Ciphertext strategy attribute-based encryption method and system for smart power grid data

Abstract

The invention discloses a ciphertext policy attribute-based encryption method and system for smart power grid data, and particularly relates to the technical field of information security, and the technical key points are that the method comprises the steps that a key generation center generates a bilinear mapping group parameter as a public parameter based on a system security parameter, and generates a system private key and a system public key; the key generation center distributes a group identifier and an attribute set for the data user applying for the user private key, generates an identifier private key and an attribute key by using the system private key, the group identifier and the attribute set in combination with a randomly selected first random number, generates a user private key in combination with the identifier private key and the attribute key, and sends the user private key to the data user; a data owner encrypts service data by using an SM4 block cipher algorithm to obtain encrypted data, encrypts a symmetric key by using a CP-ABE algorithm to obtain a key ciphertext, and sends the encrypted data and the key ciphertext to a cloud service provider.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a ciphertext policy attribute-based encryption method and system for smart grid data. Background Art

[0002] Smart grids contain a large number of different types of devices and applications that generate, collect and transmit energy data, which are characterized by huge volume, complex structure and diversity. Attackers may modify energy data to cause abnormal grid operation or wrong decisions. Since smart grids are highly distributed systems, they require a scalable, interoperable and distributed computing infrastructure to store and process these data. Business data may contain sensitive and private information, which requires special attention to data security and privacy protection, otherwise attackers may infer usage patterns through data. Prevent attackers from accessing highly secure information without authorization and rely on implementing access control.

[0003] Traditional access control technology usually configures trusted servers to store plaintext data and relies only on software to determine whether users access the data they are authorized to access, resulting in low encryption reliability of smart grid data and easy leakage of data messages. Therefore, the present invention aims to provide a ciphertext policy attribute-based encryption method and system for smart grid data to solve the above-mentioned related problems. Summary of the invention

[0004] The technical problem to be solved by the present invention is that traditional access control technology usually configures a trusted server to store plaintext data, and only relies on software to determine that users access the data they are authorized to access, which leads to related problems such as low encryption reliability of smart grid data. The purpose is to provide a ciphertext policy attribute-based encryption method and system for smart grid data, which utilizes a system private key, a group identifier and an attribute set, combined with a randomly selected first random number to generate an identification private key and an attribute key, and then generates a user private key by combining the identification private key and the attribute key to associate the attribute key related to the attribute with the identification private key related to the system private key. Only when the attribute set of the data user meets the access policy embedded in the key ciphertext can the key ciphertext be decrypted to obtain the symmetric key, thereby increasing the encryption reliability of the smart grid data and preventing the leakage of the smart grid data.

[0005] The present invention is achieved through the following technical solutions:

[0006] A ciphertext policy attribute-based encryption method for smart grid data, the method comprising:

[0007] The key generation center generates bilinear mapping group parameters as public parameters based on the system security parameters, and generates a system private key and a system public key;

[0008] The key generation center allocates a group identifier and an attribute set to a data user who applies for a user private key, generates an identifier private key and an attribute key by using the system private key, the group identifier and the attribute set, and combining the randomly selected first random number, generates a user private key by combining the identifier private key and the attribute key, and sends the generated user private key to the data user;

[0009] The data owner uses the SM4 block cipher algorithm to encrypt the business data to obtain encrypted data, uses the CP-ABE algorithm to encrypt the symmetric key to obtain the key ciphertext, and sends both the encrypted data and the key ciphertext to the cloud service provider;

[0010] The data user submits a business data application to the cloud server provider. If the data user's attribute set meets the access policy of the embedded key ciphertext, the data user can decrypt the key ciphertext to obtain the symmetric key, and use the SM4 block cipher algorithm to decrypt the encrypted data to obtain the business data.

[0011] Furthermore, the key generation center allocates a group identifier and an attribute set to the data user who applies for the user private key, uses the system private key, the group identifier and the attribute set, and combines the randomly selected first random number to generate an identifier private key and an attribute key, combines the identifier private key and the attribute key to generate a user private key and sends it to the data user, specifically:

[0012] The data user sends a user private key application request to the key generation center, and the key generation center allocates a group identifier and attribute set to the data user applying for the user private key;

[0013] The key generation center randomly selects a first random number, and generates an identification private key and an attribute key by combining the system private key, the group identifier and the attribute set;

[0014] Using the identification private key and attribute key, a user key is generated and sent to the data user.

