Cross-password system data transmission method and system

Abstract

The invention discloses a cross-password system data transmission method and system. The method comprises the steps that a central mechanism generates system public parameters and a system main private key; the central mechanism generates an identity-based encryption system private key based on the system public parameters and the system main private key; generating a ciphertext policy attribute-based encryption system private key based on the system public parameter and the system main private key; the data owner encrypts a plaintext by using a system public parameter and generates a re-encryption key by using a ciphertext policy attribute-based encryption system private key; the agent converts the ciphertext by using the re-encryption key, and converts the ciphertext from ciphertext policy attribute-based encryption to identity-based encryption; and the data receiver decrypts the converted ciphertext into a plaintext by using a private key of the identity-based encryption system. According to the scheme, the agent can be authorized to directly convert the CP-ABE ciphertext of the data owner into the ciphertext of the IBE algorithm adopted by the data receiver, and safe and efficient data transmission between the heterogeneous terminal and the power grid is achieved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for transmitting data across cryptographic systems. Background Art

[0002] The existing distribution network integration devices and distribution network servers use hardware encryption to transmit data, requiring the distribution network integration devices to be pre-equipped with encryption chips, which use the national secret SM4 block encryption algorithm to protect data and the national secret SM2 algorithm for identity authentication. This ensures the data security of distribution network integration devices and distribution network servers to a certain extent. With the advancement of the construction of the power Internet of Things, there may be a variety of external heterogeneous terminals (such as smart cars, etc.) connected to the distribution network system in the future. The cryptographic system they use may not be the same as the cryptographic system used by the existing distribution network system. The existing method of pre-equipping encryption chips is also difficult to popularize and promote among a variety of external heterogeneous terminals.

[0003] In order to share encrypted data, scholars at home and abroad have proposed proxy re-encryption technology. Using proxy re-encryption technology, the fusion device can convert the ciphertext under a certain public key into the ciphertext under a new public key without leaking any sensitive information of the data. In this way, different heterogeneous terminals can share their own encrypted data. Blaze et al. designed the first proxy re-encryption scheme, in which the data owner generates a re-encryption key and gives it to the proxy, and then the proxy converts the data owner's ciphertext into ciphertext that can only be decrypted by the designated user.

[0004] Proxy re-encryption is combined with other cryptographic methods to produce proxy re-encryption schemes with different properties. Green and Ateniese introduced proxy re-encryption into the field of identity-based encryption and designed identity-based proxy re-encryption technology to avoid the problem of public key certificate management. Shao et al. first proposed identity-based conditional proxy re-encryption technology, where users specify conditions for data (such as data content keywords) when encrypting, and use certain conditions to generate re-encryption keys when granting data access rights to other users, so that the proxy can only convert ciphertext with the same conditions as the re-encryption key. Liang et al. first proposed attribute-based proxy re-encryption technology, which converts attribute-based encrypted ciphertext into ciphertext under a new access control policy.

[0005] In addition, researchers have also proposed a proxy re-encryption scheme from attribute-based encryption (ABE) to identity-based encryption (IBE), which can convert ABE ciphertext into IBE ciphertext. However, the existing scheme mainly implements key-policy attribute-based encryption (KP-ABE). In KP-ABE, the key generation agency specifies the access control policy for the user and generates the user's private key based on the policy; when encrypting data, the data owner specifies a set of attributes and uses the attribute set to encrypt the data; the user can decrypt the ciphertext if and only if the attribute set of the ciphertext satisfies the access control policy of the user's private key. It is not difficult to see that KP-ABE only allows the key generation agency to specify the access control policy, and does not support the data owner to formulate the access control policy, which means that fine-grained access control cannot be performed on the data during encryption. In contrast, Ciphertext-Policy ABE (CP-ABE) allows data owners to specify access control policies and encrypt data, while the key generation agency only needs to specify the attribute set of the user's private key, thus better meeting the data owner's fine-grained access control needs. Unfortunately, according to existing public literature, no proxy re-encryption scheme from CP-ABE to IBE has been found, which cannot meet the data owner's needs to convert their CP-ABE ciphertext into IBE ciphertext. Summary of the invention

[0006] In order to solve the above technical problems, an embodiment of the present invention provides a method and system for cross-cryptographic system data transmission.

