A threshold multi-center attribute-based encryption method with high Byzantine fault tolerance threshold

Abstract

The present invention provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold, including: the attribute committee node obtains the number of the attribute committee, calls a distributed key generation algorithm, generates a total public key and a public and private key share corresponding to each node; the encryption party receives the total public key sent by the attribute committee node, and encrypts the data according to the total public key of the attribute committee; the attribute committee node obtains the user attribute, the user's global identity identifier and the node private key to obtain the user attribute key; the user receives the public key share and the user attribute key sent by the attribute committee node, and aggregates the target number of valid attribute keys; the user decrypts the encrypted data sent by the encryption party according to the aggregate key. This method achieves complete decentralization by replacing a single attribute organization with multiple attribute committees that manage keys in parallel; and solves the single-point vulnerability problem of the attribute organization in the encryption algorithm by applying a distributed key generation algorithm.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption, and in particular relates to a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold. Background Art

[0002] Attribute-based Encryption (ABE) is an important research field in public key cryptography. It can perform fine-grained access control on confidential data based on different attribute values ​​and flexible access policies, allowing the data owner to encrypt the data once according to the attributes of the target user group and the public key of the corresponding organization, that is, it can be decrypted by multiple decryption parties with corresponding attributes.

[0003] The traditional ABE scheme uses a single attribute authority to issue attribute keys for users, which is difficult to apply in practical scenarios due to centralization and scalability issues. Therefore, a study proposed Multi-Authority Attribute-based Encryption (MA-ABE), which independently manages different attribute sets by establishing multiple attribute authorities. In MA-ABE, the attribute authority issues attribute keys to users, and the data owner performs encryption based on the public key of the attribute in the access policy. The public key and private key are held by the attribute authority, where the private key is used to issue the user's attribute key. Therefore, the security and performance of the attribute authority are crucial to the entire system.

[0004] In ABE, a single centralized attribute mechanism has a weak defense capability against corrupt adversaries, which leads to the leakage of the private key of the attribute mechanism, and then damages the security of the ciphertext. As an improvement of ABE, MA-ABE provides a certain degree of fault tolerance, but each attribute mechanism is centralized in nature, so the problems in ABE still exist. When an attribute mechanism is compromised, the private key corresponding to any attribute A is leaked, and the ciphertext encrypted by the access policy like policy = ((policy')orA) will be leaked. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold to solve the single-point vulnerability problem of attribute mechanism in traditional attribute-based encryption algorithms.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] According to the first aspect, an embodiment of the present invention provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold, which is applied to a system composed of a user, an encryption party and multiple attribute committees, wherein an attribute committee includes multiple nodes, and the method includes: each node of the attribute committee obtains global parameters and the number of the attribute committee, calls a distributed key generation algorithm multiple times, generates a total public key of the attribute committee and a public and private key share corresponding to each node; the encryption party receives the total public key sent by the attribute committee node, and encrypts the data according to the total public key of the attribute committee; each node of the attribute committee obtains user attributes, the user's global identity identifier and the node private key to obtain a user attribute key; the user receives the public key share and the user attribute key sent by the attribute committee node, and determines whether the user attribute key is valid according to the public key share. When the target number of attribute keys is judged to be valid, the target number of attribute keys are aggregated to obtain an aggregated attribute key; the user decrypts the encrypted data sent by the encryption party according to the aggregated attribute key.

[0008] Optionally, it also includes: when any node of the attribute committee detects that the number of corrupt nodes and crashed nodes exceeds a threshold or the detection times out, a public-private key share update request message is broadcast.

[0009] Optionally, it includes: when any node of the attribute committee receives a public-private key share update request message, determining whether the public-private key share request message is valid by verifying the signature; when any node of the attribute committee receives a target number of valid public-private key share request messages, generating new public-private key shares according to the target generation method.

[0010] Optionally, when any node of the attribute committee receives a target number of valid public and private key share request messages, it generates new public and private key shares according to the target generation method, including: the attribute committee node P i Based on the active secret sharing protocol, the current key share is secretly shared to generate new public and private key shares and commitments; the attribute committee node P i Using the attribute committee node P j The public key encrypts the new public and private key shares to obtain the ciphertext, and generates a zero-knowledge proof through the ciphertext and commitment; the attribute committee node P i Encode the ciphertext, commitment, and zero-knowledge proof, and send the encoded ciphertext, commitment, and zero-knowledge proof to all nodes of the attribute committee; the attribute committee node P j Receive a set of successfully executed instances and reach consensus based on the set of instances.

