A lightweight attribute-based encryption method based on OBDD access structure

Abstract

This invention discloses a lightweight attribute-based encryption method based on the OBDD access structure. From the perspective of encryption and decryption efficiency, this method splits the encryption stage into an offline stage and an online stage. In the offline stage, paired master and slave ciphertext module pools are computed offline, improving the encryption efficiency of the online stage. The decryption stage is split into outsourced decryption and local decryption. Before outsourced decryption, the decryptor generates an auxiliary key and provides it to the decryption agent, ensuring that the agent cannot know the plaintext while transferring most of the computational work to the agent, thereby reducing the computational burden on the decryptor. This invention improves upon existing attribute-based encryption algorithms based on the OBDD access structure, enabling data terminals to obtain the final result with low-complexity computation when encrypting or decrypting data.

Description

Technical Field

[0001] This invention relates to attribute-based encryption techniques in the field of cryptography, and particularly to a lightweight attribute-based encryption scheme based on the OBDD access structure. Background Technology

[0002] Data sharing, due to its convenience and cost-effectiveness, has become a highly attractive service offered by cloud computing platforms. However, cloud service providers are often untrustworthy and may unauthorizedly disclose user data to competitors for undue gain. Therefore, protecting sensitive user data stored in the cloud is particularly important. One feasible approach is to encrypt and store the data. While traditional asymmetric cryptography allows users to secretly share data with designated users, it lacks fine-grained access control. As a scalable one-to-many encryption mechanism, attribute-based encryption (ABE) provides robust security and fine-grained access control for cloud storage.

[0003] From an access control perspective, access structures in attribute-based encryption schemes can take various forms. A better access structure can not only improve system efficiency and the expressiveness of access policies, but also reduce the number of attributes that need to be embedded in the ciphertext, thereby shortening the ciphertext length and reducing communication and storage overhead. Common LSSS matrix and threshold structure access policies are monotonic access structures and cannot represent negative values ​​of attributes. To define a negative value of an attribute in the access policy, a new attribute must be defined to correspond to that negative value. When the attribute set is large, this approach can directly double the number of attributes. The CP-ABE scheme based on the Ordered Binary Decision Diagram (OBDD) has the characteristics of strong expressiveness and computational efficiency, and can simultaneously support positive and negative values ​​of attributes in the access policy.

[0004] However, in traditional OBDD-based attribute-based encryption computation, the pairing operation of bilinear groups incurs significant computational overhead, consuming substantial computing resources in practical systems and imposing a heavy computational burden on data owners and users. This is even more pronounced in scenarios with limited mobile terminal resources, such as Industrial IoT and Wireless Body Area Networks. Therefore, this scheme needs improvement by introducing offline / online encryption and outsourced decryption to achieve a lightweight OBDD-based attribute-based encryption solution. Summary of the Invention

[0005] To overcome the shortcomings of existing technologies and address the difficulty in balancing reduced computational overhead and rich semantic expression of access control structures in current attribute-based encryption schemes, this invention provides a lightweight attribute-based encryption method based on the OBDD access structure. This invention improves existing attribute-based encryption algorithms based on the OBDD access structure, enabling data terminals to obtain the final result with lower computational complexity when encrypting or decrypting data. From an access control perspective, the OBDD access structure, which can represent negative attribute values, reduces the total attribute set, thereby reducing the number of attributes that need to be embedded in the ciphertext, shortening the ciphertext length, and lowering communication and storage overhead. From an encryption / decryption efficiency perspective, this invention splits the encryption stage into an offline stage and an online stage. The offline stage computes intermediate results offline, improving the encryption efficiency of the online stage. The decryption stage is split into outsourced decryption and local decryption. While ensuring that the outsourced agent is unaware of the plaintext, most of the computational work is transferred to the agent, thus reducing the computational burden on the decryptor.

