Method and system for secure sharing of internal data of power distribution terminals based on lightweight attribute encryption

Abstract

The present invention discloses a method and system for securely sharing data within a distribution terminal based on lightweight attribute encryption. The present invention uses a security control center and all applications within the distribution terminal as the application layer, the sensors or actuators of the distribution terminal as the physical layer, and a distributed database as the data layer. At the application layer, all applications within the distribution terminal are divided into several functional partitions according to their functions. Each partition is responsible for a specific function. Each application is assigned attributes and encrypted according to data acquisition rules. The data acquisition rules specify the attributes that applications that can obtain their data should possess. Only when other applications possess the attributes of the data acquisition rules can data sharing between applications within the partition be achieved. When cross-partition data sharing is required, dynamic policy update technology is adopted to enable secure data sharing between applications in different partitions. The present invention can achieve secure data sharing between applications.

Description

Technical Field

[0001] The present invention relates to the field of power information security technology, and in particular to a method and system for securely sharing internal data of a power distribution terminal based on lightweight attribute encryption. Background Art

[0002] With the development of smart grids and the increasing functional demands on distribution terminals, the volume of applications and data within distribution terminal devices has skyrocketed. These terminal devices play a crucial role in the distribution network, undertaking multiple functions such as data collection, status monitoring, fault diagnosis, and remote control. However, terminal devices have very limited resources, typically characterized by small storage space, weak computing power, and limited battery capacity, making the security of their internal data a significant challenge. Furthermore, the protection options for distribution terminal devices are relatively limited. Traditional security mechanisms, such as complex encryption algorithms and cumbersome authentication processes, often require high computing and storage resources, making them impractical for resource-constrained terminal devices. This makes the data within these devices extremely vulnerable to theft, tampering, and corruption by attackers, threatening the security and stability of the entire distribution network. Multiple applications reside within distribution terminals, and secure data sharing between these applications is a pressing issue. Summary of the Invention

[0003] In view of the problems existing in the prior art, the purpose of the present invention is to provide a method and system for secure sharing of internal data of a distribution terminal based on lightweight attribute encryption, which can realize secure sharing of data between applications.

[0004] In order to achieve the above-mentioned object of the invention, the present invention provides the following technical solutions:

[0005] A method for securely sharing data within a power distribution terminal based on lightweight attribute encryption. This method uses the security control center and all applications within the power distribution terminal as the application layer and implements the following steps:

[0006] The security control center divides all applications within the power distribution terminal into several functional partitions according to their functions, and assigns attributes and data acquisition rules to each application in the same functional partition. The data acquisition rules specify the attributes that applications must possess to obtain their data.

[0007] The security control center generates public keys and user encryption keys, and makes the public keys public to all applications;

[0008] When accessing data of an application in the same functional partition, the accessing application sends a first access request including its own attributes to the security control center and the accessed application. When accessing data of an application in a different functional partition, the accessing application sends a second access request including its own attributes to the security control center and the accessed application.

[0009] When the security control center receives the first access request, it parses the attributes of the access application from it, generates a user private key that matches the attributes of the access application based on the user encryption key, and returns it to the access application. When it receives the second access request, after the access application's identity and permissions are authenticated, it dynamically updates the attributes of the access application to the data acquisition rules of the accessed application, parses the attributes of the access application from the second access request, generates a user private key that matches the attributes of the access application based on the user encryption key, and returns it to the access application.

[0010] When the accessed application receives the first access request or the second access request, it returns the corresponding ciphertext data to the accessing application; wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key;

[0011] The access application decrypts the received ciphertext data based on the user's private key and public key to achieve secure data sharing within a partition or across zones.

[0012] Furthermore, the method also includes: using the sensor or actuator of the distribution terminal as the physical layer, all applications inside the distribution terminal realize data collection through the physical layer, and transmit it through a wireless or wired communication network, using the transport layer security protocol and transmitting through an encrypted communication channel.

[0013] Furthermore, the method also includes: using a distributed database as the data layer, and using different encryption strategies to process data belonging to different functional partitions transmitted at the physical layer. Specifically, for functional partitions with a privacy level higher than a preset threshold, first encrypt the data using homomorphic encryption technology, and then encrypt it according to data acquisition rules and public keys. For functional partitions with a privacy level lower than a preset threshold, directly encrypt the data according to data acquisition rules and public keys.

[0014] Furthermore, the security control center divides all applications within the power distribution terminal into several functional partitions according to their functions, specifically including:

[0015] The security control center divides all applications inside the distribution terminal into monitoring partitions, control partitions and analysis partitions according to their functions. The monitoring partition is used to collect and monitor the operating status and environmental information of the distribution terminal in real time. The control partition is used to receive and execute control commands to ensure the normal operation of the distribution terminal. The analysis partition is used to conduct in-depth analysis and modeling of the collected data to provide decision support and optimization suggestions.

[0016] Furthermore, the method also includes: recording and auditing all access requests and operations, and generating access log records, operation log records and audit reports.

