Ciphertext policy-based medical data access control system and method

Abstract

The present application relates to a ciphertext policy-based medical data access control system and method, belonging to the field of information security technology. The method comprises the following steps: S1: initializing the ciphertext policy-based medical data access control system; S2: key generation and distribution; S3: group key generation; S4: data encryption; S5: data decryption; S6: key update; S7: ciphertext update. First, by ensuring the privacy and security of patient data, the trust of users in the medical system is enhanced. Second, the risk of medical data leakage is reduced, ensuring the confidentiality of data. At the same time, the problem of revocation management after the user exits the platform is solved, maintaining the integrity of the system. In addition, by improving the encryption and decryption efficiency and realizing flexible and secure data sharing, the convenience and cooperation of medical services are improved. And it lays a solid foundation for the development of the intelligent medical industry, promotes the safe sharing and application of medical data.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security and relates to a medical data access control system and method based on ciphertext strategy. Background Art

[0002] Since the concept of cloud computing took hold in China, practitioners in the internet and IT industries have been paying close attention to it, attempting to translate their findings into practical applications while also exploring its potential applications. With my country's economic development and industrial transformation and upgrading, the trend toward digitalization, networking, and intelligentization is posing challenges to an increasing number of businesses. Cloud computing presents enormous development opportunities, providing Chinese companies with low-cost, convenient, highly reliable, secure, and controllable digital infrastructure support services. Consequently, cloud computing technology, through the provision of electronic medical records and telemedicine, is enriching medical diagnosis and treatment options, breaking the limitations of traditional medical care models and enhancing the informationization of smart healthcare platforms.

[0003] Because the personal information collected by smart medical network platform systems involves a large amount of user privacy, better data security measures are needed. If traditional public-key encryption is used, different ciphertexts must be generated for different users and data can only be shared at a coarse-grained level. However, using attribute-based encryption achieves one-to-many encryption and fine-grained access control. Patients collect health indicator information and transmit it to the cloud platform. Authorized personnel, including doctors, can decrypt and download health indicator information through the medical cloud to promptly understand the patient's symptoms and make a diagnosis. Because the data involves patient privacy, other patients and other personnel with access rights cannot see the patient's specific data content, so data access control for data downloaders is particularly critical. Under the premise of strengthening patient access control and strictly protecting patient privacy, attribute encryption based on ciphertext strategies is considered a solution.

[0004] The Key-Policy Attribute-Based Encryption (KP-ABE) scheme proposed by Goyal et al. in 2006 and the Cipher-Policy Attribute-Based Encryption (CP-ABE) scheme proposed by Bethencourt et al. in 2007 are two important milestones in the field of attribute-based encryption. These encryption schemes provide more fine-grained control over data access, allowing only users who meet specific attributes to decrypt data.

[0005] KP-ABE: In this scheme, ciphertext is associated with attributes. The user's private key is associated with an access policy, and the user can decrypt the data only if the attributes in the ciphertext satisfy this policy.

[0006] CP-ABE: In contrast to KP-ABE, CP-ABE allows the party encrypting data to specify the roles that can decrypt it. This means that the ciphertext is associated with an access policy, while the user's private key is associated with their attributes. The user can decrypt the data only if their attributes satisfy the access policy in the ciphertext. This solution better meets the control requirements of data owners in real-world applications.

[0007] However, traditional attribute-based encryption schemes have some disadvantages:

[0008] Privacy Leakage Risk: Traditional attribute-based encryption schemes typically incorporate attribute sets carrying sensitive user information directly into the access structure without hiding them. This means that simply by observing the access structure, an attacker may be able to infer certain sensitive user information. Attribute Revocation Issue: In practical applications such as smart medical network platforms, users may exit the platform, requiring the revocation of their attributes. However, if an attribute is shared by multiple users, revoking that attribute for any one user will affect all other users who have not revoked it. This is because traditional attribute-based encryption schemes do not provide fine-grained control over the revocation of shared attributes.

