AIC of data user DU, and based on the public parameters GP, master key MSK, and private key SK obtained in step 1. θ Calculate the decryption private key SK for data user DU;

[0014] Step 3: The data owner (DO) defines the access structure (M, ρ), where matrix M is an l-row, n-column shared matrix constructed according to the access policy. The mapping function ρ maps row x to attribute ρ(x), where x represents the x-th row of matrix M. A one-to-one mapping relationship is formed between row vectors and attributes, based on the public parameter GP and the public key PK. θThe plaintext m is converted into ciphertext CT. The access structure (M,ρ) is encrypted and the attribute Bloom filter ABF is generated according to the Bloom filter BF. The consensus node interacts with the data owner DO and generates transactions from all information and stores them in the blockchain BC, thus completing the data encryption.

[0015] Step 4: Input the total attribute set S of data user DU into the attribute Bloom filter ABF, and output the function ρ = (rownum, att) att∈S Here, rownum represents the row label of the shared matrix M, and att is the attribute corresponding to the row vector of the shared matrix M. There is a one-to-one correspondence between rownum and att. Data user DU generates a transformation key pair (tpk, tsk) based on its decryption private key SK, and uses the cloud server CSP to pre-decrypt the ciphertext CT to obtain the intermediate ciphertext IC. The data user takes tsk and the intermediate ciphertext IC as input and outputs plaintext m. Finally, data user DU verifies the correctness of plaintext m and completes data decryption.

[0016] Step 5: When a key leak occurs, the consensus node tracks and audits the malicious data user DU or the ledger node BN. θ Finally, the encrypted CT is updated by the cloud server CSP.

[0017] Further, step 1 specifically includes:

[0018] Step 1.1: Consensus nodes generate public parameters for the encryption system. and master key Where N represents the number of users in the user binary tree, i is a natural number ranging from 0 to 2N-2, and there are 2N-1 nodes in the user binary tree. For each node, a random number x is selected. i ∈Z p Calculate common parameters Random selection As a symmetric encryption algorithm (En c De c The key of Z, where Z p Let f(p) represent the integer residue class modulo p, where p is a prime number. It is Z p The multiplicative group of all elements coprime to p. Contains Z p All elements except 0;

[0019] Step 1.1.1: Set the security parameter λ of the encryption system: Define a bilinear mapping.

[0020] G and G T G is a multiplicative cyclic group of two prime numbers p, and g is set to be a generator of the group G.

[0021] Step 1.1.2: Define three collision-resistant hash functions: H1:{0,1} * →{0,1} * H2:{0,1} * ×G→{0,1} * H3:G×{0,1} * ×{0,1} * ×{0,1} * →G; Define k hash functions h for the Bloom filter BF. μ {0,1} * →[1,2,...,t], where μ=1,2,...,k; t represents the length of the array in the Bloom filter; define a function T: map each attribute to its corresponding θ-th ledger node BN. θ In this invention, there are a total of V accounting nodes, i.e., 1≤θ≤V;

[0022] Step 1.1.3: Randomly select an element h∈G from the multiplicative cyclic group G; construct the user binary tree. For user binary tree Choose a random number from 2N-1 nodes. And calculate Where i∈[1,2,...,2N-1]; randomly selected Define a symmetric encryption algorithm

[0023] Step 1.2, BN for each accounting node θ Managing different attribute sets A θ There are m θ Each attribute att θ,j where 1≤j≤m θ ,

[0024] Randomly select α θ ,a θ ,b θ ∈Z p And calculate the corresponding common parameters.

[0025] For each attribute att θ,j ∈A θ Select a random number r θ,j ∈Z p and calculate

[0026] Each accounting node BN θ Generate your own public key and private key

[0027] Step 1.3: The cloud server CSP and the data owner DO set their respective key pairs (PK). CSP SK CSP ) and (PK DO SK DO ), used for signature verification during the interaction and consensus phases;

[0028] Step 1.4: Data user DU submits its identity GID and attribute set S to the consensus node to complete the registration. The consensus node generates an anonymous identity credential AIC for data user DU.

