A method, chip and terminal for attribute encryption based on multiple authoritative centers

Abstract

The embodiment of the present invention discloses an attribute encryption method, chip and terminal based on multiple authoritative centers, generates a basic seed matrix based on bilinear pairing tuples, calculates a master key and publishes public parameters; splits the basic seed matrix to obtain multiple sub-matrices; randomly distributes the sub-matrices to multiple authoritative centers, generates a private key of a user to be created, obtains an input message to be encrypted and selects a suitable access structure to generate a ciphertext, and uploads the ciphertext to a cloud service provider; or, obtains a target private key belonging to a target user account, converts the target private key into a blinded key, and uploads the blinded key to a cloud service provider, so that the cloud service provider calculates the blinded ciphertext based on the blinded key and the ciphertext stored therein; after verification, the blinded ciphertext is sent to the target user. The present invention can realize decentralized attribute encryption and reduce the user's computing burden.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an attribute encryption method, chip and terminal based on multiple authoritative centers. Background Art

[0002] At present, most attribute encryption schemes are based on key generation centers, which have the problems of single point failure and excessive power of the center. At the same time, the computing power of users is generally low, and the complexity of bilinear pairing operations is high.

[0003] Therefore, a new attribute encryption scheme is urgently needed to solve the above problems. Summary of the invention

[0004] Based on this, the present invention provides an attribute encryption method, chip and terminal based on multiple authoritative centers, which can solve the problems of single point failure and excessive power of the center, high requirements on user computing power, and complex bilinear pairing operations in existing attribute encryption schemes based on multiple authoritative centers.

[0005] In a first aspect, a multi-authority center-based attribute encryption method is provided, comprising:

[0006] Generate the basic seed matrix based on the bilinear pairing tuples, calculate the master key, and publish the public parameters;

[0007] Splitting the basic seed matrix to obtain a plurality of sub-matrices;

[0008] The sub-matrices are randomly distributed to a plurality of authoritative centers, and the authoritative centers calculate secret values ​​according to the distributed sub-matrices;

[0009] Generate a private key of the user to be created, wherein the private key of the user to be created is obtained by aggregating the partial secret values ​​calculated by the authoritative center participating in the calculation and the master key;

[0010] Obtain the input message to be encrypted and select a suitable access structure to generate ciphertext, and upload the ciphertext to the cloud service provider;

[0011] or,

[0012] Obtain a target private key belonging to a target user, convert the target private key into a blinded key, and upload the blinded key to a cloud service provider, so that the cloud service provider calculates the blinded ciphertext based on the blinded key and the ciphertext stored therein;

[0013] The target private key and the blinded ciphertext are used to verify whether the cloud service provider has correctly performed the outsourced decryption. If so, the blinded ciphertext is sent to the target user.

[0014] Optionally, if the target private key of the target user is lost, the target private key is recovered based on the partial secret value calculated by all authoritative centers participating in the calculation.

[0015] Optionally, generate the private key of the user to be created, including:

[0016] Obtain the attribute set and ID of the user to be created, and match the matching seed matrix set belonging to the user to be created in multiple sub-matrices;

[0017] Selecting an authoritative center to participate in the calculation according to the matching seed matrix set;

[0018] Aggregate the partial secret values ​​calculated by all authoritative centers participating in the calculation, obtain the secret value of the user to be created, and generate the private key of the user to be created based on the secret value and the master key.

[0019] Optionally, any participating authority center calculates a partial secret value, and the calculation formula is:

[0020] w u =H 2 (SSK i ||ID)

[0021]

[0022] Where m represents the number of matching seed matrices that match the user to be created in multiple sub-matrices, and d m It is a partial secret value calculated by any participating authority based on the submatrix assigned to it. The calculation principle is to randomly select a value in each column of the submatrix assigned to the authority for accumulation. w is used to record the hash value of each submatrix and ID. SSK i A matching seed matrix that matches the user to be created in multiple sub-matrices;

[0023] The partial secret value calculated based on all sub-matrices of any authority center is d n , l i and h i For SSK i The dimension of the partial secret value calculated by all participating authoritative centers is n b is the total number of sub-matrices;

[0024] The private key of the user to be created is generated based on the secret value and the master key, and the formula is:

[0025]

[0026] Where S is the attribute set of the target user account, x represents the attribute in the attribute set S, represents the master key and secret value, d represents the secret value, represents the d-th power after x maps the group G in the public parameter, and the private key sk of the user to be created is (sk 1 ,sk 2 ,{sk x} x∈S ).

