A method and system for attribute-based access control encryption and decryption

Abstract

The present invention discloses an attribute-based access control encryption and decryption method and system, which belongs to the technical field of cryptography. The ciphertext constructed by this method is of constant size, so the overhead of encrypting and generating ciphertext and ciphertext purification is relatively small. At the same time, this method can support access structures of multi-valued AND gates, and can meet the policy description in most scenarios. The process of this method specifically includes: system initialization, calculation of public parameters, generation of encryption keys and decryption keys for users based on the user's policy and attributes, the user encrypts the information with the encryption key, and then sends the ciphertext to the purifier, the purifier purifies the ciphertext, and broadcasts the purified ciphertext to all receivers. Receivers that meet the corresponding policy can decrypt the ciphertext. Traditional access control encryption is generally designed based on identity, while the present invention proposes an attribute-based access control encryption method that can control the information flow in the system in a more fine-grained manner.

Description

Technical Field

[0001] The present invention belongs to the technical field of cryptography, and more specifically, relates to an attribute-based access control encryption and decryption method and system. Background Art

[0002] In traditional cryptographically protected information systems, access to information is effectively restricted through cryptography. After information is encrypted and transmitted, it is ensured that only users with the corresponding decryption key can read the message. In other words, only users with the decryption key have read access. From basic symmetric encryption to asymmetric encryption with various features, all methods restrict access to messages in various ways to ensure that only the intended user can decrypt the encrypted message.

[0003] However, in more common scenarios, it is necessary not only to restrict users' permission to read messages, but also to restrict users' permission to write messages. This is the concept of access control. Currently, the implementation of access control generally requires the use of a trusted central processing unit (CPU). This CPU contains the access control policy for the entire system, which determines which users can communicate and which users cannot. If the CPU is attacked, the attacker may arbitrarily tamper with the access control policy and may obtain the content of all messages. Therefore, cryptographic-based access control has been proposed, namely access control encryption. This encryption method can restrict users' write and read permissions at the same time as general access control. At the same time, access control encryption also has higher security. Access control encryption relies on an intermediate entity to forward messages, namely the purifier. However, the purifier only performs very simple operations. Even if the purifier is attacked, the attacker cannot tamper with the access control policy or obtain any useful information from the encrypted information flow.

[0004] The currently proposed access control encryption is basically based on identity to build access control policies. Although the identity-based approach can complete the construction of policies, it still has limitations in the expression of access control policies, that is, it cannot express the system's access control policies intuitively and conveniently. Summary of the Invention

[0005] In response to the defects and improvement needs of the existing technology, the present invention provides an attribute-based access control encryption and decryption method and system, aiming to solve the technical problem that the existing access control encryption and decryption methods cannot intuitively and conveniently express the system's access control policy.

[0006] To achieve the above objectives, in a first aspect, the present invention provides an attribute-based access control encryption method, comprising:

[0007] Generate encryption key parameters (β A ,γ A ); then generate the encryption key parameter (β A ,γ A ) signature σ, thereby obtaining the encryption key ek A =(β A ,γ A ,σ);

[0008] Using the encryption key ek A Encrypt message m to generate ciphertext C;

[0009] Among them, the public parameters

[0010] g1 and g2 come from the Type III group {p,G1,G2,G T ,g1,g2,e}, p is a prime number, G1,G2,G T are three p-order multiplicative groups, g1 is the generator of the G1 group, g2 is the generator of the G2 group, e:G1×G2→G T is a bilinear map;

[0011] H0 is the hash function, random number represents the set of integers in the range (0, p); i represents the i-th attribute, n is the total number of attributes, k i The kth value of the i-th attribute i Value, n i is the number of possible values ​​for the i-th attribute;

[0012] vk represents the signature verification key, crs represents the public reference string of zero-knowledge proof;

[0013] The master key msk=(x, y, sk);

[0014] The encryption key parameters in I A Indicates a non-wildcard attribute.

