A proxy pairing method and system based on identity encryption

Abstract

The present application belongs to the field of information security technology, and specifically relates to a proxy pairing method and system based on identity encryption, which defines the identity ID of system users; defines the types of participants in the encryption system; defines encryption algorithms and decryption algorithms; introduces Kate commitments to solve the contradiction between the necessity of leaking some information for third-party pairing and user anonymity; introduces Merkle trees to solve the need for parallel pairing; the anonymous message is encrypted into ciphertext by the sender and uploaded to the blockchain; the proxy downloads the ciphertext from the blockchain and performs pairing forwarding; the receiver decrypts the received ciphertext to obtain the anonymous message. The present invention can realize an efficient proxy pairing method based on identity encryption, which provides a good example for implementing encrypted communication on the blockchain.

Description

Technical Field

[0001] The present application belongs to the field of information security technology, and specifically relates to a proxy pairing method and system based on identity encryption. Background Art

[0002] In today's information age, blockchain technology is gradually changing the operating model of various industries with its decentralized, tamper-proof and highly transparent characteristics. The existing IB-ME method allows both the sender and the receiver to specify a target identity: if all selected target identifiers match each other, the anonymous message is displayed, otherwise the sender identity, target identifier and anonymous message remain hidden. However, the IB-ME method requires the receiver to try to match all ciphertexts, which will cause a large number of failed pairing attempts, greatly waste computing resources, and increase the load on individual users. In addition, when data is transmitted or processed in an untrusted environment, sensitive data should be protected from privacy leakage, and data source identification should be provided to ensure the validity and authenticity of the data.

[0003] Therefore, how to achieve efficient identity-based pairing while ensuring security has become an issue worth studying. Summary of the invention

[0004] In view of this, the present invention mainly solves the problem of resource waste in the IB-ME method and provides an agent pairing method and system based on identity encryption. The technical solution is:

[0005] A proxy pairing method based on identity encryption includes the following steps:

[0006] S1. Initialization: The system server obtains the required system parameters;

[0007] S2. Key generation: The user submits his / her identity ID to the key generation center KGC; KGC calculates the private key corresponding to the user ID according to the key generation algorithm; then KGC passes the private key back to the user;

[0008] S3. Message encryption: When the sender needs to send anonymous information to the receiver, the sender uses the receiver's ID as a public key to encrypt the anonymous message into a target ciphertext. The sender and the receiver are different users among the multiple users, and the target ciphertext implicitly contains the sender and the receiver's information.

[0009] S4. Generate pairing information: When the receiver needs to send pairing information to the agent, the receiver generates a polynomial based on the target sender ID and stores the polynomial values ​​corresponding to all target IDs in a Merkle tree. The pairing information implicitly includes the receiver and its target sender information;

[0010] S5. Proxy forwarding: The third-party proxy downloads the ciphertext uploaded by the sender from the blockchain and obtains the pairing information from the receiver; the proxy then determines whether to forward the ciphertext by calculating in turn whether the ciphertext matches the pairing information;

[0011] S6. Message decryption and verification.

[0012] Further, in step S1, the system server obtains the required system parameters according to the algorithm: where G is a multiplication cyclic group of order q, and the bilinear mapping relationship is expressed as e: G×G→G T , P is the generator of the multiplicative cyclic group G; H1, H2, H3, H4, H5 are hash functions, where H1: {0,1} * →G,H2:{0,1} * →G,H3: H4:G T →{0,1} l and H5∶{0,1} l →{0,1} l ; The key generation center KGC selects a random number As a promised secret; the key generation center KGC selects a random number The key generation center KGC selects a random number As the master key, set P pub =P s ; pp=(z,e,G,G T ,q,P,P pub ,H1,H2,H3,H4,H5) as public parameters.

[0013] Further, in step S2: the system server groups all users into M groups, and each trusted user selects his / her desired receiver ID and sender ID; the user needs to obtain his / her own private key before starting communication; the sender ID is replaced by σ, and the receiver ID is replaced by ρ;

[0014] The sender needs to obtain his own private key ek before starting communication σ The key generation center KGC generates the master key of the model based on the proxy pairing method of identity encryption and the private key ek corresponding to each sender identity σ σ; The private key ek corresponding to each sender identity σ σ For: ek σ =H1(σ) s ;

[0015] After the private key is generated, the system server distributes the private key to the corresponding sender;

[0016] The receiver needs to obtain his own private key dk before starting communication ρ The key generation center KGC generates the master key of the model based on the identity encryption proxy pairing method and the private key dk corresponding to each recipient identity ρ ρ ; The private key dk corresponding to each receiver identity ρ ρ For: dk ρ =H1(ρ) s ;

[0017] After the private key is generated, the key generation center KGC distributes the private key to the corresponding recipient.