[0015] Furthermore, the key generation center randomly selects a first random number, combines the system private key, the group identifier and the attribute set to generate an identification private key and an attribute key, combines the identification private key and the attribute key to generate a user private key and sends it to the data user, specifically:

[0016] The key generation center randomly selects a first random number and generates an identification private key by combining the system key, the group identifier and the attribute set;

[0017] For each attribute in the attribute set, a second random number is selected, and a first attribute key and a second attribute key are generated in combination with the public parameter;

[0018] Based on the identification private key, the first attribute key and the second attribute key, a user private key is generated and sent to the data user.

[0019] Furthermore, the key generation center generates bilinear mapping group parameters as public parameters based on the system security parameters, and generates a system private key and a system public key, specifically:

[0020] The key generation center generates bilinear mapping group parameters as public parameters based on the system security parameters;

[0021] The key generation center randomly selects at least one third random number as a system private key, and uses the system private key in combination with the public parameters to generate a system public key.

[0022] Furthermore, the common parameters specifically include: a prime number N; an additive cyclic group G1, G2, Z whose order is the prime number N N ; Multiplicative cyclic group G of prime order N T ; Bilinear mapping e: G1×G2→G T ; Generator P1 of additive cyclic group G1; Generator P2 of additive cyclic group G2; Hash mapping function H1: {0,1} * →Z N ; Hash mapping function H2: {0,1} k →G2.

[0023] Furthermore, the CP-ABE algorithm is used to encrypt the symmetric key to obtain the key ciphertext, specifically:

[0024] Randomly select a fourth random number to generate a first ciphertext component, and construct a threshold tree according to the attribute set of the data user, wherein each leaf node in the threshold tree corresponds one-to-one to an attribute in the attribute set;

[0025] encrypting the symmetric key to generate a second ciphertext component;

[0026] Encrypting the first ciphertext component, the bit length of the symmetric key, and the group identifier of the data user using a key derivation function to generate a derived key, and combining the derived key with the second ciphertext component to generate a third ciphertext component;

[0027] Generate a first attribute ciphertext component and a second attribute ciphertext component based on the attribute corresponding to each leaf node in the threshold tree and the system public key;

[0028] A key ciphertext is determined based on the first ciphertext component, the second ciphertext component, the third ciphertext component, the first attribute ciphertext component, and the second attribute ciphertext component.

[0029] The present invention also provides a ciphertext policy attribute-based encryption system for smart grid data, the system is used in any one of the ciphertext policy attribute-based encryption methods for smart grid data described above, and the system includes:

[0030] A system key generation module, used for the key generation center to generate bilinear mapping group parameters as public parameters based on system security parameters, and to generate system private keys and system public keys;

[0031] A user key generation module, which is used by the key generation center to allocate a group identifier and an attribute set to a data user who applies for a user private key, generate an identifier private key and an attribute key by using the system private key, the group identifier and the attribute set, and combining a randomly selected first random number, and generate a user private key by combining the identifier private key and the attribute key and send it to the data user;

[0032] The data encryption module is used by the data owner to encrypt the business data using the SM4 block cipher algorithm to obtain encrypted data, encrypt the symmetric key using the CP-ABE algorithm to obtain the key ciphertext, and send both the encrypted data and the key ciphertext to the cloud service provider;

[0033] The data decryption module is used by data users to submit business data applications to cloud server providers. If the data user's attribute set meets the access policy of the embedded key ciphertext, the data user can decrypt the key ciphertext to obtain the symmetric key, and use the SM4 block cipher algorithm to decrypt the encrypted data to obtain the business data.

[0034] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above-mentioned methods when executing the computer program.

[0035] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any one of the methods described above are implemented.

[0036] The present invention also provides a computer program product comprising instructions, and when the instructions are executed by a computer device cluster, the computer device cluster executes any of the above methods.

