Accountable identity-based broadcast agent re-encryption method and system

Abstract

The present application relates to an accountable identity-based broadcast proxy re-encryption generation method and system, including: initialization setup, registration setup, proxy key setup, encryption setup, re-encryption key setup, re-encryption setup, decryption setup, and judgment setup steps. The identity-based broadcast proxy re-encryption generation method only needs to be executed once to generate re-encrypted ciphertext for multiple data requesters, embeds the proxy public key in the re-encryption key, and designs an efficient judgment algorithm to identify malicious entities, thereby holding entities that abuse decryption permissions accountable. Simultaneously, the re-encryption key is constructed based on Lagrange interpolation polynomials to achieve data requester identity privacy. The method of the present application can meet the needs of multiple data requesters sharing data while ensuring data confidentiality and identity privacy, and reduces computational complexity and improves computational and storage efficiency.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular, to an accountable identity-based broadcast agent re-encryption method and system. Background Art

[0002] Proxy re-encryption enables data sharing by converting the data owner's ciphertext into ciphertext decipherable by the data requester. However, it only supports one-to-one sharing. When the data owner wants to share data with multiple data requesters, multiple re-encryption keys need to be generated, and the proxy needs to perform multiple re-encryption operations, resulting in excessive computational overhead and waste of communication and storage resources. To address this issue, broadcast proxy re-encryption was proposed, which not only achieves ciphertext conversion but also meets the one-to-many data sharing requirements. When multiple data requesters access the same shared data, it can significantly save computational and communication storage overhead. To avoid complex certificate management issues, identity-based broadcast proxy re-encryption was proposed.

[0003] However, existing identity-based broadcast proxy re-encryption suffers from the problem that agents and data requesters can collude to obtain decryption permissions for all the data of the data owner, creating decryption devices and leading to abuse of decryption permissions. Furthermore, since the data owner also has the same decryption permissions, agents and data requesters could also accuse the data owner of malicious behavior. Consequently, the malicious distribution or circulation of illegal decryption devices with decryption capabilities would pose serious security and privacy issues. Furthermore, when accessing certain sensitive data, data requesters want to conceal their identity information to prevent identity privacy leaks.

[0004] To address the above issues, there is no identity-based broadcast agent re-encryption solution that holds entities that abuse decryption privileges accountable. Therefore, existing identity-based broadcast agent re-encryption solutions still have problems in terms of accountability, confidentiality, and data requester identity privacy. Summary of the Invention

[0005] In order to overcome at least one deficiency in the prior art, the present application provides an accountable identity-based broadcast agent re-encryption method and system.

[0006] In a first aspect, a method for accountable identity-based broadcast agent re-encryption is provided, comprising:

[0007] Step 1: The trusted center generates system parameters and a system master private key based on security parameters, and publishes the generated system parameters to users in the system; and generates a user private key based on the system parameters, the system master private key, and the user identity;

[0008] Step 2: The agent generates the agent public key and agent private key according to the system parameters;

[0009] Step 3: The data owner outputs the original ciphertext based on the system parameters, the message to be encrypted, and the user identity; and generates a re-encryption key based on the system parameters, the user's private key, and the identity set of the data requester to be shared;

[0010] Step 4: The proxy outputs the re-encrypted ciphertext based on the system parameters, re-encryption key, and original ciphertext.

[0011] Step 5: For the original ciphertext, the data owner outputs the plaintext message based on the system parameters and the user's private key; for the re-encrypted ciphertext, the data requester outputs the plaintext message based on the system parameters and the user's private key;

[0012] In step 6, the trusted third party determines that the party that generates the illegal decryption device is the agent or the data owner based on the system parameters and the agent public key.

[0013] In one embodiment, in step 1, the trusted center generates system parameters and a system master private key based on security parameters, including:

[0014] Step 11, input security parameter λ;

[0015] Step 12: The trusted center generates a prime number p factorial cyclic group and And determine the bilinear map in and The order of is p, g is The generators, h, v, h, v, u are Elements in

[0016] Step 13: The trusted center selects a random value α. For a set of integers, calculate the intermediate variables g1, h1, and h2:

[0017] g1=g α , h1=h r , h2=h αr

[0018] Step 14: The trusted center selects two hash functions H0 and H1;

[0019] Step 15: Output system parameters PP = (g1, v, v α ,u,u α ,h,h α , h1, h2, e(g, h), H0, H1); and secretly hold the system master private key MSK = (g, α).

