Data sharing method, device and system

Abstract

The invention provides a data sharing method and system, and the method comprises the steps: at least a threshold number t of secret key generation devices in a secret key generation system cooperate with an intermediate device, so as to carry out the cooperative operation of the secret key generation devices and the intermediate device according to a global system public key PK, the public key of each user in a user complete set, and an attribute set X corresponding to each user; and calculating to obtain a conversion key of each user. A data owner can encrypt plaintext data according to a global system public key PK, a user subset and an access control rule related to attributes to obtain ciphertext data. And then, aiming at any target user in the user subset, under the condition that the attribute set X of the target user conforms to the access control rule, the intermediate equipment converts the ciphertext data into a converted ciphertext corresponding to the target user by utilizing the conversion key of the target user. Therefore, the target user can decrypt the plaintext data based on the converted ciphertext.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of data security, and more particularly, to a method, device and system for securely sharing data. Background Art

[0002] Data security and privacy protection are increasingly becoming the focus of technical attention. In many technical scenarios, ciphertext access control is required. A ciphertext access control scheme is an encryption scheme that can grant decryption permissions to a specified subset of users. In one scenario, the data owner wants to specify a set S that can decrypt the ciphertext. Only members of S can decrypt the ciphertext, and other unauthorized parties cannot decrypt it. In another scenario, the data owner wants to specify some attributes and encrypt messages based on these attributes without worrying about the identity of the message recipient. Only users whose attributes meet the requirements can decrypt the ciphertext, ensuring the confidentiality of the message.

[0003] I hope there will be an improved solution to better implement flexible ciphertext access control. Summary of the invention

[0004] The purpose of the present invention is to provide a data sharing method and system, which can safely and conveniently implement dynamic access control of data.

[0005] A first aspect of this specification provides a data sharing method, comprising:

[0006] In the key generation system, at least a threshold number t of key generation devices and an intermediate device cooperate to calculate the conversion key of each user according to the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user;

[0007] The data owner encrypts the plaintext data according to the global system public key PK, the user subset, and the access control rules related to the attributes to obtain the ciphertext data;

[0008] The intermediate device converts the ciphertext data into a converted ciphertext corresponding to the target user using its conversion key for any target user in the user subset, if its attribute set X meets the access control rule;

[0009] The target user decrypts the converted ciphertext to obtain the plaintext data.

[0010] A second aspect of the present specification provides a data sharing method, which is executed by an intermediate device, comprising:

[0011] Cooperating with at least a threshold number t of key generation devices in the key generation system, the conversion key of each user is calculated based on the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user;

[0012] Acquire ciphertext data, where the ciphertext data is obtained by encrypting the plaintext data by the data owner according to the global system public key PK, the user subset, and the access control rules related to the attributes;

[0013] For any target user in the user subset, if its attribute set X meets the access control rule, use its conversion key to convert the ciphertext data into a conversion ciphertext corresponding to the target user;

[0014] The converted ciphertext is sent to the target user, so that the target user can decrypt the converted ciphertext to obtain the plaintext data.

[0015] A third aspect of the present specification provides a data sharing device, which is deployed in an intermediate device and includes:

[0016] The conversion key generation unit is configured to cooperate with at least a threshold number t of key generation devices in the key generation system, so as to calculate the conversion key of each user according to the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user;

[0017] A ciphertext acquisition unit is configured to acquire ciphertext data, wherein the ciphertext data is obtained by encrypting the plaintext data by the data owner according to the global system public key PK, the user subset, and the access control rules related to the attribute;

[0018] A ciphertext conversion unit is configured to, for any target user in the user subset, use its conversion key to convert the ciphertext data into a conversion ciphertext corresponding to the target user when its attribute set X meets the access control rule;

[0019] The ciphertext sending unit is configured to send the converted ciphertext to the target user so that the target user can decrypt the converted ciphertext to obtain the plaintext data.

[0020] A fourth aspect of the present specification provides a data sharing system, including a key generation system, an intermediate device, a data owner, and a user set consisting of multiple users, wherein:

[0021] The key generation system is used to calculate the conversion key of each user according to the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user by using at least a threshold number t of the key generation devices and the intermediate device to cooperate with each other;

[0022] The data owner is used to encrypt the plaintext data according to the global system public key PK, the user subset, and the access control rules related to the attributes to obtain the ciphertext data;

[0023] The intermediate device is used to, for any target user in the user subset, use its conversion key to convert the ciphertext data into a conversion ciphertext corresponding to the target user when its attribute set X meets the access control rule, so that the target user can decrypt the plaintext data based on the conversion ciphertext.

[0024] The fifth aspect of the present specification provides a computer program product, comprising a computer program / instruction, which implements the steps of the first and second aspects of the method when executed by a processor.

[0025] A sixth aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the methods described in the first and second aspects.

[0026] A seventh aspect of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the methods described in the first and second aspects are implemented.

[0027] In an eighth aspect, the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the methods described in the first and second aspects are implemented.

