Attribute-based searchable encryption method for weighted access control based on alliance chain

Abstract

The present invention discloses a weighted access control attribute-based searchable encryption method based on alliance chain, which belongs to the field of blockchain cloud computing security technology. The present invention includes global settings, user attribute private key generation, data encryption, trapdoor generation, keyword ciphertext retrieval, and data ciphertext decryption steps. The method of the present invention is based on alliance chain and attribute-based searchable encryption technology to construct a weighted access policy tree, and realize flexible access control by setting node weights. At the same time, the attribute authority is used as the alliance chain consensus node, which is responsible for system parameter generation and key management. The method has the functions of privacy protection, multi-keyword encryption, fine-grained access, anti-tampering, etc., and the user only needs lightweight encryption and decryption calculations. Through security and experimental analysis, the method proves its security under the decision bilinear Diffie-Hellman (DBDH) assumption.

Description

Technical Field

[0001] The present invention relates to alliance chain technology and searchable encryption technology. Background Art

[0002] The concept of blockchain first appeared in a paper published by Nakamoto in 2008. Subsequently, the technology has received great attention from governments, enterprises and financial institutions and has been widely used. As a new decentralized infrastructure and distributed computing paradigm, blockchain is expected to become the prototype of the next generation of cloud computing. Like the Internet, it will completely reshape the life of human society and realize the transformation from the information Internet to the value Internet. Blockchain is divided into three categories according to the degree of openness: public chain, private chain and alliance chain. The degree of openness of the alliance chain is between the public chain and the private chain. The nodes that maintain the data on the chain must be authorized to join or exit. It is a partially decentralized blockchain.

[0003] The concept of keyword search public key encryption was first proposed by Boneh et al. In the PEKS method, identity-based encryption is used, which can only support single keyword search. In recent years, some public key searchable encryption methods have been proposed to integrate searchable encryption and blockchain technology. Liu et al. proposed a blockchain-assisted searchable attribute encryption algorithm with efficient revocation and decryption functions. With the assistance of blockchain, the security issues under chosen plaintext attacks and chosen keyword attacks were solved, but the problem of excessive ciphertext length was caused. Yang et al. proposed a blockchain-based data search scheme, which implemented fine-grained access control of cloud data based on the attribute encryption mechanism, and verified the authenticity of the data source using attribute signature technology. Niu et al. proposed a data sharing scheme based on permissioned blockchain, which uses ciphertext-based attribute encryption to ensure the confidentiality and access control of medical data. It is indistinguishable from adaptive selected keyword attacks under the random oracle model, but there is a problem of high computational overhead. At present, blockchain is mostly used in searchable encryption systems to record key information of data and ensure data integrity using blockchain technology. The existing application modes and their defects are as follows:

[0004] 1. Existing attribute-based blockchain searchable encryption schemes often have the problem of over-centralization of the power of the attribute authorization center. With the help of a third-party trusted entity to provide access control performance for nodes in the system, there is a risk of single point failure or data tampering. Blockchain technology is only used to record key information and ensure data integrity, but the power of the attribute authorization agency is too concentrated and cannot be effectively supervised. At the same time, each attribute authorization agency has equal power, but in actual application scenarios, the power of each attribute authorization agency should be different. In different application scenarios, the power of an attribute authorization agency is changeable.

[0005] 2. The access policy tree structure is not flexible enough and can only express single AND, OR and threshold operations. As the amount of data and users increase, the structure of the access policy tree becomes more and more complex. The modification and update of access policies are cumbersome and require frequent changes to the tree structure, which increases storage performance overhead.

[0006] 3. The computational efficiency of the encryption and decryption process is low. Many current attribute-based blockchain searchable encryption schemes are not suitable for lightweight device scenarios, and both encryption and decryption operations require huge computations. Summary of the invention

[0007] The technical problems to be solved by the present invention are that the power of the attribute authorization agency is too concentrated, the access policy construction is not flexible enough, and the computational efficiency of the encryption and decryption process is low. In view of the shortcomings of the prior art, the present invention aims to provide a weighted access control attribute-based searchable encryption method based on a consortium chain.

[0008] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0009] A weighted access control attribute-based searchable encryption method based on alliance chain adopts the alliance chain framework in the attribute authorization agency, and multiple attribute authorization agencies act as consensus nodes in the alliance chain. At the same time, the power of each attribute authorization agency is defined by setting weights to achieve power decentralization of attribute authorization agencies. When encrypting data, a weighted access policy tree is constructed to achieve more flexible fine-grained access control.