[0037] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0038] In the present invention, by utilizing the system private key, group identifier and attribute set, combined with a randomly selected first random number to generate an identifier private key and an attribute key, and then by combining the identifier private key and the attribute key to generate a user private key, the attribute key related to the attribute and the identifier private key related to the system private key are associated. Only when the attribute set of the data user meets the access policy of the embedded key ciphertext can the key ciphertext be decrypted to obtain the symmetric key, thereby increasing the encryption reliability of the smart grid data and preventing the leakage of the smart grid data. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative work. In the drawings:

[0040] Figure 1 A system architecture diagram of a ciphertext policy attribute-based encryption method for smart grid data in this embodiment;

[0041] Figure 2 This is a method flow chart of a ciphertext policy attribute-based encryption method for smart grid data in this embodiment;

[0042] Figure 3 A graph showing the relationship between the number of attributes and encryption time for generating key ciphertext for the simulated data owner in this embodiment;

[0043] Figure 4 This is a graph showing the relationship between the number of attributes and the decryption time of the decryption key ciphertext of the simulated data user in this embodiment;

[0044] Figure 5 This is a module diagram of a ciphertext policy attribute-based encryption system for smart grid data in this embodiment;

[0045] Figure 6 It is a structural schematic diagram of a computer device in this embodiment. DETAILED DESCRIPTION

[0046] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0047] In the present disclosure, unless otherwise specified, the use of the terms "first", "second", etc. to describe various elements is not intended to limit the positional relationship, timing relationship, or importance relationship of these elements, and such terms are only used to distinguish one element from another element. In some examples, the first element and the second element may refer to the same instance of the element, and in some cases, based on the description of the context, they may also refer to different instances.

[0048] The terms used in the description of various examples in this disclosure are only for the purpose of describing specific examples and are not intended to be limiting. Unless the context clearly indicates otherwise, if the number of elements is not specifically limited, the element can be one or more. In addition, the term "and / or" used in this disclosure covers any one of the listed items and all possible combinations.

[0049] Example 1

[0050] See also Figure 1 As shown, the method provided in this embodiment is used in a system architecture constructed by a data owner (DataOwner, DO), a data user (DataUser, DU), a cloud service provider (CloudServiceProvider, CSP) and an attribute authorization agency (AttributeAuthority, AA); wherein the data owner is a series of power equipment, such as a programmable logic controller (PLC), a remote terminal unit (RTU), an intelligent electronic device (IED), etc., which generates, collects and transmits business data, designs access strategies according to requirements, and uploads encrypted data and key ciphertexts to the cloud service provider; the data user is an entity or user such as consumption, market, operation, etc. in the smart grid, which can describe its identity with a set of attributes and apply to the cloud service provider for access to data. The key ciphertext can be decrypted only when the user's private key satisfies the ciphertext access strategy; the cloud service provider has abundant cloud storage space, stores the encrypted data uploaded by the data owner, receives access requests from the data user, and transfers the communication between the participants, but cannot obtain the content of the data; the attribute authorization agency is a third-party trusted agency that undertakes the key generation center (Key Generation Center Center, KGC) to generate system public parameters, manage attribute sets, evaluate user identity information, determine the attributes owned by data users, and distribute user private keys.

[0051] See also Figure 2 As shown, a ciphertext policy attribute-based encryption method for smart grid data includes:

[0052] S1: The key generation center generates the bilinear mapping group parameter as the public parameter PP based on the system security parameter λ, and generates the system private key MK and the system public key PK, specifically:

[0053] S11: The key generation center generates bilinear mapping group parameters as public parameters PP based on the system security parameter λ, wherein the public parameters PP specifically include: a prime number N; an additive cyclic group G1, G2, Z with an order of the prime number N; N ; Multiplicative cyclic group G of prime order N T ; Bilinear mapping e: G1×G2→GT ; Generator P1 of additive cyclic group G1; Generator P2 of additive cyclic group G2; Hash mapping function H1: {0,1} * →Z N ; Hash mapping function H2: {0,1} k →G2;

[0054] It should be noted that, in this embodiment, for the bilinear mapping e:G1×G2→G T The following three conditions need to be met: Bilinear: For any u∈G1,v∈G2 and a,b∈Z, there exists e(u a ,v b )=e(u,v) ab ; Non-degeneracy: bilinear mapping does not generate G T The identity element of , e(g1,g2)≠1; Computability: For any u∈G1,v∈G2, there is an efficient algorithm to calculate e(u,v).