[0009] The revocation mechanism in the ABE system is designed to ensure the security of the system and the privacy of users. Revocation can be divided into two types: user revocation and attribute revocation. User revocation: This type of revocation is for a specific user. When a user no longer needs to access data or their access rights are terminated, the system will revoke the user's access rights. This type of revocation only affects the revoked user, and the access rights of other users will not be affected. Attribute revocation: Attribute revocation involves the user's attributes, not specific users. In some cases, users may lose certain attributes, which may be related to their roles, qualifications, or other characteristics. When these attributes change, the system needs to update the user's access rights accordingly. Attribute revocation can be more flexible because it can revoke any attribute based on actual needs, rather than just the access rights of specific users.

[0010] Existing attribute-based encryption schemes may not be sufficient to protect user privacy in certain high-security scenarios. In particular, in systems involving a large number of users, when user attributes change, their access permissions need to be modified promptly and effectively. Failure to do so could lead to unauthorized data access or leakage, threatening system security.

[0011] Therefore, research on attribute-based encryption mechanisms that support policy hiding and attribute revocation has important theoretical and practical value. By hiding policies, attackers can be prevented from inferring sensitive user information by observing access policies. Furthermore, by providing an attribute revocation mechanism, the system can promptly update user access permissions when their attributes change, thereby maintaining system security and user privacy. Summary of the Invention

[0012] In view of this, the purpose of the present invention is to provide a medical data access control system and method based on ciphertext policy, so as to solve the technical problem that the traditional attribute-based encryption scheme provides fine-grained control over data access but has insufficient privacy protection and attribute revocation, resulting in the user's sensitive information being inferred by attackers due to improper exposure of access policies, and the attribute revocation operation may also affect other non-revokated users.

[0013] In order to achieve the above object, the present invention provides the following technical solutions:

[0014] A medical data access control system based on ciphertext policy, including attribute authority AA, data holder DO, data user DU and medical cloud MC;

[0015] The attribute authority AA establishes, revokes, and changes the attributes available in the entire system and runs the initialization algorithm to generate public keys and master keys. The attribute authority AA is fully trustworthy and will run the private key generation algorithm to distribute different private keys to users with different permissions;

[0016] The data holder DO uses a data encryption algorithm to encrypt personal privacy information and uploads the encrypted data to the medical cloud MC for hosting and storage. The user type that obtains the data is the user defined by the data holder DO in the access structure and embedded in the ciphertext;

[0017] The data user DU obtains the encrypted uploaded private data from the medical cloud MC, and uses the private key distributed by the attribute authority AA to obtain the ciphertext information embedded in the access structure published by the data holder DO for decryption;

[0018] The medical cloud MC accepts the electronic health data uploaded by the data holder DO and stores it in trust. The data user DU uses the search function of the medical cloud MC to find the required data and uses identity attributes to perform verification calculations to obtain the data.

[0019] A medical data access control method based on ciphertext strategy, the method comprising the following steps:

[0020] S1: Initialize the medical data access control system based on the ciphertext strategy: including inputting the security parameter λ into the initialization algorithm, outputting the public parameter PK for public use and the master key MSK for auxiliary key generation, Setup(1 λ )→(PK,MSK);

[0021] The medical data access control system based on ciphertext strategy includes attribute authority AA, data holder DO, data user DU and medical cloud MC;

[0022] The attribute authority AA establishes, revokes, and changes the attributes available in the entire system and runs the initialization algorithm to generate public keys and master keys. The attribute authority AA is fully trustworthy and will run the private key generation algorithm to distribute different private keys to users with different permissions;

[0023] The data holder DO uses a data encryption algorithm to encrypt personal privacy information and uploads the encrypted data to the medical cloud MC for hosting and storage. The user type that obtains the data is the user defined by the data holder DO in the access structure and embedded in the ciphertext;

[0024] The data user DU obtains the encrypted uploaded private data from the medical cloud MC, and uses the private key distributed by the attribute authority AA to obtain the ciphertext information embedded in the access structure published by the data holder DO for decryption;

[0025] The medical cloud MC accepts the electronic health data uploaded by the data holder DO and stores it in trust. The data user DU uses the search function of the medical cloud MC to find the required data and uses identity attributes for verification calculation to obtain the data;

[0026] S2: Key generation and distribution, including inputting the public parameter PK, master key MSK and attribute set S into the key generation algorithm, and outputting the user private key sk s And distributed by the attribute authority AA,KeyGen(PK,MSK,S)→sks;