[0007] The technical solution of the embodiment of the present invention is achieved as follows: An embodiment of the present invention provides a cross-cryptographic system data transmission method, which is applied to a cross-cryptographic system data transmission system, wherein the cross-cryptographic system data transmission system includes a central organization, an agent, a data recipient and a data owner, and the method includes: the central organization generates a system public parameter and a system master private key; the central organization generates an identity-based encryption system private key based on the system public parameter and the system master private key; a ciphertext policy attribute-based encryption system private key is generated based on the system public parameter and the system master private key; the data owner encrypts plaintext using the system public parameter and generates a re-encryption key using the ciphertext policy attribute-based encryption system private key; the agent converts the ciphertext using the re-encryption key, converting the ciphertext from ciphertext policy attribute-based encryption to identity-based encryption; the data recipient decrypts the converted ciphertext into plaintext using the identity-based encryption system private key.

[0008] An embodiment of the present invention also provides a cross-cryptographic system data transmission system, the system comprising a central organization, an agent, a data recipient and a data owner; the central organization is used to generate system public parameters and a system master private key, and generate an identity-based encryption system private key based on the system public parameters and the system master private key; a ciphertext policy attribute-based encryption system private key is generated based on the system public parameters and the system master private key; the data owner is used to encrypt plaintext using the system public parameters and generate a re-encryption key using the ciphertext policy attribute-based encryption system private key; the agent is used to convert the ciphertext using the re-encryption key, converting the ciphertext from ciphertext policy attribute-based encryption to identity-based encryption; the data recipient is used to decrypt the converted ciphertext into plaintext using the identity-based encryption system private key.

[0009] An embodiment of the present invention further provides a storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the above method are implemented.

[0010] The embodiments of the present invention have the following beneficial effects: The embodiment of the present invention effectively combines ciphertext policy attribute-based encryption and identity-based encryption to form an encryption method that supports data owners to flexibly formulate access control policies. When the data owner needs to share the ciphertext with the identity-based encryption system user, the agent can be authorized to convert the attribute-based ciphertext based on the ciphertext policy into the identity-based encrypted ciphertext. This embodiment can not only ensure the secure transmission of data, but also enable those resource-constrained users (identity-based encryption system users) to access complex ciphertext policy attribute-based encrypted ciphertext. In addition, compared with existing similar solutions, the encryption and re-encryption of the scheme of this embodiment has less computational overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A schematic diagram of a flow chart of a method for transmitting data across cryptographic systems according to an embodiment of the present invention; Figure 2 This is a data transmission schematic diagram of a cross-cryptographic system data transmission system according to an embodiment of the present invention; Figure 3 1 is a diagram showing the internal structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0012] The present invention will be described in further detail below with reference to the accompanying drawings and embodiments.

[0013] The embodiment of the present invention provides a cross-cryptographic system data transmission method, which is applied to a cross-cryptographic system data transmission system, wherein the cross-cryptographic system data transmission system includes an agent, a data receiver, and a data owner, such as Figure 1 As shown, the method includes: Step 101: The agent generates system public parameters and system master private key; Step 102: The data receiver generates an identity-based encryption system private key based on the system public parameters and the system master private key; Step 103: The data owner generates a ciphertext policy attribute base encryption system private key based on the system public parameters and the system master private key; and encrypts the plaintext using the system public parameters and generates a re-encryption key using the ciphertext policy attribute base encryption system private key; Step 104: The proxy party converts the ciphertext using the re-encryption key, converting the ciphertext from ciphertext policy attribute-based encryption to identity-based encryption; Step 105: The data recipient uses the identity-based encryption system private key to decrypt the converted ciphertext into plaintext.

[0014] Specifically, see Figure 2 This embodiment includes four entity parts, namely, heterogeneous terminals as data owners, distribution network servers as data receivers, fusion devices as agents, and trusted authorities as central agencies. The specific steps include: the central agency initializes the system, the central agency generates an identity-based encryption system private key, the central agency generates a ciphertext policy ciphertext policy attribute-based encryption system private key, the heterogeneous terminal generates and uploads a policy-based ciphertext policy attribute-based ciphertext, the heterogeneous terminal generates and uploads a re-encryption key, the fusion device re-encrypts the ciphertext and sends the re-encrypted identity-based ciphertext to the distribution network server, and the distribution network server decrypts it. The following describes each step in detail.