[0027] Optionally, obtaining a message to be encrypted input by a user and an access structure of the user to generate a ciphertext includes:

[0028] Pick a random vector

[0029] The calculation formula for generating ciphertext is:

[0030]

[0031] Ciphertext

[0032] Among them, the access structure is Γ=(A,ρ), and the dimension of matrix A is n 1 ×n 2 , ρ is a mapping function that maps each attribute in the access structure Γ to the row of the matrix A. The message to be encrypted is α, y is a secret value random number, S M is the hash fingerprint, C is the first part of the ciphertext calculated based on the public parameters, and C 1 is the second part of the ciphertext calculated based on the public parameters, C 3 is the third part of the ciphertext calculated based on the public parameters.

[0033] Optionally, converting the target private key into a blinded key comprises:

[0034]

[0035] Among them, sk is the target private key, Indicates in the collection The random number obtained from Where Z represents an integer set, p is a prime number in the bilinear pairing tuple, S is the attribute set of the target user account, and x represents an attribute in the attribute set S;

[0036] Blind key bk = (bk 1 ,bk 2 ,{bk x} x∈S ).

[0037] Optionally, the cloud service provider performs calculations based on the blinded key and the ciphertext stored therein to obtain the blinded ciphertext, including:

[0038] Set T = {t|ρ(t)∈S};

[0039] Get θ t , and θ t Satisfy t∈T θ t A t =(1,0,…,0);

[0040] Calculate the blinded ciphertext

[0041] Optionally, verifying whether the cloud service provider correctly performs the outsourced decryption by using the target private key and the blinded ciphertext includes:

[0042] calculate

[0043] According to the calculated value of α, if Equal to S M , then the cloud service provider correctly performs the outsourced decryption, otherwise the cloud service provider incorrectly performs the outsourced decryption.

[0044] In a second aspect, a chip is provided, comprising a first processor for calling and running a computer program from a first memory, so that a device equipped with the chip executes the various steps of the attribute encryption method based on multiple authority centers as described above.

[0045] In a third aspect, a terminal is provided, comprising a second memory, a second processor, and a computer program stored in the second memory and executable on the second processor, wherein the second processor implements the various steps of the attribute encryption method based on multiple authority centers as described above when executing the computer program.

[0046] The above-mentioned attribute encryption method, chip and terminal based on multiple authoritative centers, based on smart contracts, aggregate the secret values ​​calculated by each authoritative center to obtain the user's private key, and realize a solution for multiple authoritative centers to collaboratively generate user private keys. In this solution, each authoritative center only holds a part of the secret matrix, so it is impossible to recover the secret alone, solving the problem of authority concentration. At the same time, it also reduces the computing burden on the user side by providing outsourced decryption through cloud service providers, and protects data security through blinded keys. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 A basic flow chart of the attribute encryption method based on multiple authority centers according to an embodiment of the present invention;

[0049] Figure 2 This is a practical application flow chart of the attribute encryption method based on multiple authority centers according to an embodiment of the present invention;

[0050] Figure 3 A basic structural block diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0052] In some of the processes described in the specification and claims of the present invention and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0054] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0055] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0056] Please refer to Figure 1 , Figure 1 This is a basic flow chart of the attribute encryption method based on multiple authoritative centers in this embodiment.

[0057] like Figure 1 As shown, an attribute encryption method based on multiple authority centers includes:

[0058] S101. Generate a basic seed matrix based on bilinear pairing tuples, calculate a master key, and publish public parameters.