[0027] S3: Group key generation, including the group key generation algorithm, which takes attribute x as input and outputs a binary state tree given a fully trusted AA. And the group key AGK corresponding to attribute x,

[0028]

[0029] S4: Data encryption: The encryption algorithm takes as input the public parameter PK, the plaintext M, and the access policy A = (A, ρ, T), and outputs the encrypted ciphertext CT corresponding to M embedded in A, Encrypt(PK, M, A) → CT; the re-encryption algorithm takes as input the encrypted ciphertext CT and a series of group keys {AGK}, and outputs the re-encrypted ciphertext CT', ReEncrypt(CT, {AGK}) → CT';

[0030] S5: Data decryption: including decryption algorithm through input and then encrypted ciphertext CT', PK and sk s , check the verification value after the attribute set S and A match, if the verification value meets the conditions, return the decrypted value plaintext M; if the check value does not meet the conditions, output ⊥ to stop the algorithm running,

[0031] S6: Key update: includes the key update algorithm by inputting the attributes to be revoked u, sk s And the updated AGK u ', output the new sk s ', in the scenario of attribute revocation, the user runs the key update algorithm to update the key,

[0032] KeyUpdate(sk s ,u,AGK u ')→sk s ';

[0033] S7: Ciphertext update: includes the ciphertext update algorithm by inputting the re-encryption result CT' and the group key AGK u 'And the attribute u to be revoked, output the updated ciphertext CT * ,The attribute authority runs the ciphertext update algorithm to update the ciphertext and realize the attribute revocation,CTUpdate(CT',u,AGK u ')→CT * .

[0034] Furthermore, the system initialization in S1 specifically includes:

[0035] The attribute authority AA selects the security parameter λ and generates Where G represents the generator, G T represents the multiplication group, Represents mapping, N represents a large prime number; select attribute domain U=Z N , where Z N is a set of non-negative integers modulo N, execute the initialization Setup(1 λ ):The attribute authority AA generates random parameters for calculation: α, ɑ∈Z N , The master key MSK generated by calculating the public parameter PK and the auxiliary key is expressed as:

[0036]

[0037] MSK=α (2).

[0038] Furthermore, the key is generated and distributed, specifically including: the attribute authority AA selects parameters: random non-negative integer t∈Z N ,group Random numbers in Any attribute in the attribute set S

[0039] Key generation involves inputting the public parameter PK, the master key MSK and the attribute set S into the key generation algorithm, and outputting the user private key sk s and distributed by the attribute authority AA;

[0040] Key distribution KeyGen(PK,MSK,S): Take the public parameter PK, the master key MSK and the attribute set S as input, and perform the following calculation to obtain the temporary keys T and T", so as to calculate the end user private key: T = g t κ, T" = g α g at γ, for each i∈Ι S : Temporary key The attribute authority AA then organizes and generates the user's private key sk S , expressed as:

[0041]

[0042] in, Indicates that The calculated T i A collection of .

[0043] Furthermore, in S3, the group key generation specifically includes: the attribute authority AA selects parameters: a random non-negative integer t∈Z N ,group Random numbers in Any attribute in the attribute set S

[0044] Group key generation AttrGroupKeyGen(x): Given a fully trusted AA with attribute x, the key encrypted key tree KEK is in the form of a binary tree and each tree represents a user. The information on the node is used to update the private key. For unrevoked users, the node and path information is used to update their own sk S , decrypt; in the KEK tree, any attribute u i∈U is assigned to the leaf node, and any node v j Holds a random key KEK j ; The path key is the key passed from each leaf node to the root node; the key set of the path node is the unique path key of each member, expressed as PK i ; For any U j , which has a minimum covering set on the KEK tree, covering all leaf nodes.