[0028] The above aspects provide a new data sharing solution, which embeds the attributes of data users into their keys through the collaborative operation of multiple key generation devices and intermediate devices, and allows data owners to encrypt their messages based on user sets and access control policies. The intermediate device performs ciphertext conversion on the target users who are in the set and whose attributes comply with the access control policy, so that the target users can decrypt the messages based on the converted ciphertext. The above overall process provides data owners with flexible and secure data access control. In particular, access control can support user revocation based on both user sets and access control policies; the multi-party collaborative key generation process ensures the security and performance of key generation; the ciphertext conversion process reduces the decryption calculation burden of the target user, thereby solving several problems of the existing technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0030] Figure 1 A schematic diagram showing a communication system and a data access control process in the system according to an embodiment;

[0031] Figure 2 The process of generating a global system public key by a global key device and a key generation system in one embodiment is shown;

[0032] Figure 3 The process of jointly generating a conversion key by a key generating device and an intermediate device in one embodiment is shown;

[0033] Figure 4 The process of decrypting the ciphertext by the intermediate device and the user is shown;

[0034] Figure 5 A schematic diagram showing the logical structure of a data sharing device according to an embodiment is shown. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0036] In the era of big data, data security and privacy protection issues have increasingly become the focus of attention of all parties. In the process of data sharing and distribution, how data users can securely access private data stored in the cloud, and how data owners can flexibly and securely share data with designated users have become challenging issues. This issue includes two major challenges: data confidentiality and access control. To this end, some ciphertext access control schemes have been proposed to control data access rights while ensuring data confidentiality.

[0037] To achieve ciphertext access control, a broadcast encryption (BE) scheme has been proposed, in which the sender encrypts the broadcast information to be sent, and the sender can specify a set U that can decrypt the ciphertext. Only authorized users in U can correctly decrypt the broadcast information, and other unauthorized users cannot decrypt it. Even if they intercept the broadcast information, they cannot obtain the correct information. At the same time, the sender can dynamically add and delete authorized users in U. However, this scheme cannot meet the requirements of constraining users based on attribute characteristics.

[0038] Recently, attribute-based encryption (ABE) schemes have been proposed, which allow data owners to encrypt messages based on specified attributes without specifying specific users; only users whose attributes meet the requirements can decrypt the ciphertext, ensuring the confidentiality of the message. Ciphertext policy attribute-based encryption (CP-ABE) is a branch of attribute-based encryption (ABE). It embeds access policies into ciphertexts and attributes into keys. Only users whose attribute sets in the keys meet the access control policy can correctly restore the message. Ciphertext policy attribute-based encryption can achieve one-to-many communication between data owners and data users and provide fine-grained access control.

[0039] However, there are many potential problems when directly applying the CP-ABE scheme to actual communication systems. First, there are usually a large number of users in the system, but the traditional CP-ABE scheme has only a single key distribution authority, which cannot adapt to practical applications. For example, when a large number of users request keys at the same time, the authority will inevitably have insufficient performance, resulting in a degraded user experience. Not to mention the problems such as data delay that may be caused by the large physical distance between the authority. In addition, the master key of the system is held by a single authority, which means that once it is compromised, it will be easy for an attacker to generate decryption keys for any set of identities and attributes, so that the shared ciphertext is no longer confidential. Second, the user terminals that access the system are also different. They can be servers or high-performance computers, or they can be devices with low computing and small storage capacity, such as smart watches and medical sensors. Traditional ABE schemes often require a large number of bilinear pairing operations during the decryption process, which is not friendly to terminal devices with insufficient computing resources. Third, users may not be suitable to continue decrypting ciphertexts for various reasons, including but not limited to key leakage, resignation, identity change, etc. Therefore, the system needs to support user revocation to invalidate the keys of these users so that they can no longer decrypt the ciphertext newly shared by the data owner.

[0040] In view of this, in the embodiments of the present specification, a new data sharing scheme is proposed, which can be applied to decentralized scenarios, wherein the attributes of data users are embedded in their keys through the collaborative operation of multiple key generation devices and intermediate devices, and data owners are allowed to encrypt their messages according to user sets and access control policies. The intermediate device performs ciphertext conversion on the target users who are in the set and whose attributes comply with the access control policy, so that the target users can decrypt the messages based on the converted ciphertext. The above overall process provides data owners with flexible and secure data access control. In particular, access control can support user revocation based on both user sets and access control policies; the multi-party collaborative key generation process ensures the security and performance of key generation; the ciphertext conversion process reduces the decryption calculation burden of the target user, thereby solving several problems of the prior art.

[0041] The implementation of the above solution is described below.

[0042] Figure 1 A schematic diagram showing a communication system and a data access control process in the system according to an embodiment is shown. The communication system includes multiple participants, and the roles of these participants in the entire system are divided into the following six categories.

[0043] Cloud server: As a shared hardware and software resource, cloud server provides elastically scalable computing services for various terminals and other devices as needed. In this solution, due to the auxiliary role of the intermediate node, the cloud server does not serve as a data processing center. It only stores and forwards ciphertexts, that is, receives ciphertexts uploaded by the intermediate node and sends ciphertexts to the intermediate node.