[0018] Furthermore, the message encryption step in step S3 is as follows:

[0019] The sender uses the receiver's identity ρ as the public key to encrypt the anonymous message m and obtain the target ciphertext CT. All users who want to transmit information in the model of the proxy pairing method based on identity encryption can encrypt the anonymous message m according to the receiver's identity ρ as follows:

[0020] The sender generates a random string α∈{0,1} of length l each time it generates a ciphertext. l , and generate a joint hash value based on the string α and the anonymous message m Let T = P t , as the first parameter position of the ciphertext; the sender obtains the encryption key k in the following manner: k = e(e σ ,P)·e(H2(ρ) t ,P pub ); Place the joint hash value V of the key k and the random string α in the second parameter position:

[0021] Then use the hash value of the random string α to perform bitwise XOR processing on the anonymous message As the third parameter of the ciphertext;

[0022] Finally, the sender generates a polynomial and commits to it according to the following method based on the identity of the sender and the target receiver:

[0023] The sender uses the generated quotient polynomial commitment ω as the last parameter of the ciphertext, and the ciphertext structure generated by the sender is CT=(T, V, Q, ω).

[0024] Further, in step S4, the receiver uses the target sender identity σ to obtain the pairing information Match. Since each receiver can receive information from multiple senders at the same time, σ i Defined as the i-th target sender identity; the receiver obtains a random number Let I = P u , as the first parameter of the pairing information; the receiver is based on its own identity ρ and the target sender's identity σ i Generate the generating polynomial Ploy respectively ρ (x) and Ploy i (x), the receiver adds the two polynomials and brings them into the public parameter z of the system server to obtain the value of the joint polynomial of the receiver's identity and the target sender's identity, and sets the joint hash value of the receiver and the sender's identity to be H i (z)=uF i (z) = uPloy ρ (z)+uPloy i (z); The receiver compares its own identity ρ with the identities σ of all the target senders in the above manner i The joint hash value is constructed as a leaf node of the Merkle tree, and the recipient uses the Merkle tree as the second parameter of the pairing information.

[0025] Furthermore, in step S5, the third-party agent downloads the ciphertext generated by the sender from the blockchain through an anonymous channel, and obtains the pairing information from the receiver; then the agent attempts to pair the downloaded ciphertext with the received pairing information one by one, and calculates whether the ciphertext and the pairing information are paired in turn in the following manner:

[0026] Specifically, the agent obtains the first parameter T, the second parameter V, the third parameter Q and the fourth parameter polynomial commitment ω of the ciphertext; then, the agent obtains the first parameter U and the second parameter Merkle tree root node Tree of the pairing information; the agent substitutes the parameters into the pairing formula If both sides of the equation hold, the proxy forwards the ciphertext to the receiver corresponding to the pairing information.

[0027] Furthermore, in step S6, the third-party agent forwards the ciphertext to the receiver paired with the ciphertext through an anonymous channel; then the receiver decrypts the ciphertext, and the decryption process is divided into two parts: ciphertext decryption and anonymous message verification.

[0028] Furthermore, the specific method of decrypting the ciphertext is as follows:

[0029] The receiver obtains the first parameter T, the second parameter V, the third parameter Q and the fourth parameter polynomial commitment ω of the ciphertext; the receiver calculates the decryption key k′=e(H1(σ),P pub )·e(dk ρ ,T); after that, the receiver calculates the verification string The receiver calculates the anonymous message

[0030] The anonymous message verification phase is as follows:

[0031] The receiver calculates the sender's random number t=H3(α, m); the sender calculates P t , if T=P t , the receiver receives the anonymous message m, otherwise it discards the anonymous message;

[0032] The receiver receives the ciphertext forwarded by the third-party agent; then the receiver calculates the key based on the public parameters and obtains the ciphertext based on the decryption algorithm; after obtaining the ciphertext, it is also necessary to verify the joint hash value of the random string α and the anonymous message m Whether the decryption judgment condition T=P is met t , T is the first parameter of the ciphertext. The receiver can successfully obtain the ciphertext only when the decryption judgment condition is met;

[0033] All users apply for keys from the system server, and all senders encrypt the anonymous message information m and upload the information to the blockchain; the agent constantly detects the blockchain and the communication network. Whenever the agent detects new content on the blockchain and the communication network, the agent downloads the ciphertext from the blockchain and obtains the pairing information from the communication network; the agent forwards the successfully paired ciphertext according to the pairing algorithm; each pairing information is discarded after it expires; the receiver decrypts the received ciphertext, and the anonymous message decrypted by the receiver, if the anonymous message meets the receiver's judgment conditions, the receiver receives the anonymous message information, otherwise the anonymous message information will be discarded by the receiver; the various participants in the system may be in multiple execution stages at the same time.