[0045] Furthermore, in S4, data encryption specifically includes:

[0046] Encrypt(PK,M,Α): Given a message M, public parameters PK, a mapping ρ from {1,2,...,l} to the domain of attribute names, there is an LSSS-related access policy Α=(A,ρ,Τ) of the l×n matrix and a vector representing the attribute value Select two vectors in the attribute name space, respectively from the finite field Z p Randomly selected variables v2,...,v n and v2',...,v n ', and the shares to be shared s and s', expressed as:

[0047]

[0048]

[0049] Select 2l+2 random subgroup element d1, d 1,x , Where x∈{1,2,…,l}; Encrypt any selected message Any hash function H:G→Z p * , where H represents the hash function itself, G represents the input domain, which is the set domain that the hash function accepts input, and Z p * The output domain is the set or domain of hash values ​​generated by the hash function, which is an additive cyclic group in the integer domain. The ciphertext is calculated as follows:

[0050]

[0051] in,

[0052]

[0053] Among them, H(M) and Represented as the message M and As input, a set of generated hash values;

[0054]

[0055]

[0056]

[0057]

[0058]

[0059]

[0060] ReEncrypt(CT,{AGK}): For any Α=(A,ρ,Τ), there is any attribute ρ(i) and a group key AGK ρ(i) Related, re-encryption is to use AGK to generate CT by encryption algorithm ρ(i) Re-encrypt and get:

[0061]

[0062] in,

[0063]

[0064]

[0065] Furthermore, in S5, data decryption specifically includes:

[0066] Decrypt(PK,CT',sk s ):The user encrypts the ciphertext CT', PK and sk according to the given s , for any ρ(x)∈S, use the specific path key to recover AGK ρ(x) , and finally calculate the temporary key

[0067] make And there exists a subset X = {x:ρ(x)∈S}, select a constant {ω x ∈Z p} x∈X Satisfaction proof {λ x} is the condition of effective share, and there is ∑ x∈X ω x λ x =s, the decryption function is calculated as:

[0068]

[0069] Get the part of M, expressed as:

[0070]

[0071] Among them, T ρ(x) It means that for any A = (A, ρ, Τ), there is any attribute ρ(x) associated with a temporary key T;

[0072] like Then the message M is returned, indicating that the data user DU meets the conditions and is allowed to use sk s To decrypt.

[0073] Furthermore, in S6, the key update specifically includes:

[0074] KeyUpdate(id,sk s ,u,AGK' u ): For every v∈G u , used by a fully trusted AA {KEK v AGK u 'After encryption, Submit to the user who has not expired yet; Assume that u is the attribute to be revoked, and ρ(x')=u; The unrevoked user uses a random key KEK from Recover AGK u ',in in, Indicates the minimum set of users that are not on the revocation list, PATH gid Represents the path from the root node to the target node; the user's private key is updated through the revocation list R' as follows, expressed as:

[0075]

[0076]

[0077]

[0078] Furthermore, in S7, the ciphertext update specifically includes:

[0079] Ciphertext update CTUpdate(CT',u,AGK u '): Select two random vectors v'=(s',v2',...,v n ”) T and

[0080] The algorithm updates CT' to CT * , expressed as:

[0081]

[0082] in,

[0083]

[0084]

[0085]

[0086]

[0087]

[0088]

[0089] The beneficial effects of the present invention are:

[0090] First, this invention effectively hides attribute values ​​by separating attribute names from their corresponding content. While ensuring more secure data sharing and efficient hiding of attribute values, it also requires, in some cases, for user exit and join operations, to disable some of a user's attributes to achieve revocation. In this solution, a fully trusted third-party generates a corresponding group key based on user attributes, and stores the attributes in the form of a binary tree. This improves the efficiency of the encryption and decryption stages while maintaining the security of the solution.

[0091] Second, by adopting the attribute-based encryption mechanism, the present invention allows doctors and other authorized personnel to decrypt and download patients' health indicator information while protecting data privacy, thereby ensuring the security and privacy of patients' personal information.

[0092] Third, the present invention can effectively hide attribute values ​​by separating attribute names and corresponding contents, thereby reducing the possibility of data leakage.

[0093] Fourth, the present invention proposes a revocation mechanism that can achieve the revocation effect by invalidating some of the user's attributes. This can prevent users from still being able to access medical data after logging out of the platform, ensuring data security.

[0094] Fifth, the present invention uses a binary tree format to store attributes, and a trusted third-party generates a group key based on user attributes. This approach improves the efficiency of encryption and decryption without compromising security, allowing authorized personnel to access required data more quickly.