[0029] Step 1.4.1: The consensus node first defines an empty user list (UL);

[0030] Store the identity (GID) of data user DU in the user binary tree. In the leaf nodes, assign the value i d =GID, and calculate the encrypted i d value

[0031] Configure user DU in the user binary tree path(i) d )={i0,i1,...,i d}, where i0 is the root node, i d It is a leaf node, computing key components

[0032] Step 1.4.2: Blind the identity GID by calculating the blinding value τ = H1(GID);

[0033] For each accounting node BN θ Randomly select υ u,θ ∈G, and calculate v u,θ The parameter PN u,θ =H2(τ,υ) u,θ );

[0034] Step 1.4.3: Select a random number κ∈Z p Announcement of g κ And calculate the signature sig θ,j =H3(R θ,j ,PN u,θ BN θ c) κ ;

[0035] get

[0036] Furthermore, step 2 specifically includes:

[0037] Step 2.1, Posting Node BN θ Verify the anonymous identity credential (AIC) of data user DU;

[0038] BN (Billing Node) θ Verify whether the following equation holds true:

[0039]

[0040] If the verification passes, proceed to step 2.2; otherwise, end the process directly.

[0041] Step 2.2, Accounting Node BN θ Based on the public parameters GP, master key MSK, and private key SK obtained in step 1 θ Calculate the decryption private key SK for data user DU;

[0042] Step 2.2.1: Data user DU randomly selects a secret value. Calculate w c The parameter H = h wc and set K τ =w c Then, zero-knowledge proofs of H, SK′, and the discrete logarithm H are sent to the ledger node BN. θ ;

[0043] Step 2.2.2, Accounting Node BN θ After verifying H, the tuple (BN) θ Add ,H,c) to the list UL, and then send it to the consensus node storage;

[0044] BN (Billing Node) θ Randomly select r,t θ ∈Z p The calculation key is as follows:

[0045] Among them att θ,j ∈S∩A τ , where i∈path(i d ), i≠i d ;

[0046] Finally, the decryption private key SK for data user DU was obtained:

[0047]

[0048] Furthermore, step 3 specifically includes:

[0049] Step 3.1: The data owner (DO) defines the access structure (M, ρ) and generates the encrypted CT.

[0050] Step 3.1.1, Offline Encryption: The data owner DO specifies the access structure (M, ρ), where M is... A matrix is ​​defined, and the function δ(x) = T(ρ(x)) maps row x of M to ledger node BN. θ ;

[0051] Constructing vectors ⊥ is the transpose symbol; and calculate

[0052] Define a set of numbers Randomly select λ′ θ,x ,p x ∈Z p where x∈[1,l];

[0053] The ciphertext is calculated as follows:

[0054]

[0055] Step 3.1.2, Online Encryption: The data owner (DO) performs online encryption based on the offline encryption result to complete the encryption process;

[0056]

[0057] For node ∈ cover(R), compute

[0058] Obtain the encrypted CT scan:

[0059] CT={C,C0,{C 1,x C 2,x C 3,θ,x C 4,θ,x C 5,x} θ∈[1,V],x∈[1,l] ,{T ∈} ∈∈cover(R)};

[0060] Step 3.2: Based on the Bloom filter BF, encrypt the access structure (M,ρ) to generate the attribute Bloom filter ABF;

[0061] Step 3.2.1: Utilize the x-th row of M and its corresponding mapping attribute att e Construct a collection of elements S e ={x‖att e} x∈[1,l] ,att e =ρ(x);

[0062] Step 3.2.2: Randomly generate k-1 strings r of length λ. 1,e ,r 2,e ,…,r k-1,e Here, k is the hash function h. μ The number of elements is shared in set S through a (k,k) secret sharing mechanism. e The element e in the middle, and set r k,e =r 1,e ⊕r 2,e ⊕r 3,e …⊕r k-1,e ⊕e;

[0063] For an attribute att e Calculate the hash value h μ (att e ), using the calculated k position indices to store r i,e soon att e Stored in the attribute Bloom filter ABF;

[0064] Step 3.2.3: Calculate the parameter Δ = H1(ρ(x)) to complete the hidden access to the structure (M,ρ) using the attribute Bloom filter ABF;

[0065] Step 3.3: Store transaction generation;

[0066] The data owner (DO) uploads the ciphertext CT and the attribute Bloom filter (ABF) to the cloud server (CSP) for storage. The cloud server (CSP) then sends the signature of the ciphertext CT and the storage address back to the data owner (DO).

[0067] The data owner, DO, verifies the signature of the ciphertext CT and calculates H1(H1(CT)‖Address‖Time) using their own signing private key SK. DO Generate sign=Sign DO (o);

[0068] The data owner DO will store the tuple {sign, H1(m), H1(CT), sign} CSP (CT),Address} is sent to the consensus node;

[0069] Step 3.4: Verify the storage transaction;

[0070] The consensus node generates a transaction with complete information and broadcasts it to the ledger node BN. θ Verification is required;

[0071] The verification process is as follows:

[0072] Calculate o = H1(H1(CT)‖Address‖Time) and verify the signature.