[0015] Furthermore, the encryption key ek is used A Encrypt message m to generate ciphertext C, including:

[0016] Select random number calculate And use the random number r to re-randomize the signature σ to get σ ′ ;

[0017] Select random number calculate

[0018] Select random number calculate

[0019] By x1=(C1,C2,C3,g1 r ,β A ′ ,γ A ′ ) and w1=(u1) generate zero-knowledge proof π1, through x2=(c1,c2,c3,g1 r ,β A ′ ,γ A ′ ) and w2=(u2) generate zero-knowledge proof π2;

[0020] The output ciphertext is C=(C1,C2,C3,c1,c2,c3,π1,π2,σ ′ ,β A ′ ,γ A ′ ,g1 r ).

[0021] In a second aspect, the present invention provides an attribute-based access control encryption system, comprising:

[0022] processor;

[0023] A memory stores a computer-executable program, which, when executed by the processor, enables the processor to perform the attribute-based access control encryption method as described in the first aspect.

[0024] In a third aspect, the present invention provides an attribute-based access control decryption method, comprising:

[0025] When the receiver receives the ciphertext C after being purified by the purifier ′ Then, the receiver's decryption key dk is used L For the purified ciphertext C ′ Decryption is performed, and during the decryption process, it is determined whether the attribute set L of the receiver satisfies the ciphertext C ′ If yes, then the plain text is output; otherwise, the decryption fails;

[0026] The purifier is used to receive the ciphertext C from the sender and verify the legitimacy of the ciphertext C; if it is illegal, the ciphertext C is discarded; otherwise, the ciphertext C is purified and the purified ciphertext C is sent to the server.′ Sent to the recipient; the ciphertext C is obtained using the attribute-based access control encryption method as described in the first aspect;

[0027] The decryption key dk L Generated by:

[0028] Select random number For 1≤i≤n, assume that the attribute set L takes the kth i value, calculate H1 is the hash function;

[0029] Get all access control policies A that the receiver's attribute set L can satisfy * ;

[0030] Output decryption key

[0031] Furthermore, the verification of the legitimacy of the ciphertext C is specifically as follows:

[0032] Verify the re-randomized signature σ using the signature verification key vk ′ Is it correct? And use the public reference string crs to verify whether the zero-knowledge proof π1,π2 is correct.

[0033] If the signature σ ′ If the zero-knowledge proof π1 and π2 are both correct, the ciphertext C is purified and the purified ciphertext is calculated. The random number Otherwise, discard the ciphertext C.

[0034] Furthermore, if the receiver's attribute set L satisfies the ciphertext C ′ The access control policy is output in plain text. For A∈A * ,

[0035] In a fourth aspect, the present invention provides an attribute-based access control decryption system, comprising:

[0036] processor;

[0037] A memory stores a computer-executable program, which, when executed by the processor, enables the processor to perform the attribute-based access control decryption method as described in the third aspect.

[0038] In a fifth aspect, the present invention provides an attribute-based access control encryption and decryption method, comprising:

[0039] Generate system public parameters pp and master key msk;

[0040] Generate encryption key parameters (β A ,γ A ); then generate the encryption key parameter (β A ,γ A ) signature σ, thereby obtaining the encryption key ek A =(β A ,γ A ,σ); using the encryption key ek A Encrypt the message m to generate ciphertext C, and send the ciphertext C to the purifier;

[0041] When the receiver receives the ciphertext C after being purified by the purifier ′ Then, the receiver's decryption key dk is used L For the purified ciphertext C ′ Decryption is performed, and during the decryption process, it is determined whether the attribute set L of the receiver satisfies the ciphertext C ′ If yes, then the plain text is output; otherwise, the decryption fails;

[0042] Among them, the public parameters

[0043] g1 and g2 come from the Type III group {p,G1,G2,G T ,g1,g2,e}, p is a prime number, G1,G2,G T are three p-order multiplicative groups, g1 is the generator of the G1 group, g2 is the generator of the G2 group, e:G1×G2→G T is a bilinear map;

