A lightweight sensitive data access control method

Abstract

The present invention discloses a lightweight sensitive data access control method, comprising: a system initialization step, generating public parameters; an encryption step, including two parts, symmetric encryption and attribute-based encryption, generating an access control tree according to an access control policy; embedding key material into the access control tree based on the Shamir secret sharing scheme; wherein the secret value of the root node is used to generate a key and an integrity verification key of a symmetric encryption algorithm, and the password share of the leaf node is used to generate an attribute ciphertext. In a decryption key generation step, a data user applies to an attribute authority for its attribute key, and the attribute authority generates a key for the attribute verified by the data user and sends it to the data user securely; in a decryption step, a user who complies with the access control policy uses its attribute key to recover a symmetric encryption key according to the access control tree, and decrypts and verifies the ciphertext data. The present invention is used for resource-constrained devices in an open network environment to control access to sensitive data.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer information security, and in particular relates to a lightweight sensitive data access control method. Background Art

[0002] Today is an era of the Internet of Everything. Our lives are inseparable from various IoT devices. In this open network environment, a large amount of personal information data is collected by service providers to provide personalized services. While enjoying the convenience brought by the IoT big data era, our personal privacy information security has also suffered unprecedented threats. A large amount of data information is collected and stored in the cloud, and this data information is not controlled by the user and may be leaked or abused without the user's knowledge. How to better protect the user's personal privacy in the era of the Internet of Everything is a hot topic in current research. One feasible method is to introduce an access control system in the system. At present, attribute-based encryption (ABE) is a mainstream ciphertext data access control model that can be used for access control of ciphertext data in cloud storage network environments.

[0003] Traditional ABE schemes are mostly built on bilinear pairing. When the number of attributes in the system increases, the computational and communication overhead in the encryption and decryption stages increases accordingly. In order to solve the problem of low efficiency of ABE, the current popular approach is to outsource decryption, that is, to migrate the heavy bilinear pairing calculation operations in the decryption stage to the proxy server for execution. Similarly, decryption is divided into two stages, which are calculated online and offline respectively. In addition, there are some methods that use lightweight cryptographic primitives to replace pairing schemes to design new ABE algorithms to improve efficiency.

[0004] There are a large number of resource-constrained IoT devices in an open network environment, such as smart phones, smart wearable devices, etc. When they use ABE to access sensitive data, they cannot use local hardware resources to efficiently complete the decryption task, and migrating the operation of the decryption stage to the proxy server will cause the problem of sensitive data leakage. Using an efficient ABE solution that can be executed on resource-constrained devices is a more reliable solution. To this end, the present invention designs a lightweight ciphertext policy attribute-based encryption algorithm for access control of sensitive data. Summary of the invention

[0005] To solve the above technical problems, the present invention proposes a lightweight sensitive data access control method, which can be used to perform secure access control on sensitive data in resource-constrained devices, has strong practicality, a wide range of applications, and is easy to promote.

[0006] To achieve the above object, the present invention provides a lightweight sensitive data access control method, comprising:

[0007] S1, global initialization step, the attribute authority AA performs initialization and generates public parameters Params;

[0008] S2, encryption step, the data owner DO generates an access control tree according to the access control policy, generates a secret random number t, and generates a data encryption key k according to the secret random number t and the system public key x and data integrity verification key k y , embed the secret random number t into the access control tree; select a secure symmetric encryption algorithm with the data encryption key k x Encrypt sensitive data M, select a secure hash function and use the data integrity verification key k y Calculate the message authentication code of sensitive data M;

[0009] S3, decryption key generation step, for the attribute set ω of the data user DU, the attribute authority generates an attribute key for each attribute in it, and the final attribute key is D, and the attribute key is securely sent to DU;

[0010] S4, decryption step, the data user DU that complies with the access control policy can recover the data encryption key and integrity verification key from the access control tree according to its own attribute key, decrypt the data ciphertext and verify the message integrity.