[0044] Intermediate node: also known as intermediate device, located between the user device and the cloud server. In this solution, it undertakes the key storage and decryption calculation work of most user devices, and is responsible for the storage of conversion keys and the initial conversion of ciphertext.

[0045] In one embodiment, the intermediate node can be a fog node in a fog computing scenario. Fog computing is an emerging distributed solution and an extended concept of cloud computing. Fog computing deploys fog nodes closer to user terminal devices as an intermediate layer connecting the cloud center and users, providing users with storage and computing services, and solving the high latency disadvantages of centralized processing in cloud computing. Fog nodes are not composed of powerful servers, but of various functional computers with weaker performance and more dispersed. Therefore, fog computing is also more suitable for low-latency and high-mobility application scenarios such as Internet of Vehicles and smart warehouses. In system deployment, fog nodes are located at the edge of the network, where data processing programs related to the implementation scenario of fog computing are deployed. In this solution, fog nodes will serve as the hub of data processing, and collaborate with all parties to perform tasks such as generation and storage of conversion keys and preliminary conversion of ciphertexts.

[0046] Data owner: The data owner is the user device that owns the data and can set data access permissions. After the data owner obtains the public keys of each user from the intermediate node, it can customize the access control policy and broadcast set, encrypt the message and upload the generated ciphertext to the intermediate node.

[0047] User: User device that uses data. The user can independently generate a public-private key pair and upload the public key to the key generation agency and the intermediate node for key generation and ciphertext conversion. The user can receive the converted ciphertext sent by the intermediate node and decrypt it with his own private key.

[0048] Global authority GA: also known as global key device. The global authority is only responsible for generating global parameters, not for generating keys and decryption. It generates system parameters together with the key generation agency and uploads them to the intermediate node.

[0049] Key Generation Authority KGA: also known as key generation device. All n key generation devices constitute a key generation system. The key generation system is mainly responsible for generating conversion keys based on the public key of the data user.

[0050] The following describes the interactive process performed in the above communication system for secure data sharing.

[0051] exist Figure 1In step S1, the global authority (GA) and all key generation agencies (KGA) work together to generate the master key and global parameters, and upload them to the intermediate node. Without considering the interaction between the global authority GA and each key generation device KGA, and ignoring the intermediate products of generating system parameters, in this step S1, the security parameter λ, the maximum number of system users q, the number of KGAs n and the universal attribute set U are used as inputs, and the threshold value t is set. After the GA and KGA jointly operate, the global system public key PK is output and uploaded to the intermediate node. The global system public key PK includes the jointly generated master key parameters and other global parameters.

[0052] In step S2, each user sends its public key to the key generation agency and the intermediate node. The public keys of all users constitute the user public key set

[0053] Step S3 corresponds to the generation of the conversion key, which is performed by the intermediate node and at least t (t≤n) KGAs. Among them, at least t key generation agencies return the conversion key shares of each user, and the intermediate node processes to obtain the conversion key of each user. This step is based on the aforementioned global system public key PK, the user public key set and the attribute set of a user d As input, the processing obtains the user's conversion key TK d This step is equivalent to embedding the attributes of the user d into the key TK d for subsequent decryption.

[0054] In step S4, the data owner obtains the global system public key PK from the intermediate node, and the public key PK is previously uploaded to the intermediate node by the GA and KGA.

[0055] In step S5, the data owner customizes the LSSS access control structure (M, ρ) and the broadcast set The access policy is embedded into the ciphertext using the public key PK to encrypt the plaintext. Then, the data owner uploads the generated ciphertext to the intermediate node.

[0056] In step S6, the intermediate node uploads the ciphertext to the cloud server.

[0057] In step S7, the intermediate node downloads the ciphertext from the cloud server. The download may be performed in response to a request from a data user.

[0058] Step S8 involves the decryption process, which is completed by the data user and the intermediate node. The intermediate node first converts the downloaded ciphertext and sends the converted ciphertext to the user. The user uses his private key to decrypt the converted ciphertext to obtain the original plaintext data. The entire decryption process is based on the public key PK and the user's public key set. Conversion Key TK d 、User private key usk d and ciphertext C as input, if and only if the identity of the user d is in the broadcast set S and the transformation key TK d When the user attributes contained meet the access policy, the intermediate node allows the ciphertext to be converted, and then the user can use his own user private key usk d Decryption completed.

[0059] The implementation details of the above steps are described in detail below.

[0060] Figure 2 The process of generating a global system public key by a global key device and a key generation system in one embodiment is shown, wherein the global key device is the aforementioned global authority GA, and the key generation system is composed of all n key generation agencies (KGA), and the key generation agency KGA is hereinafter referred to as a key generation device. Figure 2 The process can be regarded as Figure 1 Sub-steps of step S1 in .

[0061] As shown in the figure, first in step S21, the global key device GA generates global parameters.