[0044] H0 is the hash function, random number represents the set of integers in the range (0, p); i represents the i-th attribute, n is the total number of attributes, k i The kth value of the i-th attribute i Value, n i is the number of possible values ​​for the i-th attribute;

[0045] vk represents the signature verification key, crs represents the public reference string of zero-knowledge proof;

[0046] The master key msk=(x, y, sk);

[0047] The encryption key parameters in I A Indicates a non-wildcard attribute;

[0048] The decryption key dk L Generated by:

[0049] Select random number For 1≤i≤n, assume that the attribute set L takes the kth i value, calculate H1 is the hash function;

[0050] Get all access control policies A that the receiver's attribute set L can satisfy * ;

[0051] Output decryption key

[0052] In a sixth aspect, the present invention provides an attribute-based access control encryption and decryption system, comprising:

[0053] processor;

[0054] A memory stores a computer executable program, which, when executed by the processor, enables the processor to perform the attribute-based access control encryption and decryption method as described in the fifth aspect.

[0055] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

[0056] (1) Different from the existing identity-based access control encryption method, the present invention proposes attribute-based access control encryption, in which each user is assigned a policy and an attribute. The policy determines to whom he can send messages, and the attribute determines from whom he can receive messages. In this way, access control policies can be conveniently constructed by assigning policies and attributes to each user. On this basis, encryption keys and decryption keys are generated based on the system public parameters pp, the master key msk, and the sender's access control policy A and attribute L. Therefore, during the encryption process, fine-grained control of information flow in the system can be achieved by assigning corresponding access control policies and attributes to different users, thereby better controlling the direction of information flow in the encryption system and more conveniently and efficiently managing user behavior. In addition, since the size of the ciphertext is constant, the encryption, purification, and decryption processes are all highly efficient. At the same time, this method can support the access structure of multi-valued AND gates and can meet the access control policy description in most scenarios.

[0057] (2) The output ciphertext of the present invention is C=(C1,C2,C3,c1,c2,c3,π1,π2,σ ′ ,β A ′ ,γ A ′,g1 r ), where C1, C2, and C3 are mainly used to encrypt the message, c1, c2, and c3 are mainly used to purify the ciphertext, and β A ′ ,γ A ′ ,σ ′ Mainly used to verify the legitimacy of encryption keys, π1, π2, β A ′ ,γ A ′ ,g1 r C1, C2, C3, c1, c2, c3 are mainly used to verify that the ciphertext is generated by the encryption key. This ensures the security of encryption, prevents malicious senders from generating illegal ciphertext, and prevents unauthorized receivers from reading any information from the ciphertext. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 Flowchart of the attribute-based access control encryption and decryption method provided in Example 5 of the present invention;

[0059] Figure 2 This is a structural diagram of the attribute-based access control encryption and decryption system provided in Example 5 of the present invention. DETAILED DESCRIPTION

[0060] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.

[0061] In the present invention, the terms "first", "second", etc. (if any) in the present invention and the drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0062] Example 1

[0063] An attribute-based access control encryption method, comprising:

[0064] Generate encryption key parameters (β A ,γ A ); then generate the encryption key parameter (β A ,γ A ) signature σ, thereby obtaining the encryption key ek A =(β A ,γA ,σ);

[0065] Using the encryption key ek A Encrypt message m to generate ciphertext C;

[0066] Among them, the public parameters

[0067] g1 and g2 come from the Type III group {p,G1,G2,G T ,g1,g2,e}, p is a prime number, G1,G2,G T are three p-order multiplicative groups, g1 is the generator of the G1 group, g2 is the generator of the G2 group, e:G1×G2→G T is a bilinear map;

[0068] H0 is the hash function, random number represents the set of integers in the range (0, p); i represents the i-th attribute, n is the total number of attributes, k i The kth value of the i-th attribute i Value, n i is the number of possible values ​​for the i-th attribute;

[0069] vk represents the signature verification key, crs represents the public reference string of zero-knowledge proof;

[0070] The master key msk=(x, y, sk);

[0071] The encryption key parameters in I A Indicates a non-wildcard attribute.

