A lightweight attribute-based encryption data sharing method and system in a low-altitude intelligent networking scene

Abstract

The application relates to a lightweight attribute encryption data sharing method in a low-altitude intelligent networking scene, which comprises four parts: initializing a lightweight attribute encryption data sharing system, generating a public key and a private key of the system; generating a decryption private key of a user; performing encryption, including: encrypting and converting data transmitted in the low-altitude intelligent networking into ciphertext, and associating an attribute set of the user, an access strategy, a public parameter and plaintext needing to be encrypted in the encryption process; performing decryption, including: converting ciphertext and obtaining encrypted plaintext by decrypting the user in the low-altitude intelligent networking, and the user uses the attribute set to match the access strategy of the encrypted data after obtaining the initial verification of the decryption server, and uses the private key to decrypt the data. Compared with the prior art, the application has the advantages of reducing the calculation pressure of a low-altitude intelligent networking terminal device, solving the problem of low strategy matching efficiency during data decryption and the like.

Description

Technical Field

[0001] This invention relates to the field of low-altitude intelligent networking, and in particular to a lightweight attribute-encrypted data sharing method and system in low-altitude intelligent networking scenarios. Background Technology

[0002] Low-altitude intelligent networking (LAI) scenarios, as one of the important application areas of next-generation information and communication technologies, are widely used in monitoring, rescue, agriculture, urban planning, and other fields. With the popularization and application of low-altitude devices such as drones and IoT devices, a large amount of sensitive information, such as images, videos, and location information, is frequently shared and processed in LAI scenarios. The security of this information transmission is directly related to user privacy, national security, and the normal operation of the system. However, due to the openness, heterogeneity, and wireless transmission characteristics of LAI scenarios, data sharing faces a series of security threats and challenges. Existing access control schemes are mostly applied to cloud storage systems. The encryption and decryption implementation in these schemes requires a large amount of complex computation, including pairwise operations and exponentiation operations. However, in data sharing in LAI scenarios, end users are mostly drone devices with limited resources, which cannot bear the computational burden of encryption and decryption caused by access control. In addition, in existing access control schemes, the relationship between users and attributes is often one-to-many or many-to-one, leading to difficulties in user and attribute management, especially the updating and revocation of users and attributes.

[0003] In the prior art, Chinese Patent Publication No. CN113904818A discloses a lightweight, fine-grained access control method supporting encrypted sharing and aggregation. This method includes initialization, generating a master private key and a master public key based on an authorization center, lightweight encryption of data generated by the device, user registration at the authorization center to obtain a user-side attribute set private key, and decryption using the private key to obtain plaintext. This method aims to solve the problem of limited efficiency in encrypted text storage and retrieval, but it does not address reducing the computational resource consumption of low-altitude aircraft or the difficulty of user and attribute management, especially the issues of updating and revoking users and attributes. Therefore, this invention provides a lightweight attribute-encrypted data sharing method and system for low-altitude intelligent network scenarios. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the existing technology and provide a lightweight attribute-encrypted data sharing method and system for low-altitude intelligent network scenarios.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] This invention provides a lightweight attribute-encrypted data sharing method in a low-altitude intelligent network scenario. The method is implemented based on a lightweight attribute-encrypted data sharing system and includes the following four parts:

[0007] Part One: Initializing the system, including:

[0008] S100. Initialize the central authorization agency and generate the public and private keys of the system;

[0009] Part Two: Generating the user's decryption private key, including:

[0010] S200. The data accessor sends the user attribute list to the central authorization agency, and the central authorization agency returns the decryption private key corresponding to the user attribute list;

[0011] Part Three, the encryption process, includes:

[0012] S300. The data owner sets an access policy for the shared data, generates a public key and a private key for the elliptic curve cryptography algorithm, encrypts the data to be shared with the public key, generates the data owner's encrypted ciphertext, and sends the private key, the generated data owner's encrypted ciphertext, and the access policy to the encryption server.

[0013] S400. The access policy is parsed through the encryption server, Bloom filter parameters are formulated according to the access policy, the private key is encrypted using the attribute encryption method, and the encryption server encrypted ciphertext is generated. The Bloom filter parameters, data owner encrypted ciphertext, encryption server encrypted ciphertext and access policy are summarized and uploaded to the cloud server through the encryption server.

