A data sharing method, apparatus and system

Abstract

Provided are a data sharing method and system, wherein the data sharing method comprises: at least t key generation devices in a key generation system cooperating with an intermediate device, so as to calculate a conversion key of each user according to a global system public key PK, a public key of each user in a user set, and an attribute set X corresponding to each user. A data owner can encrypt plaintext data according to the global system public key PK, a user subset, and an access control rule related to the attribute, to obtain ciphertext data. Then, the intermediate device converts the ciphertext data into conversion ciphertext corresponding to a target user in the user subset, by using the conversion key of the target user, when the attribute set X of the target user meets the access control rule. Thus, the target user can decrypt the conversion ciphertext to obtain the plaintext data.

Description

TECHNICAL FIELD

[0001] Embodiments of the present specification belong to the field of data security, and particularly relate to a method, device and system for securely sharing data. BACKGROUND

[0002] Data security and privacy protection are increasingly becoming the focus of technical attention. In many technical scenarios, ciphertext access control is needed. Ciphertext access control scheme is an encryption scheme that can grant decryption rights to specified users. In one scenario, the data owner wants to specify a set S that can decrypt the ciphertext, only members in S can decrypt the ciphertext, and other unauthorized parties cannot decrypt it. In one scenario, the data owner wants to specify some attributes, encrypt the message according to these attributes, and not care about the identity of the message receiver. Only users with attributes meeting the requirements can decrypt the ciphertext, ensuring the confidentiality of the message.

[0003] It is desirable to have an improved scheme to better implement flexible ciphertext access control. SUMMARY

[0004] The purpose of the present application is to provide a data sharing method and system that can securely and conveniently implement dynamic access control of data.

[0005] The first aspect of the present specification provides a data sharing method, comprising:

[0006] The key generation system includes at least t key generation devices and an intermediate device, which cooperatively operate to calculate the conversion key of each user according to the global system public key PK, the public key of each user in the user set, and the attribute set X corresponding to each user;

[0007] The data owner encrypts the plaintext data according to the global system public key PK, the user subset, and the access control rule related to the attribute, to obtain the ciphertext data;

[0008] The intermediate device converts the ciphertext data into the conversion ciphertext corresponding to the target user in the user subset, using the conversion key of the target user, when the attribute set X of the target user meets the access control rule;

[0009] The target user decrypts the conversion ciphertext to obtain the plaintext data.

[0010] The second aspect of the present specification provides a data sharing method, which is executed by an intermediate device, comprising:

[0011] In cooperation with at least a threshold number t of key generation devices in a key generation system, a conversion key of each user is calculated according to a global system public key PK, a public key of each user in a user set, and an attribute set X corresponding to each user;

[0012] Obtain ciphertext data, wherein the ciphertext data is obtained by encrypting plaintext data according to the global system public key PK, a subset of users, and an attribute-related access control rule by a data owner;

[0013] For any target user in the subset of users, if the attribute set X of the target user meets the access control rule, the ciphertext data is converted into conversion ciphertext corresponding to the target user by using the conversion key of the target user;

[0014] Send the conversion ciphertext to the target user, so that the target user decrypts the plaintext data based on the conversion ciphertext.

[0015] The third aspect of the present specification provides a data sharing device deployed in an intermediate device, comprising:

[0016] A conversion key generation unit is configured to cooperate with at least a threshold number t of key generation devices in a key generation system, so as to calculate a conversion key of each user according to a global system public key PK, a public key of each user in a user set, and an attribute set X corresponding to each user;

[0017] A ciphertext obtaining unit is configured to obtain ciphertext data, wherein the ciphertext data is obtained by encrypting plaintext data according to the global system public key PK, a subset of users, and an attribute-related access control rule by a data owner;

[0018] A ciphertext conversion unit is configured to, for any target user in the subset of users, if the attribute set X of the target user meets the access control rule, convert the ciphertext data into conversion ciphertext corresponding to the target user by using the conversion key of the target user;

[0019] A ciphertext sending unit is configured to send the conversion ciphertext to the target user, so that the target user decrypts the plaintext data based on the conversion ciphertext.

[0020] The fourth aspect of the present specification provides a data sharing system, comprising a key generation system, an intermediate device, a data owner, and a user set consisting of a plurality of users, wherein:

[0021] The key generation system is configured to cooperate with the intermediate device by using at least a threshold number t of key generation devices, so as to calculate a conversion key of each user according to a global system public key PK, a public key of each user in a user set, and an attribute set X corresponding to each user;

[0022] The data owner is configured to encrypt plaintext data to obtain ciphertext data according to the global system public key PK, the subset of users, and the access control rule related to the attribute;

[0023] The intermediate device is configured to, for any target user in the subset of users, if the attribute set X of the target user meets the access control rule, convert the ciphertext data into converted ciphertext corresponding to the target user by using the conversion key of the target user, so that the target user decrypts the converted ciphertext to obtain the plaintext data.

[0024] The fifth aspect of the present specification provides a computer program product, comprising computer programs / instructions, which, when executed by a processor, implement the steps of the methods of the first and second aspects.

[0025] The sixth aspect of the present specification provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed in a computer, the computer program causes the computer to execute the methods of the first and second aspects.

[0026] The seventh aspect of the present specification provides a computing device, comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the methods of the first and second aspects are implemented.

[0027] The eighth aspect of the present specification provides a computing device, comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the methods of the first and second aspects are implemented.