[0095] Sixth, the present invention allows users to share data more securely while efficiently hiding attribute values. This provides users with a more flexible data sharing method that protects personal privacy while meeting the needs of medical collaboration.

[0096] Other advantages, objects, and features of the present invention will be described in part in the following description and, in part, will be apparent to those skilled in the art upon examination of the following or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below with reference to the accompanying drawings, in which:

[0098] Figure 1 This is a system architecture diagram of the present invention;

[0099] Figure 2 This is a timing diagram of the process of the present invention. DETAILED DESCRIPTION

[0100] The following describes the embodiments of the present invention by means of specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0101] Among them, the accompanying drawings are only for illustrative purposes and represent only schematic diagrams rather than actual pictures, and should not be understood as limiting the present invention. In order to better illustrate the embodiments of the present invention, some parts of the accompanying drawings may be omitted, enlarged or reduced, and do not represent the dimensions of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions may be omitted in the accompanying drawings.

[0102] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if there are terms such as "upper", "lower", "left", "right", "front", "back", etc. indicating directions or positional relationships, they are based on the directions or positional relationships shown in the drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operate in a specific direction. Therefore, the terms describing the positional relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0103] See also Figures 1 and 2, which is a medical data access control system and method based on ciphertext strategy.

[0104] A medical data access control system based on ciphertext strategy, including attribute authority AA, data holder DO, data user DU and medical cloud MC;

[0105] The attribute authority AA establishes, revokes, and changes the attributes available in the entire system and runs the initialization algorithm to generate public keys and master keys. The attribute authority AA is fully trusted and will run the private key generation algorithm to distribute different private keys to users with different permissions.

[0106] The data holder DO uses a data encryption algorithm to encrypt personal privacy information and uploads the encrypted data to the medical cloud MC for hosting and storage. The user type that obtains the data is the user defined by the data holder DO in the access structure and embedded in the ciphertext;

[0107] The data user DU obtains the encrypted uploaded private data from the medical cloud MC. The user uses the private key distributed by the attribute authority AA to obtain the ciphertext information embedded in the access structure published by the data holder DO for decryption;

[0108] The medical cloud MC accepts the electronic health data uploaded by the data holder DO and stores it in trust. The data user DU uses the search function of the medical cloud MC to find the required data and uses identity attributes for verification calculation to obtain the data.

[0109] The medical data access control method based on ciphertext strategy includes five stages: system initialization stage, key generation and distribution stage, data encryption stage, data decryption stage and attribute revocation stage.

[0110] 1) System initialization phase: First, AA selects the security parameter λ and generates Where G represents the generator, G T represents the multiplication group, Represents mapping, N represents a large prime number; select attribute domain U=Z N , where Z N is a set of non-negative integers modulo N, execute the initialization Setup(1 λ ):The attribute authority AA generates random parameters for calculation: α, ɑ∈Z N , The post-operation generates the PK for public use and the MSK that helps generate the private key, expressed as:

[0111]

[0112] MSK=α (2).

[0113] 2) Key generation and distribution phase: Attribute authority AA selects parameters: random non-negative integer t∈Z N ,group Random numbers in Any attribute in the attribute set S

[0114] Key generation involves inputting the public parameter PK, the master key MSK and the attribute set S into the key generation algorithm, and outputting the user private key sk s and distributed by the attribute authority AA;

[0115] Key distribution KeyGen(PK,MSK,S): Take the public parameter PK, the master key MSK and the attribute set S as input, and perform the following calculation to obtain the temporary keys T and T", so as to calculate the end user private key: T = g t κ, T" = g α g at γ, for each i∈Ι S : Temporary key Finally, AA organizes and generates the user private key sk in the following form S ,

[0116] Group key generation AttrGroupKeyGen(x): Given a fully trusted AA with attribute x. First, the key encryption key tree (KEKtree) is a binary tree and each tree represents a user. The information on the node is used to update the private key. For users who have not been revoked, they can use the node and path information to update their own sk S , in order to achieve the purpose of decryption. In the KEK tree, any attribute u i ∈U is assigned to the leaf node, and any node v j Holds a random key KEK j The path key is the key passed from each leaf node to the root node. The key set of the path node is the path key unique to each member, called PK i For any U j , which has a minimum covering set on the KEK tree that can cover all leaf nodes.