[0055] S12: The key generation center randomly selects two third random numbers as the system private key, and uses the system private key and the public parameters to generate the system public key, specifically:

[0056] S121: The key generation center randomly selects two third random numbers k1, k2∈[1, N-1] as the system private key MK=(k1, k2);

[0057] S122: Using the system private key MK and combining the generator P1 of the additive cyclic group G1 in the public parameters, calculate PK1=[k1]P1, PK2=[k2]P1 to obtain the system public key PK=(PK1, PK2).

[0058] S2: The key generation center allocates a group identifier and attribute set to the data user who applies for the user private key, uses the system private key, group identifier and attribute set, and combines the randomly selected first random number to generate an identifier private key and an attribute key, combines the identifier private key and the attribute key to generate a user private key and sends it to the data user, specifically:

[0059] S21: The data user sends a user private key application request to the key generation center, and the key generation center allocates a group identifier GID and an attribute set S to the data user applying for the user private key;

[0060] S22: The key generation center randomly selects a first random number r, and generates an identification private key and an attribute key by combining the system private key, the group identifier and the attribute set, specifically:

[0061] S221: The key generation center randomly selects a first random number r, and generates an identification private key SK1 in combination with the system key, the group identifier and the attribute set, specifically:

[0062]

[0063] Wherein, H1 is a hash mapping function; GID is a group identifier; hid is an encryption private key generation function identifier; N is a prime number; k1 is one of the third random numbers; r is the first random number; P2 is a generator of the additive cyclic group G2;

[0064] S222: For each attribute i∈S in the attribute set S, select a second random number r i , and generate the first attribute key and the second attribute key in combination with the public parameters, specifically:

[0065] SK i =[k2 -1 ]([r]P2+[r i ]H2(i))

[0066] SK i ′=[r i ]P1

[0067] Wherein, k2 is one of the third random numbers; r is the first random number; P2 is the generator of the additive cyclic group G2; r i is the second random number; H2 is the hash mapping function; i is the attribute; SK i SK is the first attribute key; i ' is the second attribute key;

[0068] S23: Generate a user key using the identification private key and attribute key and send it to the data user, specifically:

[0069] Based on the identification private key, the first attribute key and the second attribute key, a user private key is generated and sent to the data user, where the user key SK is specifically:

[0070] S3: The data owner uses the SM4 block cipher algorithm to encrypt the business data to obtain encrypted data, uses the CP-ABE algorithm to encrypt the symmetric key to obtain the key ciphertext, and sends both the encrypted data and the key ciphertext to the cloud service provider;

[0071] It should be noted that, in this embodiment, the data owner adopts the idea of ​​hybrid encryption, uses the SM4 block cipher algorithm to encrypt the business data, and then uses the CP-ABE algorithm to encrypt the symmetric key M, and finally sends the encrypted data and the key ciphertext together to the cloud service provider for storage;

[0072] Specifically, in this embodiment, the CP-ABE algorithm is used to encrypt the symmetric key to obtain the key ciphertext, which is specifically:

[0073] S31: randomly select a fourth random number to generate a first ciphertext component, and construct a threshold tree according to the attribute set of the data user, wherein each leaf node in the threshold tree corresponds one-to-one to an attribute in the attribute set, specifically:

[0074] S311: The data owner queries the group identifier GID of the data user. If the corresponding group identifier GID exists, the first encrypted intermediate value Q is calculated, which is specifically:

[0075] Q=[H1(ID∥hid,N)]P1+PK1

[0076] S312: The data owner randomly selects a fourth random number s and combines it with the first encrypted intermediate value Q to calculate the first ciphertext component C1, specifically:

[0077] C1=[s]Q

[0078] S312: The data owner constructs a threshold tree T according to the attribute set S of the data user, wherein each leaf node in the threshold tree T corresponds one-to-one to an attribute i in the attribute set S;

[0079] S32: Encrypt the symmetric key to generate a second ciphertext component C2;

[0080] S33: Encrypt the first ciphertext component, the bit length of the symmetric key, and the group identifier of the data user using a key derivation function to generate a derived key, and then combine the derived key and the second ciphertext component to generate a third ciphertext component C3;

[0081] Specifically, in this embodiment, the key derivation function is used to encrypt the first ciphertext component, the bit length of the symmetric key, and the group identifier of the data user to generate a derived key, which adopts conventional technical means in the field and will not be elaborated here.