[0028] The above aspects provide a new data sharing scheme, which embeds the attributes of data users in the keys of the users by the cooperative operation of multiple key generation devices and an intermediate device, and allows the data owner to encrypt messages according to the user set and the access control strategy. The intermediate device converts the ciphertext for the target user in the set and whose attribute meets the access control strategy, so that the target user can decrypt the message based on the converted ciphertext. The above overall process provides flexible and secure data access control for the data owner. In particular, the access control can be based on both the user set and the access control strategy, supporting user revocation; the key generation process of multiple parties cooperates to ensure the security and performance of key generation; and the ciphertext conversion process reduces the decryption calculation burden of the target user, thereby solving a number of problems of the prior art. BRIEF DESCRIPTION OF DRAWINGS

[0029] In order to make the technical solutions in the specification clearer, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments described in the specification, and other drawings can be obtained by those skilled in the art without creative labor.

[0030] Figure 1 A schematic diagram of a communication system and a data access control process in the system according to an embodiment is shown;

[0031] Figure 2 A process in which a global key device and a key generation system generate a global system public key in an embodiment is shown;

[0032] Figure 3 A process in which a key generation device and an intermediate device jointly generate a conversion key in an embodiment is shown;

[0033] Figure 4 A process in which an intermediate device and a user decrypt ciphertext is shown;

[0034] Figure 5 A schematic diagram of a logical structure of a data sharing device according to an embodiment is shown. DETAILED DESCRIPTION

[0035] In order to make the technical solutions in the specification clearer, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments described in the specification, and other drawings can be obtained by those skilled in the art without creative labor.

[0036] In the big data era, data security and privacy protection issues have increasingly become the focus of attention. In the process of data sharing and distribution, how does the data user securely access the private data stored in the cloud, and how does the data owner flexibly and securely share the data with the specified user, which becomes a challenging problem. This problem includes two challenges: data confidentiality and access control. Therefore, some ciphertext access control schemes are proposed to control the access rights of data under the premise of ensuring data confidentiality.

[0037] To realize ciphertext access control, a broadcast encryption (BE) scheme has been proposed, in which a sender encrypts the broadcast information sent, and the sender can specify a set U that can decrypt the ciphertext, only authorized users in U can correctly decrypt the broadcast information, and other non-authorized users cannot decrypt, even if the broadcast information is intercepted, the correct information cannot be obtained. Meanwhile, the sender can dynamically add and delete authorized users in U. However, this scheme cannot meet the requirement of using users based on attribute characteristics constraints.

[0038] Recently, an attribute-based encryption (ABE) scheme has also been proposed, which allows a data owner to encrypt a message according to a specified attribute without specifying a specific user; only a user with a required attribute can decrypt the ciphertext, ensuring the confidentiality of the message. Ciphertext policy attribute-based encryption (CP-ABE) is a branch of attribute-based encryption (ABE), which embeds an access policy into a ciphertext and embeds an attribute into a key, and only a user whose attribute set meets the access control policy can correctly recover the message. Ciphertext policy attribute-based encryption can realize one-to-many communication between a data owner and a data user and provide fine-grained access control.

[0039] However, when the CP-ABE scheme is directly applied to an actual communication system, many potential problems may occur. First, there are usually a large number of users in the system, but the traditional CP-ABE scheme has only a single key distribution authority, which cannot adapt to actual applications. For example, when a large number of users simultaneously request a key, the authority inevitably has insufficient performance, resulting in a decline in user experience. Not to mention the problem of data delay caused by a large physical distance between the authority and the user terminal. In addition, the master key of the system is held by a single authority, which means that once it is destroyed, an attacker will easily generate a decryption key for any set of identity and attribute, so that the shared ciphertext is no longer secret. Second, user terminals accessing the system are also different. They can be servers or high-performance computers, or low-computing and small-storage-capacity devices such as smart watches and medical sensors. The traditional ABE scheme often needs to perform a large number of bilinear pairing operations in the decryption process, which is not friendly to terminal devices with insufficient computing resources. Third, users may not be suitable for continuing to decrypt the ciphertext due to various reasons, including but not limited to key leakage, resignation, identity change, etc. Therefore, the system needs to support user revocation, so that the keys of these users are invalidated, and they can no longer decrypt the new shared ciphertext of the data owner.

[0040] In view of this, in the embodiments of the present specification, a new data sharing scheme is proposed, which can be applied to a decentralized scenario, in which the attributes of data users are embedded in their keys through the cooperative operation of multiple key generation devices and intermediate devices, and the data owner is allowed to encrypt its message according to the user set and the access control policy. The intermediate device performs ciphertext conversion for the target user in the set and whose attributes meet the access control policy, so that the target user can decrypt the message based on the converted ciphertext. The above overall process provides flexible and secure data access control for the data owner. In particular, the access control can be based on both the user set and the access control policy, supporting user revocation; the multi-party cooperative key generation process ensures the security and performance of key generation; and the ciphertext conversion process reduces the decryption calculation burden of the target user, thereby solving several problems of the prior art.

[0041] The implementation of the above scheme idea is described below.

[0042] Figure 1 A schematic diagram of a communication system and a data access control process in the system according to an embodiment is shown. The communication system includes multiple participants, and the roles of these participants in the whole system are divided into the following 6 categories.

[0043] Cloud server: The cloud server provides elastic and scalable computing services for various terminals and other devices according to demand as a shared software and hardware resource. In the present scheme, due to the auxiliary role of the intermediate node, the cloud server does not play the role of data processing center, and it only undertakes the storage and forwarding of ciphertext, i.e. receiving the ciphertext uploaded by the intermediate node and sending the ciphertext to the intermediate node.

[0044] Intermediate node: Also known as intermediate device, located between the user device and the cloud server, in the present scheme, it undertakes most of the key storage and decryption calculation of the user device, and is responsible for the storage of the converted key and the preliminary conversion of the ciphertext.