[0015] Step 1: The central agency initializes public parameters. The specific steps are as follows a. The system center runs the bilinear group generation algorithm , output bilinear group ,in is a safety parameter, , Is a prime number The cyclic group of Representation Group The generator of It is a bilinear map ; b. From Randomly select elements from , , ; from the group Randomly select elements from ,in Represents the binary length of the identity string; calculate ; c. Choose a hash function and encoding mapping function ; d. Output system common parameters and the system master private key ;in Open to other parties, Keep it secret. Step 2: Generate the private key of the distribution network server. The specific steps are as follows: a. Determine the ID of the distribution network server, whose binary length is L; is the ith bit of the binary ID, defined as For all The set of positions i; b. From Randomly select elements from , calculate the private key of the ID .

[0016] Step 3: Generate the private key of the heterogeneous terminal. The specific steps are as follows: a. Determine the attribute set of heterogeneous terminals ;from Randomly select elements from ,calculate , and for any attribute ,calculate ; b. Output heterogeneous terminals and attribute sets Associated private key .

[0017] Step 4: Generate access control policies based on heterogeneous terminals The specific steps are as follows: a. Defining access control policies for heterogeneous terminals , and according to Generate a linear secret sharing scheme ,in yes The secret sharing matrix of Map each row of the matrix to an attribute; b. From Randomly select elements from as well as , forming a vector ; c. For the matrix The i-th row ,calculate Sub-secret ; d. For plain text ,calculate , , , ; e. Output access control policy The ciphertext and sends it to the fusion device.

[0018] Step 5: Generate re-encryption keys on heterogeneous terminals. The specific steps are as follows: a. The heterogeneous terminal determines the receiver's identity ID and obtains The set U of all positions i; b. Select a random number ,calculate , , , , , ; c. Generate re-encryption key , sent to the fusion device.

[0019] Step 6: The fusion device converts the ciphertext policy attribute-based ciphertext based on the access control policy into the identity-based encryption ciphertext. The specific steps are as follows: a. If the re-encryption key The attribute collection in Satisfy ciphertext Access control policies in , we can find the constant satisfy ,in is the i-th row of the secret sharing matrix A; b. Fusion device computing ,in ; c. Then calculate , , , , ; d. The fusion device encrypts the identity ID sent to the distribution network.

[0020] Step 7: Decryption of the distribution network server. The specific steps are as follows: a. The distribution network server uses the private key ,calculate ; b. Then calculate ; c. Finally get the plain text .

[0021] This embodiment effectively combines ciphertext policy attribute-based encryption and identity-based encryption to form an encryption method that supports data owners to flexibly formulate access control policies. When the data owner needs to share the ciphertext with the identity-based encryption system user, the agent can be authorized to convert the attribute-based ciphertext based on the ciphertext policy into the identity-based encrypted ciphertext. In this way, not only can the secure transmission of data be guaranteed, but also those resource-constrained users (identity-based encryption system users) can access complex ciphertext policy attribute-based encrypted ciphertext. In addition, compared with existing similar schemes, the encryption and re-encryption computational overhead of this scheme is less.

[0022] In order to implement the method of the embodiment of the present invention, the embodiment of the present invention also provides a cross-cryptographic system data transmission system, the system including a central organization, an agent, a data recipient and a data owner; the central organization is used to generate system public parameters and a system master private key, and generate an identity-based encryption system private key based on the system public parameters and the system master private key; generate a ciphertext policy attribute-based encryption system private key based on the system public parameters and the system master private key; the data owner is used to encrypt plaintext using the system public parameters and generate a re-encryption key using the ciphertext policy attribute-based encryption system private key; the agent is used to convert the ciphertext using the re-encryption key, converting the ciphertext from ciphertext policy attribute-based encryption to identity-based encryption; the data recipient is used to decrypt the converted ciphertext into plaintext using the identity-based encryption system private key.

[0023] The above-mentioned system provided in this embodiment belongs to the same concept as the above-mentioned method embodiment. The specific implementation process thereof is detailed in the method embodiment and will not be repeated here.

[0024] In order to implement the method of the embodiment of the present invention, the embodiment of the present invention also provides a computer program product, which includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps of the above method.

[0025] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present invention, the embodiment of the present invention further provides an electronic device (computer device). Specifically, in one embodiment, the computer device may be a terminal, and its internal structure diagram may be as follows: Figure 3As shown. The computer device includes a processor A01, a network interface A02, a display screen A04, an input device A05 and a memory (not shown in the figure) connected through a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A06. The non-volatile storage medium A06 stores an operating system B01 and a computer program B02. The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A06. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor A01, the method of any one of the above embodiments is implemented. The display screen A04 of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device A05 of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0026] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0027] The device provided by the embodiment of the present invention includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the method of any one of the above embodiments is implemented.