[0072] It should be noted that, assuming that the full set of attributes is U = {ω1,ω2,…,ω n}, which has n attributes, and each attribute has multiple values, such as attribute ω i The value set is S i ={v i,1 ,v i,2 ,…,v i,ni}, where the number of possible values ​​is n i , remember n i The maximum value in (1≤i≤n) is m. Assume that the attributes in the attribute set U can be encoded into Elements in, define two hash functions as well as

[0073] In an optional embodiment, the encryption key ek is used A Encrypt message m to generate ciphertext C, including:

[0074] Select random number calculate And use the random number r to re-randomize the signature σ to get σ ′ ;

[0075] Select random number calculate

[0076] Select random number calculate

[0077] By x1=(C1,C2,C3,g1 r ,β A ′ ,γ A ′ ) and w1=(u1) generate zero-knowledge proof π1, through x2=(c1,c2,c3,g1 r ,β A ′ ,γ A ′ ) and w2=(u2) generate zero-knowledge proof π2;

[0078] The output ciphertext is C=(C1,C2,C3,c1,c2,c3,π1,π2,σ ′ ,β A ′ ,γ A ′ ,g1 r ).

[0079] Example 2

[0080] An attribute-based access control encryption system, comprising:

[0081] processor;

[0082] A memory stores a computer-executable program, which, when executed by the processor, enables the processor to execute the attribute-based access control encryption method as described in embodiment 1.

[0083] The relevant technical solutions are the same as those in Example 1 and will not be described again here.

[0084] Example 3

[0085] An attribute-based access control decryption method, comprising:

[0086] When the receiver receives the ciphertext C after being purified by the purifier′ Then, the receiver's decryption key dk is used L For the purified ciphertext C ′ Decryption is performed, and during the decryption process, it is determined whether the attribute set L of the receiver satisfies the ciphertext C ′ If yes, then the plain text is output; otherwise, the decryption fails;

[0087] The purifier is used to receive the ciphertext C from the sender and verify the legitimacy of the ciphertext C; if it is illegal, the ciphertext C is discarded; otherwise, the ciphertext C is purified and the purified ciphertext C is sent to the server. ′ Sent to the recipient; the ciphertext C is obtained using the attribute-based access control encryption method described in Example 1;

[0088] The decryption key dk L Generated by:

[0089] Select random number For 1≤i≤n, assume that the attribute set L takes the kth i value, calculate H1 is the hash function;

[0090] Get all access control policies A that the receiver's attribute set L can satisfy * ;

[0091] Output decryption key

[0092] In an optional implementation manner, the legitimacy of the ciphertext C is verified as follows:

[0093] Verify the re-randomized signature σ using the signature verification key vk ′ Is it correct? And use the public reference string crs to verify whether the zero-knowledge proof π1,π2 is correct.

[0094] If the signature σ ′ If the zero-knowledge proof π1 and π2 are both correct, the ciphertext C is purified and the purified ciphertext is calculated. The random number Otherwise, discard the ciphertext C.

[0095] In an optional implementation, if the receiver's attribute set L satisfies the ciphertext C ′ The access control policy is output in plain text. For A∈A * ,

[0096] Example 4

[0097] An attribute-based access control decryption system, comprising:

[0098] processor;

[0099] A memory stores a computer-executable program, which, when executed by the processor, enables the processor to perform the attribute-based access control decryption method as described in Example 3.

[0100] The relevant technical solution is the same as that in Example 3 and will not be described again here.