[0034] An agent pairing system based on identity encryption, including multiple users, blockchain, agents, key generation center KGC and system server;

[0035] The key generation center KGC accepts the sender and receiver identities, and sends the information corresponding to the target identity as a key to the sender and receiver who made the request to it;

[0036] The sender and the receiver are users among the multiple users. The sender and the receiver respectively determine the groups to which they and the target object belong by selecting different identities σ and target identities ρ; when the sender needs to send anonymous information to the receiver, the sender uses the receiver identity ρ as the public key to encrypt the anonymous message into the target ciphertext; the sender encrypts the anonymous message into the target ciphertext and sends the target ciphertext to the blockchain;

[0037] The agent downloads the target ciphertext from the blockchain and forwards the target ciphertext to the recipient; the recipient uses its own identity p as a private key to decrypt the target ciphertext to obtain the anonymous message.

[0038] Furthermore, each receiver generates a Merkle tree based on the identities of multiple target objects, so that the agent can try to match multiple targets at the same time.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] 1. Pairing is achieved by introducing a third-party agent to forward ciphertexts. This method replaces the IB-ME method proposed by Ateniese et al., in which the receiver tries to pair all ciphertexts in turn.

[0041] 2. The present invention introduces polynomial commitment into the ciphertext structure to ensure user anonymity while providing credentials for the proxy pairing forwarding function.

[0042] 3. The present invention implements identity-encrypted proxy pairing by applying Merkle tree technology to the pairing information delivered by the receiver to the proxy.

[0043] 4. The user of the proxy pairing system based on identity encryption is the main body, and the main functions implemented by the front end are sending and receiving anonymous messages. Users need to register and log in to the system server to execute the above functions of the model of the proxy pairing method based on identity encryption. The messages transmitted by users in the parallel pairing model can be viewed through the message recording function in the parallel pairing model, and everyone can also view the encrypted ciphertext. Since others cannot decrypt it, the relevant privacy information of the sender and the receiver will not be disclosed. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a flow chart;

[0045] Figure 2 It is a parallel pairing model diagram;

[0046] Figure 3The workflow of different participants in the identity-based encryption proxy pairing method, taking a successfully decrypted anonymous message as an example. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0048] An agent pairing system based on identity encryption, including multiple users, blockchain, agents, key production center KGC and system server;

[0049] The key generation center KGC accepts the sender and receiver identities, and sends the information corresponding to the target identity as a key to the sender and receiver who made the request to it;

[0050] The sender and the receiver are users among the multiple users, and the sender and the receiver respectively determine the groups to which they and the target object belong by selecting different identity IDs and target identity IDs; when the sender needs to send anonymous information to the receiver, the sender uses the receiver identity ρ as the public key to encrypt the anonymous message into the target ciphertext; the sender encrypts the anonymous message into the target ciphertext and sends the target ciphertext to the blockchain;

[0051] The agent downloads the target ciphertext from the blockchain and forwards the target ciphertext to the recipient; the recipient uses its own identity p as a private key to decrypt the target ciphertext to obtain the anonymous message.

[0052] The present invention first stores the data set in a pre-built blockchain, and utilizes the characteristics of blockchain data that are not easily tampered with to improve the security of the data set.

[0053] The method specifically comprises the following steps:

[0054] Step S1: Initialization: The system server selects the elliptic curve, master key and public parameters according to the algorithm. The specific steps are as follows:

[0055] Within the set time T1, the system server obtains the required system parameters according to the algorithm: where G is a multiplication cyclic group of order q, and the bilinear mapping relationship is expressed as e: G×G→G T , P is a multiplicative cyclic group Generators; H1, H2, H3, H4, H5 are hash functions, where H1: {0,1} * →G,H2:{0,1} * →G,H3: H4:G T→{0,1} l and \5∶{0,1} l →{0,1} l ; The key generation center KGC selects a random number As a promised secret; the key generation center KGC selects a random number The key generation center KGC selects a random number As the master key, set P pub =P s ; pp=(z,e,G,G T ,q,P,P pub ,H1,H2,H3,H4,H5) as public parameters.

[0056] Step S2: Key generation. The multiple users will submit at least one identity ID to the system server, and the system server will generate a corresponding private key for each user's identity ID. Each user's identity ID corresponds to the group to which the user belongs. The specific steps are as follows:

[0057] Within the set time T2, the system server can group all users into M groups. In order to prevent traffic analysis attacks, the number M should be large enough. The present invention can record the user identity as ID, and each trusted user can choose his or her desired receiver identity ρ and his or her desired sender identity σ. The sender needs to obtain his or her own private key ek before starting communication. σ The key generation center KGC generates the master key of the model based on the proxy pairing method of identity encryption and the private key ek corresponding to each sender identity σ σ ; The private key ek corresponding to each sender identity σ σ For: ek σ =H1(σ) s ;

[0058] The receiver needs to obtain his own private key dk before starting communication ρ The key generation center KGC generates the master key of the model based on the identity encryption proxy pairing method and the private key dk corresponding to each recipient identity ρ ρ ; The private key dk corresponding to each receiver identity ρ ρ For: dk ρ =H1(ρ) s ;

[0059] After the private key is generated, the key generation center KGC distributes the private key to the corresponding user.