[0017] A data security sharing system for distribution terminals based on lightweight attribute encryption, the system includes an application layer, the application layer includes all applications within the security control center and the distribution terminal, wherein:

[0018] The security control center includes:

[0019] A functional partitioning module is used to divide all applications within the power distribution terminal into several functional partitions according to their functions, and to assign attributes and data acquisition rules to each application in the same functional partition, wherein the data acquisition rules specify the attributes that an application must have in order to obtain its data;

[0020] A key generation module, used to generate public keys and user encryption keys, and publish the public keys to all applications;

[0021] A user private key generation module is configured to, upon receiving a first access request, parse the attributes of the accessing application therefrom, generate a user private key that matches the attributes of the accessing application based on the user encryption key, and return the key to the accessing application; and, upon receiving a second access request, after the identity and permissions of the accessing application are authenticated, dynamically update the attributes of the accessing application into the data acquisition rules of the accessed application, parse the attributes of the accessing application from the second access request, generate a user private key that matches the attributes of the accessing application based on the user encryption key, and return the key to the accessing application;

[0022] The applications include:

[0023] an access request sending module, configured to, when accessing data of an application in the same functional partition is required, cause the accessing application to send a first access request including its own attributes to the security control center and the accessed application; and, when accessing data of an application in a different functional partition is required, cause the accessing application to send a second access request including its own attributes to the security control center and the accessed application;

[0024] An access data transmission module, configured to return corresponding ciphertext data to the access application upon receiving the first access request or the second access request; wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key;

[0025] The decryption module is used to decrypt the received ciphertext data according to the user's private key and public key when receiving the ciphertext data, so as to realize the secure sharing of data within the partition or across the partitions.

[0026] Furthermore, the system also includes a physical layer, which includes sensors or actuators of the distribution terminal. All applications inside the distribution terminal collect data through the physical layer and transmit it through a wireless or wired communication network. The transmission adopts the transport layer security protocol and is transmitted through an encrypted communication channel.

[0027] Furthermore, the system also includes a data layer, which includes a distributed database, which is used to process data belonging to different functional partitions transmitted by the physical layer using different encryption strategies. Specifically, for functional partitions with a privacy level higher than a preset threshold, the data is first encrypted using homomorphic encryption technology, and then encrypted according to data acquisition rules and public keys. For functional partitions with a privacy level lower than the preset threshold, the data is directly encrypted according to data acquisition rules and public keys.

[0028] Furthermore, the security management and control center divides all applications within the distribution terminal into monitoring partitions, control partitions, and analysis partitions according to their functions. The monitoring partition is used to collect and monitor the operating status and environmental information of the distribution terminal in real time. The control partition is used to receive and execute control commands to ensure the normal operation of the distribution terminal. The analysis partition is used to conduct in-depth analysis and modeling of the collected data to provide decision support and optimization suggestions.

[0029] Furthermore, the system also includes an audit module for recording and auditing all access requests and operations, and generating access log records, operation log records and audit reports.

[0030] Compared with the prior art, the present invention has the following beneficial effects: the present invention solves the problem of secure data sharing between various applications within a new power distribution system terminal, thereby enhancing the overall security and credibility of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a system block diagram of a power distribution terminal internal data security sharing system based on lightweight attribute encryption provided by an embodiment of the present invention;

[0032] Figure 2 is an example of an access policy within a partition;

[0033] Figure 3 is an example of a cross-partition access strategy. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the present invention will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present invention.

[0035] Example 1

[0036] The embodiment of the present invention provides a method for secure sharing of data within a distribution terminal based on lightweight attribute encryption. The method uses the security control center and all applications within the distribution terminal as the application layer, the sensors or actuators of the distribution terminal as the physical layer, and a distributed database as the data layer. Figure 1 shown.

[0037] The physical layer can realize the collection and transmission of data such as the operating status of the distribution network. The collected data of the physical layer is transmitted through a wireless or wired communication network. For example, multiple communication methods are supported between the physical layer and the data layer, mainly including wired communication methods and wireless communication methods, to ensure that data can be transmitted efficiently. The data transmission process adopts the transport layer security protocol (TLS / SSL) to protect the security and correctness of data during transmission through encrypted communication channels to prevent data from being intercepted and tampered. Different wireless communication protocols can be selected as needed for wireless communication, such as Wi-Fi, LoRaWAN, etc., to meet the data transmission requirements in different application scenarios and ensure the flexibility and security of data transmission.

[0038] The data layer is primarily a distributed database, responsible for receiving and encrypting data transmitted from the physical layer and providing access to it to applications at the application layer. The database utilizes a multi-node architecture to improve data storage reliability and stability, enabling it to meet the concurrent storage and user access requests for large amounts of data. To ensure data security in different partitions, different encryption strategies are employed. For functional partitions with privacy levels above a preset threshold, data is encrypted using CKKS homomorphic encryption technology. This encryption method ensures that data remains encrypted during storage and processing, preventing data leakage and unauthorized access. After data processing is complete, the data is decrypted and encrypted again according to data acquisition rules and public keys. For functional partitions with privacy levels below the preset threshold, such as monitoring partitions and flow control partitions, data is directly encrypted according to data acquisition rules and public keys, enabling fine-grained access control to ensure data security.