[0014] Part Four, the decryption process, includes:

[0015] S500 receives data uploaded from an encrypted server via a cloud server, verifies the integrity of the data, and stores it on the cloud server's disk;

[0016] S600. The data accesser sends a request to the decryption server to access data. The decryption server initiates an encrypted data access request to the cloud server, obtains the access data, and determines whether the data accesser's private key version, number of attributes, and list of attribute hash values ​​corresponding to the ID meet the set conditions. If they meet the conditions, the data accesser obtains the access data; if they do not meet the conditions, the data accesser cannot obtain the data.

[0017] Furthermore, step S100 specifically includes the following steps:

[0018] S110. Select a bilinear group, using the safety parameter as input;

[0019] S120. Normalize the output content, which includes the order, the set of prime numbers, and the multiplication cycle group;

[0020] S130. Based on the output calculation parameters, obtain the public key and private key information.

[0021] Furthermore, step S200 specifically includes the following steps:

[0022] S210. The data accessor standardizes its own attribute list and uploads the attribute list to the central authorization agency;

[0023] S220. The centrally authorized agency parses the attribute list, calculates each attribute, assembles the user's private key information, and returns it to the data accessor;

[0024] S230. Save the private key information returned by the central authorized agency to the local machine of the data accessor.

[0025] Furthermore, step S300 specifically includes the following steps:

[0026] 310. Determine the shared data through the data owner, formulate an access policy for the shared data, and save the access policy locally to the data owner;

[0027] 320. Generate the public and private keys for the elliptic curve cryptography algorithm, use the public key to encrypt the shared data, generate the data owner's encrypted ciphertext, and save the data owner's encrypted ciphertext to the data owner's local machine;

[0028] 330. Upload the access policy, private key, and data owner's encrypted ciphertext to the encryption server.

[0029] Furthermore, step S400 specifically includes the following steps:

[0030] 410. The data uploaded by the data owner is parsed through the encryption server, the access policy is parsed, the corresponding Bloom filter parameters are formulated according to the access policy, and the parameters are saved;

[0031] 420. Using an attribute encryption algorithm, encrypt the private key information of the elliptic curve cryptography algorithm to generate encrypted ciphertext for the encryption server;

[0032] 430. Summarize the Bloom filter parameters, data owner encrypted ciphertext, encryption server encrypted ciphertext, and access policy, and upload them to the cloud server.

[0033] Furthermore, step S600 specifically includes the following steps:

[0034] 610. The data visitor sends a request to the decryption server to access the data, carrying the data visitor ID information;

[0035] 620. After receiving the data access request, the decryption server sends an encrypted data access request to the cloud server and saves the data locally;

[0036] 630. The decryption server sends a request to the central authorization center, carrying the data accessor's ID information, to determine whether the data accessor's private key is the latest version; if yes, proceed to 640; if no, the data accessor is required to obtain the private key from the central authorization center again, and the process returns to step 610 to re-initiate the data access request.

[0037] 640. The decryption server obtains the attribute list hash corresponding to the data visitor ID from the central authorization center, reads the relevant parameters of the Bloom filter in the ciphertext, sets the Bloom filter, and determines whether the data visitor's attributes meet the minimum number of attributes required by the access policy. If yes, then execute 650; otherwise, prompt the data visitor that they have no right to access.

[0038] 650. The data accessor uses the attribute list to match the access policy in the ciphertext. If the policy matches, the data is decrypted using the decryption private key. Otherwise, the decryption is invalid and the data in the ciphertext cannot be parsed.

[0039] Furthermore, the minimum number of attributes required by the access strategy is set by using traversal to solve the minimum depth of the access strategy tree.

[0040] Secondly, the present invention provides a lightweight attribute-encrypted data sharing system for low-altitude intelligent network scenarios, comprising a central authorizing agency, a data owner, an encryption server, a cloud server, a decryption server, and a data accessor; wherein, the central authorizing agency is connected to the encryption server, the decryption server, the data owner, and the data accessor via a wireless link; the data owner is connected to the encryption server and the central authorizing agency via a wireless link; the encryption server is connected to the central authorizing agency, the data owner, and the cloud server via a wireless link; the cloud server is connected to the encryption server and the decryption server via a wireless link; the decryption server is connected to the central authorizing agency, the cloud server, and the data owner via a wireless link; and the data accessor is connected to the encryption server and the central authorizing agency via a wireless link. The system is used in any one of the above-described methods.

[0041] Thirdly, the present invention provides an electronic device including a processor, a memory, a user interface, and a network interface, wherein the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the electronic device to perform any of the methods described above.