[0045] In an embodiment, the intermediate node can be a fog node in a fog computing scenario. Fog computing is an emerging distributed solution and an extended concept of cloud computing. Fog computing solves the high latency problem of cloud computing by deploying fog nodes closer to user terminal devices, providing storage and computing services for users as an intermediate layer connecting the cloud center and users. Fog nodes are not composed of powerful servers, but of various functional computers with weaker performance and more dispersion. Therefore, fog computing is more suitable for low-latency and high-mobility application scenarios such as vehicle networking and intelligent warehouses. In system deployment, fog nodes are located at the network edge, where data processing programs related to the implementation scenario of fog computing are deployed. In this scheme, the fog node will serve as the hub of data processing, coordinate with each party, and perform key generation, storage, and preliminary conversion of ciphertext.

[0046] Data owner: The data owner is a user device that owns data and can set data access permissions. After the data owner obtains the public key of each user from the intermediate node, the data owner can customize the access control policy and broadcast set, encrypt the message, and upload the generated ciphertext to the intermediate node.

[0047] User: A user device that uses data. The user can generate a public-private key pair independently and upload the public key to the key generation authority and the intermediate node for key generation and ciphertext conversion. The user can receive the converted ciphertext sent by the intermediate node and decrypt it through the user's private key.

[0048] Global authority GA: Also known as a global key device. The global authority is only responsible for generating global parameters and is not responsible for key generation and decryption. It generates system parameters together with the key generation authority and uploads them to the intermediate node.

[0049] Key generation authority KGA: Also known as a key generation device. All n key generation devices constitute a key generation system. The key generation system is mainly responsible for generating conversion keys according to the public keys of data users.

[0050] The following describes the interaction process performed in the above communication system for secure data sharing.

[0051] In Figure 1In step S1, the global authority (GA) and all key generation authorities (KGA) work together to generate the master key and global parameters, and upload them to the intermediate node. The interaction between the global authority GA and the individual key generation devices KGA is not considered at this time, and the intermediate product of generating the system parameters is ignored. In this step S1, the secure parameter λ, the maximum number of users q, the number of KGA n, and the universal attribute set U are taken as inputs, and the threshold value t is set. After GA and KGA jointly operate, the global system public key PK is output and uploaded to the intermediate node. The global system public key PK includes the commonly generated master key parameter and other global parameters.

[0052] In step S2, each user sends his own public key to the key generation authority and the intermediate node. The public keys of all users form a user public key set

[0053] Step S3 corresponds to the generation of the conversion key, which is jointly performed by the intermediate node and at least t (t≤n) KGA. Among them, at least t key generation authorities return the conversion key share of each user, and the intermediate node processes to obtain the conversion key of each user. This step takes the aforementioned global system public key PK, user public key set , and the attribute set of a certain user d as inputs, and processes to obtain the conversion key TK d of the user. This step is equivalent to embedding the attributes of user d into the key TK d for subsequent decryption.

[0054] In step S4, the data owner obtains the global system public key PK from the intermediate node, which was previously uploaded to the intermediate node by GA and KGA.

[0055] In step S5, the data owner defines the LSSS access control structure (M, ρ) and the broadcast set The access policy is embedded into the ciphertext using the public key PK, and the encryption of the plaintext is completed. Then, the data owner uploads the generated ciphertext to the intermediate node.

[0056] In step S6, the intermediate node uploads the ciphertext to the cloud server.

[0057] In step S7, the intermediate node downloads the ciphertext from the cloud server. This download can be performed in response to a request from the data user.

[0058] Step S8 involves the decryption process, which is jointly completed by the data user and the intermediate node. The intermediate node first converts the downloaded ciphertext and sends the converted ciphertext to the user. The user decrypts the converted ciphertext using his own private key to obtain the original plaintext data. The entire decryption process takes the public key PK, the user public key set Conversion key TK d User private key usk d The ciphertext C is used as input if and only if the identifier of method d is in the broadcast set S and the transformation key TK is used. d Intermediate nodes are only allowed to convert ciphertext when the included user attributes meet the access policy, and only then can the user use their own user private key (usk). d Decryption complete.

[0059] The implementation details of each of the above steps are described below.

[0060] Figure 2 This illustration shows the process of generating a global system public key using a global key device and a key generation system in one embodiment. The global key device is the aforementioned Global Authority (GA), and the key generation system consists of all n Key Generation Agencies (KGAs), which are hereinafter referred to as key generation devices. Figure 2 The process can be regarded as Figure 1 Sub-step of step S1.

[0061] As shown in the figure, in step S21, the Global Key Device (GA) generates global parameters.

[0062] Specifically, the global key device selection includes security parameter λ, maximum number of system users (i.e., maximum number of users) q, number of key generation devices n, and a global attribute set. and As input, the global attribute set is a collection of all possible attribute values ​​that all users might possess, including, for example, region-related attribute values: Beijing, Shanghai, Hangzhou, etc.; device type-related attribute values: mobile phone, PC, tablet, etc.; operating system-related attribute values: iOS, Android, HarmonyOS, etc. The operating system-related parameters are matched based on the security parameter λ. Where p1, p2, and p3 can be large prime numbers, G is a cyclic group, and e is a pairing function based on the generators of the cyclic group. The result of the pairing function belongs to the cyclic group G. T .

[0063] In addition, the Global Key Device (GA) randomly selects... As the master key of the GA, the cyclic group is selected. Generators in as well as Corresponding to the global attribute set Each attribute att i Randomly select one And calculate As this attribute att ithe encoding value of the attribute. In addition, the global key device determines a threshold value t, which is less than or equal to the number n of the key generation devices.

[0064] The global key device GA randomly obtains a set of n ids as the identity representation of the n key generation devices. Finally, the GA also prepares an empty set for storing the public key generated by the user himself.

[0065] Thus, the global key device generates and returns the global parameter and the empty set It can be seen that the global parameter includes the attribute set the encoding value C1,...,C p of each of the p attributes, and other public parameters.