[0060] S3: Message encryption. When the sender needs to send anonymous information to the receiver, the sender uses the receiver identity ρ as the public key to encrypt the anonymous message into a target ciphertext. The sender and the receiver are different users among the multiple users, and the target ciphertext implicitly contains the sender and the receiver information.

[0061] Specifically, within the set time T3, the sender can use the receiver's identity ρ as the public key to encrypt the anonymous message m and obtain the target ciphertext CT. All users who want to transmit information in the model of the proxy pairing method based on identity encryption can encrypt the anonymous message m according to the receiver's identity ρ within the time T3 as follows:

[0062] The sender generates a random string α∈{0,1} of length l each time it generates a ciphertext. l , and generate a joint hash value based on the string α and the anonymous message m Let T = P t , as the first parameter position of the ciphertext; the sender obtains the encryption key k in the following manner: k = e(ek σ ,P)·e(H2(ρ) t ,P puzi ); Place the joint hash value V of the key k and the random string α in the second parameter position: Then use the hash value of the random string α to perform bitwise XOR processing on the anonymous message As the third parameter of the ciphertext; finally, the sender generates a polynomial and commits to it according to the KZG commitment based on the identity of the sender and the target receiver:

[0063] The key generation center KGC selects a random secret number Output u+1 tuple <P,rP,...,r u P>; The system server generates the above system random number The sender generates a polynomial uPloy based on its own identity σ and the target receiver identity ρ σ (x) and Ploy ρ (x); the sender calculates F(z) = Ploy σ (z)+Ploy ρ (z), and generates a commitment C = t·F(r)·P; the sender opens a random point to calculate the quotient polynomial The sender calculates the quotient polynomial commitment ω=h(r)·P based on the polynomial coefficients and PK, and uses the generated quotient polynomial commitment ω as the last parameter of the ciphertext. The ciphertext structure generated by the sender is CT=(T, V, Q, ω).

[0064] S4: Generation of pairing information. When the receiver needs to send pairing information to the agent, the receiver uses the target sender identity σ i The pairing information is converted into a polynomial, and the corresponding polynomial value is stored in a Merkle tree. The pairing information implicitly includes the information of the receiver and its target sender.

[0065] Specifically, within the set time T3, the receiver can use the target sender identity σ to obtain the pairing information Match. The receiver obtains a random number Let U = P u , as the first parameter of the pairing information; the receiver is based on its own identity ρ and the target sender's identity σ i Generate the generating polynomial Ploy respectively ρ (x) and Ploy i (x), the receiver adds the two polynomials and brings them into the public parameter z of the system server to obtain the value of the joint polynomial of the receiver's identity and the target sender's identity, and sets the joint hash value of the receiver and the sender's identity to be H i (z)=uF i (z) = uPloy ρ (z)+uPloy i (z); The receiver compares its own identity ρ with the identities σ of all the target senders in the above manner i The joint hash value is constructed as a leaf node of the Merkle tree, and the recipient uses the Merkle tree as the second parameter of the pairing information.

[0066] S5: Proxy forwarding. Within the set time T4, the third-party agent downloads the ciphertext generated by the sender from the blockchain through an anonymous channel and obtains the pairing information from the receiver; then the agent tries to pair the downloaded ciphertext with the received pairing information one by one, and calculates whether the ciphertext and the pairing information are paired in turn in the following way:

[0067] Specifically, within the set time T5, the agent obtains the first parameter T, the second parameter V, the third parameter Q and the fourth parameter polynomial commitment ω of the ciphertext; then, the agent obtains the first parameter U and the second parameter Merkle tree root node Tree of the pairing information; the agent substitutes the parameters into the pairing formula If both sides of the equation hold, the proxy forwards the ciphertext to the receiver corresponding to the pairing information.

[0068] S6: Message decryption. Within the set time T6, the third-party agent forwards the ciphertext to the receiver paired with the ciphertext through an anonymous channel; then the receiver will decrypt the ciphertext, and the decryption process is divided into two parts: ciphertext decryption and anonymous message verification.