[0020] In one embodiment, in step 1, generating a user private key based on system parameters, a system master private key, and a user identity includes:

[0021] Step 16: Input the system parameters PP, system master private key MSK and user ID;

[0022] Step 17: Output the user private key SK ID :

[0023]

[0024] Where g is the prime number p factorial cyclic group The generator of , α is a random value, and H0 is a hash function.

[0025] In one embodiment, in step 2, the agent generates a proxy public key and a proxy private key based on system parameters, including:

[0026] Step 21, input system parameter PP;

[0027] Step 22, select a random value For an integer set, calculate the proxy public key PK P and the proxy private key SK P :

[0028] PK P =v x

[0029] SK P =x

[0030] Where v is the prime number p factorial cyclic group elements.

[0031] In one embodiment, in step 3, the data owner outputs the original ciphertext based on the system parameters, the message to be encrypted, and the user identity, including:

[0032] Step 31: Input system parameters PP, message to be encrypted M and user ID;

[0033] Step 32, select a random value is a set of integers, and the original ciphertext that can only be decrypted by the data owner is calculated

[0034]

[0035] Among them, C0 and C1 are both original ciphertext Part of, e is a bilinear map, g is a prime number p factorial cyclic group The generator of α is a random value, H0 is a hash function; h is the prime number p factorial cyclic group Elements in

[0036] And calculate the shareable original ciphertext CT ID :

[0037]

[0038] Among them, C0, C1, C2, and C3 are all original ciphertext CT ID Part of h, v, u is a prime number p factorial cyclic group Elements in

[0039] Step 33: Output the shareable original ciphertext CT ID .

[0040] In one embodiment, in step 3, generating a re-encryption key based on system parameters, the user's private key, and the set of identities of the data requesters to be shared includes:

[0041] Step 34: Enter system parameters PP and user private key SK ID ;

[0042] Step 35, specify the identity set S of the data requesters to be shared, i is the user number in S, n is the maximum value of the user number in S, m is the number of all users, ID i is the identity of user i;

[0043] Step 36: For each user in the identity set S, calculate the point in, is the horizontal coordinate of user i, is the vertical coordinate of user i:

[0044]

[0045] Among them, α is a random value; h is the prime number p factorial cyclic group Elements in

[0046] Utilization Point Construct the polynomial F(x) and determine the coefficients a0, a1, ...a of the polynomial n ;

[0047] F(x)=a0+a1x+…+a n x n

[0048] Where x is the variable of the polynomial;

[0049] Step 37, calculate the re-encryption key RKID→S :

[0050]

[0051] Among them, rk1, rk2, rk3, and rk4 are all re-encryption keys RK ID→S Part of, H0, H1 are hash functions, e is a bilinear map, g is the prime number p factorial cyclic group Generators, h, v, u are prime number p factorial cyclic groups Elements in t, is a random number, x is a random number, and r2 is an intermediate variable;

[0052] Step 38: Output the re-encryption key RK ID→S Send to agent.

[0053] In one embodiment, in step 4, the agent outputs the re-encrypted ciphertext based on the system parameters, the re-encryption key, and the original ciphertext, including:

[0054] Step 41: Input system parameters PP and re-encryption key RK ID→S and the original ciphertext CT ID ;

[0055] Step 42: Calculate the re-encrypted ciphertext CT′ S =(C′1, C′2, C′3, C′4), where C′1, C′2, C′3, and C′4 are all part of the re-encrypted ciphertext:

[0056] C′1=rk1

[0057]

[0058] C′3=rk3

[0059] C′4=C2

[0060] Among them, rk1, rk2, rk3, and rk4 are all re-encryption keys RK ID→S Part of, C0, C1, C2, C3 are the original ciphertext CT ID Part of, e is a bilinear map, SK P is the proxy private key, h1 is the intermediate variable, M is the message to be encrypted, h, u are the prime number p factorial cyclic group The elements in is a random number, α and s are random values, H0 is a hash function, and ID is the user identity;

[0061] Step 43: Output the re-encrypted ciphertext CT′ S =(C′1, C′2, C′3, C′4) is sent to the data requester.