[0006] Technical solution:

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] A lightweight attribute-based encryption method based on the OBDD access structure extends traditional attribute-based encryption algorithms based on the OBDD access structure. It improves encryption efficiency in the online encryption stage by computing intermediate results offline during the offline encryption phase. An auxiliary key is introduced to transfer most of the decryption computation to the agent while ensuring that the outsourced agent cannot know the plaintext, thereby reducing the computational burden on the decryptor. The method includes the following steps:

[0009] S10. System initialization algorithm Setup(ξ,U)→(PK,MSK): executed by the authorization center CA, the input is the security parameter ξ and the complete set of attributes U, the output public parameter PK is made public, and the master key MSK is kept secret by the authorization center CA;

[0010] S20. User key generation algorithm KeyGen(PK,MSK,S)→SK S Executed by the Authorized Center (CA), the input includes the master key MSK, public parameters PK, and user attribute set S, and the output is the corresponding user private key SK. S , will the user's private key SK S Send to the user via a secure channel;

[0011] S30. Offline Encrypt (PK) Algorithm → (IT) a IT m ): Executed by the data owner DO, with the common parameter PK as input and the main encrypted module pool IT as output. aand the corresponding secondary encrypted module pool IT m The calculation is performed offline and is independent of the actual ciphertext; the completed calculation is saved locally.

[0012] S40. Online Encryption Algorithm: Online.Encrypt(PK,IT,OBDD,m)→CT: Executed by the data owner DO, inputs are the public parameter PK, the access control structure OBDD, and the main and secondary ciphertext module pools IT. a IT m Plaintext m, output as ciphertext CT, and uploaded to cloud service provider SSP;

[0013] S50. Auxiliary Key Generation Algorithm: Agential.KeyGen(SK S ,z)→SK s 'Executed by data user DU, input is user private key SK' S A random number z is output as the auxiliary key SK. s ', will the auxiliary key SK s 'Sent to the decryption service provider DSP via a secure channel;'

[0014] S60. Outsourcing.Decrypt(CT,S,SK) algorithm s ')→CT': Executed by an outsourced decryption service provider, input is ciphertext CT, user attribute set S, and auxiliary key SK. s 'Output the semi-decrypted ciphertext CT';

[0015] S70. Local decryption algorithm: Local.Decrypt(CT', C SE ,z)→m: Executed by data user DU, input is the semi-decrypted ciphertext CT', and the symmetric ciphertext C SE Generate auxiliary key SK s The secret z is output as plaintext m.

[0016] Furthermore, the system initialization algorithm in phase S1 includes the following steps:

[0017] S11. Select two cyclic groups G and G' of order p, both of which are large prime numbers. T Let g be a generator of G1, and e: G×G→G T It is a bilinear mapping.

[0018] S12. Select a random number α∈Z p Calculate Y α =e(g,g) α .

[0019] S13. Number each attribute in the attribute set U as {0,1,…,m-1}, and... Select a random number k i ,k i '∈Z p ,calculate and, Where, k i A positive value representing attribute i means that the attribute i is possessed by k. i ' represents a negative value for attribute i, meaning that attribute i is not present.

[0020] S14. Set system parameter PK = <e,g,Y α ,{K i ,K i '}> Public, MSK=<α,{k i ,k i It is secretly stored as the system's private key.

[0021] Furthermore, the S2 stage user key generation algorithm includes the following steps:

[0022] S21. Data user DU sends its attribute set S to the authorization center CA, requesting the user's private key.

[0023] S22. After receiving the attribute set S from the user, the authorization center (CA) determines whether each attribute i in the universal attribute set belongs to the user's attribute set S. If i∈S, then take the positive value of the attribute. like Then take the negative value of the attribute.

[0024] S23. The authorization center CA selects a random number r∈Z. p ,calculate Obtain user key Send the user's private key to the user via a secure channel.

[0025] Furthermore, the S3 stage offline encryption algorithm includes the following steps:

[0026] S31. Data owner DO selects a random number s∈Z while offline. p Y is calculated based on the common parameter PK. α s g s , {K i s}, {K i ' s}

[0027] S32. Execute S31 multiple times, using secret 's' as the key and the main and secondary ciphertext modules as the values, to construct the main ciphertext module pool IT. a = < s,e(g,g) αs ,gs >, Sub-ciphertext module pool IT m = < s, {K i s ,K i ' s}>, and save it locally.

[0028] Furthermore, the S4 stage online encryption algorithm includes the following steps:

[0029] S41. The data owner DO randomly selects a set of primary and secondary ciphertext modules and retrieves the data from the primary ciphertext module. Calculate the symmetric key K SE =H(e(g,g) αs ), and symmetric encryption is performed on plaintext m to obtain C. SE =SE.Enc(K SE ,m).

[0030] S42. Assuming the number of valid paths from the root node to the terminal node in the OBDD access structure is n, then the set of valid paths R can be represented as {R1, R2, ..., R...} n-1 For each path R t calculate Obtain from the secondary ciphertext module Here, set I represents the set of attributes involved in the access structure, and set U represents the complete set of attributes.