[0073] If o′=o, then calculate

[0074] If and only if o′=o, and If the verification passes, the consensus node packages all transactions into data blocks and stores them in the blockchain BC; otherwise, if the verification fails, it indicates that the cloud server CSP has tampered with the encrypted CT, and the cloud server CSP needs to be held accountable. At the same time, the consensus node deletes the transaction information.

[0075] Furthermore, step 4 specifically includes:

[0076] Step 4.1: Attribute Bloom Filter ABF Query;

[0077] When a data user DU wants to access data, it first needs to verify whether its attribute set S satisfies the access structure (M, ρ).

[0078] For attribute att in the attribute set S of data user DU, first calculate k hash function values ​​h. μ (att) retrieves all location indices;

[0079] Then reconstruct the elements: e = r 1,e ⊕r 2,e ⊕…⊕r k-1,e ⊕r k,e =r 1,e ⊕r 2,e ⊕…⊕r k-1,e ⊕r 1,e ⊕r 2,e ⊕…⊕r k-1,e ⊕e, recovering e=x‖att e Calculate the hash value Δ′ = H1(att) and verify it. If the equation holds true, it means that the attribute set S of the data user DU satisfies the access structure (M, ρ), and ρ = (rownum, att) can be recovered. att∈S If the equation does not hold, it means that the attribute set S of the data user DU does not satisfy the access structure (M,ρ), and the process ends.

[0080] Step 4.2: Data user DU generates a conversion key pair (tpk, tsk) based on their decryption private key SK, and uses the cloud server CSP to complete the pre-decryption to obtain the intermediate ciphertext IC;

[0081] Data user DU randomly selects z,y∈Z p And calculate the transformation key pair tk = (tpk, tsk), where:

[0082] Data user DU sends the conversion public key tpk to the cloud server CSP for decryption assistance and secretly saves the conversion private key tsk;

[0083] Definition I θ ={x:ρ(x)∈S∩A θ}, find satisfaction coefficient The cloud server CSP performs the following calculations:

[0084]

[0085] Step 4.3, final decryption;

[0086] Data user DU calculates plaintext m: m = C·IC tsk ;

[0087] Step 4.4, Plaintext Verification;

[0088] Data user DU calculates H′1(m) based on plaintext m and queries TX. storage H1(m) in;

[0089] If H′1(m)≠H1(m), it means that the cloud server CSP returned an incorrect result and you need to return to step 4.2.

[0090] Furthermore, step 5 specifically includes:

[0091] Step 5.1, Tracking;

[0092] The consensus node calculates whether the decryption private key SK satisfies the following equation; if the equation is true, output K. 2,u and K τ Otherwise, the output will terminate.

[0093] K 2,u ,K 3,θ,u ,K 4,θ,u ∈Z p

[0094] K 1,θ,u ,K 4,θ,u ,K 5,θ,u, K 6,θ,u ,K 7,θ,u ,K 8,θ,u ,K 9,θ,u ∈G

[0095]

[0096] Step 5.2, Audit;

[0097] The consensus node determines the owner of the decrypted private key SK obtained in step 5.1;

[0098] Specifically as follows:

[0099] Based on the result K output in step 5.1 2,u =c and K τ =w, the consensus node finds the corresponding tuple in the list UL based on c and makes the following judgment:

[0100] If the tuple exists, the consensus node requires the data user DU corresponding to c to submit its complete decryption private key SK;

[0101] If the decryption private key SK of data user DU is incomplete, the identity of data user DU will be returned, indicating that data user DU is dishonest;

[0102] If the data user DU's decryption private key SK is in good format and Then the identity of data user DU is returned, and it is determined that data user DU has leaked the decryption private key SK;

[0103] if Return the corresponding ledger node BN θ Determine the BN of the accounting node. θ The decryption private key SK of data user DU was illegally forged;

[0104] Step 5.3, Ciphertext Update;

[0105] When data user DU is judged to be dishonest, the calculation... And add the identity GID of data user DU to the revocation list to form a new revocation list R′;

[0106] The encryption system needs to update the ciphertext CT according to the new revocation list R′, so that user DU cannot access the data in the new revocation list R′.