[0011] Optionally, including: attribute committee node P j Obtain the consensus result of the instance set; attribute committee node P j Reconstruct the consensus result and obtain the attribute committee node Pi Generated ciphertext, commitment, zero-knowledge proof; attribute committee node P j Verify the zero-knowledge proof and use the attribute committee node P after verification. j Decrypt the private key to get the attribute committee node P i The newly generated public and private key shares.

[0012] According to the second aspect, an embodiment of the present invention provides a threshold multi-center attribute-based encryption device with a high Byzantine fault tolerance threshold, which is applied to a system composed of a user, an encryption party and multiple attribute committees, wherein an attribute committee includes multiple nodes, and the method includes: a generation module, which is used for each node of the attribute committee to obtain global parameters and the number of the attribute committee, and to call the distributed key generation algorithm multiple times to generate a total public key of the attribute committee and a public and private key share corresponding to each node; an encryption module, which is used for the encryption party to receive the total public key sent by the attribute committee node, and to encrypt data according to the total public key of the attribute committee; an attribute key determination module, which is used for each node of the attribute committee to obtain user attributes, the user's global identity identifier and the node private key to obtain the user attribute key; an aggregation module, which is used for the user to receive the public key share and the user attribute key sent by the attribute committee node, and to determine whether the user attribute key is valid according to the public key share. When the target number of attribute keys is judged to be valid, the target number of attribute keys are aggregated to obtain the aggregated attribute key; an encrypted data sending module, which is used for the user to decrypt the encrypted data sent by the encryption party according to the aggregated attribute key.

[0013] According to the third aspect, an embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored thereon and executable on the processor, wherein the processor executes the steps of the threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold as described in the first aspect or any implementation scheme of the first aspect.

[0014] According to the fourth aspect, an embodiment of the present invention provides a computer storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold as described in the first aspect or any embodiment of the first aspect.

[0015] This embodiment provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold, which achieves complete decentralization by replacing a single attribute organization with multiple attribute committees to manage attributes and issue attribute keys in parallel. By applying a distributed key generation algorithm, private keys are dispersed to nodes in the committee in the form of thresholds, and the calculation and verification problems of public key shares are solved to prevent corrupt nodes from issuing illegal attribute keys. This can effectively defend against corruption by adversaries, improve Byzantine fault tolerance, and solve the single-point vulnerability problem of attribute organizations in traditional attribute-based encryption algorithms.

[0016] This embodiment provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold. When corrupt nodes and crashed nodes exceeding a threshold number are detected, the public and private key shares can be updated. By updating the public and private keys, security vulnerabilities caused by corrupt nodes or crashed nodes can be reduced, preventing unauthorized access or data leakage.

[0017] Other advantages, objectives and features of the present invention will be described in the following description and will be apparent to those skilled in the art to some extent, or those skilled in the art may be taught from the practice of the present invention. The objectives and other advantages of the present invention may be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to make the purpose, technical solution and beneficial effects of the present invention clearer, the present invention provides the following drawings for illustration:

[0019] Figure 1 A specific example flow chart of a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold of the present invention;

[0020] Figure 2 A schematic diagram of a system composed of a user, an encryption party and multiple attribute committees of the present invention;

[0021] Figure 3 It is a schematic diagram of the detection and broadcasting phase, and the verification and execution phase in a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold of the present invention;

[0022] Figure 4 This is a flow chart of the steps of the share generation phase and the verification reconstruction phase of the dynamic batch active key generation protocol (DBPKG protocol) of the present invention;

[0023] Figure 5 The specific steps of the threshold multi-center ABE algorithm and the dynamic threshold multi-center ABE algorithm of the present invention;

[0024] Figure 6 It is a principle block diagram of a specific example of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, it can also be the internal connection of two components, it can be a wireless connection, or it can be a wired connection. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0027] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0028] Secret sharing: is a method of splitting a secret into multiple shares, so that only when a certain number of shares are combined together can the original secret be recovered. This is often used to increase security, ensuring that no single share can independently recover the secret.

[0029] Attribute Committee Node: A group of nodes in a distributed system that is responsible for managing keys and operations related to specific attributes.