[0069] The specific method of decrypting the ciphertext is as follows:

[0070] The receiver obtains the first parameter T, the second parameter V, the third parameter Q and the fourth parameter polynomial commitment ω of the ciphertext; the receiver calculates the decryption key k′=e(H1(σ),P pub )·e(dk ρ ,T); after that, the receiver calculates the verification string The receiver calculates the anonymous message m to obtain

[0071] The anonymous message verification phase is as follows:

[0072] The receiver calculates the sender's random number t=H3(α,m); the sender calculates P t , if T=P t , the receiver receives the anonymous message m, otherwise it discards the anonymous message.

[0073] The receiver receives the ciphertext forwarded by the third-party agent; then the receiver calculates the key based on the public parameters and obtains the ciphertext based on the decryption algorithm; after obtaining the ciphertext, it is also necessary to verify the joint hash value of the random string α and the anonymous message m Whether the decryption judgment condition T=P is met t (T is the first parameter of the ciphertext). Only when the decryption judgment condition is met can the receiver successfully obtain the ciphertext.

[0074] All users apply for keys from the system server within T2, and all senders encrypt the anonymous message information m within T3 and upload the information to the blockchain; the agent constantly detects the blockchain and the communication network. Whenever the agent detects new content on the blockchain and the communication network, the agent downloads the ciphertext from the blockchain and obtains the pairing information from the communication network; within T5, the agent forwards the successfully paired ciphertext according to the pairing algorithm; each pairing information is discarded after it expires; within T6, the receiver decrypts the received ciphertext, and the anonymous message decrypted by the receiver, if the anonymous message meets the receiver's judgment conditions, the receiver receives this anonymous message information, otherwise the anonymous message information will be discarded by the receiver.

[0075] Embodiment 1 The present invention can be divided into several stages:

[0076] T1: Preprocessing stage. The work of the present invention at this stage is that the key generation center KGC generates public parameters and master keys.

[0077] T2: Key request stage. The present invention works in this stage as follows: the sender and the receiver each send their own identity to the key generation center KGC, and then the key generation center KGC sends the information corresponding to the target identity as a key to the sender and the receiver who made the request to it.

[0078] T3: Information generation stage. The operations of the present invention in this stage correspond to step S3 performed by the sender and step S4 performed by the receiver.

[0079] T4: Information download phase. The third-party agent downloads the ciphertext and pairing information from the blockchain.

[0080] T5: Proxy forwarding stage. The third-party proxy pairs and forwards the downloaded ciphertext according to step S5.

[0081] T6: Decrypt the downloaded ciphertext. The receiver decrypts the ciphertext from the proxy.

[0082] In some embodiments of the present application, the above-mentioned proxy pairing algorithm based on identity encryption is introduced. Next, the construction process of the above-mentioned proxy pairing method based on identity encryption will be explained.

[0083] Specifically, a proxy pairing method based on identity encryption is constructed based on the BDH problem, which can resist the ANON-IND-ID-CCA attack of the network attack adversary. The specific process is as follows:

[0084] Let G be a multiplicative cyclic group of order q, and the mapping e: G×G→G T is a bilinear map.

[0085] This application uses the Fujisaki-Okamoto method to convert a CPA-secure cryptographic system into a CCA-secure cryptographic system under the random oracle model: Encryption Algorithm E pk (M,r) is a public key encryption algorithm that uses a random number t to encrypt an anonymous message M under a public key pk. If the encryption algorithm E pk (M, r) is IND-ID-CPA secure, then the encryption algorithm It is IND-ID-CCA secure under the random oracle model, where α is a randomly generated bit string, and H3 and H4 are hash functions.

[0086] This application will prove that GBS-PME satisfies privacy under the BDH assumption by defining a game, and replace the identity ID in the original text with the identity pair (σ,ρ) as the public key. First, we define BasicPub* , which is a variant of BasicPub that better suits our needs. BasicPub * The following algorithms are included.

[0087] Initialization: Generate a symmetric pairing e∶G×G→G T , where P is the generator of the multiplication cyclic group G; the system server selects a random number And set the public parameter P pub =P s . Select function H1:{0,1} * →G,H2:{0,1} * →G and H3:G T →{0,1} l ; The public parameter pp generated by the system server is pp = (e, G, G T ,q,P,P pub ,H1,H2,H3), the master key is msk=s.

[0088] Sender signature: The key generation center KGC inputs the master key msk and identity σ, and the algorithm calculates ek σ =H1(σ) s ; KGC returns the private key ek σ .

[0089] Receiver signature: The key generation center KGC inputs the master key msk and identity ρ, and the algorithm calculates dk ρ =H2(ρ) s ; KGC returns the private key dk ρ .

[0090] Encryption: The sender inputs identity σ, target identity rcv = ρ and message m∈{0,1} n After that, the sender obtains the random number Calculate T = P t ; The sender calculates the encryption key k = e(ek σ ,H2(ρ))·e(H2(ρ) t ,P pub ); the sender calculates The sender outputs the ciphertext CT = (T, V).