[0042] Fourthly, the present invention provides a storage medium having a program stored thereon, wherein the program, when executed, implements the method described in any one of the preceding methods.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] 1. This invention proposes using an encryption server to assist in encryption and decryption operations, which reduces the computational burden on low-altitude intelligent network terminal devices and can address the problem of high computational load in data encryption in low-altitude intelligent networks.

[0045] 2. This invention proposes a method that uses a decryption server to assist in verifying the legitimacy of user decryption, and forces data accessors to update their keys after user attributes are updated or revoked, which can solve the problem of updating and revoking users and attributes.

[0046] 3. This invention proposes a method of using a decryption server combined with a Bloom filter for coarse attribute matching, which solves the problem of low efficiency in strategy matching during data decryption. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the lightweight attribute-encrypted data sharing system of the present invention;

[0048] Figure 2 This is a schematic diagram of the lightweight attribute encryption data sharing method in this invention. Detailed Implementation

[0049] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0050] Example

[0051] This embodiment provides a lightweight attribute-encrypted data sharing method in a low-altitude intelligent network scenario. This method is implemented based on a lightweight attribute-encrypted data sharing system for a low-altitude intelligent network scenario. For example... Figure 1 As shown, the system includes a central authorizing agency, a data owner, an encryption server, a cloud server, a decryption server, and a data accessor. The central authorizing agency is connected to the encryption server, the decryption server, the data owner, and the data accessor via wireless links. The data owner is connected to the encryption server and the central authorizing agency via wireless links. The encryption server is connected to the central authorizing agency, the data owner, and the cloud server via wireless links. The cloud server is connected to the encryption server and the decryption server via wireless links. The decryption server is connected to the central authorizing agency, the cloud server, and the data owner via wireless links. The data accessor is connected to the encryption server and the central authorizing agency via wireless links.

[0052] This method can be divided into four parts: system initialization, user key generation, encryption, and decryption. The specific steps are as follows: Figure 2 As shown, it includes the following:

[0053] Part One

[0054] Step S100. Perform the system initialization process: Setup(λ) → {PK, MSK}.

[0055] Specifically, it includes the following steps:

[0056] 110. The centrally authorized agency chooses a bilinear group G of order p, with generator g, and a bilinear mapping e: G × G → G T ;

[0057] 120. Generate random numbers α, β ∈ Z p The public key PK and private key SK of the system g∈G are respectively:

[0058] PK = {g b ,e(g,g) a}

[0059] MSK = {g a ,b}.

[0060] 130. The centrally authorized agency stores the generated system public and private keys for use in subsequent data decryption and decryption processes.

[0061] Part Two

[0062] Step S200. Perform the user's decryption private key generation process: KeyGen(PK,MSK,A) u )→SK.

[0063] Specifically, the user key generation process includes the following steps:

[0064] 210. Users standardize their own attribute lists through data access and upload these lists to the central authorization agency. The user's attribute list is as follows:

[0065] A u ={x1,…x i ,…x u}, u∈Z.

[0066] 220. The centrally authorized agency parses the user attribute list, calculates for each attribute, assembles the user's private key information, and returns it to the data accessor. The specific process is as follows:

[0067] SK = {D, D0, {D i} i∈u}

[0068] Where, x∈A u D = g a g bt D0 = g t Di =H(i) t .

[0069] 230. Save the private key information returned by the central authorized agency to the local machine of the data accessor for use in the subsequent decryption process.

[0070] Part Three

[0071] Step S300. Perform the encryption process, specifically including the following steps:

[0072] 310. Identify the data that needs to be shared by the data owner, and formulate access policies for the shared data. Policy First, save the access policy to the data owner's local machine.

[0073] 320. Generate a public and private key for the elliptic curve cryptography algorithm, encrypt the shared data using the public key, and save the encrypted data locally to the data owner. The steps are as follows:

[0074] CT = ECC(PK) ECC M).

[0075] 330. The data owner summarizes the access policy, private key, and encrypted data, and uploads them to the encryption server.

[0076] 340. The encrypted server parses the data uploaded by the data owner, analyzes the access policy, and sets the corresponding Bloom filter parameters based on the access policy, saving these parameters. When setting the Bloom filter, each bit is configured using the x parameter. i,j =Hash i (att j ), 1≤i≤k,att j ∈A Policy ,0≤j≤attNum, use traversal to solve the minimum number of attributes at the minimum depth of the access strategy tree and set the minimum number of access attributes.