[0062] Specifically, the global key device selects the security parameter λ, the maximum number of system users (i.e., the maximum number of users) q, the number of key generation devices n, and the global attribute set and As input. The global attribute set is a set of all attribute values ​​that all users may have, such as region-related attribute values: Beijing, Shanghai, Hangzhou, etc.; device type-related attribute values: mobile phones, PCs, tablets, etc.; operating system-related attribute values: IOS system, Android system, Hongmeng system, etc. Operating system-related According to the security parameter λ, obtain the pairing parameters Where p1, p2, p3 can be selected as large prime numbers, G is a cyclic group, e is a pairing function based on the generator of the cyclic group, and the result of the pairing function belongs to the cyclic group G T .

[0063] In addition, the global key device GA randomly takes As the master key of GA, select the cyclic group The generators in as well as Corresponds to the global attribute set Each attribute att in i , randomly select one And calculate As the attribute att iIn addition, the global key device determines a threshold value t, which is less than or equal to the number n of key generation devices.

[0064] The global key device GA randomly obtains a set of n ids As the identity representation of n key generation devices. Finally, GA also needs to prepare an empty set Used to store the public key generated by the user.

[0065] From this, the global key device generates and returns the global parameters and the empty set As you can see, the global parameters include the full set of attributes The encoding values ​​of the p attributes in p , and other common parameters.

[0066] Next, in step S22, the n key generation devices KGA are each initialized.

[0067] The initialization process takes the global parameter GP as input. First, each KGA declares a As its identity, the KGA can then be recorded as the i-th key generation device.

[0068] Next, the i-th key generation device selects a random element α i and a random polynomial f of degree t-1 i (x), and f i (0) = α i Then, the i-th generating device inputs each device ID into its own random polynomial f i (x), and get the intermediate values, namely:

[0069] s i,j =f i (id j ), j∈[1,n] (1)

[0070] Thus, the i-th generating device calculates and returns each intermediate value set K i ={s ij =f i (id j )}, where the intermediate value s for its own id ii To be kept secret by each KGA itself.

[0071] Thus, when all KGAs in the system run the algorithm, the master key of the system can be implicitly expressed as And the master polynomial F(x) can be implicitly expressed as akin, It also holds implicitly.

[0072] In step S23, each key generation device KGA exchanges intermediate values ​​and generates its own device private key and device public key.

[0073] Specifically, the i-th key generation device will generate the intermediate value f for any other key generation device j. i (id j ), which is sent to the key generation device j and received from the device j, using the polynomial f j (x) The intermediate value f generated by the i-th key generation device j (id i ). Therefore, the i-th key generation device can aggregate the n intermediate values ​​of the n key generation devices for the party to obtain the device private key of the party. Device private key ksk i It can be expressed as:

[0074]

[0075] Furthermore, the i-th key generation device generates a key according to the device private key ksk i , and global parameters to generate the device public key kpk i , which can be expressed as:

[0076]

[0077] Thus, each key generation device can generate its own device private key and device public key.

[0078] Next, in step S24, the global key device GA obtains a global system public key PK according to the device public keys of at least t key generation devices and the global parameters.

[0079] The global key device GA obtains its device public key from at least t key generation devices KGA and uses the global parameter GP and at least t KGA public keys {kpk i} i∈[1,t] As input, calculate the master key parameters:

[0080]

[0081] Here, α is the master key msk implicitly determined in step S22.

[0082] Then, the global key device can generate and return the global system public key PK:

[0083]

[0084] It can be seen that the global system public key PK includes the calculated master key parameters e(g,g)α , and all elements in the global parameter GP as common parameters.

[0085] Next, the process of initializing the user device is described, which corresponds to Figure 1 Step S2 in .

[0086] Each user is allowed to join after being authenticated Figure 1 After the system is initialized, the initialization process can be performed. Any user d takes the global parameter GP as input and randomly selects a number As the user's private key usk d , and calculate the relevant user public key based on this Thus, the user's public and private key pair (upk d ,usk d ).

[0087] Then, each user fills his or her public key into the collection Sent to the key generation device and the intermediate device. Then, the key generation device and the intermediate device can obtain the user public key set consisting of the public keys of all users.

[0088]

[0089] Figure 3 The process of jointly generating a conversion key by a key generation device and an intermediate device in one embodiment is shown. The process can be regarded as Figure 1 Sub-step of step S3 in .

[0090] like Figure 3 As shown, in step S31, any i-th key generation device in the key generation system generates, for any first user, a key share of the first user according to the global system public key, the first public key of the first user and the corresponding first attribute set;

[0091] Then, in step S32, the intermediate device receives key shares from at least t key generating devices for the first user, and obtains the conversion key of the first user by merging the key shares.

[0092] Specifically, in step S31, any i-th key generation device generates a key share for any user d. The identity of the i-th key generation device is The i-th key generation device has obtained the public key PK, using the public key of party d It can also obtain the attribute set corresponding to the user d And the KGA's own device private key ksk i As input, the key share calculation is performed. Among them, the attribute set corresponding to the user d is Contains the attributes of the user d, which is a global attribute set For example, the attribute set corresponding to square d is It can include, for example, Beijing, mobile phones, Hongmeng system, etc.