[0066] Next, in step S22, the n key generation devices KGA each perform initialization.

[0067] The initialization process takes the global parameter GP as input. First, each KGA declares an id that has not been selected as its identity, and the KGA can then be denoted as the i-th key generation device.

[0068] Next, the i-th key generation device selects a random element α i and a random polynomial f i (x) of degree t-1, and f i (0) = α i . Then, the i-th generation device inputs the id of each device into the random polynomial f i (x) of the user, to obtain each intermediate value, i.e.:

[0069] s i,j = f i (id j ), j∈[1,n] (1)

[0070] Thus, the i-th generation device calculates and returns each intermediate value set K i = {s ij = f i (id j )}, where the intermediate value s ii for the id of the user is secretly kept by each KGA.

[0071] In this way, when all the KGA in the system run the algorithm, the master key of the system can be implicitly represented as and the master polynomial F(x) can be implicitly represented as Similarly, Also implicitly established.

[0072] In step S23, each key generation device KGA exchanges the intermediate values, generates its own device private key and device public key.

[0073] Specifically, the i-th key generation device will generate the intermediate value f i (id j ) for any other key generation device j, send it to the key generation device j, and receive from the device j the intermediate value f j (id j ) generated by the key generation device j using the polynomial f i (x). Thus, the i-th key generation device can aggregate the n intermediate values for the i-th key generation device from the n key generation devices to obtain the device private key for the i-th key generation device. The device private key ksk i can be represented as:

[0074]

[0075] Further, the i-th key generation device generates the device public key kpk i from the device private key ksk i and the global parameter, which can be represented as:

[0076]

[0077] Thus, each key generation device can generate its own device private key and device public key.

[0078] Next, in step S24, the global key device GA obtains the global system public key PK from the device public keys of at least t key generation devices and the global parameter.

[0079] The global key device GA obtains the device public keys of at least t key generation devices KGA and takes the global parameter GP and at least t KGA public keys {kpk i} i∈[1,t] as input, calculates the master key parameter:

[0080]

[0081] where α is the master key msk implicitly determined in step S22.

[0082] Thus, the global key device can generate and return the global system public key PK:

[0083]

[0084] It can be seen that the global system public key PK includes the calculated master key parameter e(g,g)α And all elements in the global parameter GP are used as common parameters.

[0085] Next, the process of initializing the user's device is described, which corresponds to... Figure 1 Step S2 in the process.

[0086] Each user, after being certified, is allowed to join. Figure 1 After the system is complete, the initialization process can begin. Any user 'd' takes the global parameter GP as input and randomly selects a number. As the user's private key usk d And calculate the relevant user's public key based on this. This allows us to obtain the user's public / private key pair (UPK). d usk d ).

[0087] Then, each user fills their own public key into the set. The key is sent to the key generation device and the intermediate device. Thus, both the key generation device and the intermediate device can obtain the user's public key set, which consists of the public keys of all users.

[0088]

[0089] Figure 3 This illustrates a process in one embodiment where a key generation device and an intermediate device jointly generate a transformation key, which can be viewed as... Figure 1 The sub-step of step S3.

[0090] like Figure 3 As shown, in step S31, any i-th key generation device in the key generation system generates a key share for any first user based on the global system public key, the first public key of the first user, and the corresponding first attribute set.

[0091] Then, in step S32, the intermediate device receives at least t key shares from key generation devices for the first user, and obtains the conversion key for the first user by merging the various key shares.

[0092] Specifically, in step S31, any i-th key generation device generates a key share for any user d. The identity of this i-th key generation device is... The i-th key generation device has obtained the public key PK, and uses the public key of method d. It can also obtain the attribute set corresponding to user d. And the KGA's own device private key ksk i As input, key share calculations are performed. Here, the attribute set corresponding to the user d is used. It contains the attributes possessed by the user d, and is a global attribute set. A subset. For example, the set of attributes corresponding to method d. This could include, for example, Beijing, mobile phones, and the HarmonyOS operating system.

[0093] More specifically, for the user d, the i-th key generation device randomly selects... and four random number parts in, For random values, It is a random vector or set of random numbers with dimension q-1, that is, it includes random numbers generated for q-1 other users. It is also a set of random vectors or random numbers, with dimension 1. That is, the number of attributes in the attribute set x possessed by the user d. Then, the i-th key generation device uses the public key upk of user d based on the above random number. d And the public parameters in the global system public key PK, calculate and output the key share generated for user d. in:

[0094]

[0095] As can be seen, the key share TK d,i It includes four sub-parts, the first sub-part Based on the public key of user d and the device private key ksk of the i-th key generation device i Generation, second sub-part Generated based on random numbers, third sub-part Based on the public key of other users Generation, fourth sub-part According to the attribute set The encoded value C of the attribute x The key share is generated. During the generation process, each of the four sub-parts of the key share also incorporates four random number components. Thus, the i-th key generation device generates a key share TK for user d. d,i .

[0096] In one embodiment, n key generation devices of the key generation system each generate a key share for user d; then, at least t of the key generation devices send their key shares to an intermediate device.

[0097] Or, in another embodiment, at least t key generation devices in the key generation system are targeted as target devices, each target device generates a key share for the user d; then, all target devices send their key shares to the intermediate device.

[0098] Regardless of the way, in step S32, the intermediate device can obtain the key shares of at least t key generation devices for the user d, and obtain the conversion key of the user d by merging the key shares.