[0082] S34: Generate a first attribute ciphertext component C based on the attribute corresponding to each leaf node x in the leaf node set TL in the threshold tree T and the system public key x and the second attribute ciphertext component C x ′ , specifically:

[0083] C x =[q x (0)]PK2

[0084] C x ′=[q x (0)]H2(att(x))

[0085] Among them, q x (0) indicates the value of the polynomial corresponding to the leaf node when the variable is 0; [q x(0)]PK2 represents the scalar multiplication of the two on the elliptic curve; att(x) represents the attribute value corresponding to the leaf node.

[0086] S35: Determine the key ciphertext based on the first ciphertext component, the second ciphertext component, the third ciphertext component, the first attribute ciphertext component, and the second attribute ciphertext component

[0087] S4: The data user submits a business data application to the cloud server provider. If the data user's attribute set meets the access policy embedded in the key ciphertext, the data user can decrypt the key ciphertext to obtain the symmetric key, and use the SM4 block cipher algorithm to decrypt the encrypted data to obtain the business data. Specifically:

[0088] S41: According to the business data application submitted by the user to the cloud server provider, if the attribute set of the data user satisfies the access policy embedded in the key ciphertext, the threshold tree T is extracted from the key ciphertext CT, and each leaf node x of the threshold tree T corresponds to an attribute i; for each leaf node x, let i = att(x), if i∈S holds, calculate:

[0089]

[0090] For each internal node x, let its child node set be S x , the index set S of the child nodes x ′ ={index(z)},z∈S x , get the decryption result F of each child node z ,z∈S x ,calculate:

[0091]

[0092]

[0093] Obtain the decryption result F of the root node R R =e(P1,P2) rs ; Then, the data user calculates Combined with the key derivation function, the decrypted plaintext M ′ It is a symmetric key. Finally, the SM4 block cipher algorithm is used to decrypt the encrypted data to obtain the business data.

[0094] It should be noted that to prove the effectiveness of this method, it is only necessary to prove The specific proof process is:

[0095]

[0096] Specifically, in this embodiment, the business data is encrypted by the SM4 block cipher algorithm and stored in the cloud service provider. After that, all entities in the system can apply to the cloud service provider for access. Since the symmetric key is independently generated by the data owner and encrypted by the CP-ABE algorithm, the cloud service provider cannot crack the business data without the symmetric key. If the attribute set of the data user does not meet the access policy embedded in the key ciphertext, he cannot decrypt the key ciphertext to obtain the symmetric key. Similarly, the data user cannot crack the business data.

[0097] At the same time, in this embodiment, by utilizing the system private key, group identifier and attribute set, combined with a randomly selected first random number to generate an identifier private key and an attribute key, and then by combining the identifier private key and the attribute key to generate a user private key, the attribute key related to the attribute and the identifier private key related to the system private key are associated. Only when the attribute set of the data user meets the access policy of the embedded key ciphertext can the key ciphertext be decrypted to obtain the symmetric key, thereby increasing the encryption reliability of the smart grid data and preventing the leakage of the smart grid data.

[0098] In this embodiment, the process of the attribute authorization agency distributing user private keys, the data owner generating key ciphertext, and the data user decrypting the key ciphertext in this method is simulated. Figure 3 , Figure 4 As shown in the figure, the computing time required for encryption and decryption is shown. According to the experimental results, when the number of attributes increases, the encryption and decryption time increases linearly.