[0093] More specifically, for the user d, the i-th key generation device randomly selects And four random number parts in, is a random value, is a random vector or a set of random numbers with a dimension of q-1, that is, it includes random numbers generated for q-1 other users. is also a random vector or a collection of random numbers with dimension That is, the number of attributes in the attribute set x possessed by party d. Then, the i-th key generation device generates the public key upk of party d based on the random number. d , and the public parameters in the global system public key PK, calculate and output the key share generated for user d in:

[0094]

[0095] It can be seen that the key share TK d,i It consists of four sub-parts. The first sub-part According to the public key of user d and the device private key ksk of the i-th key generating device i Generation, subsection 2 According to the random number generation, the third sub-part Based on the public key of other users Generation, Subsection 4 According to the attribute set The coded value of the attribute in C x Of course, in the generation process, the four sub-parts of the key share also introduce four random number parts respectively. In this way, the i-th key generation device generates a key share TK for the user d. d,i .

[0096] In one embodiment, n key generation devices of the key generation system each generate a key share for the user d; then, at least t key generation devices send their key shares to the intermediate device.

[0097] Alternatively, in another embodiment, at least t key generation devices in the key generation system are selected as target devices, and each target device generates a key share for the user d; then, all target devices send their key shares to the intermediate device.

[0098] Regardless of the method, in step S32, the intermediate device can obtain the key shares of at least t key generating devices for the user d, and obtain the conversion key of the user d by merging the key shares.

[0099] Specifically, the intermediate device obtains at least t conversion keys {TK d,i} i∈[1,t] As input, the four sub-parts of each conversion key are merged respectively to obtain the conversion key in:

[0100]

[0101] in,

[0102] It can be seen that the merged conversion key also includes four parts, among which the first part Generated based on the public key of user d, the second part is the result of random parameter operation, the third part is generated according to the public key of other users, and the fourth part is generated according to the encoded value C of the attribute in the user's attribute set x. x generate.

[0103] In this way, the key generation system and the intermediate device work together to generate the conversion key TK for the user d. d As you can see, the conversion key TK d The attribute set information corresponding to the user d is embedded in it.

[0104] Next, we describe the encryption process of the data owner, which corresponds to Figure 1 Step S5. In this step, the data owner encrypts the plaintext data according to the aforementioned global system public key PK, the user subset S specified by it, and the access control rules related to the attributes to obtain the ciphertext data.

[0105] Specifically, the data owner can obtain the aforementioned global system public key PK and specify the access control structure (M, ρ), a broadcast set And the plaintext m is used as input. Among them, the broadcast set S is the subset of users who are authorized to decrypt the data specified by the data owner, and the access control structure (M, ρ) is used to indicate the access control rules related to the attributes.

[0106] In the access control structure, let M be an l×k matrix and ρ be a mapping function that transforms each row M x Mapped to an attribute att x There are no two different rows that are mapped to the same attribute by ρ. Therefore, (M, ρ) can jointly define l attributes.

[0107] The data owner can choose a random vector vector The first component s is the encryption exponent, y2,…,y n is used to share s. Then, calculate Where x∈[1,l], that is, for each row of the matrix M x , by applying a random vector Get the perturbation vector λ of each row x The data owner also randomly selects Finally, the data owner performs encryption calculation and outputs the ciphertext C = (S, (M, ρ), ct1, ct2, {ct 3,x ,ct 4,x} x∈[1,l] ,ct5),

[0108] in:

[0109] ct1=m·e(g,g) αs ,

[0110] ct2=g s ,

[0111]

[0112] It can be seen that the ciphertext C includes multiple ciphertext parts. Among them, the first ciphertext ct1 is obtained based on the plaintext data m and the encryption exponent s, and the second ciphertext group {ct 3,x ,ct 4,x}Based on the perturbation vector λ of each row of matrix M x , and the encoded value C of the attribute ρ(x) after each row is mapped ρ(x) The third ciphertext is based on the public key of each user in the user subset S The ciphertext C also includes a fourth ciphertext ct2 generated based on the encryption exponent s. The generation of the above ciphertext part also uses several public parameters in the global system public key PK, such as the master key parameter e(g,g) α , generator g, and g a .

[0113] It can be seen that in the above generated ciphertext C, in addition to the plaintext information, the information of the user subset S (for example, through the third ciphertext) and the access control rule information related to the attribute (through the second ciphertext group) are also embedded. In this way, the ciphertext C can only be decrypted by the user who meets the corresponding permission requirements.

[0114] Next, combine Figure 4 Describe the decryption process of the intermediate device and the user for the above ciphertext C, which corresponds to Figure 1 Step S8 in .

[0115] like Figure 4 As shown, in step S41, the intermediate device uses its conversion key to convert the ciphertext data C into a converted ciphertext C' corresponding to any target user in the user subset S if its attribute set meets the aforementioned access control rule.

[0116] Thus, in step S42, the target user decrypts the converted ciphertext C' to obtain the plaintext data m.

[0117] Specifically, the intermediate device uses the global system public key PK and the user public key set The attribute set of the user d The conversion key TK d and ciphertext C as input for calculation. Assume that user d belongs to the broadcast set, that is, upk d ∈S, and the attribute set of user d complies with the access control rule, that is, That is, the attribute set Contains all attributes after (M,ρ) mapping. At this time, the set can be defined when In addition, the intermediate device can find a set of constants {σ x} x∈I , so that∑ x∈I σ i λ i =s.