[0107] The update is as follows:

[0108] Consensus nodes select random numbers χ∈Z p and calculate

[0109] The cloud server CSP updates the ciphertext CT by updating the key X′. Specifically, for a node ε′∈cover(R′), if node ε∈cover(R) and ε′=∈, directly set T. ∈′ =T ∈ If node ε∈cover(R) and is the parent node of node ∈′, first obtain the path of ∈′:

[0110] path(∈′)=path(ε)∪{i depth(ε)+1 ,...,i depth(∈′)}, where i depth(∈) =∈, i depth(∈′) =∈′, then calculate the ciphertext CT update part: Where π = depth(∈), ..., depth(∈′)-1, the ciphertext CT update is finally completed.

[0111] Meanwhile, the present invention provides a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the steps of the multi-center attribute base encryption method.

[0112] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: when the processor executes the computer program, it implements the steps of the multi-center attribute-based encryption method.

[0113] Compared with the prior art, the beneficial effects of the present invention are:

[0114] (1) The present invention provides a multi-center attribute-based encryption method that utilizes the decentralized characteristics of blockchain and employs multiple ledger nodes (BN). θ By acting as a multiple attribute authorization authority to distribute keys, this invention effectively avoids single-point bottlenecks. Simultaneously, the consensus node generates anonymous identity credentials (AICs) for data users (DUs), protecting their sensitive information from leakage. Addressing the prevalent problem of key abuse, this invention protects data integrity by accurately tracking and revoking the credentials of malicious data users (DUs). Furthermore, it can hold malicious data users (DUs) and corruption centers accountable through smart contract tracking. In addition, regarding encryption and decryption efficiency, both the data owner (DO) and the data user (DU) only need to perform some lightweight calculations, reflecting real-world scenarios.

[0115] (2) The present invention provides a multi-center attribute-based encryption method, which generates an anonymous identity credential (AIC) for data user DU by establishing a central authorization center consensus node. The anonymous identity credential (AIC) contains a signature sig. θ,j This is used to ensure that sensitive information of data user DU is not leaked. Furthermore, this invention uses a Bloom filter to hide the access structure (M, p) of data owner DO.

[0116] (3) The multi-center attribute-based encryption method provided by this invention achieves data confidentiality and integrity assurance; the data owner DO stores the hash values ​​of plaintext m and ciphertext CT, the cloud server's signature of ciphertext CT, and the storage address Address={sign,H1(m),H1(CT),sign CSP(CT),Address} is sent to the consensus node, the consensus node generates a transaction, and then broadcasts the transaction to other ledger nodes BN. θ Verification is then performed. Once verification is successful, the consensus node packages all transactions into data blocks and stores them in the blockchain BC. Data users DU can verify the integrity of the data by checking the stored records.

[0117] (4) The present invention provides a multi-center attribute-based encryption method, which uses a user binary tree. Implement a mechanism to revoke the decryption key for malicious data users (DU). The complete decryption key for the data consists of three parts: the first part is obtained by the central authorization center (consensus node) based on the user binary tree. The first part is generated by the attribute authorization authority (ledger node) based on the attributes of the data user DU. The second part is the secret value selected by the data user DU. These three parts are interlocked to form the decryption key. When revocation occurs, the cloud server CSP only needs to update the part of the ciphertext CT related to the revocation list, thereby preventing collusion between the revoked data user DU and the unrevoked data user DU, as well as between the data user DU and the authorization center, thus satisfying forward and backward security.

[0118] (5) The multi-center attribute-based encryption method provided by this invention employs an offline-online encryption mechanism and an outsourced pre-decryption mechanism. The client only needs to complete some lightweight computational tasks, making it more suitable for smart healthcare systems. Attached Figure Description

[0119] Figure 1 A schematic diagram of the encryption system used in an embodiment of a multi-center attribute-based encryption method provided by the present invention;

[0120] Figure 2 User binary tree in this embodiment of the invention A structural diagram. Detailed Implementation

[0121] The present invention will be further described below with reference to the accompanying drawings and exemplary embodiments.

[0122] Reference Figure 1 , Figure 2 A multi-center attribute-based encryption method employs an encryption system comprising a blockchain BC, and a data owner DO, a data user DU, and a cloud server CSP interconnected with the blockchain BC. The data owner DO and the cloud server CSP, as well as the data user DU and the cloud server CSP, are interconnected.