[0062] In one embodiment, in step 5, for the original ciphertext, the data owner outputs a plaintext message based on the system parameters and the user's private key; for the re-encrypted ciphertext, the data requester outputs a plaintext message based on the system parameters and the user's private key, including:

[0063] Step 51: Input system parameters PP and user private key SK ID , original ciphertext CT ID Or re-encrypt ciphertext CT S ';

[0064] Step 52, for the original ciphertext Calculate the plaintext message M′:

[0065] M′=C0 / e(SK ID , C1)

[0066] Among them, C0 and C1 are the original ciphertext Part of, e is a bilinear map, SK ID The user's private key;

[0067] For the re-encrypted ciphertext CT′ S , CT′ S =(C′1, C′2, C′3, C′4), where C′1, C′2, C′3, and C′4 are all part of the re-encrypted ciphertext. Calculate the plaintext message M′:

[0068]

[0069]

[0070] Among them, H0, H1 are hash functions, is the private key of user i, is the horizontal coordinate of user i, is the vertical coordinate of user i; a0, a1, ...a n is the re-encryption key RK ID→S The third part rk3,n is the maximum value of the user ID in the identity set S of the data requester to be shared, ID i is the identity of user i; H0 is the hash function;

[0071] Step 53: Output the plaintext message M'.

[0072] In one embodiment, in step 6, the trusted third party determines the party generating the illegal decryption device as the agent or the data owner based on the system parameters and the agent public key, including:

[0073] Step 81: Input system parameters PP and proxy public key PK P ;

[0074] Step 82, select a random value s, Choose a random message M * , calculate irregular ciphertext CT, All are part of CT:

[0075]

[0076] Among them, e is a bilinear map, g is the prime number p factorial cyclic group The generators, h, v, u are Elements in PK P is the proxy public key, r, α are random values, H0 is the hash function, and ID is the user identity;

[0077] Step 83: Input the irregular ciphertext CT into the illegal decryption device and output the recovered message M. * ′, if M * ′=M * , the party that generates the illegal decryption device is determined to be the agent, otherwise, the party that generates the illegal decryption device is determined to be the data owner.

[0078] In a second aspect, an accountable identity-based broadcast proxy re-encryption system is provided, comprising: a trusted center, an agent, a data owner, a data requester, and three trusted parties;

[0079] The trusted center generates system parameters and system master private keys based on security parameters, and publishes the generated system parameters to users in the system; and generates user private keys based on system parameters, system master private keys and user identities;

[0080] The agent generates the agent public key and agent private key according to the system parameters;

[0081] The data owner outputs the original ciphertext based on the system parameters, the message to be encrypted, and the user's identity; and generates a re-encryption key based on the system parameters, the user's private key, and the identity set of the data requester to be shared;

[0082] The agent outputs the re-encrypted ciphertext based on the system parameters, re-encryption key and original ciphertext;

[0083] For the original ciphertext, the data owner outputs the plaintext message based on the system parameters and the user's private key; for the re-encrypted ciphertext, the data requester outputs the plaintext message based on the system parameters and the user's private key;

[0084] The trusted third party determines the party that generates the illegal decryption device as the agent or data owner based on the system parameters and the agent public key.

[0085] Compared with the prior art, the present application has the following beneficial effects: The present application provides an accountable identity-based broadcast agent re-encryption method and system, the method including: initialization setting, registration setting, agent key setting, encryption setting, re-encryption key setting, re-encryption setting, decryption setting and judgment setting steps. The identity-based broadcast agent re-encryption generation method only needs to be executed once to generate re-encrypted ciphertext for multiple data requesters, and embeds the agent public key in the re-encryption key, designs an efficient judgment algorithm to identify malicious entities, and implements accountability for entities that abuse decryption authority. At the same time, the re-encryption key is constructed based on the Lagrange interpolation polynomial to achieve the privacy of the data requester's identity. The method of the present application is based on the ciphertext and re-encryption key structure of the identity-based broadcast agent re-encryption algorithm, and can simultaneously complete the encryption and sharing operations of the data, meet the needs of multiple data requesters sharing data, reduce the computational complexity, and improve practicality while ensuring security. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] The present application may be better understood by referring to the following description in conjunction with the accompanying drawings, which together with the following detailed description are incorporated into and form a part of this specification. In the drawings:

[0087] Figure 1 A flow chart of an accountable identity-based broadcast agent re-encryption method according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0088] Exemplary embodiments of the present application are described below with reference to the accompanying drawings. For the sake of clarity and conciseness, not all features of actual embodiments are described in this specification. However, it should be understood that in the process of developing any such actual embodiment, many implementation-specific decisions may be made to achieve the developer's specific goals, and these decisions may vary from one implementation to another.