[0099] Specifically, the intermediate device obtains at least t conversion keys {TK d,i} i∈[1,t] As input, and the four sub-portions of each conversion key are merged respectively to obtain the conversion key TK Among them:

[0100]

[0101] Among them,

[0102] It can be seen that the conversion key obtained by merging also corresponds to four parts, among which the first part TK is generated according to the public key of the user d, the second part TK is the result of the operation of a random parameter, the third part TK x is generated according to the public key of other users, and the fourth part TK is generated according to the encoding value C

[0103] of the attribute in the attribute set x of the user. d It can be seen that the conversion key TK d has the attribute set information corresponding to the user d embedded therein.

[0104] Next, the encryption process of the data owner is described, which corresponds to Figure 1 Step S5 in the method. In this step, the data owner encrypts the plaintext data according to the aforementioned global system public key PK, the specified user subset S, and the attribute-related access control rule, to obtain the ciphertext data.

[0105] Specifically, the data owner can obtain the aforementioned global system public key PK, and specify the access control structure (M, p), a broadcast set and plaintext m as input. Among them, the broadcast set S is the user subset specified by the data owner to decrypt, and the access control structure (M, p) is used to indicate the attribute-related access control rule.

[0106] In the access control structure, let M be an l×k matrix, and ρ be a mapping function that maps each row of matrix M to M. x Mapping to an attribute at x There is no case where two distinct rows are mapped to the same attribute by ρ. Therefore, (M, ρ) can jointly define l attributes.

[0107] The data owner can choose a random vector. vector The first component s is the cryptographic exponent, y2,…,y n Used to share s. Then, calculate. Where x∈[1,l], that is, for each row M of the matrix x By applying a random vector The perturbation vector λ for each row is obtained. x The data owner also randomly selected data from each row. Finally, the data owner performs encrypted calculations and outputs the ciphertext C = (S, (M, ρ), ct1, ct2, {ct 3,x ,ct 4,x} x∈[1,l] ,ct5),

[0108] in:

[0109] ct1 = m·e(g,g) αs ,

[0110] ct2=g s ,

[0111]

[0112] As can be seen, ciphertext C consists of multiple ciphertext parts. The first ciphertext ct1 is obtained based on the plaintext data m and the encryption index s. The second ciphertext group {ct1}... 3,x ,ct 4,x Based on the perturbation vector λ of each row of matrix M x And the encoded value C of the attribute ρ(x) after each row mapping. ρ(x) The third ciphertext is obtained based on the public keys of each user in the subset S of users. And the encryption exponent s is obtained. Ciphertext C also includes a fourth ciphertext ct2 generated based on the encryption exponent s. The generation of the above ciphertext parts also utilizes several public parameters in the global system public key PK, such as the master key parameter e(g,g). α generator g, and g a .

[0113] It can be seen that in the ciphertext C generated above, in addition to the embedding of the plaintext information, the information of the subset S of the user (for example, through the third ciphertext) and the access control rule information related to the attribute (through the second ciphertext group) are also embedded. In this way, the ciphertext C can only be decrypted by the user who meets the corresponding permission requirements.

[0114] Next, the decryption process of the intermediate device and the user on the ciphertext C described above will be described, which corresponds to step S8 in Figure 4 Figure 1

[0115] As shown in Figure 4 , in step S41, the intermediate device converts the ciphertext data C into the corresponding conversion ciphertext C' of the target user in the subset S of the user by using the conversion key of the target user, as long as the attribute set of the target user meets the aforementioned access control rule.

[0116] Thus, in step S42, the target user decrypts the plaintext data m based on the conversion ciphertext C'.

[0117] Specifically, the intermediate device takes the global system public key PK, the public key set of the user, the attribute set of the user d, the conversion key TK d on the attribute set d of the user d, and the ciphertext C as inputs to perform the calculation. It is assumed that the user d belongs to the broadcast set, i.e., upk x ∈ S, and the attribute set of the user d meets the access control rule, i.e., That is, the attribute set contains all the attributes after the (M, p) mapping. At this time, the set can be defined as In addition, the intermediate device can find a set of constants {σ x∈I} x∈I such that i λ i = s.

[0118] Therefore, the intermediate device can perform the following conversion calculation:

[0119]

[0120] It can be seen that in the first term of the conversion calculation, the intermediate device uses the first part of the conversion key ​​The first operation is a pairing-related operation on the partial elements of the first and third parts of the conversion key, and the third ciphertext ct5. It can be understood that the above-mentioned partial elements of the first and third parts of the conversion key, and the third ciphertext, all involve the usage party public key in the usage party subset S. In addition, the first operation also uses the second part of the conversion key and the fourth ciphertext in the ciphertext to perform auxiliary operations, both of which are generated based on the random number.

[0121] In the second term of the conversion calculation, the intermediate device performs a second operation on the elements corresponding to the target attributes ρ(x) that meet the access control rule in the fourth part of the conversion key and the second ciphertext set {ct 3,x , ct 4,x}. It can be understood that the above-mentioned partial elements of the fourth part of the conversion key, and the second ciphertext set, all involve the target attributes specified in the access control rule. In addition, the second operation also uses the second part of the conversion key and the determined constant set {σ x} x∈I to perform auxiliary operations.

[0122] Through the above conversion calculation, the first conversion result ct ′ is obtained; the first conversion result is related to the main key parameter e(g, g) α in the global system public key PK, the encryption exponent s, and the private key β d of the usage party d. The intermediate device constructs the conversion ciphertext C ′ =(ct ′ , ct1) from the first conversion result ct d and the aforementioned first ciphertext ct1, and sends it to the target usage party d.

[0123] Thus, at step S42, the target usage party uses its own private key usk d = β ′ and the conversion ciphertext C d as inputs, and through simple calculation, the plaintext m can be decrypted and restored. Specifically, the target usage party performs the following calculation:

[0124]

[0125] It can be seen that the target usage party d uses its private key β ′ to perform an exponential operation on the first conversion result ct ; then calculates the quotient of the first ciphertext ct1 and the result of the exponential operation, and the plaintext data m is obtained. This decryption calculation only involves one exponential operation and one division operation, and the calculation amount is extremely small, so even a lightweight terminal device can easily complete such a calculation.