[0091] Decryption: The receiver inputs the ciphertext CT from the proxy and the decryption key dk ρ , identity ρ and target identity snd=σ, parse CT=(T,V); the receiver calculates the decryption key k′=e(H1(σ),P pub )·e(dk ρ ,T); receiver calculates

[0092] Assume A is an attacker who can query q R In this case, BasicPub is cracked with advantage ε * IND-ID-CPA security. Then there exists an algorithm that solves the BDH problem with an advantage of 2ε / q R success.

[0093] Proof: A' receives a BDH tuple (P, aP, bP, cP), where P∈G, and the correct solution is D=(P,P) abc The challenger starts the game and sets the public parameters pp = (G, e, q, P, P Pub ,H1,H2,H3) are sent to A'. Among them, H1,H2,H3 are three random oracles controlled by A'.

[0094] Initialization: A' provides the above public parameters and three random oracles H1, H2, H3 under its control to adversary A.

[0095] H1 query: A' maintains a list L1 for storing i ,S i ,β i ) records the call record of H1. If the query σ i Already exists in the list, the challenger returns the value S i Otherwise, it randomly selects a set up And (σ i ,S i ,β i ) is added to the list and S is returned i .

[0096] H2 query: If the query Q i The tuples in list L2 (ρ i ,Q i ,β′ i ,d i ) exists, then return Q i ; Otherwise, randomly select one And generate a random value d i ∈{0,1}, so that Pr[d i =0] =δ; if d i =1, then let Otherwise, set Finally, the tuple (ρ i ,Q i ,β′ i ,d i ) is added to list L2 and returned to Q i .

[0097] H3 query: A' maintains a list L3 for storing (X i ,k i ) records the call record to H3. i Already exists in the list, the challenger returns the value k i Otherwise, it randomly selects k i ∈{0,1} n , (X i ,k i ) is added to list L3 and k is returned i .

[0098] Sender key query: Let the input be σ i , A' obtains H1(σ i )=S i , where (σ i ,S i ,β i ) is the corresponding tuple in list L1, return

[0099] Receiver key query: Let the input be ρ i , A' obtains H2(ρ)=Q i , where (ρ i ,Q i ,β′ i ,d i ) is the corresponding tuple in list L2, if d i =1, A' terminates, otherwise returns

[0100] Afterwards, the opponent A sends (m′0, m′1, rcv′, σ′) to A′, where rcv′=ρ; A′ calculates H1(σ i ′)=S i ' and H2(ρ i ′)=Q i ′; if the tuple in list L2 (ρ i ,Q i ,β′ i ,d2) where d2 is not equal to 1, A' terminates. Otherwise, A' randomly selects b'∈{0,1} and generates a challenge ciphertext C'∈{0,1} l sent to A. C's decryption is

[0101] Guessing stage:

[0102] A' receives A's guess b and randomly selects a tuple (X i ,k i ), ki Set up as a solution for the received BDH instance.

[0103] Next, we analyze the probability that A' does not terminate during the above simulation. Three events are defined:

[0104] E1: event that A aborts in the RKGen query;

[0105] E2: A' event aborted during the challenge phase;

[0106] E3: A' requested during the simulation of events.

[0107] We derived the probability of each event so When δ=q R / (q R +2), Take the maximum value 4 / (e2(qR+2)2), and Pr[E3]≧2δ.

[0108] Finally, according to the calculation of probability and the definition of events, we conclude that A' breaks through the BDH hypothesis in the above process, and its advantage is

[0109] Finally, the present invention cites the Fujisaki-Okamoto method and proves that the GBS-PME scheme is safe for IND-ID-CCA.

[0110] Specifically, after the user logs in to the anonymous communication model, two-way anonymous authentication and key negotiation are implemented with the big data server, the session key is obtained, and secret communication is established. The user enters the anonymous message to be sent in the foreground through the visualization page, and the message is encrypted by the background. Similarly, when the background successfully decrypts the downloaded ciphertext, the message is presented to the user through the visualization page.

[0111] The user of the proxy pairing system based on identity encryption is the main body, and the main functions implemented by the front end are sending and receiving anonymous messages. Users need to register and log in to the system server to execute the above functions of the model of the proxy pairing method based on identity encryption. The messages transmitted by users in the parallel pairing model can be viewed through the message recording function in the parallel pairing model, and everyone can also view the encrypted ciphertext. Since others cannot decrypt it, the relevant privacy information of the sender and the receiver will not be disclosed.