[0089] It is also necessary to explain here that, in order to avoid obscuring the present application due to unnecessary details, the accompanying drawings only show the device structure closely related to the solution according to the present application, while other details that are not closely related to the present application are omitted.

[0090] It should be understood that the present application is not limited to the described embodiments due to the following description with reference to the accompanying drawings. In this document, where feasible, the embodiments may be combined with each other, features between different embodiments may be replaced or borrowed, and one or more features may be omitted in one embodiment.

[0091] The embodiment of the present application provides an accountable identity-based broadcast agent re-encryption method. Figure 1 A flowchart of the accountable identity-based broadcast agent re-encryption method according to an embodiment of the present application is shown. Figure 1 , methods include:

[0092] Step 1: The trusted center generates system parameters and a system master private key based on security parameters, and publishes the generated system parameters to users in the system; and generates a user private key based on the system parameters, the system master private key, and the user identity;

[0093] Step 2: The agent generates the agent public key and agent private key according to the system parameters;

[0094] Step 3: The data owner outputs the original ciphertext based on the system parameters, the message to be encrypted, and the user identity; and generates a re-encryption key based on the system parameters, the user's private key, and the identity set of the data requester to be shared;

[0095] Step 4: The proxy outputs the re-encrypted ciphertext based on the system parameters, re-encryption key, and original ciphertext.

[0096] Step 5: For the original ciphertext, the data owner outputs the plaintext message based on the system parameters and the user's private key; for the re-encrypted ciphertext, the data requester outputs the plaintext message based on the system parameters and the user's private key;

[0097] In step 6, the trusted third party determines that the party that generates the illegal decryption device is the agent or the data owner based on the system parameters and the agent public key.

[0098] This embodiment includes initialization setup, registration setup, proxy key setup, encryption setup, re-encryption key setup, re-encryption setup, decryption setup, and judgment setup steps. This identity-based broadcast proxy re-encryption generation method only needs to be executed once to generate re-encrypted ciphertext for multiple data requesters. The proxy public key is embedded in the re-encryption key, and an efficient judgment algorithm is designed to identify malicious entities and hold entities that abuse decryption privileges accountable. Simultaneously, the re-encryption key is constructed based on Lagrange interpolation polynomials to ensure the privacy of the data requester's identity. The method of this application, based on the ciphertext and re-encryption key structure of the identity-based broadcast proxy re-encryption algorithm, can simultaneously encrypt and share data, meeting the need for data sharing among multiple data requesters, reducing computational complexity, and improving practicality while ensuring security.

[0099] In one embodiment, in step 1, the trusted center generates system parameters and a system master private key based on security parameters, including:

[0100] Step 11, input security parameter λ;

[0101] Step 12: The trusted center generates a prime number p factorial cyclic group and And determine the bilinear map in and The order of is p, g is The generators, h, v, h, v, u are Elements in

[0102] Step 13: The trusted center selects a random value α. For a set of integers, calculate the intermediate variables g1, h1, and h2:

[0103] g1=g α , h1=h r , h2=h αr

[0104] Step 14: The trusted center selects two hash functions H0 and H1; Here, H0 represents a 0, 1 bit string {0, 1} * Map to

[0105] Step 15: Output system parameters PP = (g1, v, v α ,u,u α ,h,h α , h1, h2, e(g, h), H0, H1); and secretly hold the system master private key MSK = (g, α).

[0106] In one embodiment, in step 1, generating a user private key based on system parameters, a system master private key, and a user identity includes:

[0107] Step 16: Input the system parameters PP, system master private key MSK and user ID;

[0108] Step 17: Output the user private key SK ID :

[0109]

[0110] Where g is the prime number p factorial cyclic group The generator of , α is a random value, and H0 is a hash function.