[0077] 350. Using an attribute encryption algorithm, encrypt the private key information of the elliptic curve cryptography algorithm to generate encrypted ciphertext for the encryption server. The specific steps are as follows:

[0078] Encrypt(PK,MSK,A Policy SK ECC ) = CT1

[0079] The final ciphertext is:

[0080] CT' = {CT1, CT2, minNum}

[0081] in C = M1e(g,g) asC0 = g s , i∈A Policy .

[0082] 360. The encryption server summarizes the Bloom filter parameters, data owner encrypted ciphertext, encryption server encrypted ciphertext, and access policy, and uploads them to the cloud server.

[0083] 370. After receiving the uploaded data from the encrypted server, the cloud server verifies the integrity of the data and stores it on the cloud server's disk.

[0084] Part Four

[0085] S400 Decryption Process

[0086] Specifically, the decryption process includes the following steps:

[0087] 410. The data accessor sends a request to the decryption server to access the data, carrying the data accessor's unique ID information in the system.

[0088] 420. After receiving the data access request, the decryption server initiates an encrypted data access request to the cloud server and saves the encrypted data locally to the decryption server.

[0089] 430. The decryption server sends a request to the central authorization center, carrying the data accessor's ID information, to verify whether the data accessor's private key is the latest version.

[0090] Step 430 is followed by step 430A: Determine if the data accessor's private key is the latest version. If yes, proceed to step 440; otherwise, require the data accessor to obtain the private key from the central authorization center and return to step 410 to re-initiate the data access request.

[0091] 440. The decryption server obtains the attribute list hash corresponding to the data visitor ID from the central authorized agency, reads the relevant parameters of the Bloom filter in the ciphertext, sets the Bloom filter, and verifies whether the data visitor's attributes meet the minimum number of attributes required by the access policy.

[0092] Following 440 is 440A: It determines whether the data visitor's attributes meet the minimum number of attributes required by the access policy. If yes, then execute 450; otherwise, inform the data visitor that they do not have permission to access the data.

[0093] 450. The data accessor uses the attribute list to match the access policy in the ciphertext. If the policy matches, the data is decrypted using the decryption private key. If the policy does not match, the decryption is invalid and the data in the ciphertext cannot be parsed.

[0094] During the decryption process, the secret value shared by each node is first obtained:

[0095]

[0096] After performing exponential operations based on the Lagrange difference factor, a multiplication operation is then performed, as follows:

[0097]

[0098] Calculate the following formula to restore the original text. The restored content is the private key part for ECC decryption. Then, use ECC to decrypt it.

[0099]

[0100] This embodiment provides an electronic device, including a processor, a memory, a user interface, and a network interface. The memory stores instructions, the user interface and network interface are used for communication with other devices, and the processor executes the instructions stored in the memory to cause the electronic device to perform the method described in this embodiment. This electronic device includes a personal computer, a server, or a network device.

[0101] Thirdly, the present invention provides a storage medium on which a program is stored, which, when executed, implements the method described in this embodiment. The storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0102] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A lightweight attribute-encrypted data sharing method in a low-altitude intelligent network scenario, characterized in that, The method is implemented based on a lightweight attribute-encrypted data sharing system, comprising the following four parts: Part One: Initializing the system, including: S100. Initialize the central authorization agency and generate the public and private keys of the system; Part Two: Generating the user's decryption private key, including: S200. The data accessor sends the user attribute list to the central authorization agency, and the central authorization agency returns the decryption private key corresponding to the user attribute list; Part Three, the encryption process, includes: S300. The data owner sets an access policy for the shared data, generates a public key and a private key for the elliptic curve cryptography algorithm, encrypts the data to be shared with the public key, generates the data owner's encrypted ciphertext, and sends the private key, the generated data owner's encrypted ciphertext, and the access policy to the encryption server. S400. The access policy is parsed through the encryption server, Bloom filter parameters are formulated according to the access policy, the private key is encrypted using the attribute encryption method, and the encryption server encrypted ciphertext is generated. The Bloom filter parameters, data owner encrypted ciphertext, encryption server encrypted ciphertext and access policy are summarized and uploaded to the cloud server through the encryption server. Part Four, the decryption process, includes: S500 receives data uploaded from an encrypted server via a cloud server, verifies the integrity of the data, and stores it on the cloud server's disk; S600. The data accesser sends a request to the decryption server to access data. The decryption server initiates an encrypted data access request to the cloud server, obtains the access data, and determines whether the data accesser's private key version, number of attributes, and list of attribute hash values ​​corresponding to the ID meet the set conditions. If they meet the conditions, the data accesser obtains the access data; if they do not meet the conditions, the data accesser cannot obtain the data.