[0010] Preferably, in the above-mentioned weighted access control attribute-based searchable encryption method based on alliance chain, the roles include five types:

[0011] Alliance chain, used to achieve the functions of power decentralization and data storage. The alliance chain used in the system is a peer-to-peer network composed of a group of pre-selected attribute authorization agencies, transaction pools and distributed ledgers, wherein the multiple attribute authorization agencies act as trusted consensus nodes of the alliance chain to participate in consensus, and the alliance chain stores ciphertext hash values ​​to record key information;

[0012] Attribute authorization agencies are used to implement the functions of system initialization and attribute private key distribution. The attribute authorization agencies are all involved in the initialization of the system. After receiving the plaintext data integrity information sent by the data owner, the attribute authorization agencies record the information and package it into a transaction pool for broadcast;

[0013] The data owner is used to realize the function of sharing data. The data owner encrypts the relevant data files, wherein the original files are encrypted using symmetric keys, and the access policy tree is set to use CPABE to encrypt the data index and symmetric keys, and the data and key information are uploaded to the cloud server and the alliance chain respectively;

[0014] Data users are used to access data. Data users are a group of people who want to obtain data and request it from the cloud server and consortium chain.

[0015] Cloud service provider, used to implement data matching and data storage functions, including pre-matching verification and keyword matching.

[0016] Preferably, in the above-mentioned weighted access control attribute-based searchable encryption method based on alliance chain, the system global setting process is performed by multiple attribute authorization agencies to execute the initialization algorithm, build an alliance chain platform, and assign a unique identifier to each role. Each attribute authorization agency has its own weight, assigns secret values ​​based on Mignotte columns and weight secret sharing methods, and discloses system parameters.

[0017] Preferably, in the above-mentioned weighted access control attribute-based searchable encryption method based on alliance chain, the user and the attribute authorization agency interact in the process of system user registration, and the generation of user attribute private key requires consensus participation of multiple attribute authorization agencies.

[0018] Preferably, in the above-mentioned weighted access control attribute-based searchable encryption method based on alliance chain, the data owner constructs a weight access policy tree to encrypt the data in the system data encryption process, and only users who meet the attribute requirements can decrypt the file, wherein the construction of the access policy tree is based on the Mignotte column and weight secret sharing method, each non-leaf node is set with a Mignotte column and weight, the secret value and weight and attribute are associated, and the decryption depends on the flexible combination of attributes, and finally the ciphertext data, the matrix containing the Mignotte column and weight, and the access policy tree are uploaded to the cloud server. Digital signature technology and hash technology are used to ensure data integrity.

[0019] Preferably, in the above-mentioned weighted access control attribute-based searchable encryption method based on alliance chain, in the system trapdoor generation process, the data user generates a search token based on a private key and a keyword.

[0020] Preferably, in the above-mentioned weighted access control attribute-based searchable encryption method based on alliance chain, in the system keyword ciphertext search process, the cloud service provider and the alliance chain first perform identity authentication, and when both the access policy match and the keyword match are met, the data is returned to the data user.

[0021] Preferably, in the above-mentioned weighted access control attribute-based searchable encryption method based on alliance chain, in the system decryption process, the data user decrypts according to the private key to obtain the symmetric key, and then uses it to decrypt the original ciphertext data to obtain the plaintext data, and finally uses hash technology to verify the data integrity.

[0022] The beneficial effects of the present invention are:

[0023] 1. Propose a system model jointly constructed by the alliance chain and the attribute authorization agency, see Figure 1 , which strengthens the security of the system and disperses the control of attribute authorization agencies over system security.

[0024] 2. The system proposed in the present invention implements lightweight encryption and decryption and can track malicious users.

[0025] (1) In ciphertext generation, the cost of data encryption calculation is characterized by the cost value being (2N A +N K +3)E+p, where E represents the exponential operation time of the elements in group G, p represents the pairwise operation time of the elements in group G, and N k Indicates the number of encrypted keywords, N A Indicates the number of attributes in the access policy.