[0111] In one embodiment, in step 2, the agent generates a proxy public key and a proxy private key based on system parameters, including:

[0112] Step 21, input system parameter PP;

[0113] Step 22, select a random value For an integer set, calculate the proxy public key PK P and the proxy private key SK P :

[0114] PK P =v x

[0115] SK P =x

[0116] Where v is the prime number p factorial cyclic group elements.

[0117] In one embodiment, in step 3, the data owner outputs the original ciphertext based on the system parameters, the message to be encrypted, and the user identity, including:

[0118] Step 31: Input system parameters PP, message to be encrypted M and user ID;

[0119] Step 32, select a random value is a set of integers, and the original ciphertext that can only be decrypted by the data owner is calculated

[0120]

[0121] Among them, C0 and C1 are both original ciphertext Part of, e is a bilinear map, g is a prime number p factorial cyclic group The generator of α is a random value, H0 is a hash function; h is the prime number p factorial cyclic group Elements in

[0122] And calculate the shareable original ciphertext CT ID :

[0123]

[0124] Among them, C0, C1, C2, and C3 are all original ciphertext CT ID Part of h, v, u is a prime number p factorial cyclic group Elements in

[0125] Step 33: Output the shareable original ciphertext CT ID .

[0126] In one embodiment, in step 3, generating a re-encryption key based on system parameters, the user's private key, and the set of identities of the data requesters to be shared includes:

[0127] Step 34: Enter system parameters PP and user private key SK ID ;

[0128] Step 35, specify the identity set S of the data requesters to be shared, i is the user number in S, n is the maximum value of the user number in S, m is the number of all users, ID i is the identity of user i;

[0129] Step 36: For each user in the identity set S, calculate the point in, is the horizontal coordinate of user i, is the vertical coordinate of user i:

[0130]

[0131] Among them, α is a random value; h is the prime number p factorial cyclic group Elements in

[0132] Utilization Point Construct the polynomial F(x) and determine the coefficients a0, a1, ...a of the polynomial n ;

[0133]

[0134] Among them, x j is the random value corresponding to user j, and x is the variable of the polynomial;

[0135] Step 37, calculate the re-encryption key RK ID→S :

[0136]

[0137] Among them, rk1, rk2, rk3, and rk4 are all re-encryption keys RK ID→S Part of, H0, H1 are hash functions, e is a bilinear map, g is the prime number p factorial cyclic group Generators, h, v, u are prime number p factorial cyclic groups Elements in t, is a random number, x is a random number, r2 is an intermediate variable, satisfying r1+r2=r, r is a random value;

[0138] Step 38: Output the re-encryption key RK ID→S Send to agent.

[0139] In one embodiment, in step 4, the agent outputs the re-encrypted ciphertext based on the system parameters, the re-encryption key, and the original ciphertext, including:

[0140] Step 41: Input system parameters PP and re-encryption key RK ID→S and the original ciphertext CT ID ;

[0141] Step 42: Calculate the re-encrypted ciphertext CT′S =(C′1, C′2, C′3, C′4), where C′1, C′2, C′3, and C′4 are all part of the re-encrypted ciphertext:

[0142] C′1=rk1

[0143]

[0144] C′3=rk3

[0145] C′4=C2

[0146] Among them, rk1, rk2, rk3, and rk4 are all re-encryption keys RK ID→S Part of, C0, C1, C2, C3 are the original ciphertext CT ID Part of, e is a bilinear map, SK P is the proxy private key, h1 is the intermediate variable, M is the message to be encrypted, h, u are the prime number p factorial cyclic group The elements in is a random number, α and s are random values, H0 is a hash function, and ID is the user identity;

[0147] Step 43: Output the re-encrypted ciphertext CT′ S =(C′1, C′2, C′3, C′4) is sent to the data requester.