[0011] Optionally, the attribute authority AA is initialized to generate public parameters Params including:

[0012] Choose an elliptic curve E that meets the security requirements p (a, b), q are large prime numbers, a, b∈GF(p), and (4a 3 +27b 2 )modp≠0, assuming that the order of the elliptic curve that meets the security requirements is a large prime number q, the base point is G, and a security parameter n and a secure hash function h are selected: {0, 1} * →{0, 1} n ;

[0013] From a finite field modulo q Select a random number s from the list, calculate the system public key PK = sG; for each attribute a in the attribute space i , randomly selected Calculate P i =s i G, generate public parameters Params = {PK, P i , G, h, n}.

[0014] Optionally, the encryption step includes:

[0015] Step 1: The data owner DO generates an access control tree Γ according to the access control policy P, where R is the root node, Y is the set of leaf nodes, and each leaf node represents an attribute in the access control policy;

[0016] Step 2: The data owner DO secretly selects a random number Calculate encryption keys for sensitive data like Then reselect t until

[0017] Step 3: The data owner DO uses the Shamir secret sharing scheme to embed the secret random number t into the access control tree Γ; according to the threshold d of each node u in the access control tree, a (d-1)-order Lagrange interpolation polynomial q modulo q is constructed for the node u (x), where q R (0) = t, assuming that the threshold of the root node R is d, for its child nodes i∈{1,...,d},q i (0) = q R (i), and so on, each node j in the access control tree obtains the secret share q of each node in the access control tree. j (0);

[0018] Step 4: The data owner DO selects a lightweight symmetric encryption algorithm E, with k x As the key, the sensitive data M is encrypted to obtain the ciphertext C = E (k x , M), and at the same time calculate the message authentication code C′=h(k y ||M).

[0019] Optionally, encrypt the sensitive data obtained in step 2 Further output its CP-ABE ciphertext CT, including:

[0020] Assume that the attribute set corresponding to access policy P is S p , for each leaf node y∈Y in the access control structure, attr(y)∈S p , according to formula c y =q y (0)·P i and c y ′=q y (0) G calculates the corresponding attribute ciphertext c respectively y and c y ′, and output the CP-ABE ciphertext of the data encryption key

[0021] Optionally, the decryption key generation step includes: the data user DU requests the attribute key from the attribute authority AA, and the attribute authority AA generates a decryption key for each attribute a in the attribute set ω of the data user. i Calculate the attribute key d i , the decryption key output of the attribute set is D including:

[0022] For the attribute set ω of the data user DU, the attribute authority AA randomly selects Use formula d i =(s×s i -1 +h(r ω ))modq and d i ′=(s i ×h(r ω ))modq calculates and generates attribute keys The attribute key is replaced by the public key PK of the data user DU Encrypted with the attribute authority's private key SK AA After signing, it is sent to the data user DU, where PK DU is the public key of the data user DU; the data user DU receives the attribute key ciphertext and signature message Enc(D, PK DU )||sig(H(D),SK AA ) and then use the data user's private key SK DU Decrypt the ciphertext to obtain the attribute key D, and calculate the attribute key hash value H(D) and digital signature sig(H(D), SK AA )Verify the integrity of attribute key D.

[0023] Optionally, the decryption step includes: if the attribute set ω of the data user satisfies the access control policy P, the CP-ABE ciphertext CT of the data encryption key can be decrypted to recover k x , k y Then use k x Decrypt the ciphertext data C and use k y Verify the integrity of the data.

[0024] Optionally, the decryption step specifically includes:

[0025] The data user DU decrypts the CP-ABE ciphertext CT of the encryption key. During decryption, for each leaf node u, let i=attr(u), where i is the attribute corresponding to the node u; if attribute i is an attribute of the data user DU, i.e., i∈ω, then the attribute private key is used according to the formula

[0026] DecryptLeafNode(CT,D,i)=c i d i -c i 'd i '

[0027] =q y (0)·P i ·(s×s i -1 +h(r ω ))-q y (0)·G·s i ×h(r ω )=q i (0)PK

[0028] Perform decryption calculation to obtain the secret share value of the leaf node, otherwise Unable to perform decryption calculations;

[0029] For non-leaf node u, set the threshold to d, let ω u is the set of any d child nodes of node u, according to the formula

[0030]

[0031] Calculate the key share q corresponding to node u u (0) PK; When the algorithm recursively calculates to the root node, the decryption result of the data encryption key is obtained:

[0032] DecryptNode(CT, D, R) = q R (0)·PK=t·PK=(k x ′,k y ′);

[0033] For the sensitive data ciphertext C||C′, take the horizontal coordinate k x ′ decrypts C and obtains the plaintext M′=D(k x ′, C); according to M′ and k y 'Calculate C" = h(k y ||M), if C′=C″, the message is decrypted successfully and its integrity is maintained.