[0031] S43. Data Owner DO Combined Ciphertext And upload it to the cloud service provider SSP.

[0032] Furthermore, the S5 stage auxiliary key generation algorithm includes the following steps:

[0033] S51. Data user DU randomly selects number z∈Z p And calculate based on its own key

[0034] S52. Data User DU Combination Auxiliary Key It is then sent to the decryption service provider DSP via a secure channel.

[0035] Furthermore, the S6 stage outsourced decryption algorithm includes the following steps:

[0036] S61. The outsourced decryption service provider DSP constructs an ordered decision graph (V,E,id) based on the OBDD access structure in the ciphertext.

[0037] S62. Starting from the root node, determine the child node based on whether the attribute set S contains a non-terminal node of the attribute. If i∈S, then move along high(v) to the high child node; otherwise, move along low(v) to the low child node.

[0038] S63. Repeat S62 until the terminal node is reached. If the terminal node is 1, the iteration terminates, and the valid path R is obtained. t Otherwise, output "failure". At this point, a valid path or termination identifier has been obtained.

[0039] S64. Based on the result of S63, decide whether to proceed with further calculations. If "failure" is output, stop decryption; if "valid path R" is output, proceed with decryption. t Then calculate

[0040] S65. Calculate the semi-decrypted ciphertext And send it to data user DU via a secure channel.

[0041] Furthermore, the S7 stage local decryption algorithm includes the following steps:

[0042] S71. Data user DU calculates the symmetric key K based on the semi-decrypted ciphertext. SE =H(CT') z )=H(e(g,g) αs ).

[0043] S72. Data user DU decrypts using a symmetric key to obtain the plaintext m = SE.Dec(K). SE C SE ).

[0044] Beneficial effects:

[0045] The advantages of this invention are: it improves the attribute-based encryption algorithm based on the OBDD access structure, introduces the concepts of offline / online encryption and outsourced decryption, allowing the data owner to quickly obtain the final ciphertext using intermediate results from offline computation during encryption; and enabling the data user to perform most of the decryption work while ensuring the decryption agent remains unaware of the plaintext by introducing an auxiliary key. It is particularly suitable for scenarios with limited mobile terminal resources, such as Industrial IoT and Wireless Body Area Networks, where the data terminal can obtain the final result through relatively simple calculations. Attached Figure Description

[0046] Figure 1 This is a system architecture diagram of the OBDD-based lightweight attribute base encryption involved in this invention;

[0047] Figure 2 This is a timing diagram of the OBDD-based lightweight attribute base encryption involved in this invention. Detailed Implementation

[0048] The technical solution of the present invention will be further described in detail below with reference to the embodiments.

[0049] This section will introduce an example of using this invention for data sharing, involving five entities: the Authorization Center (CA), the Data Owner (DO), the Data User (DU), the Decryption Agent (DSP), and the Cloud Storage Service Provider (SSP). The relationships between these entities are as follows: Figure 1 As shown.

[0050] This invention relates to an algorithm involving seven stages, with timing diagrams showing the execution of the algorithm by each entity at different stages, as shown below. Figure 2 As shown, the algorithms are as follows:

[0051] S1. System initialization algorithm Setup(ξ,U)→(PK,MSK): executed by the authorization center CA, the input is the security parameter ξ and the complete set of attributes U, the output public parameter PK is made public, and the master key MSK is kept secret by the authorization center CA;

[0052] S2. User key generation algorithm KeyGen(PK,MSK,S)→SK S Executed by the Authorized Center (CA), the input includes the master key MSK, public parameters PK, and user attribute set S, and the output is the corresponding user private key SK. S , will the user's private key SK S Send to the user via a secure channel;

[0053] S3. Offline Encrypt (PK) algorithm → (IT) a IT m ): Executed by the data owner DO, with the common parameter PK as input and the main encrypted module pool IT as output. a and the corresponding secondary encrypted module pool IT m The calculation is performed offline and is independent of the actual ciphertext; the completed calculation is saved locally.