[0148] In one embodiment, in step 5, for the original ciphertext, the data owner outputs a plaintext message based on the system parameters and the user's private key; for the re-encrypted ciphertext, the data requester outputs a plaintext message based on the system parameters and the user's private key, including:

[0149] Step 51: Input system parameters PP and user private key SK ID , original ciphertext CT ID Or re-encrypt the ciphertext CT′ S ;

[0150] Step 52, for the original ciphertext Calculate the plaintext message M′:

[0151] M′=C0 / e(SK ID , C1)

[0152] Among them, C0 and C1 are the original ciphertext Part of, e is a bilinear map, SK ID The user's private key;

[0153] For the re-encrypted ciphertext CT′ S , CT′ S=(C′1, C′2, C′3, C′4), where C′1, C′2, C′3, and C′4 are all part of the re-encrypted ciphertext. Calculate the plaintext message M′:

[0154]

[0155] Among them, H0, H1 are hash functions, is the private key of user i, is the horizontal coordinate of user i, is the vertical coordinate of user i; a0, a1, ...a n is the re-encryption key RK ID→S The third part rk3,n is the maximum value of the user ID in the identity set S of the data requester to be shared, ID i is the identity of user i; H0 is the hash function;

[0156] Step 53: Output the plaintext message M'.

[0157] In one embodiment, in step 6, the trusted third party determines the party generating the illegal decryption device as the agent or the data owner based on the system parameters and the agent public key, including:

[0158] Step 81: Input system parameters PP and proxy public key PK P ;

[0159] Step 82, select a random value s, Choose a random message M * , calculate the irregular ciphertext CT, All are part of CT:

[0160]

[0161]

[0162] Among them, e is a bilinear map, g is the prime number p factorial cyclic group The generators, h, v, u are Elements in PK P is the proxy public key, r, α are random values, H0 is the hash function, and ID is the user identity;

[0163] Step 83: Input the irregular ciphertext CT into the illegal decryption device and output the recovered message M. * ′, if M * ′=M * , the party that generates the illegal decryption device is determined to be the agent, otherwise, the party that generates the illegal decryption device is determined to be the data owner.

[0164] If the illegal decryption device is created by the agent, the recovered message M is obtained using the following formula: * ′:

[0165]

[0166] in, and are intermediate variables, H0 and H1 are hash functions, is the private key of user i, is the horizontal coordinate of user i, is the vertical coordinate of user i; a0, a1, ...a n is the re-encryption key RK ID→S The third part rk3,n is the maximum value of the user ID in the identity set S of the data requester to be shared, ID i is the identity of user i; rk1 is the re-encryption key RK ID→S In the first part, h and u are the prime number p factorial cyclic group. The elements in , α is a random value, ID is the user identity, and r1 is a random number;

[0167] Eventually you will get M * ′=M * ;

[0168] If the illegal decryption device is created by the data owner, the recovered message M is obtained using the following formula: * ′:

[0169]

[0170] Finally, we will get M′≠M, SK ID The user's private key.

[0171] Using the same inventive concept as the accountable identity-based broadcast agent re-encryption method, this embodiment also provides a corresponding accountable identity-based broadcast agent re-encryption system, including:

[0172] Trusted center, agent, data owner, data requester and trusted parties;

[0173] The trusted center generates system parameters and system master private keys based on security parameters, and publishes the generated system parameters to users in the system; and generates user private keys based on system parameters, system master private keys and user identities;

[0174] The agent generates the agent public key and agent private key according to the system parameters;

[0175] The data owner outputs the original ciphertext based on the system parameters, the message to be encrypted, and the user's identity; and generates a re-encryption key based on the system parameters, the user's private key, and the identity set of the data requester to be shared;

[0176] The agent outputs the re-encrypted ciphertext based on the system parameters, re-encryption key and original ciphertext;

[0177] For the original ciphertext, the data owner outputs the plaintext message based on the system parameters and the user's private key; for the re-encrypted ciphertext, the data requester outputs the plaintext message based on the system parameters and the user's private key;

[0178] The trusted third party determines the party that generates the illegal decryption device as the agent or data owner based on the system parameters and the agent public key.

[0179] The accountable identity-based broadcast agent re-encryption system of this embodiment has the same inventive concept as the accountable identity-based broadcast agent re-encryption method described above. Therefore, the specific implementation method of this system can be seen in the embodiment section of the accountable identity-based broadcast agent re-encryption method described above, and its technical effects correspond to the technical effects of the above-mentioned method, which will not be repeated here.