[0099] Example 2

[0100] See also Figure 5 As shown, the present invention also provides a ciphertext policy attribute-based encryption system for smart grid data, the system is used in any one of the ciphertext policy attribute-based encryption methods for smart grid data described above, and the system includes:

[0101] The system key generation module 100 is used for the key generation center to generate bilinear mapping group parameters as public parameters based on system security parameters, and to generate system private keys and system public keys;

[0102] The user key generation module 200 is used for the key generation center to allocate a group identifier and an attribute set to a data user who applies for a user private key, generate an identifier private key and an attribute key by using the system private key, the group identifier and the attribute set, and combining a randomly selected first random number, and generate a user private key by combining the identifier private key and the attribute key and send it to the data user;

[0103] The data encryption module 300 is used for the data owner to encrypt the business data using the SM4 block cipher algorithm to obtain encrypted data, encrypt the symmetric key using the CP-ABE algorithm to obtain the key ciphertext, and send both the encrypted data and the key ciphertext to the cloud service provider;

[0104] The data decryption module 400 is used for data users to submit business data applications to the cloud server provider. If the attribute set of the data user meets the access policy of the embedded key ciphertext, the data user can decrypt the key ciphertext to obtain the symmetric key, and use the SM4 block cipher algorithm to decrypt the encrypted data to obtain the business data.

[0105] It should be noted that the modules in the system of Example 2 correspond to the steps in the method of Example 1. The steps in the method of Example 1 have been described in detail in Example 1. In this Example 2, the contents of the modules in the system will not be described in detail.

[0106] Example 3

[0107] See also Figure 6 As shown, this embodiment further provides a computer device, including a memory 1005 and a processor 1001, wherein the memory 1005 stores a computer program, and the processor 1001 implements the steps of any one of the above methods when executing the computer program.

[0108] It should be noted that the processor 1001 is used to execute the steps in the above method embodiments according to the instructions in the program code. Alternatively, the processor 1001 implements the functions of each module / unit in the above system / device embodiments when executing the computer program.

[0109] Specifically, in this embodiment, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 1005, and are executed by the processor 1001 to complete the present application. One or more modules / units may be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program in the terminal device.

[0110] The terminal device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The terminal device may include, but is not limited to, a processor 1001 and a memory 1005. Those skilled in the art will appreciate that this does not constitute a limitation on the terminal device, and may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the terminal device may also include an input / output device 1003, a network access device 1002, a bus 1006, etc.

[0111] The processor 1001 may be a central processing unit (CPU), or other general-purpose processors 1001, digital signal processors 1001 (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor 1001 may be a microprocessor or any conventional processor, etc.

[0112] The memory 1005 may be an internal storage unit of the terminal device, such as a hard disk or memory of the terminal device. The memory 1005 may also be an external storage device 1004 of the terminal device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the terminal device. Further, the memory 1005 may also include both the internal storage unit of the terminal device and the external storage device 1004. The memory 1005 is used to store computer programs and other programs and data required by the terminal device. The memory 1005 may also be used to temporarily store data that has been output or is to be output.

[0113] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0114] Example 4

[0115] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the above methods are implemented.

[0116] Among them, the computer readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, system or device, or any combination of the above. More specific examples of computer readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk. Random Access Memory (RAM), Read-Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), registers, hard disks, optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above or any other form of computer readable storage medium of numerical value in the art.

[0117] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application-specific integrated circuit (ASIC). In an embodiment of the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system, or device.

[0118] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A ciphertext policy attribute-based encryption method for smart grid data, characterized in that: Methods include: The key generation center generates bilinear mapping group parameters as public parameters based on the system security parameters, and generates a system private key and a system public key; The key generation center allocates a group identifier and an attribute set to a data user who applies for a user private key, generates an identifier private key and an attribute key by using the system private key, the group identifier and the attribute set, and combining the randomly selected first random number, generates a user private key by combining the identifier private key and the attribute key, and sends the generated user private key to the data user; The data owner uses the SM4 block cipher algorithm to encrypt the business data to obtain encrypted data, uses the CP-ABE algorithm to encrypt the symmetric key to obtain the key ciphertext, and sends both the encrypted data and the key ciphertext to the cloud service provider; The data user submits a business data application to the cloud server provider. If the data user's attribute set meets the access policy of the embedded key ciphertext, the data user can decrypt the key ciphertext to obtain the symmetric key, and use the SM4 block cipher algorithm to decrypt the encrypted data to obtain the business data.