[0054] S4. Online Encryption Algorithm: Online.Encrypt(PK,IT,OBDD,m) → CT: Executed by the data owner DO, inputs are the public parameter PK, the access control structure OBDD, and the main and secondary ciphertext module pools IT. a IT m Plaintext m, output as ciphertext CT, and uploaded to cloud service provider SSP;

[0055] S5. Auxiliary Key Generation Algorithm: Agential.KeyGen(SK S ,z)→SK s 'Executed by data user DU, input is user private key SK' SA random number z is output as the auxiliary key SK. s The auxiliary key is sent to the decryption service provider DSP via a secure channel;

[0056] S6. Outsourcing.Decrypt(CT,S,SK) S ')→CT': Executed by an outsourced decryption service provider, input is ciphertext CT, user attribute set S, and auxiliary key SK. S 'Output the semi-decrypted ciphertext CT';

[0057] S7. Local decryption algorithm: Local.Decrypt(CT', C SE ,z)→m: Executed by data user DU, input is the semi-decrypted ciphertext CT', and the symmetric ciphertext C SE Generate the secret z of the auxiliary key and output the plaintext m.

[0058] First, the Authorization Center (CA) performs initialization operations, generating system parameters and the system private key. Two cyclic groups G and G', of order p, are selected. T Let g be a generator of G1, and e: G×G→G T It is a bilinear mapping. Choose random numbers α∈Z. p Calculate Y α =e(g,g) α Number each attribute in the attribute set U, and then... Select a random number k i ,k i '∈Z p ,calculate and, Where, k i A positive value representing attribute i means that the attribute i is possessed by k. i 'Represents a negative value for attribute i, i.e., the attribute i is not present. The system parameter PK = <e,g,Y α ,{K i ,K i '}> Public, MSK=<α,{k i ,k i It is secretly stored as the system's private key.

[0059] Secondly, when a data user DU joins the data sharing platform, they need to register their identity in the system, authenticate their attribute set S, and request their private key from the authorization center CA. After obtaining the user's attribute set S, the authorization center CA determines whether each attribute i in the attribute set belongs to the user's attribute set S. If i∈S, then take the positive value of the attribute. like Then take the negative value of the attribute. Choose a random number r∈Z p ,calculate Obtain user key Send the user's private key to the user via a secure channel.

[0060] Each user who needs to share data needs to pre-calculate a pool of ciphertext modules unrelated to the actual data to be shared while offline. This ensures that when data needs to be encrypted, the complete ciphertext can be obtained through computation with low complexity. The data owner DO selects a random number s∈Zp offline and calculates Y based on the common parameters PK. α s g s , {K i s}, {K i ' s Repeatedly performing the above operations, using the secret 's' as the key and the primary and secondary ciphertext modules as the values, constructs the primary ciphertext module pool IT. a = <s,e(g,g) αs ,g s >, Sub-ciphertext module pool IT m = <s,{K i s ,K i ' s The data is then processed and stored locally. It can be seen that the calculations in the offline phase are independent of the specific plaintext, and therefore can be performed in advance. At this point, the data owner has completed the generation of the ciphertext module pool in the offline phase, including all the more complex bilinear pairing operations. Therefore, in the subsequent online phase, the data owner can obtain the final result with relatively low computational complexity.

[0061] When the data owner (DO) needs to share data, a set of primary and secondary ciphertext modules is randomly selected, and the data is retrieved from the primary ciphertext module. Calculate the symmetric key K SE =H(e(g,g) αs ), and symmetric encryption is performed on plaintext m to obtain C. SE =SE.Enc(K SE ,m). DO specifies the corresponding access control policy in the form of OBDD. Assuming that the number of valid paths from the root node to the terminal node in the OBDD access structure is n, then the set of valid paths R is represented as {R1,R2,…,R}. n-1 For each path R t calculate Obtain from the secondary ciphertext module Here, set I represents the set of attributes involved in the access structure, and set U represents the complete set of attributes. Combined ciphertext The data is then uploaded to the cloud service provider SSP. It can be seen that the online encryption stage does not include bilinear pairing operations, but only symmetric encryption calculations and multiplication operations. Therefore, when plaintext needs to be encrypted, the data owner can quickly obtain the final ciphertext based on the offline encryption result.

[0062] When a data user DU, whose access control policy is in effect, wants to decrypt the ciphertext, they need to delegate most of the decryption work to a decryption agent. To ensure the agent remains unaware of the final plaintext, an auxiliary key needs to be generated for the agent. DU randomly selects a number z∈Z. p And calculate based on its own key D'=D (1 / z) Combined auxiliary keys It is then sent to the decryption service provider DSP via a secure channel.