[0117] 3) Data encryption stage: The data holder uses PK and M as input and uses the algorithms Encrypt and ReEncrypt to encrypt information while setting the access policy Α=(A,ρ,Τ).

[0118] Encrypt(PK,M,Α): Given a message M, public parameters PK, a mapping ρ from {1,2,...,l} to the domain of attribute names, there is an LSSS-related access policy Α=(A,ρ,Τ) of the l×n matrix and a vector representing the attribute value Then, it selects two vectors on the attribute name space, respectively, from the finite field Z p Randomly selected variables v2,...,v n and v2',...,v n ', and the shares to be shared s and s', expressed as: and Select 2l+2 random subgroup element d1, d 1,x , where x∈{1,2,...,l}. Finally, Encrypt selects any message Any hash function H:G→Z p * , where H represents the hash function itself, G represents the input domain, which is the set domain that the hash function accepts input, and Z p * The output domain is the set or domain of hash values ​​generated by the hash function, which is an additive cyclic group in the integer domain. The ciphertext is calculated as follows:

[0119]

[0120] in,

[0121]

[0122] Among them, H(M) and Represented as the message M and As input, a set of generated hash values;

[0123]

[0124]

[0125]

[0126]

[0127]

[0128]

[0129] ReEncrypt(CT,{AGK}): For any Α=(A,ρ,Τ), there is any attribute ρ(i) and a group key AGK ρ(i) Related, the re-encryption process is to use AGK to generate CT by encryption algorithm. ρ(i) After re-encryption, we finally get:

[0130]

[0131] in,

[0132] 4) Data decryption phase: Data users can successfully decrypt the ciphertext only when the attribute set corresponding to the user meets the conditions embedded in the access policy.

[0133] Decrypt(PK,CT',sk s ):The user encrypts the ciphertext CT', PK and sk according to the given s , for any ρ(i)∈S, use the specific path key to recover AGK ρ(x) , and finally calculate the temporary key

[0134] make And there exists a subset X = {x:ρ(x)∈S}, select a constant {ω x ∈Z p} x∈X Satisfaction proof {λ x} is the condition of effective share, and there is ∑ x∈X ω x λ x =s, the decryption function is calculated as:

[0135]

[0136] Get the part of M, expressed as:

[0137]

[0138] Among them, T ρ(x) It means that for any A = (A, ρ, Τ), there is any attribute ρ(x) associated with a temporary key T;

[0139] Ultimately, if Then the message M is returned, indicating that DU meets the conditions and is allowed to use sk s To decrypt.

[0140] 5) Attribute revocation phase: The revocation information comes from the binary tree and revocation list, and is then encrypted in the encryption phase. It is a separate part of the ciphertext. Only the ciphertext related to the revocation information needs to be updated. Compared with key updates, the ciphertext only needs to be updated once, while the keys of all unrevoked users need to be updated, which will result in a large overhead for key updates. For each v∈G u , used by a fully trusted AA {KEK v AGK' u After encryption, Submit it to the user who has not yet expired. Finally, two functions KeyUpdate and CTUpdate are given to implement attribute-level revocation.

[0141] KeyUpdate(id,sk s ,u,AGK' u ): For every v∈G u , used by a fully trusted AA {KEK v AGK u 'After encryption, Submit to the user who has not expired yet; assuming u is the attribute to be revoked, ρ(x')=u. The unrevoked user uses a random key KEK from Recover AGK u ',in in, Indicates the minimum set of users that are not on the revocation list, PATH gid Represents the path from the root node to the target node; the user's private key is updated through the revocation list R' as follows, expressed as:

[0142]

[0143] Ciphertext update CTUpdate(CT',u,AGK u '): Select two random vectors v'=(s',v2',...,v n ”) T and

[0144] The algorithm updates CT' to CT * And the form is as follows:

[0145]

[0146] in,

[0147]

[0148]

[0149]

[0150]

[0151]

[0152]

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions, which should all be included in the scope of the claims of the present invention.