[0030] Active Secret Sharing Protocol: is a variant of the secret sharing protocol in which nodes actively share secrets to generate new shares.

[0031] Public-private key shares: In a public key encryption system, each user has a pair of keys: a public key and a private key. The present invention divides the public key and the private key into shares so that they can be managed through secret sharing.

[0032] Commitment: In cryptography, a commitment is a mechanism that allows one party to guarantee the existence or properties of some information to another party without revealing that information.

[0033] Zero-knowledge proof: is a cryptographic method that allows one party to prove to another party that a statement is correct without providing any information other than the correctness of the statement.

[0034] Consensus: In a distributed system, consensus refers to the process by which multiple nodes reach agreement on a state or value. It usually involves complex algorithms to ensure the consistency and reliability of the system.

[0035] The embodiment of the present invention mainly includes three entities: attribute committee, encryption party, and user. The adversary model introduced in the embodiment of the present invention is as follows: Consider the adversary of probabilistic polynomial time Adaptive Adversary Any honest node in the committee can be corrupted at any time, but there is an upper limit t on the number of corruptions, and the ciphertext and attribute keys can be adaptively queried. It is possible to dynamically corrupt t nodes in the committee in a unit time. When a node is corrupted, the adversary can fully control it, read all its inputs and set the messages to be sent. When the number of corrupt nodes in the committee exceeds t, their public keys and secret values ​​are all controlled by the adversary. master.

[0036] The embodiment of the present invention provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold, which is applied to a system composed of a user, an encryption party and multiple attribute committees, wherein an attribute committee includes multiple nodes, such as Figure 1 As shown, the method includes:

[0037] S101, each node of the attribute committee obtains the global parameters and the number of the attribute committee, calls the distributed key generation algorithm multiple times, and generates the total public key of the attribute committee and the public and private key shares corresponding to each node;

[0038] S103, the encryption party receives the total public key sent by the attribute committee node, and encrypts the data according to the total public key of the attribute committee;

[0039] S105, each node of the attribute committee obtains the user attribute, the user's global identity identifier and the node private key to obtain the user attribute key;

[0040] S107, the user receives the public key share and the user attribute key sent by the attribute committee node, and determines whether the user attribute key is valid according to the public key share. When the target number of attribute keys are determined to be valid, the target number of attribute keys are aggregated to obtain an aggregated attribute key;

[0041] S109, the user decrypts the encrypted data sent by the encryption party according to the aggregated attribute key.

[0042] For example, Figure 2 As shown, this embodiment provides a schematic diagram of a system consisting of a user, an encryption party, and multiple attribute committees. Each attribute committee includes multiple nodes, and each party in the system executes the following process:

[0043] (1) Global initialization GlobalSetup(1 κ ) → GP:

[0044] Input security parameters and output global parameters.

[0045] (2) Committee initialization CommitteeSetup(GP,i)→{sk i,j ,pk i ,pk i,j}:

[0046] It is called by each node of the attribute committee, and inputs the global parameters and the committee number. The algorithm calls DKG multiple times and outputs the total public key of the committee and the public and private key shares corresponding to each node.

[0047] DKG is a distributed key generation algorithm first proposed by Pedersen in 1991. It is based on secret sharing technology. In it, n participants can achieve distributed distribution and recovery of keys without a trusted third party. i Get the public and private key share dpk of (t,n) threshold i ,dsk i , and a total public key TPK. This process can tolerate t malicious participants, so that only a set of nodes greater than t can use the shared private key. The black box description of the DKG algorithm is as follows:

[0048] DKG(1 λ )→(dsk i ,dpk i ,TPK). The input is the security parameter λ, and the output is each participant P i The public and private key dpk i ,dsk i , and a total public key TPK.

[0049] (3) Encrypt(M,(A,ρ),{pk i})→CT:

[0050] Called by the encryption party, it inputs the plaintext, access matrix and the total public key of the corresponding committee, and outputs the ciphertext.

[0051] (4)Key generationKeyGen(k,GID,sk k,i,j )→K k,i,j :

[0052] It is called by each node of the attribute committee, inputs the user's attributes, the user's global identity identifier and the node private key, and outputs the user's attribute key.

[0053] (5)Key VerificationKeyVer(K k,i,j ,pk k,i,j ) → 1 / 0:

[0054] Called by the user, it inputs the attribute key issued by the node and the node's public key share, and outputs a Boolean value to determine whether the attribute key is valid.