[0026] (2) In the data access phase, the computational cost of decryption is characterized in that the cost value is E+P, where E represents the exponential operation time of the elements in the group G, and p represents the pairwise operation time of the elements in the group G. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 System model diagram of the present invention;

[0028] Figure 2 Weighted access strategy tree construction diagram;

[0029] Figure 3 Specific flow chart of the present invention. DETAILED DESCRIPTION

[0030] The following is combined with Figure 1-3 The technical method of the present invention is further described in detail:

[0031] Step 1: During the system initialization phase, multiple attribute authorization agencies AA jointly participate in generating system public parameters GPP. AA1, AA2, ..., AA n Denote n attribute authorization agencies respectively. Assign a global identifier GID to each role. Input security parameter λ and attribute space U, {AA1,AA2,...,AA n Output the system master key and global public parameter GPP through the secret sharing protocol. Construct a cyclic group G1 with order p as prime number, g is the generator of group G1, and e is a bilinear map e:G1×G1→G2. Select two collision-resistant hash functions and H2:{0,1} * →G1. According to the secret sharing protocol, each AA i A weight will be preset in i∈[1,n], and set a threshold in advance public and k AA . Random Selection Build a Mignotte column and then divide it by Expand to set up Each AA i Generated using secret sharing protocol Implicitly generate four system master secret values where β -1 is the inverse of element β. Each AA i based on and μ i Calculate and broadcast and AA i calculate Without loss of generality, AA1 is selected as the attribute authority representative. AA1 calculates the following common parameters by solving the congruence equations:

[0032]

[0033]

[0034] Step 2: AA generates a public-private key pair for the user based on the UID Public Key

[0035] Step 3-1: The data user DU sends the attribute set S to AA to apply for the attribute private key.

[0036] Step 3-2: AA returns the attribute private key to the data user DU. Each AA i Pick a random value and the user's global identifier GID, calculated and broadcasted in the secure channel After AA1 collects the message, it calculates in ζ(i) represents the process of solving the congruence equations using the Chinese remainder theorem, r i is the secret share of the secret value r, generating and in For each user attribute j∈S, each AA i Pick a random number AA i calculate And broadcast in the secure channel After AA1 collects the message, it calculates the attribute private key for the user and in

[0037] Step 4: After AA distributes the attribute private key, it will record the relevant user attribute authorization information, package it into a transaction and upload it to the blockchain for subsequent search and verification. AA generates a signature Sig AA [H2(Tx AKG ||t AKG )], Tx AKG , Sig AA [H2(Tx AKG ||t AKG )] and timestamp t AKG Packed into blocks #z , broadcast it to reach consensus with other alliance nodes, and get block number #z and transaction number Return to DU.

[0038] Step 5: The data owner DO processes the plaintext data and extracts keywords from the data file The original file is encrypted with a symmetric key. Then the keyword and the symmetric key are encrypted with attribute-based encryption and sent to the cloud service provider CSP. First, DO sets up a weighted access policy tree Γ. DO defines a Mignotte column m'1, m'2, ..., m' for the root node of the weighted access control tree e , set the weight vector for the child nodes of the root node in The expansion column is set up Use L1=m1,m2,...,m e Represents a (W, k, m)-Mignoote column. Similarly, according to the access tree structure, a (W, k, m)-Mignoote column is defined for each non-leaf node, and L1, L2, ..., L b and the corresponding Where a and b are the number of all non-leaf nodes in the access strategy tree Γ. Define a (l,n) matrix with l rows and n columns. The (l,n) matrix is ​​represented by Ω. Ω L Store multiple (W,k,m)-Mignoote sequences L1,L2,...,L b Ω W Storing multiple weight vectors Assume that Y is the set of all leaf nodes in Γ, then q root = r', Where m=m1m2...m t , M i=m / m i and 1≤i≤n. DO selects attribute j∈S and binds it to leaf node y in Γ. Selects a random element And calculate in C2=g υ . Send CT = {Γ,Ω L ,Ω W ,CT1,CT2} to CSP.

[0039] Step 6: After uploading the data, DO will calculate the integrity information of the data plaintext including DO's data signature and send it to AA. Calculate the file hash H1(M), DO generates the signature This includes transactions Tx HM and timestamp t HM , send them to AA.

[0040] Step 7: AA packages the integrity information into a transaction and uploads it to the blockchain for subsequent decryption verification. HM , and timestamp t HM Packed into blocks #y , broadcast it to reach consensus with other alliance nodes, and get block number #y and transaction number

[0041] Step 8: DU wants to access information. It first generates its own search trapdoor CTK through keywords and attribute private keys, and sends it to CSP to request a search. Generate search token CTK = {PTK1, PTK2, PTK3, PTK 4,j ,PTK 5,j} and the block number #z and transaction number returned by the alliance chain Sent to CSP together. PTK2=g τ ,

[0042] Step 9: After receiving the search request, CSP will first verify the legitimacy of the user, using block number #z and transaction number Initiate a query on the consortium chain for related transactions.