[0126] Reviewing the entire process above, through the cooperative operation of multiple key generation devices and intermediate devices, the attributes of data users are embedded in their keys, and the data owner is allowed to encrypt its messages according to the user set and the access control policy. The intermediate device performs ciphertext conversion for the target user in the set and whose attributes meet the access control policy, undertakes most of the decryption work, so that the target user can decrypt the message through simple calculation based on the converted ciphertext. The above process realizes ciphertext access control in a flexible way, guarantees the security and performance of key generation, and reduces the decryption calculation burden of the target user.

[0127] Although Figure 1 The system architecture is described in combination with the fog computing scenario, but the above ciphertext access control scheme can also be applied to other scenarios, such as intelligent warehouse communication access mechanism. The intelligent warehouse can provide accurate and accurate inventory data for enterprises to ensure that the enterprise can timely and reasonably formulate the next strategic direction. In order to ensure the accuracy of the inventory information of the intelligent warehouse under dynamic inventory, the above scheme can be introduced to ensure the secure access of the inventory data. The corresponding process can be as follows.

[0128] For the intelligent warehouse, after each cargo is shipped, the inventory data needs to be changed, and each delivery port in the intelligent warehouse during this period can be regarded as a data user d, which can construct a communication system similar to Figure 1 Each delivery port can only deliver specified goods, which corresponds to the attribute set of the user And at the same time, the same goods can be delivered by multiple delivery ports; that is, multiple users can have the same attribute item.

[0129] Suppose that at a certain time, the intelligent warehouse receives a delivery request for the same goods. Due to the large number of goods to be delivered, multiple delivery ports need to deliver at the same time. In this process, each delivery port as a data user will join the system and perform encrypted communication with the cloud to obtain the inventory information of the goods, and complete the modification of the inventory data after delivery. During the modification process, the consistency of the distributed workflow needs to be ensured. During the process of obtaining inventory data and modification, only the delivery port that can deliver the goods and is in the delivery state can perform the above operation, that is, the attribute needs to meet the access control rule, and the data user in the broadcast set has the right.

[0130] The intelligent warehouse is often limited by the computing power of the terminal device and cannot undertake too heavy storage and computing tasks. Using the above scheme, that is, the adaptive secure multi-key generation device attribute-based broadcast encryption scheme, not only can ensure the secure access of the private inventory data, but also can reduce the pressure on the user side with the help of the characteristics of the auxiliary device (intermediate device), which is very suitable for the low-latency and high-mobility application scenario of the intelligent warehouse.

[0131] Similarly, the users of data can also be devices in other communication scenarios, such as IoT devices, and so on. These will not be listed here.

[0132] According to another embodiment, this specification also provides a data sharing system, including a key generation system, an intermediate device, a data owner, and a complete set of users comprising multiple users, wherein:

[0133] The key generation system is used to utilize at least t key generation devices and intermediate devices to work together to calculate the conversion key of each user based on the global system public key PK, the public keys of each user in the user set, and the attribute set X corresponding to each user.

[0134] The data owner uses the global system public key PK, a subset of users, and access control rules related to attributes to encrypt plaintext data to obtain ciphertext data.

[0135] The intermediate device is used to, for any target user in the subset of users, if its attribute set X conforms to the access control rules, use its conversion key to convert the ciphertext data into the converted ciphertext corresponding to the target user, so that the plaintext data can be decrypted based on the converted ciphertext.

[0136] Examples of specific implementation methods of the above system and its various participants can be found in the examples and descriptions of the aforementioned data sharing method, and will not be repeated here.

[0137] According to another embodiment of this specification, a data sharing device is also provided, which is deployed in an intermediate device that can be implemented by any device, platform or cluster of devices with data storage, computing and processing capabilities. Figure 5 A schematic diagram of the logical structure of a data sharing device according to one embodiment is shown. Figure 5 As shown, the data sharing device 500 includes:

[0138] The conversion key generation unit 51 is configured to operate in coordination with at least a threshold number t key generation devices in the key generation system, thereby calculating the conversion key of each user based on the global system public key PK, the public keys of each user in the user set, and the attribute set X corresponding to each user.

[0139] The ciphertext acquisition unit 52 is configured to acquire ciphertext data, which is obtained by the data owner encrypting plaintext data according to the global system public key PK, a subset of users, and access control rules related to attributes.

[0140] The ciphertext conversion unit 53 is configured to, for any target user in the user set, convert the ciphertext data into converted ciphertext corresponding to the target user by using a conversion key of the target user, if the attribute set X of the target user meets the access control rule.

[0141] The ciphertext sending unit 54 is configured to send the converted ciphertext to the target user, so that the target user decrypts the converted ciphertext to obtain the plaintext data.

[0142] The specific implementation of the data sharing apparatus 500 and each unit thereof is exemplified in the foregoing examples and descriptions of the process performed by the intermediate device, and will not be repeated here.

[0143] According to yet another aspect, an embodiment also provides a computer readable storage medium having stored thereon a computer program, which, when executed in a computer, causes the computer to perform the foregoing data sharing method.

[0144] According to yet another aspect, an embodiment also provides a computer program product comprising computer programs / instructions, which, when executed by a processor, implement the foregoing data sharing method.

[0145] According to yet another aspect, an embodiment also provides a computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the foregoing data sharing method.