[0112] In some optional embodiments, the functions / operations mentioned in the block diagram only represent the order of occurrence in the model of a certain ciphertext that can be successfully decrypted based on identity encryption of the agent pairing method, such as stages T1 to T6 are a complete cycle of anonymous message transmission, but since each user may be in the process of transmitting multiple anonymous messages at the same time, the various participants in the system may actually be in multiple execution stages at the same time. For example, depending on the functions / operations involved, when the sender generates the ciphertext, the agent is simultaneously processing other ciphertexts downloaded from the blockchain. In addition, the embodiments presented and described in the flowchart of the present invention are provided by way of example for the purpose of providing a more comprehensive understanding of the technology. The disclosed method is not limited to the operations and logical flows presented herein. Alternative embodiments are foreseeable in which the order of various operations is changed and in which sub-operations described as part of a larger operation are executed independently.

[0113] It should be understood that each part of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system.

[0114] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0115] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0116] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the described embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A proxy pairing method based on identity encryption, characterized in that: The following steps are involved: S1. Initialization: The system server obtains the required system parameters; S2. Key generation: The user submits his / her identity ID to the key generation center KGC; KGC calculates the private key corresponding to the user ID according to the key generation algorithm; then KGC passes the private key back to the user; S3. Message encryption: When a sender needs to send an anonymous message to a receiver, the sender uses the receiver's ID as a public key to encrypt the anonymous message into a target ciphertext. The sender and the receiver are different users among multiple users, and the target ciphertext implicitly contains the sender and receiver information. S4. Generate pairing information: When the receiver needs to send pairing information to the agent, the receiver generates a polynomial based on the target sender ID and stores the polynomial values ​​corresponding to all target IDs in a Merkle tree. The pairing information implicitly includes the receiver and its target sender information; The receiver uses the identity σ of the target sender to obtain the pairing information Match. Since each receiver can receive information from multiple senders at the same time, i Defined as the i-th target sender identity; the receiver obtains a random number Let U = P u , as the first parameter of the pairing information; the receiver is based on its own identity ρ and the identity σ of the target sender i Generate the generating polynomial Ploy respectively ρ (x) and Ploy i (x), the receiver adds the two polynomials and brings them into the public parameter z of the system server to obtain the value of the joint polynomial of the receiver's identity and the target sender's identity, and sets the joint hash value of the receiver and the sender's identity to be H i (z)=uF i (z) = uPloy ρ (z)+uPloy i (z); The receiver compares its own identity ρ with the identities σ of all the target senders in the above manner i Constructing a joint hash value as a leaf node of a Merkle tree, and the receiver uses the Merkle tree as a second parameter of the pairing information; S5. Proxy forwarding: The third-party proxy downloads the ciphertext uploaded by the sender from the blockchain and obtains the pairing information from the receiver; the proxy then determines whether to forward the ciphertext by calculating in turn whether the ciphertext matches the pairing information; S6. Message decryption and verification.

2. The method for proxy pairing based on identity encryption according to claim 1, characterized in that: In step S1, the system server obtains the required system parameters according to the algorithm: where G is a multiplication cyclic group of order q, and the bilinear mapping relationship is expressed as e:G×G→G T , P is the generator of the multiplicative cyclic group G; H1, H2, H3, H4, H5 are hash functions, where G1:{0,1} * →G,H2:{0,1} * →G, H4:G T →{0,1} l and H5:{0,1} l →{0,1} l ; The key generation center KGC selects a random number As a promised secret; the key generation center KGC selects a random number The key generation center KGC selects a random number As the master key, set P pub = P s; pp=(z,e,G,G T ,q,P,P pub ,H1,H2,H3,H4,H5) as public parameters.

3. The identity encryption-based proxy pairing method according to claim 1, characterized in that: In step S2: the system server groups all users into M groups, and each trusted user selects his / her desired receiver ID and sender ID; the user needs to obtain his / her own private key before starting communication; the sender ID is replaced by σ, and the receiver ID is replaced by ρ; The sender needs to obtain his own private key ek before starting communication σ The key generation center KGC generates the master key of the model based on the proxy pairing method of identity encryption and the private key ek corresponding to each sender identity σ σ ; The private key ek corresponding to each sender identity σ σ For: ek σ =H1(σ) s ; After the private key is generated, the system server distributes the private key to the corresponding sender; The receiver needs to obtain his own private key dk before starting communication ρ The key generation center KGC generates the master key of the model based on the identity encryption proxy pairing method and the private key dk corresponding to each recipient identity ρ ρ ; The private key dk corresponding to each receiver identity ρ ρ For: dk ρ =H1(ρ) s ;After the private key is generated, the key generation center KGC distributes the private key to the corresponding recipient.