[0043] Step 10: Return the transaction to CSP. Query the relevant attribute authorization transaction from the alliance chain to determine whether the user has authorization information. #z Extract transaction Tx AKG , Signature Sig AA [H2(Tx AKG ||t AKG )] and timestamp tAKG . CSP uses AA's public key PK AA Verify the signature, the verification result is if CSP from transaction Tx AKG Extract attribute set S DU If the user is a legitimate one, CSP continues with the following operations.

[0044] Step 11: CSP performs keyword ciphertext search. If the keyword does not match or does not satisfy the access policy, it returns to terminate. If the access policy matches, the root node R can be obtained by recursive solution. If the keyword matches, then The equation holds

[0045] Step 12: After the search is successful, the partially decrypted result e(g,g) τrr' and the corresponding ciphertext files CT1 and CT2 as well as the block number #y and transaction number Return to DU.

[0046] Step 13: DU uses its own private key to fully decrypt Get the symmetric key, and then use the symmetric key for final decryption to get the plaintext data.

[0047] Step 14: Verify whether the data has been tampered with by querying the consortium chain for data integrity information. DU searches for relevant transaction information on CB based on the block number and transaction identifier sent by CSP. DU extracts the relevant transactions containing the original file on CB and compares the hash value of the original file in the transaction with the hash value calculated by itself. If the values ​​are consistent, it means that the original file has not been tampered with; otherwise, the file has been tampered with during the sharing process.