2. The lightweight attribute-encrypted data sharing method in a low-altitude intelligent network scenario according to claim 1, characterized in that, Step S100 specifically includes the following steps: S110. Select a bilinear group, using the safety parameter as input; S120. Normalize the output content, which includes the order, the set of prime numbers, and the multiplication cycle group; S130. Based on the output calculation parameters, obtain the public key and private key information.

3. A lightweight attribute-encrypted data sharing method in a low-altitude intelligent network scenario according to claim 1, characterized in that, Step S200 specifically includes the following steps: S210. The data accessor standardizes its own attribute list and uploads the attribute list to the central authorization agency; S220. The centrally authorized agency parses the attribute list, calculates each attribute, assembles the user's private key information, and returns it to the data accessor; S230. Save the private key information returned by the central authorized agency to the local machine of the data accessor.

4. A lightweight attribute-encrypted data sharing method in a low-altitude intelligent network scenario according to claim 1, characterized in that, Step S300 specifically includes the following steps:

310. Determine the shared data through the data owner, formulate an access policy for the shared data, and save the access policy locally to the data owner; 320. Generate the public and private keys for the elliptic curve cryptography algorithm, use the public key to encrypt the shared data, generate the data owner's encrypted ciphertext, and save the data owner's encrypted ciphertext to the data owner's local machine; 330. Upload the access policy, private key, and data owner's encrypted ciphertext to the encryption server.

5. A lightweight attribute-encrypted data sharing method in a low-altitude intelligent network scenario according to claim 1, characterized in that, Step S400 specifically includes the following steps:

410. The data uploaded by the data owner is parsed through the encryption server, the access policy is parsed, the corresponding Bloom filter parameters are formulated according to the access policy, and the parameters are saved; 420. Using an attribute encryption algorithm, encrypt the private key information of the elliptic curve cryptography algorithm to generate encrypted ciphertext for the encryption server; 430. Summarize the Bloom filter parameters, data owner encrypted ciphertext, encryption server encrypted ciphertext, and access policy, and upload them to the cloud server.

6. A lightweight attribute-encrypted data sharing method in a low-altitude intelligent network scenario according to claim 1, characterized in that, Step S600 specifically includes the following steps:

610. The data visitor sends a request to the decryption server to access the data, carrying the data visitor ID information; 620. After receiving the data access request, the decryption server sends an encrypted data access request to the cloud server and saves the data locally; 630. The decryption server sends a request to the central authorization center, carrying the data accessor's ID information, to determine whether the data accessor's private key is the latest version; if yes, proceed to 640; if no, the data accessor is required to obtain the private key from the central authorization center again, and the process returns to step 610 to re-initiate the data access request.

640. The decryption server obtains the attribute list hash corresponding to the data visitor ID from the central authorization center, reads the relevant parameters of the Bloom filter in the ciphertext, sets the Bloom filter, and determines whether the data visitor's attributes meet the minimum number of attributes required by the access policy. If yes, then execute 650; otherwise, prompt the data visitor that they have no right to access.

650. The data accessor uses the attribute list to match the access policy in the ciphertext. If the policy matches, the data is decrypted using the decryption private key. Otherwise, the decryption is invalid and the data in the ciphertext cannot be parsed.

7. A lightweight attribute-encrypted data sharing method in a low-altitude intelligent network scenario according to claim 6, characterized in that, Use traversal to solve for the minimum number of attributes at the minimum depth of the access strategy tree, and set the minimum number of attributes required by the access strategy.

8. A lightweight attribute-encrypted data sharing system for low-altitude intelligent network scenarios, characterized in that, The system includes a central authorizing agency, a data owner, an encryption server, a cloud server, a decryption server, and a data accessor; wherein the central authorizing agency is connected to the encryption server, the decryption server, the data owner, and the data accessor via a wireless link; the data owner is connected to the encryption server and the central authorizing agency via a wireless link; the encryption server is connected to the central authorizing agency, the data owner, and the cloud server via a wireless link; the cloud server is connected to the encryption server and the decryption server via a wireless link; the decryption server is connected to the central authorizing agency, the cloud server, and the data owner via a wireless link; and the data accessor is connected to the encryption server and the central authorizing agency via a wireless link. The system is used in the method described in any one of claims 1 to 7.

9. An electronic device, characterized in that, The device includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described in any one of claims 1 to 7.

10. A storage medium having a program stored thereon, characterized in that, When the program is executed, it implements the method as described in any one of claims 1 to 7.

Images