[0055] (6) Key aggregation KeyAgg ({K k,i,j})→K k,i :

[0056] Called by the user, input the attribute key issued by the node, and after verifying the validity of each key, aggregate more than t valid keys and output the aggregated attribute key.

[0057] (7) Decrypt(CT,{K k,i})→M / ⊥:

[0058] Called by the user, it inputs the ciphertext and the aggregated attribute key, and outputs the decrypted plaintext or a decryption failure indicator.

[0059] The specific algorithm used by the method in this embodiment is as follows:

[0060]

[0061]

[0062]

[0063] This embodiment provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold. By replacing a single attribute agency with multiple attribute committees to manage attributes and issue attribute keys in parallel, complete decentralization is achieved; by applying a distributed key generation algorithm, n participants generate a shared public key without mutual trust, and generate a private key share for each participant, and the process can tolerate t malicious participants. The public and private key shares generated by DKG have threshold characteristics, and the public secret corresponding to the total public key can only be revealed when more than t nodes cooperate. By applying DKG, the private key of the attribute agency can be distributed to the committee in the form of a threshold to generate a share of the attribute key, which can be calculated and verified by the public key share generated by DKG, preventing corrupt nodes from changing public keys or issuing illegal attribute keys, effectively defending against the corruption of adaptive adversaries, improving Byzantine fault tolerance, and solving the single-point vulnerability problem of the attribute agency in the traditional attribute-based encryption algorithm.

[0064] As an optional implementation, a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold also includes:

[0065] When any node in the attribute committee detects that the number of corrupt nodes and crashed nodes exceeds the threshold or the detection times out, it broadcasts a public and private key share update request message.

[0066] Exemplarily, the key share update step includes detection and broadcast stages, that is, if any node of the attribute committee identifies malicious behavior or timeout, an update message needs to be broadcast.

[0067] The specific algorithm used by the method in this embodiment is as follows:

[0068]

[0069] like Figure 3 As shown, it includes the e-1 period and the e period. In the e-1 period, the property committee Node P in i e-1 When the number of corrupted nodes and crashed nodes exceeding the threshold is detected or the detection timeout occurs, the share update message m is broadcast. i .

[0070] In addition, when there is a need for internal nodes of the attribute committee to join or exit, a public-private key share update request message can also be broadcast to enable dynamic joining and exit of internal nodes of the attribute committee.

[0071] This embodiment provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold. When corrupt nodes and crashed nodes exceeding a threshold number are detected, the public and private key shares can be updated. By updating the public and private keys, security vulnerabilities caused by corrupt nodes or crashed nodes can be reduced, preventing unauthorized access or data leakage.

[0072] As an optional implementation, a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold includes:

[0073] When any node of the attribute committee receives a public-private key share update request message, it determines whether the public-private key share request message is valid by verifying the signature; when any node of the attribute committee receives the target number of valid public-private key share request messages, it generates new public-private key shares according to the target generation method.

[0074] Exemplarily, the key share update step includes verification and execution phases, that is, any node of the attribute committee verifies the signature after receiving the update request message from other nodes. When any node of the attribute committee receives t+1 valid update messages, it starts to execute the dynamic batch active key generation protocol (DBPKG protocol), where the size of t is determined by the threshold, n is the total number of nodes, and the threshold given in this embodiment is (n, t). In the threshold system, only when a certain number of shares (i.e., the threshold) is reached can the secret be recovered or an operation be completed. This ensures that the system can still work normally even if some nodes are unavailable or attacked.

[0075] The specific algorithm used by the method in this embodiment is as follows:

[0076]

[0077]

[0078] like Figure 3As shown, in the verification and execution phase, that is, the e-1 period, the attribute committee node P i e-1 Call the DBPKG protocol to generate public and private key shares and enter period e.

[0079] This embodiment provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold. The node first verifies the signature of the request message to ensure that the source of the request message is credible and the message has not been tampered with during transmission.

[0080] As an optional implementation, in the above-mentioned threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold, when a target number of valid public and private key share request messages are received, new public and private key shares are generated according to the target generation method, including:

[0081] Attribute committee node P i Based on the active secret sharing protocol, the current key share is secretly shared to generate new public and private key shares and commitments; the attribute committee node P i Using the attribute committee node P j The public key encrypts the new public and private key shares to obtain the ciphertext, and generates a zero-knowledge proof through the ciphertext and commitment; the attribute committee node P i Input the ciphertext, commitment and zero-knowledge proof into asynchronous verifiable information dissemination, and send the ciphertext, commitment and zero-knowledge proof to all nodes of the attribute committee; the attribute committee node P j Receive a set of successfully executed instances and reach consensus based on the set of instances.