[0123] The blockchain BC includes consensus nodes and multiple ledger nodes BN interconnected with the consensus nodes. θThe consensus node, acting as a fully trusted central authorization center, is responsible for generating the public parameters GP and master key MSK of the encryption system, generating anonymous identity credentials AIC based on the identity GID and attribute set S of the data user DU, storing all transactions, and tracking and auditing malicious data users DU or ledger nodes BN. θ BN for each accounting node θ As a semi-trusted authority for various attributes, it is responsible for managing different attribute sets A. θ ;

[0124] The multi-center attribute-based encryption method includes the following steps:

[0125] Step 1: Consensus nodes generate the public parameters (GP) and master key (MSK) for the encryption system; each ledger node generates a BN. θ Using the public parameter GP, calculate and generate your respective public key PK. θ and private key SK θ The cloud server CSP and the data owner DO set their own key pairs (PK). CSP SK CSP ) and (PK DO SK DO The signature is used for verification during the interaction and consensus phases; the data user DU submits its identity GID and attribute set S to the consensus node to complete the registration, and the consensus node generates an anonymous identity credential AIC for the data user DU;

[0126] Step 1.1: Consensus nodes generate public parameters for the encryption system. and master key Where N represents the number of users in the user binary tree, i is a natural number ranging from 0 to 2N-2, and there are 2N-1 nodes in the user binary tree. For each node, a random number x is selected. i ∈Z p Calculate common parameters Random selection As a symmetric encryption algorithm (En c De c The key of Z, where Z p Let f(p) represent the integer residue class modulo p, where p is a prime number. It is Z p The multiplicative group of all elements coprime to p. Contains Z p All elements except 0;

[0127] Step 1.1.1: Set the security parameter λ of the encryption system: Define a bilinear mapping. G and G T G is a multiplicative cyclic group of two prime numbers p, and g is set to be a generator of the group G.

[0128] Step 1.1.2: Define three collision-resistant hash functions: H1:{0,1} * →{0,1} * H2:{0,1} * ×G→{0,1} * H3:G×{0,1} * ×{0,1} * ×{0,1} * →G; Define k hash functions h for the Bloom filter BF. μ {0,1} * →[1,2,...,t], where μ=1,2,...,k,t represents the length of the array in the Bloom filter; define a function T: map each attribute to its corresponding θ-th ledger node BN. θ In this invention, there are a total of V accounting nodes, i.e., 1≤θ≤V;

[0129] Step 1.1.3: Randomly select an element h∈G from the multiplicative cyclic group G; construct the user binary tree. For user binary tree Choose a random number from 2N-1 nodes. And calculate Where i∈[1,2,...,2N-1]; randomly selected Define a symmetric encryption algorithm

[0130] Step 1.2, BN for each accounting node θ Managing different attribute sets A θ There are m θ Each attribute att θ,j where 1≤j≤m θ ,

[0131] Randomly select α θ ,a θ ,b θ ∈Z p And calculate the corresponding common parameters.

[0132] For each attribute att θ,j ∈A θ Select a random number r θ,j ∈Z p and calculate Each accounting node BN θ Generate your own public key and private key

[0133] Step 1.3: The cloud server CSP and the data owner DO set their respective key pairs (PK). CSP SK CSP ) and (PK DO SK DO ), used for signature verification during the interaction and consensus phases;

[0134] Step 1.4: Data user DU submits its identity GID and attribute set S to the consensus node to complete the registration. The consensus node generates an anonymous identity credential AIC for data user DU.

[0135] Step 1.4.1: The consensus node first defines an empty user list (UL);

[0136] Reference Figure 2 Store the identity GID of data user DU in a leaf node of the user binary tree T, and assign the value i. d =GID, and calculate the encrypted i d value

[0137] Configure user DU in the user binary tree path(i) d )={i0,i1,...,i d}, where i0 is the root node, i d It is a leaf node, computing key components

[0138] Step 1.4.2: Blind the identity GID by calculating the blinding value τ = H1(GID);

[0139] For each accounting node BN θ Randomly select υ u,θ ∈G, and calculate v u,θ The parameter PN u,θ =H2(τ,υ) u,θ );

[0140] Step 1.4.3: Select a random number k∈Z p Announcement of g k And calculate the signature sig θ,j =H3(R θ,j ,PN u,θ BN θ c) h ;

[0141] get

[0142] Step 2, BN (Bill of Names) θVerify the anonymous identity credential AIC of data user DU, and based on the public parameters GP, master key MSK, and private key SK obtained in step 1. θ Calculate the decryption private key SK for data user DU;

[0143] Step 2.1, Posting Node BN θ Verify the anonymous identity credential (AIC) of data user DU;

[0144] BN (Billing Node) θ Verify whether the following equation holds true:

[0145]

[0146] If the verification passes, proceed to step 2.2; otherwise, end the process directly.