[0034] Technical effect of the invention: The present invention discloses a lightweight sensitive data access control method. For resource-constrained devices, a lightweight CP-ABE scheme is proposed based on the access control tree structure and the discrete logarithm problem on the elliptic curve. The scheme uses the scalar point multiplication operation on the elliptic curve to replace the bilinear pairing operation in the traditional scheme, which reduces the overall overhead of the scheme and verifies the data integrity while decrypting the data. The present invention can be used in resource-constrained IoT devices for secure access control, has strong practicality, a wide range of applications, and is easy to promote. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0036] Figure 1 This is a schematic diagram of the structure of lightweight sensitive data access control according to an embodiment of the present invention;

[0037] Figure 2 A flowchart of a lightweight sensitive data access control method according to an embodiment of the present invention;

[0038] Figure 3 The figure is a schematic diagram of a Shamir secret sharing scheme based on an access control tree according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0040] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0041] like Figure 1 As shown, in this embodiment, a structure of lightweight sensitive data access control is provided, including three entities: attribute authority (AA), data owner (DO), and data user (DU);

[0042] AA is used to manage the attributes in the system attribute space and issue attribute keys to data users DU according to their attributes;

[0043] The data owner DO sets the access control policy and uses the symmetric encryption algorithm to encrypt the sensitive data, and uses the proposed lightweight attribute-based encryption algorithm to encrypt the encryption key;

[0044] DU is any person who needs to use the data. Each DU gets the attribute key associated with their attribute and uses it to decrypt the sensitive data ciphertext.

[0045] like Figure 2 As shown, this embodiment provides a lightweight sensitive data access control method, including the following steps:

[0046] 1. The attribute authority AA is initialized and outputs public parameters Params;

[0047] 1.1 Select secp256k1 as the secure elliptic curve E. Its order is a large prime number q = FFFFFFFF FFFFFFFFFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F, and the base point in compressed form is G = 0279BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B16F81798. p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141, n = 256. Select the national secret algorithm SM3 as the secure hash function h;

[0048] 1.2. From Select a random number s from the list and calculate the system public key PK = sG. For each attribute a in the attribute space i , randomly selected Calculate P i =s i G. Output public parameters {PK, P i , G, h, n}.

[0049] 2. The data owner DO first generates an access control tree according to the access control policy, generates a secret random number t, and generates a sensitive data encryption key k based on t and the system public key. x , and the sensitive data integrity verification key k y , and then embed t into the access control tree; next, select a secure symmetric encryption algorithm and use k x Encrypt sensitive data M and select a secure hash function with k y Compute a message authentication code for sensitive data.

[0050] 2.1 The data owner DO generates an access control tree Γ according to the access control policy P, where R is the root node, Y is the set of leaf nodes, and each leaf node represents an attribute in the access control policy;

[0051] 2.2 The data owner DO secretly selects a random number calculate like Then reselect t until

[0052] 2.3 The data owner DO uses the Shamir secret sharing scheme to embed t into the access control tree Γ. That is, according to the threshold d of each node u in the access control tree, a (d-1)-order Lagrange interpolation polynomial q modulo q is constructed for it. u (x), where q R (0) = t, assuming that the threshold of the root node R is d, for its child nodes i∈{1,...,d},q i (0) = q R (i) And so on, we get the secret share q of each node j j (0). For example, if the access control policy P is (AORB) AND C AND (D OR (E AND F)), the generated access control tree Γ is as follows Figure 3 shown.

[0053] 2.4 The data owner DO selects the SM4 national encryption algorithm as the lightweight symmetric encryption algorithm E, with k x The first 128 bits of are used as the key to encrypt the sensitive data M, and the ciphertext C = E(k x , M), and calculate the message authentication code C′=h(k y ||M).