[0048] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present invention is limited to these examples. Under the concept of the present invention, the technical features of the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0049] The present invention is intended to cover all such substitutions, modifications and variations that fall within a broad scope. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A weighted access control attribute-based searchable encryption method based on alliance chain, characterized in that: Including the establishment of a system model, the system model includes 5 roles: Consortium Blockchain (CB), Attribute Authority (AA), Data Owner (DO), Data User (DU) and Cloud Service Provider (CSP); The Consortium Blockchain (CB) used in the system is a peer-to-peer network consisting of a set of pre-selected attribute authorization agencies, transaction pools, and distributed ledgers, where multiple attribute authorization agencies (AAs) act as trusted consensus nodes. In the entire system, CB is used to initialize the system, store ciphertext hashes, and verify the legal identity of users; During the system initialization phase, multiple attribute authorization agencies AA jointly participate in generating system public parameters GPP, AA1, AA2, ..., AA n Represent n attribute authorization agencies respectively, assign a global identifier GID to each role, input security parameter λ and attribute space U, {AA1,AA2,...,AA n Output the system master key and global public parameter GPP through the secret sharing protocol, construct a cyclic group G1 with order p as prime number, g is the generator of group G1, e is a bilinear map e:G1×G1→G2, and select two collision-resistant hash functions and H2:{0,1} * →G1, according to the secret sharing protocol, each AA i A weight will be preset in i∈[1,n], and set a threshold in advance public and k AA , randomly selected Build a Mignotte column and then divide it by Expand to set up Each AA i Generated using secret sharing protocol Implicitly generate four system master secret values ​​α, β, β -1 , where β -1 is the inverse of element β, each AA i Based on α i , and μ i Calculate and broadcast and AA i calculate Without loss of generality, AA1 is selected as the attribute authority representative. AA1 calculates the following common parameters by solving the congruence equations: The Attribute Authority (AA): All AAs participate in the initialization of the system. After receiving the plaintext data integrity information sent by the data owner, the AA records the information and packages it into a transaction pool for broadcast. AAs are responsible for generating attribute private keys for data users and sending user authorization information to CSP for verification; AA generates a public-private key pair for the user based on the UID Public Key The data user DU sends the attribute set S to AA to apply for the attribute private key. AA returns the attribute private key to the data user DU. Each AA i Pick a random value and the user's global identifier GID, calculated and broadcasted in the secure channel After AA1 collects the message, it calculates in ζ(i) represents the process of solving the congruence equations using the Chinese remainder theorem, r i is the secret share of the secret value r, generating and in For each user attribute j∈S, each AA i Pick a random number AA i calculate And broadcast in the secure channel j, after AA1 collects the message, it calculates the attribute private key for the user and in in After AA distributes the attribute private key, it will record the relevant user attribute authorization information, package it into a transaction and upload it to the blockchain for subsequent search and verification. AA generates a signature Sig AA [H2(Tx AKG ||t AKG )], Tx AKG , Sig AA [H2(Tx AKG ||t AKG )] and timestamp t AKG Packed into blocks #z , broadcast it to reach consensus with other alliance nodes, and get block number #z and transaction number Return to DU; The Data Owner (DO): DO is the party that intends to share data. First, DO encrypts the relevant data file using a symmetric key, then uses CPABE to encrypt the data index and the symmetric key. Finally, DO sends the ciphertext data to CSP and sends the plaintext data integrity information to CB. The data owner DO processes the plaintext data and extracts keywords from the data file. The original file is encrypted with a symmetric key, and then the keyword and the symmetric key are encrypted with attribute-based encryption and sent to the cloud service provider CSP. First, DO sets the weighted access policy tree Γ. DO defines a Mignotte column m'1, m'2, ..., m' for the root node of the weighted access control tree. e , set the weight vector for the child nodes of the root node in The expansion column is set up Use L1=m1,m2,...,m e Represents a (W, k, m)-Mignoote column. Similarly, according to the access tree structure, a (W, k, m)-Mignoote column is defined for each non-leaf node, and L1, L2, ..., L b and the corresponding Where b is the number of all non-leaf nodes in the access strategy tree Γ, and a (l,n) matrix with l rows and n columns is defined. The (l,n) matrix is ​​represented by Ω. L Store multiple (W,k,m)-Mignoote sequences L1,L2,...,L b ,Ω W Storing multiple weight vectors Assume that Y is the set of all leaf nodes in Γ, then q root = r', Where m=m1m2...m t , M i =m / m i and 1≤i≤n; DO selects attribute j∈S and binds it to leaf node y in Γ, and selects a random element And calculate C0, C1, C2, where C0=g αr' , C1=g βr' , C2=g υ , send CT = {Γ,Ω L ,Ω W ,CT1,CT2} to CSP; After uploading the data, DO will calculate the integrity information of the data plaintext including DO's data signature and send it to AA, calculate the file hash H1(M), and DO generates the signature. This includes transactions Tx HM and timestamp t HM , send them to AA; AA packages the integrity information into a transaction and uploads it to the blockchain for subsequent decryption verification. After receiving it, AA HM , and timestamp t HM Packed into blocks #y , broadcast it to reach consensus with other alliance nodes, and get block number #y and transaction number The data user (DU): DU is the party that intends to obtain data. They request the attribute private key from AA. The data user uses their key to generate a search trapdoor and sends it to CSP. After receiving the relevant ciphertext data, the data user decrypts it. DU wants to access information. It first generates its own search trapdoor CTK through keywords and attribute private keys, sends it to CSP to request a search, and generates a search token CTK = {PTK1, PTK2, PTK3, PTK 4,j ,PTK 5,j } and the block number #z and transaction number returned by the alliance chain Sent to CSP together; PTK2=g τ , The Cloud Service Provider (CSP): CSP is a semi-honest and trusted cloud service provider with a large amount of storage space and powerful computing performance. CSP is responsible for storing data for data owners and searching for data users. Before searching, CSP needs to verify the legitimacy of DU user identity in CB; After receiving the search request, CSP will first verify the legitimacy of the user, using the block number #z and transaction number Id TxAKG Initiate a query on the consortium chain for related transactions. Return the transaction to CSP, query the relevant attribute authorization transaction from the alliance chain to determine whether the user has authorization information, and #z Extract transaction Tx AKG , Signature Sig AA [H2(Tx AKG ||t AKG )] and timestamp t AKG , CSP uses AA's public key PK AA Verify the signature, the verification result is if CSP from transaction Tx AKG Extract attribute set S DU , if it is a legitimate user, CSP continues with the following operations; CSP performs keyword ciphertext search. If the keyword does not match or does not satisfy the access policy, it returns to terminate. If the access policy matches, the root node R can be obtained by recursive solution. If the keyword matches, then The equation holds true; After the search is successful, the partially decrypted result e(g,g) τrr' and the corresponding ciphertext files CT1 and CT2 as well as the block number #y and transaction number Return to DU; DU uses its own private key to fully decrypt Get the symmetric key, and then use the symmetric key to perform final decryption to get the plaintext data; By querying the alliance chain for data integrity information and verifying whether the data has been tampered with, DU searches for relevant transaction information on CB based on the block number and transaction identifier sent by CSP. DU extracts relevant transactions containing the original file on CB and compares the hash value of the original file in the transaction with the hash value calculated by itself. If the values ​​are consistent, it means that the original file has not been tampered with; otherwise, the file has been tampered with during the sharing process.

Images