[0147] Step 2.2, Accounting Node BN θ Based on the public parameters GP, master key MSK, and private key SK obtained in step 1 θ Calculate the decryption private key SK for data user DU;

[0148] Step 2.2.1: Data user DU randomly selects a secret value. Calculate w c parameters And set K τ =w c Then, zero-knowledge proofs of H, SK′, and the discrete logarithm H are sent to the ledger node BN. θ ;

[0149] Step 2.2.2, Accounting Node BN θ After verifying H, the tuple (BN) θ Add ,H,c) to the list UL, and then send it to the consensus node storage;

[0150] BN (Billing Node) θ Randomly select r,t θ ∈Z p The calculation key is as follows:

[0151] Among them att θ,j ∈S∩A θ , where i∈path(i d ), i≠i d ;

[0152] Finally, the decryption private key SK for data user DU was obtained:

[0153]

[0154] Step 3: The data owner (DO) defines the access structure (M, ρ) to generate the ciphertext CT, where matrix M is an l x n shared matrix constructed according to the access strategy, and the mapping function ρ maps rows M... x The mapping is represented by attribute ρ(x), where x represents the x-th row of matrix M. The row vectors and attributes form a one-to-one mapping relationship. The access structure (M,ρ) is encrypted and an attribute Bloom filter ABF is generated according to the Bloom filter BF. The consensus node interacts with the data owner DO and generates transactions from all information, which are then stored in the blockchain BC.

[0155] Step 3.1: The data owner (DO) defines the access structure (M, ρ) and generates the encrypted CT.

[0156] Step 3.1.1, Offline Encryption: The data owner DO specifies the access structure (M, ρ), where M is... A matrix is ​​defined, and the function δ(x) = T(ρ(x)) maps row x of M to ledger node BN. θ ;

[0157] Constructing vectors ⊥ is the transpose symbol; and calculate

[0158] Define a set of numbers Randomly select λ′ θ,x ,p x ∈Z p where x∈[1,l];

[0159] The ciphertext is calculated as follows:

[0160] C0 = g s ,

[0161] Step 3.1.2, Online Encryption: The data owner (DO) can complete the encryption process by performing online encryption based on the offline encryption result.

[0162]

[0163] For node ∈ cover(R), compute

[0164] Obtain the encrypted CT scan:

[0165] CT={C,C0,{C 1,x C 2,x C 3,θ,x C 4,θ,x C 5,x} θ∈[1,V],x∈[1,l] ,{T ∈}∈∈cover(R)};

[0166] Step 3.2: Based on the Bloom filter BF, encrypt the access structure (M,ρ) to generate the attribute Bloom filter ABF;

[0167] To prevent attribute leakage in the access structure (M,ρ), the data owner DO uses the Attribute Bloom Filter (ABF) to hide the access structure (M,ρ).

[0168] Step 3.2.1: Utilize the x-th row of M and its corresponding mapping attribute att e Construct a collection of elements S e ={x‖att e} x∈[1,l] ,att e =ρ(x);

[0169] Step 3.2.2: Randomly generate k-1 strings r of length λ. 1,e ,r 2,e ,…,r k-1,e Here, k is the hash function h. μ The number of elements is shared in set S through a (k,k) secret sharing mechanism. e The element e in the middle, and set r k,e =r 1,e ⊕r 2,e ⊕r 3,e …⊕r k-1,e ⊕e;

[0170] For an attribute att e Calculate the hash value h μ (att e ), using the calculated k position indices to store r i,e soon att e Stored in the attribute Bloom filter ABF;

[0171] Step 3.2.3: Calculate the parameter Δ = H1(ρ(x)) to complete the hidden access to the structure (M,ρ) using the attribute Bloom filter ABF;

[0172] Step 3.3: Store transaction generation;

[0173] The data owner (DO) uploads the ciphertext CT and the attribute Bloom filter (ABF) to the cloud server (CSP) for storage. The cloud server (CSP) then sends the signature of the ciphertext CT and the storage address back to the data owner (DO).