[0118] The intermediate device can then perform the following conversion calculations:

[0119]

[0120] As can be seen, in the first term of the transformation calculation, the intermediate device uses the first part of the transformation key Part 3 The first operation related to pairing is performed using some elements of the first part and the third part of the conversion key that fall into the user subset S, and the third ciphertext ct5. It can be understood that the above-mentioned partial elements of the first part and the third part of the conversion key, and the third ciphertext, all involve the user public key in the user subset. In addition, the first operation also uses the second part of the conversion key and the fourth ciphertext in the ciphertext for auxiliary operations, both of which are generated based on random numbers.

[0121] In the second term of the transformation computation, the intermediate device uses the element corresponding to the target attribute ρ(x) in the fourth part of the transformation key that complies with the access control rule And the second ciphertext group {ct 3,x ,ct 4,x} performs a second operation related to pairing. It can be understood that the above-mentioned partial elements of the fourth part of the conversion key and the second ciphertext group both involve the target attribute specified in the access control rule. In addition, the second operation also uses the second part of the conversion key and the determined constant group {σ x} x∈I Perform auxiliary operations.

[0122] Through the above conversion calculation, the first conversion result ct is obtained ′ ; The first conversion result and the master key parameter e(g,g) in the global system public key PK α , encryption exponent s, and user d’s private key β d The intermediate device converts the first conversion result ct ′ and the aforementioned first ciphertext ct1, constitute the converted ciphertext C ′ =(ct ′ ,ct1) and send it to the target user d.

[0123] Thus, in step S42, the target user uses its own private key usk d =β d And convert the ciphertext C ′ As input, the plaintext m can be decrypted and restored through simple calculation. Specifically, the target user performs the following calculation:

[0124]

[0125] As you can see, the target user d uses its private key β d , for the first conversion result ct ′ Perform an exponential operation; then calculate the quotient of the first ciphertext ct1 and the result of the exponential operation to obtain the plaintext data m. The decryption calculation only involves one exponential operation and one division operation, and the amount of calculation is extremely small. Even a lightweight terminal device can easily complete such a calculation.

[0126] Looking back at the entire process above, through the collaborative operation of multiple key generation devices and intermediate devices, the attributes of the data user are embedded in their keys, and the data owner is allowed to encrypt their messages according to the user set and access control policy. The intermediate device performs ciphertext conversion for the target user in the set and whose attributes comply with the access control policy, and undertakes most of the decryption work, so that the target user can decrypt the message through simple calculations based on the converted ciphertext. The above process implements ciphertext access control in a flexible way, ensures the security and performance of key generation, and reduces the decryption calculation burden of the target user.

[0127] although Figure 1 The system architecture is described in combination with the fog computing scenario. However, the above ciphertext access control scheme can also be applied to other scenarios, such as the communication access mechanism of smart warehouses. Smart warehouses can provide enterprises with accurate inventory data to ensure that enterprises can formulate the next strategic policy in a timely and reasonable manner. In order to ensure the accuracy of inventory information in smart warehouses under dynamic inventory counting, the above scheme can be introduced to ensure secure access to inventory data. The corresponding process can be carried out as follows.

[0128] For smart warehouses, when the inventory data needs to be changed after each shipment, each shipment port in the smart warehouse during this period can be regarded as a data user d, and they can construct a similar Figure 1 Each outlet can only ship designated goods, which corresponds to the attribute set of the user. And at the same time, the same kind of goods can be shipped from multiple outlets; that is, multiple users can have the same attribute items.

[0129] Assume that at a certain moment, the smart warehouse receives a request to ship the same goods. Since the number of goods to be shipped is large, multiple shipping outlets are required to ship at the same time. In this process, each shipping outlet will be added to the system as a data user, and will communicate with the cloud in an encrypted manner to obtain the inventory information of the goods, and complete the modification of the inventory data after the shipment is completed. The consistency of this distributed workflow must be ensured during the modification process. In the process of obtaining and modifying inventory data, only the shipping outlets that can ship the goods and are in the shipping state can perform the above operations, that is, the attributes must comply with the access control rules, and only the data users in the broadcast set have permission.

[0130] Smart warehouses are often limited by the computing power of terminal devices and cannot bear overly heavy storage and computing tasks. The above scheme, i.e., the attribute-based broadcast encryption scheme of the adaptive secure multi-key generation device, can not only ensure the secure access to private inventory data, but also reduce the pressure on the user side by leveraging the characteristics of auxiliary devices (intermediate devices), which is very suitable for the low-latency, high-mobility application scenario of smart warehouses.

[0131] Similarly, the data users may also be devices in other communication scenarios, such as IoT devices, etc., which are not listed here one by one.