Claims

1. A medical data access control method based on ciphertext strategy, characterized by: The method comprises the following steps: S1: Initialize the medical data access control system based on the ciphertext strategy: including inputting the security parameter λ into the initialization algorithm, outputting the public parameter PK for public use and the master key MSK for auxiliary key generation, Setup(1 λ )→(PK,MSK); The medical data access control system based on ciphertext strategy includes attribute authority AA, data holder DO, data user DU and medical cloud MC; The attribute authority AA establishes, revokes, and changes the attributes available in the entire system and runs the initialization algorithm to generate public keys and master keys. The attribute authority AA is fully trustworthy and will run the private key generation algorithm to distribute different private keys to users with different permissions; The data holder DO uses a data encryption algorithm to encrypt personal privacy information and uploads the encrypted data to the medical cloud MC for hosting and storage. The user type that obtains the data is the user defined by the data holder DO in the access structure and embedded in the ciphertext; The data user DU obtains the encrypted uploaded private data from the medical cloud MC, and uses the private key distributed by the attribute authority AA to obtain the ciphertext information embedded in the access structure published by the data holder DO for decryption; The medical cloud MC accepts the electronic health data uploaded by the data holder DO and stores it in trust. The data user DU uses the search function of the medical cloud MC to find the required data and uses identity attributes for verification calculation to obtain the data; S2: Key generation and distribution, including inputting the public parameter PK, master key MSK and attribute set S into the key generation algorithm, and outputting the user private key sk s And distributed by the attribute authority AA, KeyGen(PK,MSK,S)→sk s ; S3: Group key generation, including the group key generation algorithm, which takes attribute x as input and outputs a binary state tree KEK given a fully trusted AA. TREEx And the group key AGK corresponding to attribute x, AttrGroupKeyGen(x)→(AGK,KEK TREEx ); S4: Data encryption: including encryption algorithm by inputting public parameters PK, plaintext M and access policy A * =(A,ρ,Τ), where T represents the temporary key; outputs the encrypted ciphertext CT corresponding to M embedded in A, Encrypt(PK,M,Α)→CT; the re-encryption algorithm takes the encrypted ciphertext CT and a series of group keys {AGK} as input and outputs the re-encrypted ciphertext CT', ReEncrypt(CT,{AGK})→CT'; S5: Data decryption: including decryption algorithm through input and then encrypted ciphertext CT', PK and sk s , check the verification value after the attribute set S and A match, if the verification value meets the conditions, return the decrypted value plaintext M; if the check value does not meet the conditions, output Stop the algorithm, S6: Key update: includes the key update algorithm by inputting the attributes to be revoked u, sk s And the updated AGK u ', output the new sk s ', in the scenario of attribute revocation, the user runs the key update algorithm to update the key, KeyUpdate(sk s ,u,AGK u ')→sk s '; S7: Ciphertext update: includes the ciphertext update algorithm by inputting the re-encryption result CT' and the group key AGK u 'And the attribute u to be revoked, output the updated ciphertext CT * ,The attribute authority runs the ciphertext update algorithm to update the ciphertext and realize the attribute revocation,CTUpdate(CT',u,AGK u ')→CT * .

2. The medical data access control method based on ciphertext policy according to claim 1 is characterized in that: The system initialization in S1 specifically includes: The attribute authority AA selects the security parameter λ and generates Where G represents the generator, G T represents the multiplication group, Represents mapping, N represents a large prime number; select attribute domain U=Z N , where Z N is a set of non-negative integers modulo N, execute the initialization Setup(1 λ ):The attribute authority AA generates random parameters for calculation: α, ɑ∈Z N , The master key MSK generated by calculating the public parameter PK and the auxiliary key is expressed as: MSK=α (2).

3. The medical data access control method based on ciphertext policy according to claim 2, characterized in that: In S2: key generation and distribution, specifically including: attribute authority AA selects parameters: random non-negative integer t∈Z N ,group Random numbers in Any attribute in the attribute set S Key generation involves inputting the public parameter PK, the master key MSK and the attribute set S into the key generation algorithm, and outputting the user private key sk s and distributed by the attribute authority AA; Key distribution KeyGen(PK,MSK,S): Take the public parameter PK, the master key MSK and the attribute set S as input, and perform the following calculation to obtain the temporary keys T and T", so as to calculate the end user private key: T = g t κ, T" = g α g αt γ, for each i∈Ι S : Temporary key The attribute authority AA then organizes and generates the user's private key sk S , expressed as: in, Indicates that The calculated T i A collection of .