[0101] Example 5

[0102] like Figure 1 As shown, an attribute-based access control encryption and decryption method with high performance includes:

[0103] 1. The authority runs system initialization according to the preset access control policy and generates the public parameters pp and master key msk;

[0104] 2. The authority inputs the sender’s policy in Then the sender's encryption key ek is generated based on the public parameter pp and the master key msk A ;

[0105] 3. The authority inputs the attribute set L of the recipient, where Then, the receiver's decryption key dk is generated based on the public parameter pp and the master key msk L ;

[0106] 4. The sender uses the encryption key ek A Encrypt the message m to obtain the ciphertext C;

[0107] 5. The sender sends the ciphertext C to the purifier;

[0108] 6. The purifier verifies the legitimacy of the ciphertext C. If it is illegal, the ciphertext C is discarded directly. If it is legal, the ciphertext C is calculated to obtain the purified ciphertext C. ′ ;

[0109] 7. The purifier will purify the ciphertext C ′ Broadcast to all receivers;

[0110] 8. The receiver obtains the purified ciphertext C ′ Afterwards, it will use its own decryption key dk L Decrypt it. If the attribute set L does not satisfy the policy A in the ciphertext, decryption cannot be achieved. If it does, the message m can be successfully decrypted.

[0111] like Figure 2As shown, an attribute-based access control encryption and decryption system with high efficiency includes: an authority, a sender, a receiver, and a purifier.

[0112] The authority will perform system initialization operations, generate public parameters and master keys, and generate encryption keys for the sender based on the sender's access control policy and decryption keys for the receiver based on the receiver's attributes. After completing initialization and key generation, the authority does not need to perform other operations for the time being.

[0113] The sender will encrypt his or her own information using the encryption key obtained from the authority and send the encrypted information to the purifier. The access control policy in the sender's ciphertext is determined when the system presets the global access control policy. The sender can only encrypt the message according to the access control policy preset for himself or herself.

[0114] The purifier will perform purification operations on all ciphertexts received. First, it will check the legitimacy of the ciphertext. If it is illegal, the ciphertext will be discarded directly. If it is legal, the ciphertext will be calculated to obtain the purified ciphertext, and then the purified ciphertext will be broadcast to all receivers.

[0115] After receiving the broadcast purified ciphertext, the receiver will attempt to decrypt the ciphertext using the decryption key obtained from the authority. If the receiver's attributes do not meet the ciphertext policy, decryption will fail. If they do, the message can be successfully decrypted.

[0116] It will be easily understood by those skilled in the art that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An attribute-based access control encryption method, characterized in that: include: Generate encryption key parameters (β A ,γ A ); then generate the encryption key parameter (β A ,γ A ) signature σ, thereby obtaining the encryption key ek A =(β A ,γ A ,σ); Using the encryption key ek A Encrypt message m to generate ciphertext C; Among them, the public parameters g1 and g2 come from the Type III group {p,G1,G2,G T ,g1,g2,e}, p is a prime number, G1,G2,G T are three p-order multiplicative groups, g1 is the generator of the G1 group, g2 is the generator of the G2 group, e:G1×G2→G T is a bilinear map; H0 is the hash function, random number represents the set of integers in the range (0, p); i represents the i-th attribute, n is the total number of attributes, k i The kth value of the i-th attribute i Value, n i is the number of possible values ​​for the i-th attribute; vk represents the signature verification key, crs represents the public reference string of zero-knowledge proof; The master key msk=(x, y, sk); The encryption key parameters in I A Indicates a non-wildcard attribute.

2. The attribute-based access control encryption method according to claim 1, characterized in that: The encryption key ek is used A Encrypt message m to generate ciphertext C, including: Select random number calculate And use the random number r to re-randomize the signature σ to get σ ′ ; Select random number calculate Select random number calculate pass and w1=(u1) to generate zero-knowledge proof π1, through x2=(c1,c2,c3,g1 r ,β A ′ ,γ A ′ ) and w2=(u2) generate zero-knowledge proof π2; The output ciphertext is C=(C1,C2,C3,c1,c2,c3,π1,π2,σ ′ ,β A ′ ,γ A ′ ,g1 r ).