[0132] According to another embodiment, the present specification also provides a data sharing system, including a key generation system, an intermediate device, a data owner, and a user set consisting of multiple users, wherein:

[0133] The key generation system is used to calculate the conversion key of each user according to the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user by using at least a threshold number t of the key generation devices and the intermediate device to cooperate with each other;

[0134] The data owner is used to encrypt the plaintext data according to the global system public key PK, the user subset, and the access control rules related to the attributes to obtain the ciphertext data;

[0135] The intermediate device is used to, for any target user in the user subset, use its conversion key to convert the ciphertext data into a conversion ciphertext corresponding to the target user when its attribute set X meets the access control rule, so that the target user can decrypt the plaintext data based on the conversion ciphertext.

[0136] For examples of specific implementations of the above system and its various participants, please refer to the examples and descriptions of the aforementioned data sharing method, which will not be repeated here.

[0137] According to another embodiment of the present specification, a data sharing device is also provided. The device is deployed in an intermediate device. The intermediate device can be implemented by any device, platform or device cluster with data storage, computing and processing capabilities. Figure 5 FIG. 2 is a schematic diagram showing the logical structure of a data sharing device according to an embodiment. Figure 5 As shown, the data sharing device 500 includes:

[0138] The conversion key generating unit 51 is configured to cooperate with at least a threshold number t of key generating devices in the key generating system, so as to calculate the conversion key of each user according to the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user;

[0139] The ciphertext acquisition unit 52 is configured to acquire ciphertext data, wherein the ciphertext data is obtained by encrypting the plaintext data by the data owner according to the global system public key PK, the user subset, and the access control rules related to the attributes;

[0140] The ciphertext conversion unit 53 is configured to convert the ciphertext data into a conversion ciphertext corresponding to the target user using its conversion key for any target user in the user subset, if its attribute set X meets the access control rule;

[0141] The ciphertext sending unit 54 is configured to send the converted ciphertext to the target user so that the target user can decrypt the converted ciphertext to obtain the plaintext data.

[0142] For examples of specific implementations of the data sharing device 500 and each unit therein, please refer to the aforementioned examples and descriptions of the execution process of the intermediate device, which will not be repeated here.

[0143] According to yet another embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the aforementioned data sharing method.

[0144] According to yet another embodiment, a computer program product is provided, comprising a computer program / instruction, which implements the aforementioned data sharing method when executed by a processor.

[0145] According to yet another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the aforementioned data sharing method is implemented.

[0146] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0147] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0148] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0149] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0150] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0151] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0152] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0153] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0154] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0155] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0156] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0157] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0158] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0159] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0160] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. A data sharing method, include: In the key generation system, at least a threshold number t of key generation devices and an intermediate device cooperate to calculate the conversion key of each user according to the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user; The data owner encrypts the plaintext data according to the global system public key PK, the user subset, and the access control rules related to the attributes to obtain the ciphertext data; The intermediate device converts the ciphertext data into a converted ciphertext corresponding to the target user using its conversion key for any target user in the user subset, if its attribute set X meets the access control rule; The target user decrypts the converted ciphertext to obtain the plaintext data.

2. The method according to claim 1, in, The collaborative operation includes: Any i-th key generation device in the key generation system generates, for any first user, a key share of the first user according to the global system public key, the first public key of the first user and the corresponding first attribute set; The intermediate device receives key shares for the first user from at least t key generation devices, and obtains a conversion key of the first user by merging the key shares.

3. The method according to claim 2, in, The global system public key includes the encoded value of each attribute in the attribute set; Generating a key share of the first user includes: The i-th key generation device generates a key share for the first user, the key share including four sub-parts, the first sub-part is generated according to the public key of the first user and the device private key of the i-th key generation device, the second sub-part is generated according to a random number, the third sub-part is generated according to the public keys of other users, and the fourth sub-part is generated according to the encoded value of the attribute in the first attribute set; Merge the individual key shares, including: The four sub-parts of each key share are respectively combined to obtain the conversion key.

4. The method according to claim 1, before the collaborative operation, further include: Global key device generation global parameters, including the device IDs of the n key generation devices that constitute the key generation system; Each key generation device generates its own device public key and device private key according to each device ID; The global key device obtains the global system public key PK according to the device public keys of at least t key generation devices and the global parameters.

5. The method according to claim 4, in, Each key generation device generates its own device public key and device private key according to each device ID, including: Each key generation device inputs each device ID into its own random polynomial to obtain each intermediate value; Each key generation device interacts with the intermediate values ​​generated by each other; Each key generation device aggregates the intermediate values ​​of n key generation devices to obtain its own device private key, and generates a device public key based on the device private key.

6. The method according to claim 1, further comprising: include: The data owner sends the ciphertext data to the intermediate device; The intermediate device uploads the ciphertext data to the cloud server.

7. The method according to claim 6, in, Converting the ciphertext data into a converted ciphertext corresponding to the target user includes: In response to a request from the target user, downloading the ciphertext data from a cloud server; The ciphertext data is converted.

8. The method according to claim 1, in, The global system public key includes the encoded value of each attribute in the entire attribute set; the access control rule indicates multiple attributes that need to be complied with; the ciphertext data includes at least a first ciphertext embedded with the plaintext data, a second ciphertext group embedded with the encoded values ​​of the multiple attributes, and a third ciphertext embedded with multiple user subset information.