[0180] The above descriptions are merely examples of various embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any modifications or substitutions that can be readily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included within the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. An accountable identity-based broadcast agent re-encryption method, characterized in that: include: Step 1: The trusted center generates system parameters and system master private key based on security parameters, and publishes the generated system parameters to users in the system; and generating a user private key based on the system parameters, the system master private key and the user identity; Step 2: The agent generates an agent public key and an agent private key according to the system parameters; Step 3: The data owner outputs the original ciphertext based on the system parameters, the message to be encrypted, and the user identity; and generates a re-encryption key based on the system parameters, the user private key, and the set of identities of the data requesters to be shared; Step 4: The agent outputs the re-encrypted ciphertext according to the system parameters, the re-encryption key, and the original ciphertext; Step 5: For the original ciphertext, the data owner outputs the plaintext message according to the system parameters and the user private key; For re-encrypted ciphertext, the data requester outputs the plaintext message based on the system parameters and the user's private key; In step 6, the trusted third party determines that the party generating the illegal decryption device is the agent or the data owner based on the system parameters and the agent public key.

2. The method according to claim 1, wherein in, In step 1, the trusted center generates system parameters and the system master private key based on security parameters, including: Step 11, input security parameter λ; Step 12: The trusted center generates a prime number p factorial cyclic group and And determine the bilinear map in and The order of is p, g is The generators, h, v, h, v, u are Elements in Step 13: The trusted center selects a random value α. For a set of integers, calculate the intermediate variables g1, h1, and h2: g1=g α ,h1=h r ,h2=h αr Step 14: The trusted center selects two hash functions H0 and H1; Step 15: Output system parameters PP = (g1, v, v α ,u,u α ,h,h α , h1, h2, e(g, h), H0, H1); and secretly hold the system master private key MSK = (g, α).

3. The method according to claim 1, wherein in, In step 1, a user private key is generated based on the system parameters, the system master private key, and the user identity, including: Step 16: Input the system parameters PP, system master private key MSK and user ID; Step 17: Output the user private key SK ID : Where g is the prime number p factorial cyclic group The generator of , α is a random value, and H0 is a hash function.

4. The method according to claim 1, wherein in, In step 2, the agent generates an agent public key and an agent private key according to the system parameters, including: Step 21, input system parameter PP; Step 22, select a random value For an integer set, calculate the proxy public key PK P and the proxy private key SK P : PK P =in x EN P =x Where v is the prime number p factorial cyclic group elements.

5. The method according to claim 1, wherein in, In step 3, the data owner outputs the original ciphertext based on the system parameters, the message to be encrypted, and the user identity, including: Step 31: Input system parameters PP, message to be encrypted M and user ID; Step 32, select a random value is a set of integers, and the original ciphertext that can only be decrypted by the data owner is calculated Among them, C0 and C1 are both original ciphertext Part of, e is a bilinear map, g is a prime number p factorial cyclic group The generator of α is a random value, H0 is a hash function; h is the prime number p factorial cyclic group Elements in And calculate the shareable original ciphertext CT ID : Among them, C0, C1, C2, and C3 are all original ciphertext CT ID Part of h, v, u is a prime number p factorial cyclic group Elements in Step 33: Output the shareable original ciphertext CT ID .

6. The method according to claim 1, wherein in, In step 3, a re-encryption key is generated based on the system parameters, the user private key, and the set of identities of the data requesters to be shared, including: Step 34: Enter system parameters PP and user private key SK ID ; Step 35, specify the identity set S of the data requesters to be shared, i is the user number in S, n is the maximum value of the user number in S, m is the number of all users, ID i is the identity of user i; Step 36: For each user in the identity set S, calculate the point in, is the horizontal coordinate of user i, is the vertical coordinate of user i: Among them, α is a random value; h is the prime number p factorial cyclic group Elements in Utilization Point Construct the polynomial F(x) and determine the coefficients a0, a1, ...a of the polynomial n ; F(x)=a0+a1x+…+a n x n Where x is the variable of the polynomial; Step 37, calculate the re-encryption key RT ID→S : Among them, rk1, rk2, rk3, and rk4 are all re-encryption keys RK ID→S Part of, H0, H1 are hash functions, e is a bilinear map, g is the prime number p factorial cyclic group Generators, h, v, u are prime number p factorial cyclic groups Elements in is a random number, x is a random number, and r2 is an intermediate variable; Step 38: Output the re-encryption key RT ID→S Send to agent.