[0028] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0029] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0030] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0031] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0032] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0033] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0034] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0035] It can be understood that the memory of the embodiment of the present invention can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAMbus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memories.

[0036] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0037] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for transmitting data across cryptographic systems. It is characterized in that Applied to a cross-cryptographic system data transmission system, the cross-cryptographic system data transmission system includes a central agency, an agent, a data receiver and a data owner, and the method includes: The central agency generates system public parameters and system master private key; The central agency generates an identity-based encryption system private key based on the system public parameters and the system master private key; generates a ciphertext policy attribute-based encryption system private key based on the system public parameters and the system master private key; The data owner encrypts the plaintext using the system public parameters and generates a re-encryption key using the ciphertext policy attribute-based encryption system private key; The proxy party converts the ciphertext using the re-encryption key to convert the ciphertext from ciphertext policy attribute-based encryption to identity-based encryption; The data recipient uses the identity-based encryption system private key to decrypt the converted ciphertext into plaintext.

2. The cross-cryptographic system data transmission method according to claim 1, It is characterized in that Generate system public parameters and system master private key, including: Run the bilinear group generation algorithm , output bilinear group ,in is a safety parameter, , Is a prime number The cyclic group of Representation Group The generator of It is a bilinear map ; from Randomly select elements from , , ; from the group Randomly select elements from ,in Represents the binary length of the identity string; calculate ; Choosing a hash function and encoding mapping function ; Output system common parameters and the system master private key .

3. The cross-cryptographic system data transmission method according to claim 2, It is characterized in that Generating an identity-based encryption system private key based on the system public parameter and the system master private key includes: Get the binary length Identity ID; is the ith bit of the binary ID, defined as For all The set of positions i; from Randomly select elements from , calculate the private key of the ID .

4. The cross-cryptographic system data transmission method according to claim 3, It is characterized in that Generating a ciphertext policy attribute-based encryption system private key based on the system public parameter and the system master private key includes: Determine the data owner attribute set ;from Randomly select elements from ,calculate , and for any attribute ,calculate ; Output and Property Sets Associated private key .

5. The cross-cryptographic system data transmission method according to claim 4, It is characterized in that Encrypting the plain text using the system public parameters includes: Defining access control policies , and according to Generate a linear secret sharing scheme ,in yes The secret sharing matrix of Map each row of the matrix to an attribute; from Randomly select elements from as well as , forming a vector ; Pair Matrix The i-th row ,calculate Sub-secret ; For plain text ,calculate , , , ; Output access control policy The ciphertext .

6. The cross-cryptographic system data transmission method according to claim 5, It is characterized in that Generating a re-encryption key using the ciphertext policy attribute-based encryption system private key includes: Determine the identity ID of the data recipient and determine U as The set of all positions i of ; Select random number ,calculate , , , , , ; Generate re-encryption key .

7. The cross-cryptographic system data transmission method according to claim 6, It is characterized in that Converting the ciphertext using the re-encryption key includes: like The attribute collection in Satisfy ciphertext Access control policies in , then find the constant satisfy ,in is the i-th row of the secret sharing matrix A; calculate ,in, ; calculate , , , , ; Output identity ID ciphertext .

8. The cross-cryptographic system data transmission method according to claim 7, It is characterized in that Decrypting the converted ciphertext into plaintext using the identity-based encryption system private key includes: Utilizing private keys ,calculate ; calculate ; Recovering plaintext data .

9. A cross-cryptographic data transmission system, It is characterized in that The system includes a central agency, an agent, a data receiver and a data owner; The central agency is used to generate system public parameters and a system master private key, and generate an identity-based encryption system private key based on the system public parameters and the system master private key; Generate a ciphertext policy attribute-based encryption system private key based on the system public parameters and the system master private key; The data owner is used to encrypt the plaintext using the system public parameters and generate a re-encryption key using the ciphertext policy attribute-based encryption system private key; The proxy is used to convert the ciphertext using the re-encryption key to convert the ciphertext from ciphertext policy attribute-based encryption to identity-based encryption; The data receiver is used to decrypt the converted ciphertext into plaintext using the identity-based encryption system private key.

10. A storage medium having a computer program stored therein. It is characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images