[0174] The data owner, DO, verifies the signature of the ciphertext CT and calculates H1(H1(CT)‖Address‖Time) using their own signing private key SK.DO Generate sign=Sign DO (o);

[0175] The data owner DO will store the tuple {sign, H1(m), H1(CT), sign} CSP (CT),Address} is sent to the consensus node;

[0176] Step 3.4: Verify the storage transaction;

[0177] The consensus node generates a transaction with complete information and broadcasts it to the ledger node BN. θ Verification is required;

[0178] The verification process is as follows:

[0179] Calculate o = H1(H1(CT)‖Address‖Time) and verify the signature.

[0180] If o′=o, then calculate

[0181] If and only if o′=o, and If the verification passes, the consensus node packages all transactions into data blocks and stores them on the blockchain; otherwise, if the verification fails, it indicates that the cloud server CSP has tampered with the encrypted CT, and the consensus node deletes the transaction information.

[0182] Step 4: Input the total attribute set S of data user DU into the attribute Bloom filter ABF, and output the function ρ = (rownum, att) att∈S Here, rownum represents the row label of the shared matrix M, and att is the attribute corresponding to the row vector of the shared matrix M. There is a one-to-one correspondence between rownum and att. Data user DU generates a transformation key pair (tpk, tsk) based on its decryption private key SK, and uses the cloud server CSP to complete the pre-decryption to obtain the intermediate ciphertext IC. The data user takes tsk and IC as input and outputs plaintext m. Finally, data user DU verifies the correctness of plaintext m.

[0183] Step 4.1: Attribute Bloom Filter ABF Query;

[0184] When a data user DU wants to access data, it first needs to verify whether its attribute set S satisfies the access structure (M, ρ).

[0185] For attribute att in the attribute set S of data user DU, first calculate k hash function values ​​h. μ (att) retrieves all location indices;

[0186] Then reconstruct the elements: e = r 1,e⊕r 2,e ⊕…⊕r k-1,e ⊕r k,e =r 1,e ⊕r 2,e ⊕…⊕r k-1,e ⊕r 1,e ⊕r 2,e ⊕…⊕r k-1,e ⊕e, recovering e=x‖att e Calculate the hash value Δ′ = H1(att) and verify it. If the equation holds true, it means that the attribute set S of the data user DU satisfies the access structure (M, ρ), and ρ = (rownum, att) can be recovered. att∈S If the equation does not hold, it means that the attribute set S of the data user DU does not satisfy the access structure (M,ρ), and the process ends.

[0187] Step 4.2: Data user DU generates a conversion key pair (tpk, tsk) based on their decryption private key SK, and uses the cloud server CSP to complete the pre-decryption to obtain the intermediate ciphertext IC;

[0188] Data user DU randomly selects z,y∈Z p And calculate the transformation key pair tk = (tpk, tsk), where:

[0189] Data user DU sends the conversion public key tpk to the cloud server CSP for decryption assistance and secretly saves the conversion private key tsk;

[0190] Definition I θ ={x:ρ(x)∈S∩A θ}, find satisfaction coefficient The cloud server CSP performs the following calculations:

[0191]

[0192] Step 4.3, final decryption;

[0193] Data user DU calculates plaintext m: m = C·IC tsk ;

[0194] Step 4.4, Plaintext Verification;

[0195] Data user DU calculates H′1(m) based on plaintext m and queries TX. storage H1(m) in;

[0196] If H′1(m)≠H1(m), it means that the cloud server CSP returned an incorrect result and you need to return to step 4.2.

[0197] Step 5: When a key leak occurs, the consensus node tracks and audits the malicious data user DU or the ledger node BN. θ Finally, the encrypted CT is updated by the cloud server CSP;

[0198] Step 5.1, Tracking;

[0199] The consensus node performs a key integrity check, calculating whether the decryption private key SK satisfies the following equation; if the equation holds, it outputs K. 2,u and K τ Otherwise, the output will terminate.