[0059] In the above step S101, the smart contract initialization system first obtains the bilinear pairing tuple (e, G, G T ,p), where the bilinear map e:G×G→G T , G and G T is the cyclic group of the multiplication group of prime order p. Choose the hash function H 1 :{0,1} * →G,H 2 :{0,1} * →b 0 ,b 1 ,…,b h ,

[0060] In the above step S101, based on the bilinear pairing tuple (e, G, G T ,p) The basic seed matrix SSK generated is expressed as:

[0061]

[0062] In the above step S101, the master key is calculated based on Pick a random number ω 1 ,ω 2 ,Right now Calculate the master key Based on the bilinear pairing tuple (e, G, G T ,p) The public parameters published are

[0063] S102, splitting the basic seed matrix to obtain multiple sub-matrices;

[0064] In the above step S102, the basic seed matrix SSK is divided into n b Sub-matrix SSK i Distribute to various authoritative centers TA j , where i∈[1,n b ],j∈[1,n], where the i-th submatrix SSK i The dimension is l i ×h i, n is the total number of authority centers. It should be noted that each authority center TA j The number of sub-matrices obtained is not fixed, such as giving each authority center TA j Distribute k b sub-matrices, assigned to each authority center TA j The sub-matrix set, that is, the set of all sub-matrices is M j .

[0065] S103: Randomly distribute the sub-matrices to multiple authoritative centers, and the authoritative centers calculate secret values ​​according to the distributed sub-matrices.

[0066] S104, generating a private key of the user to be created;

[0067] The private key of the user to be created is obtained by aggregating the partial secret values ​​calculated by the authoritative centers participating in the calculation and the master key.

[0068] In the above step S103, the basic seed matrix SSK is split to obtain multiple sub-matrices, and the sub-matrices are assigned to the authoritative center. After the assignment is completed, the sub-matrices assigned to each authoritative center TA are obtained. j The sub-matrix set M j , assuming that the set of matching seed matrices that match the user to be created in multiple sub-matrices is M j , then M j ={m|SSK m ∈M j}, assuming m = 2, indicating that there are two matching seed matrices from the submatrix set M j The sub-matrix SSK 3 and SSK 5 , while SSK 3 and SSK 5 They are respectively assigned to the authoritative center TA1 and the authoritative center TA2. Therefore, the authoritative center TA1 and the authoritative center TA2 are the authoritative centers participating in the calculation, and calculate the secret value according to the sub-matrix originally assigned to them.

[0069] Exemplarily, the partial secret value calculated by any authoritative center participating in the calculation is calculated using the following formula:

[0070] w u =H 2 (SSK i ||ID)

[0071]

[0072] Where m represents the number of matching seed matrices that match the user to be created in multiple sub-matrices, and d mIt is a partial secret value calculated by any participating authority based on the submatrix assigned to it. The calculation principle is to randomly select a value in each column of the submatrix assigned to the authority for accumulation. w is used to record the hash value of each submatrix and ID. SSK i A matching seed matrix that matches the user to be created in multiple sub-matrices;

[0073] The partial secret value calculated based on all sub-matrices of any authority center is d n , l i and h i For SSK i The dimension of the partial secret value calculated by all participating authoritative centers is n b is the total number of sub-matrices;

[0074] Based on this, the detailed implementation steps of the above step S104 are:

[0075] Obtain the attribute set and ID of the user to be created, and match the matching seed matrix set belonging to the user to be created in multiple sub-matrices;

[0076] Selecting an authoritative center to participate in the calculation according to the matching seed matrix set;

[0077] Aggregate the partial secret values ​​calculated by all authoritative centers participating in the calculation, obtain the secret value of the user to be created, and generate the private key of the user to be created based on the secret value and the master key.

[0078] The private key of the user to be created is generated based on the secret value and the master key, and the formula is:

[0079]

[0080] Where S is the attribute set of the target user account, x represents the attribute in the attribute set S, represents the master key and secret value, d represents the secret value, represents the d-th power after x maps the group G in the public parameter, and the private key sk of the user to be created is (sk 1 ,sk 2 ,{sk x} x∈S ).

[0081] It can be understood that when the private key of the user to be created is generated, the creation of the user to be created is completed, including two behaviors: obtaining the ciphertext uploaded by other users as a receiver, and uploading the ciphertext as a sender, such as the following steps S105 and S106, and the same user can be both a receiver and a sender.