[0146] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) such as a field programmable gate array (FPGA) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a piece of PLD by the designer programming it by himself, without having to ask a chip manufacturer to design and manufacture a special integrated circuit chip. Moreover, instead of manually fabricating an integrated circuit chip, this programming is now mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing a program, and the original code before compilation also has to be written in a specific programming language, which is called a hardware description language (HDL), and there are many types of HDL, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit that implements the logical method flow can be easily obtained.

[0147] The controller can be implemented in any suitable way, for example, the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, e.g. software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. The skilled person will also appreciate that in addition to implementing the controller in pure computer readable program code, it is possible to implement the controller in the form of logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. to perform the same functions by logically programming the method steps. Such a controller can therefore be considered a hardware component, and the means included therein to perform the various functions can be considered structures within the hardware component. Alternatively, or even additionally, the means to perform the various functions can be considered both a software module implementing the method and a structure within the hardware component.

[0148] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not rule out that with the development of future computer technologies, computers implementing the functions of the above embodiments can be personal computers, laptop computers, vehicle human-computer interaction devices, cellular phones, camera phones, smart phones, personal digital assistants, media players, navigation devices, email devices, game consoles, tablet computers, wearable devices, or combinations of any of these devices.

[0149] Although the method operations of the embodiments of the present specification are described in sequential order, some of the operations can in practical implementations be performed concurrently, in parallel, or in a different order. The above description of the embodiments of the present specification is provided as an example only and is not intended to be limiting. For example, the steps recited in the examples or flow charts can include more, fewer, or different steps than those described. The order in which the steps are presented is merely one example and is not intended to be limiting. The steps can be performed in an order different than presented, or performed in parallel, or in a different order, for example in a parallel processor or multi-threaded processing environment, or even in a distributed data processing environment. The terms "comprise", "comprising", or any other variation thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Exclusion of such elements is only present if it is expressly stated that these elements are excluded. For example, the use of the terms "first", "second", or the like does not imply any particular order but are used for naming purposes only.

[0150] For ease of description, the above apparatuses are described in various modules with functions described separately. Of course, when implementing one or more of the present specification, the functions of the modules can be implemented in the same or multiple software and / or hardware, or the modules implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The apparatus embodiments described above are merely illustrative. For example, the division of the units is only a logical functional division, and in actual implementation, another division manner can be used, for example, multiple units or components can be combined or integrated into another system, or some features can be omitted or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, and can be electrical, mechanical, or other forms.

[0151] The present application is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as combinations of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions of a flow or multiple flows and / or blocks Figure 1 The functions of a flow or multiple flows and / or blocks

[0152] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0153] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0154] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0155] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory. The memory is an example of computer-readable media.

[0156] Computer-readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

[0157] Those skilled in the art will appreciate that the one or more embodiments described herein can be provided as a method, a system or a computer program product. Accordingly, the one or more embodiments described herein can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the one or more embodiments described herein can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable code.

[0158] The one or more embodiments described herein can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The one or more embodiments described herein can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0159] The various embodiments described in this specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The various embodiments described in this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0160] The above description is only some embodiments of the one or more embodiments described in this specification and is not intended to limit the one or more embodiments described in this specification. Those skilled in the art can make various modifications and changes to the one or more embodiments described in this specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the one or more embodiments described in this specification shall be included in the scope of the claims.

Claims

1. A data sharing method, comprising: In a key generation system, at least a threshold number t key generation devices and intermediate devices work together to calculate the conversion key for each user. The collaborative operation includes: any i-th key generation device in the key generation system generates a key share for any first user in the user set, based on the global system public key PK, the first public key of the first user, and the corresponding first attribute set; an intermediate device receives key shares for the first user from at least t key generation devices, and obtains the conversion key of the first user by merging the key shares. The data owner encrypts the plaintext data based on the global system public key PK, the subset of users, and the access control rules related to the attributes, to obtain ciphertext data. For any target user in the subset of users, if its attribute set X conforms to the access control rules, the intermediate device uses its conversion key to convert the ciphertext data into the converted ciphertext corresponding to the target user. The target user decrypts the converted ciphertext to obtain the plaintext data.

2. The method according to claim 1, wherein, The global system public key includes the encoded values ​​of each attribute in the complete set of attributes; Generating the key share for the first user includes: The i-th key generating device generates a key share for the first user. The key share includes four sub-parts: the first sub-part is generated based on the public key of the first user and the device private key of the i-th key generating device; the second sub-part is generated based on a random number; the third sub-part is generated based on the public key of other users; and the fourth sub-part is generated based on the encoded value of the attribute in the first attribute set. Merge the various key shares, including: The four sub-parts of each key share are merged respectively to obtain the conversion key.

3. The method according to claim 1, further comprising, prior to the cooperative operation: The global key device generates global parameters, which include the device IDs of the n key generation devices that constitute the key generation system; Each key generation device generates its own device public key and device private key based on each device ID; The global key device generates the device public key based on at least t keys and global parameters to obtain the global system public key PK.

4. The method according to claim 3, wherein, Each key generation device generates its own device public key and device private key based on each device ID, including: Each key generation device inputs its own random polynomial with each device ID to obtain intermediate values; Each key generation device interacts with the intermediate values ​​it generates for each other; Each key generation device aggregates the intermediate values ​​from n key generation devices to obtain its own device private key, and generates a device public key based on the device private key.

5. The method according to claim 1, further comprising: The data owner sends the encrypted data to the intermediate device; The intermediate device uploads the encrypted data to the cloud server.

6. The method according to claim 5, wherein, Converting the encrypted data into the converted ciphertext corresponding to the target user includes: In response to the request from the target user, the encrypted data is downloaded from the cloud server; The encrypted data is then converted.

7. The method according to claim 1, wherein, The global system public key includes the encoded values ​​of each attribute in the attribute set; the access control rules indicate multiple attributes that must be met; the ciphertext data includes at least a first ciphertext embedded with the plaintext data, a second ciphertext set embedded with the encoded values ​​of the multiple attributes, and a third ciphertext embedded with multiple subsets of user information.