[0082] Exemplarily, this embodiment adopts the dynamic batch active key generation protocol (DBPKG protocol) to generate new public and private key shares. In this method embodiment, the steps of the share generation phase using the dynamic batch active key generation protocol (DBPKG protocol) are described, see Figure 4 As shown:

[0083] Step 1: Attribute committee node P i Call DBPSS.Input to get the current key share Perform secret sharing and generate new shares

[0084] The DBPSS technique is an improvement on the secret sharing technique proposed by Shamir et al., which introduces a mobile adversary. Members holding secrets need to actively update their secret shares while keeping the secret value unchanged to ensure that the secret value remains confidential for a long time. However, in actual situations, the share holders may change. Therefore, a dynamic committee is introduced on the basis of active secret sharing to obtain dynamic active secret sharing, in which the members holding the secret may change. DBPSS was proposed by Yurek et al. in 2022. Based on dynamic active secret sharing, it reduces the communication complexity by updating shares in batches. One execution of the protocol can update the secret shares of multiple secret values, and the total communication complexity is O(n 3 ), the amortized complexity is O(n 2 ).

[0085] The black box description of DBPSS is as follows:

[0086] The algorithm is executed by the nodes of the old committee with a threshold of (n, t). Each node inputs the B secret shares it holds for batch secret sharing, outputs new shares and commitments, and sends them to the nodes of the new committee with a threshold of (n', t').

[0087] The algorithm is a consensus algorithm for the set of successfully executed secret sharing instances by the nodes in the new committee, and after the corresponding secret sharing instances are successfully executed, the shares are obtained and verified, and finally a new share is reconstructed. The output is the new share and the corresponding commitment and the successfully executed secret sharing instance.

[0088] Step 2: Attribute Committee Node P i Using the attribute committee node P j The public key will share Encrypted And through the ciphertext promise Generating a zero-knowledge proof By verifying the zero-knowledge proof, the verifier can determine that the received ciphertext is encrypted by the share and that the share corresponds to the commitment without obtaining the share itself. i and the attribute committee node P j They are the old committee nodes with threshold (n, t) and the new committee nodes with threshold (n', t').

[0089] Step 3: The node uses AVID.Disperse to send the ciphertext promise and zero-knowledge proofs The encoded data is sent to all nodes in the committee.

[0090] Asynchronous Verifiable Information Dispersal (AVID) uses erasure codes to encode messages into n data blocks, each of which is sent to the corresponding node. Eventually, each node can decode the entire message using more than t data blocks. Using AVID instead of broadcasting can reduce the communication complexity of sending messages while ensuring that honest nodes eventually get the correct message.

[0091] The black box description of the AVID protocol is as follows:

[0092] (1)AVID.Disperse(M)→(M i ,C i ,r). The input is message M, and the output is data blocks of n nodes, commitments of blocks, and Merkle root r.

[0093] (2)AVID.Retrieve()→M / ⊥. The node obtains data blocks from other nodes and outputs the reconstructed message M or the reconstruction failure indicator ⊥.

[0094] Step 4: Node P j Get the set of successfully executed AVID.Disperse instances T j , the set T j As input, MVBA is called for consensus.

[0095] Multi-value Verified Asynchronous Byzantine Agreement (MVBA) is an asynchronous Byzantine fault-tolerant consensus algorithm originally proposed by Cachin et al. In MVBA, each participating node contributes an input and reaches a consensus on one of the values ​​as output, which satisfies a predefined public predicate f(·).

[0096] MVBA meets the following characteristics:

[0097] (1) Consistency: All honest nodes output the same value

[0098] (2) Externally verifiable: If an honest node outputs a, then f(a) = 1

[0099] (3) Termination: If the inputs of all honest nodes satisfy the predicate, then all nodes will eventually get the output.