9. The method of claim 8, wherein the access control rule comprises a target matrix and a mapping function, wherein the mapping function maps each row of the target matrix to an attribute ； The encrypting of the plaintext data comprises: Applying a target random vector to each row of the target matrix to obtain a perturbation vector of each row, wherein the target random vector includes a randomly selected encryption exponent s; Based on the plaintext data and the encryption exponent s, obtaining the first ciphertext; Obtaining a second ciphertext group based on the perturbation vectors of each row of the target matrix and the encoded values ​​of the attributes after mapping of each row; Based on the public key of each user in the user subset and the encryption exponent s, a third ciphertext is obtained.

10. The method according to claim 8, in, The conversion key of the target user includes a first part generated according to its public key, a third part generated according to the public keys of other users, and a fourth part generated according to the encoded value of the attribute in the attribute set of the target user; The ciphertext data is converted into a conversion ciphertext corresponding to the target user by using the conversion key, including: Using the first part, some elements of the third part that fall into the user subset, and the third ciphertext to perform a first operation related to pairing; Using the element corresponding to the attribute that complies with the access control rule in the fourth part to perform a second operation related to pairing with the second ciphertext; A first conversion result is obtained according to the first operation and the second operation result; the first conversion result and the first ciphertext constitute the conversion ciphertext.

11. The method according to claim 10, in, The target user decrypts the converted ciphertext to obtain the plaintext data, including: Using the private key of the target user, performing an exponential operation on the first conversion result; The quotient of the first ciphertext and the exponential operation result is calculated to obtain the plaintext data.

12. A data sharing method, performed by an intermediate device, include: Cooperating with at least a threshold number t of key generation devices in the key generation system, the conversion key of each user is calculated based on the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user; Acquire ciphertext data, where the ciphertext data is obtained by encrypting the plaintext data by the data owner according to the global system public key PK, the user subset, and the access control rules related to the attributes; For any target user in the user subset, if its attribute set X meets the access control rule, use its conversion key to convert the ciphertext data into a conversion ciphertext corresponding to the target user; The converted ciphertext is sent to the target user, so that the target user can decrypt the converted ciphertext to obtain the plaintext data.

13. The method according to claim 12, in, The collaborative operation includes: Receiving key shares from at least t key generation devices for any first user, wherein the key share from the i-th key generation device is generated according to a global system public key, a first public key of the first user, and a corresponding first attribute set; The key shares are combined to obtain the conversion key of the first user.

14. The method according to claim 12, in, The global system public key includes the encoded value of each attribute in the entire attribute set; the access control rule indicates multiple attributes that need to be complied with; the ciphertext data includes at least a first ciphertext embedded with the plaintext data, a second ciphertext group embedded with the encoded values ​​of the multiple attributes, and a third ciphertext embedded with multiple user subset information.

15. The method according to claim 14, in, The conversion key of the target user includes a first part generated according to its public key, a third part generated according to the public keys of other users, and a fourth part generated according to the encoded value of the attribute in the attribute set of the target user; The ciphertext data is converted into a conversion ciphertext corresponding to the target user by using the conversion key, including: Using the first part, some elements of the third part that fall into the user subset, and the third ciphertext to perform a first operation related to pairing; Using the element corresponding to the attribute that complies with the access control rule in the fourth part to perform a second operation related to pairing with the second ciphertext; A first conversion result is obtained according to the first operation and the second operation result; the first conversion result and the first ciphertext constitute the conversion ciphertext.

16. A data sharing device, deployed in an intermediate device, include: The conversion key generation unit is configured to cooperate with at least a threshold number t of key generation devices in the key generation system, so as to calculate the conversion key of each user according to the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user; A ciphertext acquisition unit is configured to acquire ciphertext data, wherein the ciphertext data is obtained by encrypting the plaintext data by the data owner according to the global system public key PK, the user subset, and the access control rules related to the attribute; A ciphertext conversion unit is configured to, for any target user in the user subset, use its conversion key to convert the ciphertext data into a conversion ciphertext corresponding to the target user when its attribute set X meets the access control rule; The ciphertext sending unit is configured to send the converted ciphertext to the target user so that the target user can decrypt the converted ciphertext to obtain the plaintext data.

17. A data sharing system, comprising a key generation system, an intermediate device, a data owner, and a user set consisting of multiple users. in: The key generation system is used to calculate the conversion key of each user according to the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user by using at least a threshold number t of the key generation devices and the intermediate device to cooperate with each other; The data owner is used to encrypt the plaintext data according to the global system public key PK, the user subset, and the access control rules related to the attributes to obtain the ciphertext data; The intermediate device is used to, for any target user in the user subset, use its conversion key to convert the ciphertext data into a conversion ciphertext corresponding to the target user when its attribute set X meets the access control rule, so that the target user can decrypt the plaintext data based on the conversion ciphertext.

18. A computer program product, comprising a computer program / instructions, which when executed by a processor implement the steps of the method according to claims 1-15.

19. A computing device comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 15 is implemented.

Images