2. A ciphertext policy attribute-based encryption method for smart grid data according to claim 1, characterized in that: The key generation center allocates a group identifier and attribute set to the data user who applies for the user private key, uses the system private key, group identifier and attribute set, and combines the randomly selected first random number to generate an identifier private key and an attribute key, combines the identifier private key and the attribute key to generate a user private key and sends it to the data user, specifically: The data user sends a user private key application request to the key generation center, and the key generation center allocates a group identifier and attribute set to the data user applying for the user private key; The key generation center randomly selects a first random number, and generates an identification private key and an attribute key by combining the system private key, the group identifier and the attribute set; Using the identification private key and attribute key, a user key is generated and sent to the data user.

3. The ciphertext policy attribute-based encryption method for smart grid data according to claim 1, characterized in that: The key generation center randomly selects the first random number, combines the system private key, group identifier and attribute set to generate the identification private key and attribute key, combines the identification private key and attribute key to generate the user private key and send it to the data user, specifically: The key generation center randomly selects a first random number and generates an identification private key by combining the system key, the group identifier and the attribute set; For each attribute in the attribute set, a second random number is selected, and a first attribute key and a second attribute key are generated in combination with the public parameter; Based on the identification private key, the first attribute key and the second attribute key, a user private key is generated and sent to the data user.

4. The ciphertext policy attribute-based encryption method for smart grid data according to claim 1, characterized in that: The key generation center generates bilinear mapping group parameters as public parameters based on the system security parameters, and generates system private keys and system public keys, specifically: The key generation center generates bilinear mapping group parameters as public parameters based on the system security parameters; The key generation center randomly selects at least one third random number as a system private key, and uses the system private key in combination with the public parameters to generate a system public key.

5. A ciphertext policy attribute-based encryption method for smart grid data according to claim 4, characterized in that: The public parameters specifically include: a prime number N; additive cyclic groups G1, G2, Z whose order is the prime number N N ; Multiplicative cyclic group G of prime order N T ; Bilinear mapping e: G1×G2→G T ; Generator P1 of additive cyclic group G1; Generator P2 of additive cyclic group G2; Hash mapping function H1: {0,1} * →Z N ; Hash mapping function H2: {0,1} k →G2.

6. A ciphertext policy attribute-based encryption method for smart grid data according to claim 1, characterized in that: The CP-ABE algorithm is used to encrypt the symmetric key to obtain the key ciphertext, specifically: Randomly select a fourth random number to generate a first ciphertext component, and construct a threshold tree according to the attribute set of the data user, wherein each leaf node in the threshold tree corresponds one-to-one to an attribute in the attribute set; encrypting the symmetric key to generate a second ciphertext component; Encrypting the first ciphertext component, the bit length of the symmetric key, and the group identifier of the data user using a key derivation function to generate a derived key, and combining the derived key with the second ciphertext component to generate a third ciphertext component; Generate a first attribute ciphertext component and a second attribute ciphertext component based on the attribute corresponding to each leaf node in the threshold tree and the system public key; A key ciphertext is determined based on the first ciphertext component, the second ciphertext component, the third ciphertext component, the first attribute ciphertext component, and the second attribute ciphertext component.

7. A ciphertext policy attribute-based encryption system for smart grid data, characterized in that: The system is used in a ciphertext policy attribute-based encryption method for smart grid data as described in any one of claims 1 to 6, and the system includes: A system key generation module, used for the key generation center to generate bilinear mapping group parameters as public parameters based on system security parameters, and to generate system private keys and system public keys; A user key generation module, which is used by the key generation center to allocate a group identifier and an attribute set to a data user who applies for a user private key, generate an identifier private key and an attribute key by using the system private key, the group identifier and the attribute set, and combining a randomly selected first random number, and generate a user private key by combining the identifier private key and the attribute key and send it to the data user; The data encryption module is used by the data owner to encrypt the business data using the SM4 block cipher algorithm to obtain encrypted data, encrypt the symmetric key using the CP-ABE algorithm to obtain the key ciphertext, and send both the encrypted data and the key ciphertext to the cloud service provider; The data decryption module is used by data users to submit business data applications to cloud server providers. If the data user's attribute set meets the access policy of the embedded key ciphertext, the data user can decrypt the key ciphertext to obtain the symmetric key, and use the SM4 block cipher algorithm to decrypt the encrypted data to obtain the business data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising instructions, characterized in that When the instructions are executed by a computer device cluster, the computer device cluster executes the method according to any one of claims 1 to 6.

Images