[0063] After receiving a request from data user DU, the decryption agent DSP first verifies whether the user meets the access control policy. It then iteratively determines the next child node based on whether the attribute set S contains a non-terminal node with that attribute. If the access control policy is not met, a termination flag (failure) is obtained, and decryption stops. If the policy is met, decryption continues, and the process is repeated sequentially. Semi-decrypted ciphertext The decryption result is then sent to the data user DU via a secure channel. It can be seen that because the auxiliary key obtained by the decryption agent DSP is embedded with the secret z by the data user, the DSP cannot know the final decryption result, but it handles all the bilinear pairing operations, eliminating the need for subsequent complex calculations by the data user DU.

[0064] Finally, data user DU calculates the symmetric key K based on the semi-decrypted ciphertext. SE =H(CT') z )=H(e(g,g) αs And decrypt using a symmetric key to obtain the plaintext m = SE.Dec(K). SE C SE At this point, the data user has obtained the final plaintext securely and efficiently.

[0065] The embodiments described above are merely illustrative of specific implementations of the present invention and should not be construed as limiting the scope of the invention. Those skilled in the art can make modifications or improvements to the technical solutions created by the present invention without departing from the concept of the invention, and these modifications and improvements all fall within the scope of the present invention.

Claims

1. A lightweight attribute-based encryption method based on OBDD access structure, characterized in that: The encryption algorithm is split into an offline encryption algorithm and an online encryption algorithm, and the decryption algorithm is split into an auxiliary key generation algorithm, an outsourcing decryption algorithm and a local decryption algorithm, and comprises the following steps: S1. System initialization algorithm Setup(ξ, U)→(PK, MSK): executed by the authorized center CA, input is a security parameter ξ and an attribute set U, output is a public parameter PK which is disclosed, and a master key MSK which is kept secret by the authorized center CA; S2. User key generation algorithm executed by the authority center CA, inputting master key MSK, public parameter PK, user attribute set S, outputting corresponding user private key SK S , user private key SK S is sent to the user through a secure channel; S3. Offline encryption algorithm Executed by the data owner DO, input is the public parameter PK, output is the main ciphertext module pool And the corresponding sub-ciphertext module pool Offline state operation, irrelevant to the actual ciphertext, saved locally after calculation S4. Online encryption algorithm Online.Encrypt(PK, IT, OBDD, m)→CT: executed by the data owner DO, input is public parameter PK, access control structure OBDD, main and auxiliary ciphertext module pool , plaintext m, output is ciphertext CT, uploaded to the cloud service provider SSP; S5. Auxiliary key generation algorithm Executed by the data user DU, input is the user private key , a random number z, output is the auxiliary key The auxiliary key is sent to the decryption service provider DSP over a secure channel; S6. Outsourcing decryption algorithm : Performed by the outsourcing decryption service, input is ciphertext CT, set of user attributes S, auxiliary key , output semi-decrypted ciphertext ; S7. Local decryption algorithm : performed by data user DU, input is semi-decrypted ciphertext , symmetric ciphertext , generates helper key 's secret z, outputs plaintext m; The step S3 specifically comprises the following steps: S31. Data owner DO selects a random number in offline state According to public parameter PK , , S32. S31 is executed multiple times, and a main ciphertext module pool is formed with the secret s as a key and the main and auxiliary ciphertext modules as values sub-ciphertext module pool and saved locally; The step S4 specifically comprises the following steps: S41. The data owner DO randomly selects a set of main and auxiliary ciphertext modules, and obtains Computing the symmetric key , the symmetric encryption of the plaintext m is obtained , S42. Assuming that the number of valid paths from the root node to the terminal node of the OBDD access structure is n, the valid path set R is expressed as , for each path , calculate , obtain from the ciphertext module, wherein the set I represents the attribute set involved in the access structure, and the set U represents the attribute universe, S43. Data owner DO combines the ciphertexts and uploads to cloud service provider SSP; The step S6 specifically comprises the following steps: S61. The outsourcing decryption service provider DSP constructs an ordered decision diagram (V, E, id) according to the OBDD access structure in the ciphertext, S62. From the root node, a non-terminal node is determined according to whether the attribute set S contains the attribute, if i is in S, the high child node is turned to along high(v); otherwise, the low child node is turned to along low(v), S63. S62 is repeatedly executed until the terminal node is turned to, if the terminal node is 1, iteration is terminated, and a valid path Rt is obtained, otherwise, failure is output, thus, a valid path or a termination identifier is obtained, S64. Select whether to perform subsequent calculation according to the result of S63, if output failure, stop decryption, if output valid path Rt, calculate , S65. A semi-decrypted ciphertext is calculated , and sent to the data user DU through a secure channel.

Images