[0082] S105, obtaining an input message to be encrypted and selecting a suitable access structure to generate a ciphertext, and uploading the ciphertext to a cloud service provider;

[0083] or,

[0084] S106. Obtain a target private key belonging to a target user, convert the target private key into a blinded key, and upload the blinded key to a cloud service provider, so that the cloud service provider calculates the blinded ciphertext according to the blinded key and the ciphertext stored therein;

[0085] In practical applications, for the above step S105, the embodiment of the present invention optimizes the ciphertext structure in view of the weak computing and storage capabilities of the mobile communication device, and provides an implementation method for obtaining a message to be encrypted input by a user and generating a ciphertext from the user's access structure, including:

[0086] Pick a random vector

[0087] The calculation formula for generating ciphertext is:

[0088]

[0089] Ciphertext

[0090] Among them, the access structure is Γ=(A,ρ), and the dimension of matrix A is n 1 ×n 2 , ρ is a mapping function that maps each attribute in the access structure Γ to the row of the matrix A. The message to be encrypted is α, y is a secret value random number, S M is the hash fingerprint, A i represents traversing a specific row of A, C is the first part of the ciphertext calculated based on the public parameters, C 1 is the second part of the ciphertext calculated based on the public parameters, C 3 is the third part of the ciphertext calculated based on the public parameters.

[0091] Through the above ciphertext structure, the bilinear pairing operation of decryption can be reduced to a constant number, and the user's overhead is only one exponentiation operation plus a division operation.

[0092] For the above step S106, the present invention implements outsourcing decryption through a cloud service provider to reduce the user's overhead and protect data security through a blinded key, wherein the target private key is converted into a blinded key, and the formula is:

[0093]

[0094] Among them, sk is the target private key, Indicates in the collection The random number obtained from Where Z represents an integer set, p is a prime number in the bilinear pairing tuple, S is the attribute set of the target user account, and x represents an attribute in the attribute set S;

[0095] Blind key bk = (bk 1 ,bk 2 ,{bk x} x∈S ).

[0096] The cloud service provider calculates the blinded ciphertext based on the blinded key and the ciphertext stored therein, including:

[0097] Set T = {t|ρ(t)∈S};

[0098] Get θ t , and θ t Satisfy t∈T θ t A t =(1,0,…,0);

[0099] Calculate the blinded ciphertext

[0100] A t Indicates traversing a specific row of A.

[0101] The cloud service provider performs calculations based on the blinded key and the ciphertext stored therein as an outsourced decryption process, and according to the calculation method adopted in the embodiment of the present invention, the present invention is based on the optimized ciphertext structure and completes decryption through only two bilinear pairing operations, thereby reducing the complexity of the operation.

[0102] S107. Verify whether the cloud service provider has correctly performed the outsourced decryption using the target private key and the blinded ciphertext. If so, send the blinded ciphertext to the target user.

[0103] Based on the private key generation shown in step S104 and the ciphertext generation in step S106, step S107 of the embodiment of the present invention verifies whether the cloud service provider has correctly performed the outsourced decryption through the target private key and the blinded ciphertext, including:

[0104] calculate

[0105] According to the calculated value of α, if Equal to S M , then the cloud service provider correctly performs the outsourced decryption, otherwise the cloud service provider incorrectly performs the outsourced decryption.

[0106] In one embodiment, if the user key is lost, the partial secret value calculated by all participating authoritative centers is calculated according to wu =H 2 (SSK i ||ID), recovery key.

[0107] Through the above steps S101 to S107 and detailed implementation methods, the embodiment of the present invention proposes a solution for multiple authoritative centers to jointly generate user keys based on blockchain. Based on the smart contract, the secret values ​​of each authoritative center are aggregated to achieve user key generation. At the same time, the present invention reduces the bilinear pairing operation of outsourced decryption to a constant number of times by optimizing the ciphertext structure, so that the user's overhead is only one power operation plus division operation, and the efficiency of outsourced decryption can be greatly improved. In addition, when the cloud service provider erroneously performs outsourced decryption, it means that the user may have lost the key. The embodiment of the present invention realizes the verifiability of outsourced decryption based on two hash functions, supports key recovery, and can solve the problem of user key loss.

[0108] like Figure 2 As shown, the embodiment of the present invention also provides the actual application process of the above steps S101 to S107. The present invention is implemented based on the blockchain smart contract. Therefore, Figure 2 The system initialization in is based on the smart contract initialization system. The executor of the outsourced decryption is the cloud service provider. User U1 and user U2 can be the same user as long as they meet the access policy. Figure 2 In the example, user U2 is assumed to be the receiver, so he obtains the blinded ciphertext by blinding the key and outsourcing decryption. Assuming user U1 is the sender, he uses strategy P1 to encrypt the data using the encryption method shown above, obtains the ciphertext, and uploads it to the cloud service provider. At the same time, the key can be recovered.