[0200] K 2,u ,K 3,θ,u ,K 4,θ,u ∈Z p

[0201] K 1,θ,u ,K 4,θ,u ,K 5,θ,u ,K 6,θ,u ,K 7,θ,u ,K 8,θ,u ,K 9,θ,u ∈G

[0202]

[0203] Step 5.2, Audit;

[0204] The consensus node determines the owner of the decrypted private key SK obtained in step 5.1;

[0205] Specifically as follows:

[0206] Based on the result K output in step 5.1 2,u =c and K τ =w, the consensus node finds the corresponding tuple in the list UL based on c and makes the following judgment:

[0207] If the tuple exists, the consensus node requires the data user DU corresponding to c to submit its complete decryption private key SK;

[0208] If the decryption private key SK of data user DU is incomplete, the identity of data user DU will be returned, indicating that data user DU is dishonest;

[0209] If the data user DU's decryption private key SK is in good format and Then the identity of data user DU is returned, and it is determined that data user DU has leaked the decryption private key SK;

[0210] if Return the corresponding ledger node BN θ Determine the BN of the accounting node.θ The decryption private key SK of data user DU was illegally forged;

[0211] Step 5.3, Ciphertext Update;

[0212] When data user DU is judged to be dishonest, the calculation... And add the identity GID of data user DU to the revocation list to form a new revocation list R′;

[0213] The encryption system needs to be based on the new revocation list R ′ Update the encrypted CT so that user DU cannot access the data in the new revocation list R′;

[0214] Specifically as follows:

[0215] Consensus nodes select random numbers χ∈Z p and calculate

[0216] The cloud server CSP updates the ciphertext CT by updating the key X′. Specifically, for nodes ∈′∈cover(R′), if nodes ∈∈cover(R) and ∈′=∈, then T is directly set. ∈′ =T ∈ If node ∈ ∈ cover(R) and is the parent node of node ∈ ′, first obtain the path of ∈ ′:

[0217] path(∈′)=path(∈)∪{i depth(∈)+1 ,...,i depth(∈′)}, where i depth(∈) =∈, i depth(∈′) =∈′,

[0218] Then calculate the encrypted CT update part: Where π = depth(∈), ..., depth(∈′)-1, the ciphertext CT update is finally completed.

Claims

1. A multi-center attribute-based encryption method, characterized by: An encryption system is adopted, which comprises a blockchain BC, and a data owner DO, a data user DU and a cloud server CSP interconnected with the blockchain BC, the data owner DO and the cloud server CSP are interconnected, and the data user DU and the cloud server CSP are interconnected; the blockchain BC comprises a consensus node, and a plurality of bookkeeping nodes BN interconnected with the consensus node θ ; The multi-center attribute-based encryption method comprises the following steps: Step 1, consensus nodes generate public parameters GP and master key MSK of the encryption system; each bookkeeping node BN θ Using public parameters GP, calculate the generated respective public key PK θ And private key SK θ ; cloud server CSP and data owner DO set their own key pairs (PK CSP , SK CSP ) and (PK DO , SK DO ) for signature verification in the interaction and consensus stages; data user DU submits his own identity GID and attribute set S to the consensus node for registration, and the consensus node generates anonymous identity certificate AIC for the data user DU; Step 2, billing node BN θ Verifying the anonymous identity credential AIC of the data user DU, and obtaining the public parameter GP, the master key MSK, and the private key SK according to step 1 θ Calculating the decryption private key SK for the data user DU; Step 3, the data owner DO formulates an access structure (M, p), wherein the matrix M is a shared matrix of l rows and n columns constructed according to an access policy, and the mapping function p maps a row x to an attribute p(x), x representing the xth row of the matrix M, the row vector and the attribute form a one-to-one mapping relationship, and the mapping function p is constructed according to the public parameter GP and the public key PK θ The plaintext m is converted into ciphertext CT, the access structure (M, p) is encrypted to generate an attribute Bloom filter ABF according to a Bloom filter BF, the consensus node interacts with the data owner DO and stores all information generated in a transaction in a blockchain BC, and data encryption is completed. Step 4, input the total attribute set S of the data user DU into the attribute Bloom filter ABF, and output a function p=(rownum,att) att∈S Wherein rownum represents the row label of the shared matrix M, and att is the attribute corresponding to the row vector of the shared matrix M, and rownum and att are in one-to-one correspondence; the data user DU generates a conversion key pair (tpk,tsk) according to the own decryption private key SK, and completes the pre-decryption on the ciphertext CT by using the cloud server CSP to obtain the intermediate ciphertext IC; The data user outputs the plaintext m by taking the tsk and the intermediate ciphertext IC as inputs; Finally, the data user DU verifies the correctness of the plaintext m, and completes data decryption; Step 5, when the key is leaked, the consensus node tracks, audits the malicious data user DU or the bookkeeping node BN θ Finally, the cloud server CSP updates the ciphertext CT.

2. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to realize the steps of the multi-center attribute-based encryption method in claim 1.

3. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: The processor executes the computer program to realize the steps of the multi-center attribute-based encryption method in claim 1.

Images