[0100] The specific algorithm used by the method in this embodiment is as follows:

[0101]

[0102] This embodiment provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold. The key share is updated through the above method, ensuring the security of encrypted data under mobile adversaries. In addition, an attribute committee often holds multiple sets of public and private key shares, and DBPSS can share multiple secret values ​​in one execution process. However, DBPSS cannot solve the problem of verifiable update of public key shares of nodes within the committee. The embodiment of the present invention combines the asynchronous verifiable information dissemination protocol (AVID) and the asynchronous multi-valued Byzantine consensus (MVBA) to reduce the communication complexity of the process while realizing share updates.

[0103] The embodiment of the present invention provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold. In the above embodiment, after the share generation, the dynamic batch active key generation protocol (DBPKG protocol) also includes a verification reconstruction step, see Figure 4 As shown, the steps to verify the reconstruction include:

[0104] Attribute committee node P j Get the consensus result T of the instance set; attribute committee node P j Reconstruct the output of the AVID instance in T to obtain the attribute committee node P i Generated ciphertext, commitment, zero-knowledge proof; attribute committee node P j Verify the zero-knowledge proof and use the attribute committee node P after verification. j Decrypt the private key to get the attribute committee node P i The newly generated public and private key shares.

[0105] For example, in the verification and reconstruction phase, the attribute committee node P j Steps to perform:

[0106] Step 1: Node P i Call DBPSS.Output to get new shares from other nodes A consensus is reached on the set of successfully executed ACSS instances to ensure that all honest nodes obtain the same set of ACSS instances T.

[0107] Step 2: Node P j Get the consensus result T' of the successfully executed AVID.Disperse instance set, execute the corresponding AVID.Retrieve according to T', and obtain the node P i Generated ciphertext promise and zero-knowledge proofs Verify the zero-knowledge proof, and after verification, use your own private key to decrypt and obtain the node P i Generated share

[0108] Step 3: Node P j According to the sets T and T' and the verified and Reconstruct new public and private key shares.

[0109] The specific algorithms for the verification and reconstruction phases are as follows:

[0110]

[0111] This embodiment provides a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold, which can verify and reconstruct public and private key shares through the above-mentioned dynamic batch active key generation protocol (DBPKG protocol).

[0112] To facilitate understanding of the above embodiments, specific steps of each embodiment are given here. Figure 5 Steps S101-S109 are called threshold multi-center ABE algorithm. The key share update step is supplemented on the basis of the threshold multi-center ABE algorithm to realize the dynamic threshold multi-center ABE algorithm. The key share update step needs to call detection and broadcast, verification and execution and dynamic batch active key generation protocol (DBPKG protocol).

[0113] The embodiment of the present invention provides a threshold multi-center attribute-based encryption device with a high Byzantine fault tolerance threshold, comprising:

[0114] The generation module is used for each node of the attribute committee to obtain global parameters and the number of the attribute committee, and to call the distributed key generation algorithm multiple times to generate the total public key of the attribute committee and the public and private key shares corresponding to each node;

[0115] The encryption module is used for the encryption party to receive the total public key sent by the attribute committee node and encrypt the data according to the total public key of the attribute committee;

[0116] The attribute key determination module is used by each node of the attribute committee to obtain the user attributes, the user's global identity identifier and the node private key to obtain the user attribute key;

[0117] Aggregation module, used for receiving the public key share and user attribute key sent by the attribute committee node, judging whether the user attribute key is valid according to the public key share, and aggregating the target number of attribute keys to obtain an aggregated attribute key when the target number of attribute keys are judged to be valid;

[0118] The encrypted data sending module is used for users to decrypt the encrypted data sent by the encryption party according to the aggregated attribute key.

[0119] The present application also provides a drone device, such as Figure 6 As shown, a processor 501 and a memory 502, wherein the processor 501 and the memory 502 may be connected via a bus or other means.

[0120] The processor 501 may be a central processing unit (CPU). The processor 501 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0121] The memory 502, as a non-transient computer-readable storage medium, can be used to store non-transient software programs, non-transient computer executable programs and modules, such as program instructions / modules corresponding to the threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold in the embodiment of the present invention. The processor executes various functional applications and data processing of the processor by running the non-transient software programs, instructions and modules stored in the memory.

[0122] The memory 502 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 502 may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0123] The one or more modules are stored in the memory 502, and when executed by the processor 501, the following is performed: Figure 1 A threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold in the illustrated embodiment.

[0124] For details of the above drone equipment, please refer to Figure 1 The corresponding related descriptions and effects in the illustrated embodiments can be understood and will not be repeated here.