[0109] To solve the above technical problems, an embodiment of the present invention further provides a chip, which can be a general-purpose processor or a dedicated processor. The chip includes a processor, which is used to support the terminal to execute the above related steps, such as calling and running a computer program from a memory, so that the device equipped with the chip executes, so as to implement the attribute encryption method based on multiple authority centers in the above various embodiments.

[0110] Optionally, in some examples, the chip further includes a transceiver, which is used to accept the control of the processor and to support the terminal in executing the above-mentioned related steps to implement the attribute encryption method based on multiple authority centers in the above-mentioned embodiments.

[0111] Optionally, the chip may also include a storage medium.

[0112] It should be noted that the chip can be implemented using the following circuits or devices: one or more field programmable gate arrays (FPGA), programmable logic devices (PLD), controllers, state machines, gate logic, discrete hardware components, any other suitable circuits, or any combination of circuits that can perform the various functions described throughout this application.

[0113] The present invention also provides a terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the attribute encryption method based on multiple authority centers as described in the above-mentioned embodiments are implemented.

[0114] Please refer to Figure 3 , Figure 3 The basic structural block diagram of a terminal shown in FIG. 1 includes a processor, a non-volatile storage medium, a memory, and a network interface connected via a system bus. The non-volatile storage medium of the terminal stores an operating system, a database, and a computer-readable instruction. The database may store a control information sequence. When the computer-readable instruction is executed by the processor, the processor may implement an attribute encryption method based on multiple authoritative centers. The processor of the terminal is used to provide computing and control capabilities to support the operation of the entire terminal. The memory of the terminal may store computer-readable instructions. When the computer-readable instruction is executed by the processor, the processor may execute an attribute encryption method based on multiple authoritative centers. The network interface of the terminal is used to connect and communicate with the terminal. It can be understood by those skilled in the art that the structure shown in the figure is only a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the terminal to which the scheme of the present application is applied. The specific terminal may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0115] It will be understood by those skilled in the art that the "terminal" and "terminal device" used herein include both devices with wireless signal receivers, which are devices with only wireless signal receivers without transmission capabilities, and devices with receiving and transmitting hardware, which are electronic devices with receiving and transmitting hardware capable of performing two-way communications on a two-way communication link. Such electronic devices may include: cellular or other communication devices, which have a single-line display or a multi-line display or a cellular or other communication device without a multi-line display; PCS (Personal Communications Service), which may combine voice, data processing, fax and / or data communication capabilities; PDA (Personal Digital Assistant), which may include a radio frequency receiver, a pager, Internet / intranet access, a web browser, a notepad, a calendar and / or a GPS (Global Positioning System) receiver; conventional laptop and / or palmtop computers or other devices, which have and / or include a conventional laptop and / or palmtop computer or other device with a radio frequency receiver. The "terminal" and "terminal device" used herein may be portable, transportable, installed in a vehicle (air, sea and / or land), or adapted and / or configured to operate locally, and / or in a distributed form, at any other location on the earth and / or in space. The "terminal" and "terminal device" used herein may also be a communication terminal, an Internet terminal, a music / video playing terminal, such as a PDA, a MID (Mobile Internet Device) and / or a mobile phone with a music / video playing function, or a smart TV, a set-top box and other devices.

[0116] The present invention also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the attribute encryption method based on multiple authority centers described in the above-mentioned embodiments.

[0117] This embodiment also provides a computer program that can be distributed on a computer-readable medium and executed by a computing device to implement at least one step of the attribute encryption method based on multiple authority centers described in the above embodiments; and in some cases, at least one of the steps shown or described can be executed in an order different from that described in the above embodiments.

[0118] This embodiment further provides a computer program product, including a computer readable device, on which the computer program as shown above is stored. In this embodiment, the computer readable device may include the computer readable storage medium as shown above.