[0054] 2.5 Assume that the attribute set corresponding to access policy P is S p For each leaf node y∈Y in the access control tree, attr(y)∈S p , according to formula c y =q y (0)·P i and c y , ′ = q y (0) G calculates the corresponding attribute ciphertext c respectively y and c y ′, and output the CP-ABE ciphertext of the encryption key

[0055] 3. Data user DU requests attribute key from AA, AA is each attribute a in DU's attribute set ω i Generate attribute key d i , the decryption key output of the attribute set is D;

[0056] 3.1 For the attribute set ω of DU, AA randomly selects Use formula d i =(s×s i -1 +h(r ω ))modq and d i ′=(s i ×h(r ω ))modq calculates and generates attribute keys Use PK as the attribute key DU Encrypted and encrypt with SK AA After signing, it is sent to DU, where PK DU The public key of the data user DU;

[0057] 3.2 Data user DU receives the encryption key ciphertext and signature Enc(D, PK DU )||sig(H(D),SK AA ) and then use your own private key SK DU The ciphertext is decrypted to obtain the attribute key D, and the attribute key hash value H(D) and digital signature sig(H(D), SK AA )Verify the integrity of attribute key D.

[0058] 4. If the attribute set ω of the data user satisfies the access control policy P, the CP-ABE ciphertext CT of the encryption key can be decrypted to recover k x , k y Then use k x Decrypt the ciphertext data C, using k y and C′ to verify the integrity of the data.

[0059] 4.1DU decrypts CT locally. The decryption steps are as follows:

[0060] 4.1.1 First, the data on the leaf node needs to be decrypted. For each leaf node u in the access control tree, let i = attr(u), that is, i is the attribute corresponding to node u. If attribute i is an attribute of user U, that is, i∈ω, then the user can use the attribute private key according to the formula

[0061] DecryptLeafNode(CT,D,i)=c i d i -c i 'd i '

[0062] =q y (0)·P i ·(s×s i -1 +h(rω))-q y (0)·G·s i×h(r ω )=q i (0)PK

[0063] The secret share value of the leaf node can be obtained by performing decryption calculation, otherwise, Unable to perform decryption calculations;

[0064] 4.1.2 For non-leaf node u, assuming its threshold is d, let ω u is the set of any d child nodes of node u, according to the formula

[0065]

[0066] Calculate the key share q corresponding to node u u (0) PK, when the algorithm recursively calculates to the root node, the decryption result of the data encryption key is obtained:

[0067] DecryptNode(CT, D, R) = q R (0)·PK=t·PK=(k x ′,k y ′);

[0068] 4.2. For the sensitive data ciphertext C||C′, take k x The first 128 bits of ′ are decrypted using the SM4 algorithm to obtain the plaintext M′=D(k x ′, C). According to M′ and k y 'Calculate C", if C'=C", the ciphertext message is decrypted successfully and the integrity is maintained.