4. The medical data access control method based on ciphertext policy according to claim 3 is characterized by: In S3, the group key generation specifically includes: the attribute authority AA selects parameters: a random non-negative integer t∈Z N ,group Random numbers in Any attribute in the attribute set S Group key generation AttrGroupKeyGen(x): Given a fully trusted AA with attribute x, the key encrypted key tree KEK is in the form of a binary tree and each tree represents a user. The information on the node is used to update the private key. For unrevoked users, the node and path information is used to update their own sk S , decrypt; in the KEK tree, any attribute u i ∈U is assigned to the leaf node, and any node v j Holds a random key KEK j ; The path key is the key passed from each leaf node to the root node; the key set of the path node is the unique path key of each member, expressed as PK i ; For any U j , which has a minimum covering set on the KEK tree, covering all leaf nodes.

5. The medical data access control method based on ciphertext policy according to claim 4 is characterized in that: In S4, data encryption specifically includes: Encrypt(PK,M,Α): Given a message M, public parameters PK, a mapping ρ from {1,2,...,l} to the domain of attribute names, there is an access policy Α associated with the LSSS of the l-by-n matrix * =(A,ρ,Τ) and the vector representing the attribute value Select two vectors in the attribute name space, respectively from the finite field Z p Randomly selected variables v2,...,v n and v2',...,v n ', and the shares to be shared s and s', expressed as: Select 2l+2 random subgroup element d1, d 1,x , Where x∈{1,2,...,l}; Encrypt any selected message Any hash function H:G→Z p * , where H represents the hash function itself, G represents the input domain, which is the set domain that the hash function accepts input, and Z p * The output domain is the set or domain of hash values ​​generated by the hash function, which is an additive cyclic group in the integer domain. The ciphertext is calculated as follows: in, Among them, H(M) and Represented as the message M and As input, a set of generated hash values; ReEncrypt(CT,{AGK}): For any Α * =(A,ρ,Τ) has any one of the attributes ρ(i) and a group key AGK ρ(i) Related, re-encryption is to use AGK to generate CT by encryption algorithm ρ(i) Re-encrypt and get: in, 6. The medical data access control method based on ciphertext policy according to claim 5 is characterized in that: In S5, data decryption specifically includes: Decrypt(PK,CT',sk s ):The user encrypts the ciphertext CT', PK and sk according to the given s , for any ρ(x)∈S, use the specific path key to recover AGK ρ(x) , and finally calculate the temporary key make And there exists a subset X = {x:ρ(x)∈S}, select a constant {ω x ∈Z p } x∈X Satisfaction proof {λ x } is the condition of effective share, and there is ∑ x∈X ω x λ x =s, the decryption function is calculated as: Get the part of M, expressed as: Among them, T ρ(x) For any A * =(A,ρ,Τ) has any attribute ρ(x) associated with a temporary key T; like Then the message M is returned, indicating that the data user DU meets the conditions and is allowed to use sk s To decrypt.

7. The medical data access control method based on ciphertext policy according to claim 6, characterized in that: In S6, the key update specifically includes: KeyUpdate(id,sk S ,u,AGK' u ): For every v∈G u , used by a fully trusted AA {KEK v AGK u 'After encryption, Submit to the user who has not expired yet; Assume that u is the attribute to be revoked, and ρ(x')=u; The unrevoked user uses a random key KEK from Recover AGK u ',in in, Indicates the minimum set of users that are not on the revocation list, PATH gid Represents the path from the root node to the target node; the user's private key is updated through the revocation list R' as follows, expressed as:

8. The medical data access control method based on ciphertext policy according to claim 7 is characterized in that: In S7, the ciphertext update specifically includes: Ciphertext update CTUpdate(CT',u,AGK u '): Select two random vectors v'=(s',v2',...,v n ”) T and The algorithm updates CT' to CT * , expressed as: in,

Images