[0125] This embodiment also provides a computer storage medium, which stores computer executable instructions, and the computer executable instructions can execute the threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold in any of the above method embodiments. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviated: HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memory.

[0126] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes can be made in form and details without departing from the scope defined by the claims of the present invention.

Claims

1. A threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold, characterized in that: Applied to a system consisting of a user, an encryption party, and multiple attribute committees, where an attribute committee contains multiple nodes, the method includes: Each node of the attribute committee obtains the global parameters and the number of the attribute committee, and calls the distributed key generation algorithm multiple times to generate the total public key of the attribute committee and the public and private key shares corresponding to each node; The encryption party receives the total public key sent by the attribute committee node and encrypts the data according to the total public key of the attribute committee; Each node of the attribute committee obtains the user attributes, the user's global identity identifier and the node private key to obtain the user attribute key; The user receives the public key share and user attribute key sent by the attribute committee node, and determines whether the user attribute key is valid based on the public key share. When the target number of attribute keys are judged to be valid, the target number of attribute keys are aggregated to obtain an aggregated attribute key. The user decrypts the encrypted data sent by the encryption party according to the aggregated attribute key.

2. According to claim 1, a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold is characterized in that: Also includes: When any node in the attribute committee detects that the number of corrupt nodes and crashed nodes exceeds the threshold or the detection times out, it broadcasts a public and private key share update request message.

3. A threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold according to claim 1 or 2, characterized in that: include: When any node of the attribute committee receives a public-private key share update request message, it determines whether the public-private key share request message is valid by verifying the signature, where the signature is the signature of the node that broadcasts the public-private key share update request message. When any node of the attribute committee receives the target number of valid public and private key share request messages, it generates new public and private key shares according to the target generation method; When any node of the attribute committee receives a target number of valid public and private key share request messages, it generates new public and private key shares according to the target generation method, including: Attribute committee node P i Based on the active secret sharing protocol, the current key share is secretly shared to generate new public and private key shares and commitments; Attribute committee node P i Using the attribute committee node P j The public key encrypts the new public and private key shares to obtain the ciphertext, and generates a zero-knowledge proof through the ciphertext and commitment; Attribute committee node P i Encode the ciphertext, commitment, and zero-knowledge proof, and send the encoded ciphertext, commitment, and zero-knowledge proof to all nodes of the attribute committee; Attribute committee node P j Receive a set of successfully executed instances and reach consensus based on the set of instances.

4. According to claim 3, a threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold is characterized in that: include: Attribute committee node P j Get the consensus result of the instance set; Attribute committee node P j Reconstruct the consensus result and obtain the attribute committee node P i Generated ciphertext, commitment, and zero-knowledge proof; Attribute committee node P j Verify the zero-knowledge proof and use the attribute committee node P after verification. j Decrypt the private key to get the attribute committee node P i The newly generated public and private key shares.

5. A threshold multi-center attribute-based encryption device with a high Byzantine fault tolerance threshold, characterized in that: Applied to a system consisting of a user, an encryption party, and multiple attribute committees, where an attribute committee contains multiple nodes, the method includes: The generation module is used for each node of the attribute committee to obtain global parameters and the number of the attribute committee, and to call the distributed key generation algorithm multiple times to generate the total public key of the attribute committee and the public and private key shares corresponding to each node; The encryption module is used for the encryption party to receive the total public key sent by the attribute committee node and encrypt the data according to the total public key of the attribute committee; The attribute key determination module is used by each node of the attribute committee to obtain the user attributes, the user's global identity identifier and the node private key to obtain the user attribute key; Aggregation module, used for receiving the public key share and user attribute key sent by the attribute committee node, judging whether the user attribute key is valid according to the public key share, and aggregating the target number of attribute keys to obtain an aggregated attribute key when the target number of attribute keys are judged to be valid; The encrypted data sending module is used for users to decrypt the encrypted data sent by the encryption party according to the aggregated attribute key.

6. An electronic device, comprising: A memory, a processor, and a computer program stored thereon and executable on the processor, characterized in that the processor executes the steps of the threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold as described in any one of claims 1-4 above.

7. A computer storage medium having computer instructions stored thereon, characterized in that: When the instruction is executed by the processor, the steps of the threshold multi-center attribute-based encryption method with a high Byzantine fault tolerance threshold described in any one of claims 1-4 are implemented.

Images