3. An attribute-based access control encryption system, characterized in that: include: processor; A memory storing a computer-executable program, wherein when the program is executed by the processor, the processor is caused to execute the attribute-based access control encryption method according to claim 1 or 2.

4. A method for attribute-based access control decryption, characterized in that: include: When the receiver receives the ciphertext C after being purified by the purifier ′ Then, the receiver's decryption key dk is used L For the purified ciphertext C ′ Decryption is performed, and during the decryption process, it is determined whether the attribute set L of the receiver satisfies the ciphertext C ′ If yes, output the plain text. Otherwise, decryption fails; The purifier is used to receive the ciphertext C from the sender and verify the legitimacy of the ciphertext C; if it is not legal, the ciphertext C is discarded; Otherwise, purify the ciphertext C and send the purified ciphertext C ′ Sent to the recipient; the ciphertext C is obtained using the attribute-based access control encryption method according to claim 1 or 2; The decryption key dk L Generated by: Select random number For 1≤i≤n, assume that the attribute set L takes the kth i value, calculate H1 is the hash function; Get all access control policies A that the receiver's attribute set L can satisfy * ; Output decryption key 5. The attribute-based access control decryption method according to claim 4, characterized in that: The verification of the legitimacy of the ciphertext C is specifically as follows: Verify the re-randomized signature σ using the signature verification key vk ′ Is it correct? And use the public reference string crs to verify whether the zero-knowledge proof π1,π2 is correct. If the signature σ ′ If the zero-knowledge proof π1 and π2 are both correct, the ciphertext C is purified and the purified ciphertext is calculated. The random number Otherwise, discard the ciphertext C.

6. The attribute-based access control decryption method according to claim 5, characterized in that: If the receiver's attribute set L satisfies the ciphertext C ′ The access control policy is output in plain text. For A∈A * , 7. An attribute-based access control decryption system, characterized in that: include: processor; A memory storing a computer-executable program, wherein when the program is executed by the processor, the processor executes the attribute-based access control decryption method according to any one of claims 4 to 6.

8. An attribute-based access control encryption and decryption method, characterized in that: include: Generate system public parameters pp and master key msk; Generate encryption key parameters (β A ,γ A ); then generate the encryption key parameter (β A ,γ A ) signature σ, thereby obtaining the encryption key ek A =(β A ,γ A ,σ); using the encryption key ek A Encrypt the message m to generate ciphertext C, and send the ciphertext C to the purifier; When the receiver receives the ciphertext C after being purified by the purifier ′ Then, the receiver's decryption key dk is used L For the purified ciphertext C ′ Decryption is performed, and during the decryption process, it is determined whether the attribute set L of the receiver satisfies the ciphertext C ′ If yes, output the plain text. Otherwise, decryption fails; Among them, the public parameters g1 and g2 come from the Type III group {p,G1,G2,G T ,g1,g2,e}, p is a prime number, G1,G2,G T are three p-order multiplicative groups, g1 is the generator of the G1 group, g2 is the generator of the G2 group, e:G1×G2→G T is a bilinear map; H0 is the hash function, random number represents the set of integers in the range (0, p); i represents the i-th attribute, n is the total number of attributes, k i The kth value of the i-th attribute i Value, n i is the number of possible values ​​for the i-th attribute; vk represents the signature verification key, crs represents the public reference string of zero-knowledge proof; The master key msk=(x, y, sk); The encryption key parameters in I A Indicates a non-wildcard attribute; The decryption key dk L Generated by: Select random number For 1≤i≤n, assume that the attribute set L takes the kth i value, calculate H1 is the hash function; Get all access control policies A that the receiver's attribute set L can satisfy * ; Output decryption key 9. An attribute-based access control encryption and decryption system, characterized in that: include: processor; A memory storing a computer-executable program, wherein when the program is executed by the processor, the processor executes the attribute-based access control encryption and decryption method according to claim 8.

Images