8. The method of claim 7, wherein the access control rule includes a target matrix and a mapping function, the mapping function mapping each row of the target matrix to an attribute; The encryption of plaintext data includes: Apply a target random vector to each row of the target matrix to obtain a perturbation vector for each row, wherein the target random vector includes a randomly selected encryption exponent s; Based on the plaintext data and the encryption index s, the first ciphertext is obtained; Based on the perturbation vectors of each row of the target matrix and the encoded values ​​of the mapped attributes of each row, the second ciphertext group is obtained. Based on the public keys of each user in the subset of users and the encryption index s, the third ciphertext is obtained.

9. The method according to claim 7, wherein, The conversion key of the target user includes a first part generated based on its public key, a third part generated based on the public keys of other users, and a fourth part generated based on the encoded values ​​of attributes in the attribute set of the target user. Using its conversion key, the ciphertext data is converted into the converted ciphertext corresponding to the target user, including: Using the first part, the partial elements of the third part that fall into the subset of the user, and the third ciphertext, perform a pairing-related first operation; Using the elements corresponding to the attributes that conform to the access control rules in the fourth part, perform a pairing-related second operation with the second ciphertext; Based on the results of the first and second operations, a first conversion result is obtained; the first conversion result and the first ciphertext constitute the converted ciphertext.

10. The method according to claim 9, wherein, The target user decrypts the plaintext data based on the converted ciphertext to obtain the plaintext data, including: Using the private key of the target user, perform an exponential operation on the first conversion result; The plaintext data is obtained by calculating the quotient of the first ciphertext and the result of the exponentiation operation.

11. A data sharing method, executed via an intermediate device, comprising: It works in conjunction with at least t key generation devices in the key generation system to calculate the conversion key for each user; The collaborative operation includes: any i-th key generation device in the key generation system generates a key share for any first user in the user set, based on the global system public key PK, the first public key of the first user, and the corresponding first attribute set; an intermediate device receives key shares for the first user from at least t key generation devices, and obtains the conversion key of the first user by merging the key shares. Obtain encrypted data, which is obtained by encrypting plaintext data by the data owner based on the global system public key PK, a subset of users, and access control rules related to attributes; For any target user in the subset of users, if its attribute set X conforms to the access control rules, the ciphertext data is converted into the ciphertext corresponding to the target user using its conversion key; The converted ciphertext is sent to the target user, who can decrypt it to obtain the plaintext data.

12. The method according to claim 11, wherein, The cooperative operation includes: Receive key shares from at least t key generation devices for any first user, wherein the key share from the i-th key generation device is generated based on the global system public key, the first public key of the first user, and the corresponding first attribute set; The various key shares are merged to obtain the conversion key for the first user.

13. The method according to claim 11, wherein, The global system public key includes the encoded values ​​of each attribute in the attribute set; the access control rules indicate multiple attributes that must be met; the ciphertext data includes at least a first ciphertext embedded with the plaintext data, a second ciphertext set embedded with the encoded values ​​of the multiple attributes, and a third ciphertext embedded with multiple subsets of user information.

14. The method according to claim 13, wherein, The conversion key of the target user includes a first part generated based on its public key, a third part generated based on the public keys of other users, and a fourth part generated based on the encoded values ​​of attributes in the attribute set of the target user. Using its conversion key, the ciphertext data is converted into the converted ciphertext corresponding to the target user, including: Using the first part, the partial elements of the third part that fall into the subset of the user, and the third ciphertext, perform a pairing-related first operation; Using the elements corresponding to the attributes that conform to the access control rules in the fourth part, perform a pairing-related second operation with the second ciphertext; Based on the results of the first and second operations, a first conversion result is obtained; the first conversion result and the first ciphertext constitute the converted ciphertext.

15. A data sharing device, deployed in an intermediate device, comprising: A conversion key generation unit is configured to operate collaboratively with at least t key generation devices in the key generation system to calculate the conversion key for each user. The collaborative operation includes: any i-th key generation device in the key generation system generating a key share for any first user in the global system public key PK, the first public key of the first user, and the corresponding first attribute set; an intermediate device receiving key shares for the first user from at least t key generation devices and obtaining the conversion key for the first user by merging the key shares. The ciphertext acquisition unit is configured to acquire ciphertext data, which is obtained by the data owner encrypting plaintext data according to the global system public key PK, a subset of users, and access control rules related to attributes. The ciphertext conversion unit is configured to convert the ciphertext data into the corresponding converted ciphertext for any target user in the subset of users, provided that its attribute set X conforms to the access control rules, using its conversion key. The ciphertext sending unit is configured to send the converted ciphertext to the target user, enabling the user to decrypt the plaintext data based on the converted ciphertext.

16. A data sharing system, comprising a key generation system, an intermediate device, a data owner, and a complete set of users consisting of multiple users, wherein: A key generation system is used to calculate the conversion key for each user by cooperating with at least t key generation devices and an intermediate device. The cooperative operation includes: any i-th key generation device in the key generation system generating a key share for any first user in the global system public key PK, the first public key of the first user, and the corresponding first attribute set; the intermediate device receiving key shares for the first user from at least t key generation devices and obtaining the conversion key for the first user by merging the key shares. The data owner uses the global system public key PK, a subset of users, and access control rules related to attributes to encrypt plaintext data to obtain ciphertext data. The intermediate device is used to, for any target user in the subset of users, if its attribute set X conforms to the access control rules, use its conversion key to convert the ciphertext data into the converted ciphertext corresponding to the target user, so that the plaintext data can be decrypted based on the converted ciphertext.

17. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-14.

18. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-14.

Images