7. The method according to claim 1, wherein in, In step 4, the agent outputs the re-encrypted ciphertext according to the system parameters, the re-encryption key, and the original ciphertext, including: Step 41: Input system parameters PP and re-encryption key RK ID→S and the original ciphertext CT ID ; Step 42: Calculate the re-encrypted ciphertext CT′ S =(C′1, C′2, C′3, C′4), where C′1, C′2, C′3, and C′4 are all part of the re-encrypted ciphertext: C′1=rk1 C′3=rk3 C′4=C2 Among them, rk1, rk2, rk3, r k 4 are all re-encryption keys RK ID→S Part of, C0, C1, C2, C3 are the original ciphertext CT ID Part of, e is a bilinear map, SK P is the proxy private key, h1 is the intermediate variable, M is the message to be encrypted, h, u are the prime number p factorial cyclic group The elements in is a random number, α and s are random values, H0 is a hash function, and ID is the user identity; Step 43: Output the re-encrypted ciphertext CT′ S =(C′1, C′2, C′3, C′4) is sent to the data requester.

8. The method according to claim 1, wherein in, In step 5, for the original ciphertext, the data owner outputs the plaintext message according to the system parameters and the user private key; For re-encrypted ciphertext, the data requester outputs the plaintext message based on the system parameters and the user's private key, including: Step 51: Input system parameters PP and user private key SK ID , original ciphertext CT ID Or re-encrypt the ciphertext CT′ S ; Step 52, for the original ciphertext Calculate the plaintext message M′: M′=C0 / e(SK ID ,C1) Among them, C0 and C1 are the original ciphertext Part of, e is a bilinear map, SK ID The user's private key; For the re-encrypted ciphertext CT′ S , CT′ S =(C′1, C′2, C′3, C′4), where C′1, C′2, C′3, and C′4 are all part of the re-encrypted ciphertext. Calculate the plaintext message M′: Among them, H0, H1 are hash functions, is the private key of user i, is the horizontal coordinate of user i, is the vertical coordinate of user i; a0, a1, ...a n is the re-encryption key RKI D→S The third part rk3,n is the maximum value of the user ID in the identity set S of the data requester to be shared, ID i is the identity of user i; H0 is the hash function; Step 53: Output the plaintext message M'.

9. The method according to claim 1, wherein in, In step 6, the trusted third party determines the party generating the illegal decryption device as the agent or the data owner based on the system parameters and the agent public key, including: Step 81: Input system parameters PP and proxy public key PK P ; Step 82, select a random value s, Choose a random message M * , calculate the irregular ciphertext CT, All are part of CT: Among them, e is a bilinear map, g is the prime number p factorial cyclic group The generators, h, v, u are Elements in PK P is the proxy public key, r, α are random values, H0 is the hash function, and ID is the user identity; Step 83: Input the irregular ciphertext CT into the illegal decryption device and output the recovered message M. * ′, if M * ′=M * , the party that generates the illegal decryption device is determined to be the agent, otherwise, the party that generates the illegal decryption device is determined to be the data owner.

10. An accountable identity-based broadcast agent re-encryption system, characterized in that: include: Trusted center, agent, data owner, data requester and trusted parties; The trusted center generates system parameters and system master private keys based on security parameters, and publishes the generated system parameters to users in the system; and generating a user private key based on the system parameters, the system master private key and the user identity; The agent generates an agent public key and an agent private key according to the system parameters; The data owner outputs the original ciphertext based on the system parameters, the message to be encrypted, and the user identity; and generates a re-encryption key based on the system parameters, the user private key, and the set of identities of the data requesters to be shared; The agent outputs the re-encrypted ciphertext according to the system parameters, the re-encryption key and the original ciphertext; For the original ciphertext, the data owner outputs the plaintext message according to the system parameters and the user private key; For re-encrypted ciphertext, the data requester outputs the plaintext message based on the system parameters and the user's private key; The trusted third party determines that the party generating the illegal decryption device is the agent or the data owner based on the system parameters and the agent public key.

Images