[0069] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A lightweight sensitive data access control method, characterized in that: include: S1, global initialization step, the attribute authority AA performs initialization and generates public parameters Params; S2, encryption step, the data owner DO generates an access control tree according to the access control policy, generates a secret random number t, and generates a data encryption key k according to the secret random number t and the system public key x and data integrity verification key k y , embedding the secret random number t into the access control tree; Select a secure symmetric encryption algorithm to encrypt the data with the key k x Encrypt sensitive data M, select a secure hash function and use the data integrity verification key k y Calculate the message authentication code of sensitive data M; S3, decryption key generation step, for the attribute set ω of the data user DU, the attribute authority generates an attribute key for each attribute in it, and the final attribute key is D, and the attribute key is securely sent to DU; S4, decryption step, the data user DU that complies with the access control policy can recover the data encryption key and data integrity verification key from the access control tree according to its own attribute key, decrypt the data ciphertext and verify the message integrity; The attribute authority AA is initialized and generates public parameters Params including: Choose an elliptic curve E that meets the security requirements p (a, b), q is the module, a, b∈GF(p), and (4a 3 +27b 2 )mod p≠0, assuming that the order of the elliptic curve that meets the security requirements is modulo q, the base point is G, and a security parameter n and a secure hash function h are selected: {0,1} * →{0,1} n ; From a finite field modulo q Select a random number s from the list, calculate the system public key PK = s·G; for each attribute a in the attribute space i , randomly selected Calculate P i =s i G, generate public parameters Params = {PK, P i ,G,h,n}; The encryption steps include: Step 1: The data owner DO secretly selects a random number Calculate encryption keys for sensitive data like Then reselect t until The data owner DO selects a lightweight symmetric encryption algorithm E, with k x As the key, the sensitive data M is encrypted to obtain the ciphertext C = E (k x , M), and at the same time calculate the message authentication code C′=h(k y ||M); Step 2: The data owner DO generates an access control tree Γ according to the access control policy P, where R is the root node, Y is the set of leaf nodes, and each leaf node represents an attribute in the access control policy; Step 3: The data owner DO uses the Shamir secret sharing scheme to embed the secret random number t into the access control tree Γ; according to the threshold d of each node u in the access control tree, a (d-1)-order Lagrange interpolation polynomial q modulo q is constructed for the node u (x), where q R (0) = t, assuming that the threshold of the root node R is d, for its child nodes i∈{1,...,d}, q i (0) = q R (i), and so on, each node j in the access control tree obtains the secret share q of each node in the access control tree. j (0); Step 4: Encrypt the sensitive data obtained in step 1 The CP-ABE ciphertext CT is further encrypted and outputted, including: Assume that the attribute set corresponding to access policy P is S p , for each leaf node y∈Y in the access control structure, attr(y)∈S p , according to formula c y =q y (0)·P i and c y ′=q y (0) G calculates the corresponding attribute ciphertext c respectively y and c y ′, and output the CP-ABE ciphertext of the data encryption key 2. The lightweight sensitive data access control method according to claim 1, characterized in that: The decryption key generation step includes: the data user DU requests the attribute key from the attribute authority AA, and the attribute authority AA generates a decryption key for each attribute a in the attribute set ω of the data user. i Calculate the attribute key d i , the decryption key output of the attribute set is D including: For the attribute set ω of the data user DU, the attribute authority AA randomly selects Use formula d i =(s×s i -1 +h(r ω ))modq and d i ′=(s i ×h(r ω ))modq calculates and generates attribute keys The attribute key is replaced by the public key PK of the data user DU Encrypted with the attribute authority's private key SK AA After signing, it is sent to the data user DU, where PK DU is the public key of the data user DU; the data user DU receives the attribute key ciphertext and signature message Enc(D,PK DU )||sig(H(D),SK AA ) and then use the data user's private key SK DU Decrypt the ciphertext to obtain the attribute key D, and calculate the attribute key hash value H(D) and digital signature sig(H(D),SK AA )Verify the integrity of attribute key D.

3. The lightweight sensitive data access control method according to claim 1, characterized in that: The decryption step includes: if the attribute set ω of the data user satisfies the access control policy P, the CP-ABE ciphertext CT of the data encryption key can be decrypted to recover k x , k y Then use k x Decrypt the ciphertext data C and use k y Verify the integrity of the data.

4. The lightweight sensitive data access control method according to claim 3, characterized in that: The decryption steps include: The data user DU decrypts the CP-ABE ciphertext CT of the data encryption key. During decryption, for each leaf node u, let i=attr(u), where i is the attribute corresponding to the node u; if attribute i is an attribute of the data user DU, i.e., i∈ω, then the attribute private key is used according to the formula Perform decryption calculation to obtain the secret share value of the leaf node, otherwise Unable to perform decryption calculations; For non-leaf node u, set the threshold to d, let ω u is the set of any d child nodes of node u, according to the formula Calculate the key share q corresponding to node u u (0) PK; When the algorithm recursively calculates to the root node, the decryption result of the data encryption key is obtained: DecryptNode(CT,D,R)=q R (0)·PK=t·PK=(k x ′,k y ′); For the sensitive data ciphertext C||C′, take the recovered decryption key k x ′ decrypts C and obtains the plaintext M′=D(k x ′, C); according to M′ and k y 'Calculate C" = h(k y ||M), if C′=C″, the message is decrypted successfully and its integrity is maintained.

Images