[0119] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0120] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0121] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0122] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A multi-authority center-based attribute encryption method, characterized in that: include: Generate the basic seed matrix based on the bilinear pairing tuples, calculate the master key, and publish the public parameters; Splitting the basic seed matrix to obtain a plurality of sub-matrices; The sub-matrices are randomly distributed to a plurality of authoritative centers, and the authoritative centers calculate secret values ​​according to the distributed sub-matrices; Generate a private key of the user to be created, wherein the private key of the user to be created is obtained by aggregating the partial secret values ​​calculated by the authoritative center participating in the calculation and the master key; Obtain the input message to be encrypted and select a suitable access structure to generate ciphertext, and upload the ciphertext to the cloud service provider; or, Obtain a target private key belonging to a target user, convert the target private key into a blinded key, and upload the blinded key to a cloud service provider, so that the cloud service provider calculates the blinded ciphertext based on the blinded key and the ciphertext stored therein; Verify whether the cloud service provider has correctly performed the outsourced decryption by using the target private key and the blinded ciphertext, and if so, send the blinded ciphertext to the target user; Generate the private key of the user to be created, including: Obtain the attribute set and ID of the user to be created, and match the matching seed matrix set belonging to the user to be created in multiple sub-matrices; Selecting an authoritative center to participate in the calculation according to the matching seed matrix set; Aggregate the partial secret values ​​calculated by all authoritative centers participating in the calculation, obtain the secret value of the user to be created, and generate the private key of the user to be created based on the secret value and the master key; The partial secret value calculated by any participating authority is calculated using the following formula: Where m represents the number of matching seed matrices that match the user to be created in multiple sub-matrices, and d m It is a partial secret value calculated by any participating authority center according to the submatrix assigned to it. The calculation principle is to randomly select a value in each column of the submatrix assigned to the authority center for accumulation. w is used to record the hash value of each submatrix and ID. A matching seed matrix that matches the user to be created in multiple sub-matrices; The partial secret value calculated based on all sub-matrices of any authority center is d n , l i and h i for The dimension of the partial secret value calculated by all participating authoritative centers is n b is the total number of sub-matrices; The private key of the user to be created is generated based on the secret value and the master key. The formula is: Where S is the attribute set of the target user account, x represents the attribute in the attribute set S, represents the master key, d represents the secret value, ω1 and ω2 are random numbers; represents the group in the x-map common parameter The d-th power after the private key of the user to be created sk=(sk1,sk2,{sk x } x∈S ); Obtain the message to be encrypted entered by the user and the user's access structure to generate ciphertext, including: Set T = {t|ρ(t)∈S}; Pick a random vector The calculation formula for generating ciphertext is: Ciphertext The access structure is matrix The dimension is n1×n2, ρ is a mapping function that maps each attribute in the access structure Γ to the matrix The message to be encrypted is α, y is a secret random number, S M is the hash fingerprint, H3(α) is the hash function, H4(α) is a hash function, Represents traversal A specific row of , C is the first part of the ciphertext calculated according to the public parameters, C1 is the second part of the ciphertext calculated according to the public parameters, and C3 is the third part of the ciphertext calculated according to the public parameters; Converting the target private key into a blinded key comprises: Among them, sk is the target private key, Indicates in the collection The random number obtained from middle represents a set of integers, p is a prime number in the bilinear pairing tuple, and S is the attribute set of the target user account; Blind key bk = (bk1, bk2, {bk x } x∈S ).

2. The attribute encryption method based on multiple authority centers as claimed in claim 1, characterized in that: If the target private key of the target user is lost, the target private key can be recovered based on the partial secret value calculated by all authoritative centers participating in the calculation.

3. The attribute encryption method based on multiple authority centers as claimed in claim 1, characterized in that: The cloud service provider calculates the blinded ciphertext based on the blinded key and the stored ciphertext, including: Get θ t , and θ t satisfy Calculate the blinded ciphertext 4. The attribute encryption method based on multiple authority centers as claimed in claim 3, characterized in that: Verifying whether the cloud service provider correctly performs outsourced decryption by using the target private key and the blinded ciphertext includes: calculate According to the calculated value of α, if Equal to S M , then the cloud service provider correctly performs the outsourced decryption, otherwise the cloud service provider incorrectly performs the outsourced decryption.

5. A chip, characterized in that: include: The first processor is used to call and run a computer program from a first memory, so that a device equipped with the chip executes each step of the attribute encryption method based on multiple authority centers as described in any one of claims 1 to 4.

6. A terminal, characterized in that: The method comprises a second memory, a second processor, and a computer program stored in the second memory and executable on the second processor, wherein the second processor implements the steps of the attribute encryption method based on multiple authority centers as described in any one of claims 1 to 4 when executing the computer program.

Images