4. The method for proxy pairing based on identity encryption according to claim 1, characterized in that: The message encryption steps in step S3 are as follows: The sender uses the receiver's identity ρ as the public key to encrypt the anonymous message m and obtain the target ciphertext CT. All users who want to transmit information in the model of the proxy pairing method based on identity encryption encrypt the anonymous message m according to the receiver's identity ρ as follows: Each time the sender generates a ciphertext, it generates a random string α∈(0,1} l , and generate a joint hash value based on the string α and the anonymous message m Let T = P t , as the first parameter position of the ciphertext; the sender obtains the encryption key k in the following manner: k = e(ek σ ,P)·e(H2(ρ) t ,P pub ); Place the joint hash value of the key k and the random string α in the second parameter position Then use the hash value of the random string α to perform bitwise XOR processing on the anonymous message As the third parameter of the ciphertext; Finally, the sender generates a polynomial based on his / her own and the receiver's identity IDs and makes a commitment as follows: The sender uses the generated quotient polynomial commitment ω as the last parameter of the ciphertext, and the structure of the ciphertext generated by the sender is CT=(T, V, Q, ω).

5. The method for proxy pairing based on identity encryption according to claim 1, characterized in that: In step S5, the third-party agent downloads the ciphertext generated by the sender from the blockchain through an anonymous channel, and obtains the pairing information from the receiver; then the agent attempts to pair the downloaded ciphertext with the received pairing information one by one, and calculates whether the ciphertext and the pairing information are paired in turn in the following way: Specifically, the agent obtains the first parameter T, the second parameter V, the third parameter Q and the fourth parameter polynomial commitment ω of the ciphertext; then, the agent obtains the first parameter U and the second parameter Merkle tree root node Tree of the pairing information; the agent substitutes the parameters into the pairing formula If both sides of the equation hold, the proxy forwards the ciphertext to the receiver corresponding to the pairing information.

6. The method for proxy pairing based on identity encryption according to claim 1, characterized in that: In step S6, the third-party agent forwards the ciphertext to the receiver paired with the ciphertext through an anonymous channel; then the receiver decrypts the ciphertext, and the decryption process is divided into two parts: ciphertext decryption and anonymous message verification.

7. The method for proxy pairing based on identity encryption according to claim 6, characterized in that: The specific method of decrypting the ciphertext is as follows: The receiver obtains the first parameter T, the second parameter V, the third parameter Q and the fourth parameter polynomial commitment ω of the ciphertext; the receiver calculates the decryption key k'=e(H1(σ),P pub )·e(dk ρ ,T); after that, the receiver calculates the verification string The receiver calculates the anonymous message The anonymous message verification phase is as follows: The receiver calculates the sender's random number t=H3(α, m); the sender calculates P t , if T=P t , the receiver receives the anonymous message m, otherwise it discards the anonymous message; The receiver receives the ciphertext forwarded by the third-party agent; then the receiver calculates the key based on the public parameters and obtains the ciphertext based on the decryption algorithm; after obtaining the ciphertext, it is also necessary to verify the joint hash value of the random string α and the anonymous message m Whether the decryption judgment condition T=P is met t , T is the first parameter of the ciphertext. The receiver can successfully obtain the ciphertext only when the decryption judgment condition is met; All users apply for keys from the system server, all senders encrypt anonymous message information m and upload the information to the blockchain; the agent constantly detects the blockchain and communication network. Whenever the agent detects new content on the blockchain and communication network, the agent downloads the ciphertext from the blockchain and obtains the pairing information from the communication network; the agent forwards the successfully paired ciphertext according to the pairing algorithm; each pairing information is discarded after it expires; the receiver decrypts the received ciphertext, and the anonymous message decrypted by the receiver, if the anonymous message meets the receiver's judgment conditions, the receiver receives this anonymous message information, otherwise the anonymous message information will be discarded by the receiver; each participant in the system may be in multiple execution stages at the same time.

8. An agent pairing system based on identity encryption, using the method described in any one of claims 1 to 7, characterized in that: Includes multiple users, blockchains, agents, key generation centers KGC and system servers; The key generation center KGC accepts the sender and receiver identities, and sends the information corresponding to the target identity as a key to the sender and receiver who made the request to it; The sender and the receiver are users among the multiple users, and the sender and the receiver respectively determine the groups to which they and the target object belong by selecting different identities σ and ρ; when the sender needs to send an anonymous message to the receiver, the sender uses the receiver's identity ρ as a public key to encrypt the anonymous message into a target ciphertext; the sender encrypts the anonymous message into a target ciphertext and sends the target ciphertext to the blockchain; The agent downloads the target ciphertext from the blockchain and forwards the target ciphertext to the receiver; the receiver uses the receiver's identity p as a private key to decrypt the target ciphertext to obtain the anonymous message.

9. The agent pairing system based on identity encryption according to claim 8, characterized in that: Each receiver generates a Merkle tree based on the identities of multiple target objects, so that the agent can try to match multiple targets at the same time.

Images