[0039] The application layer mainly includes all applications within the security control center and the power distribution terminal, and is implemented in the following steps:

[0040] S101. The security control center divides all applications within the power distribution terminal into several functional partitions according to their functions, and assigns attributes and data acquisition rules to each application in the same functional partition.

[0041] The security control center divides all applications within the distribution terminal into monitoring partitions, control partitions, and analysis partitions according to their functions. The monitoring partition is used to collect and monitor the operating status and environmental information of the distribution terminal in real time. The control partition is used to receive and execute control commands, such as switch operation and circuit breaker control, to ensure the normal operation of the distribution terminal. The analysis partition is used to conduct in-depth analysis and modeling of the collected data to provide decision support and optimization suggestions.

[0042] The security control center assigns attributes and data acquisition rules to each application in the same functional partition. The data acquisition rules specify the attributes that applications that can access their data should have, so that only applications with specific attributes can access the corresponding application data, thereby ensuring the security and confidentiality of data within the partition. Data acquisition rules can be implemented through the access control policy tree, such as Figure 2 As shown in the figure, the root node of this policy tree is an AND node, meaning that the application must meet both attribute "G" and the conditions of the "2-of-4" policy. To meet the "2-of-4" policy, the application must meet any two of the four conditions: attribute "A," attribute "E," and attribute "F," or comply with the "2-of-3" policy. The "2-of-3" policy further requires that the application meet any two of the attributes "B," "C," and "D." Only when the application meets these combined conditions can it decrypt and access the data within the partition.

[0043] S102: The security control center generates a public key and a user encryption key, and makes the public key public to all applications.

[0044] S103. When it is necessary to access the data of an application in the same functional partition, the accessing application sends a first access request including its own attributes to the security control center and the accessed application. When it is necessary to access the data of an application in a different functional partition, the accessing application sends a second access request including its own attributes to the security control center and the accessed application.

[0045] S104. When the security control center receives the first access request, it parses the attributes of the access application from it, and generates a user private key that matches the attributes of the access application based on the user encryption key, and returns it to the access application; when receiving the second access request, after the identity and permission authentication of the access application are passed, the attributes of the access application are dynamically updated to the data acquisition rules of the accessed application, and then the attributes of the access application are parsed from the second access request, and a user private key that matches the attributes of the access application is generated based on the user encryption key, and returns it to the access application.

[0046] Among them, dynamically updating the attributes of the accessing application to the data acquisition rules of the accessed application can be achieved by updating the access policy tree, such as Figure 3 As shown in the original access control policy tree of the data, the root node is an AND node, which requires both the attribute "G" and the "2-of-4" policy conditions. In order to meet the "2-of-4" policy, any two of the four conditions must be met. These four conditions include the attributes "A", "E", "F" and the "2-of-3" policy, while the "2-of-3" policy requires any two of the attributes "B", "C", and "D". In order to achieve cross-partition data sharing, data holders can dynamically update access policies, such as Figure 3 As shown on the right, the original attribute "G" is adjusted to a new "2-of-4" policy subtree, containing attributes "G1," "G2," "G3," and "G4." This allows for dynamic updates to the access policy, allowing cross-partition access to data when applications in other partitions meet the AND requirements of the root node. Because access control policies are independent of the ciphertext content, adjusting the policy tree allows for logical expansion of the attribute combinations that can decrypt data. However, the actual ciphertext structure remains unchanged, eliminating the need to decrypt and re-encrypt already encrypted data. This allows for flexible cross-partition data access, enabling secure data flow between multiple partitions and achieving fine-grained access control and secure sharing of data.

[0047] S105 . When the accessed application receives the first access request or the second access request, it returns corresponding ciphertext data to the accessing application, wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key.

[0048] S106. The access application decrypts the received ciphertext data according to the user's private key and public key to achieve secure sharing of data within a partition or secure sharing of data across partitions.

[0049] Encrypted data is shared and transmitted within the partition. Because the data is encrypted, even if it is intercepted during transmission by a malicious attacker, the data cannot be read without the correct user private key. Decryption is only possible with the user's private key and public key.

[0050] S107. All access requests and operations are recorded and audited, generating access logs, operation logs, and audit reports. All data access and operations are recorded in detail, ensuring rapid tracking and location of issues in the event of a security incident. The security audit mechanism regularly generates audit reports, providing detailed access and operation records for review and analysis by security management personnel.

[0051] Example 2

[0052] Figure 1 This is a schematic diagram of a distribution terminal internal data security sharing system based on lightweight attribute encryption provided in the second embodiment of the present invention, including a physical layer, a data layer and an application layer.

[0053] The physical layer can realize the collection and transmission of data such as the operating status of the distribution network. The collected data of the physical layer is transmitted through a wireless or wired communication network. For example, multiple communication methods are supported between the physical layer and the data layer, mainly including wired communication methods and wireless communication methods, to ensure that data can be transmitted efficiently. The data transmission process adopts the transport layer security protocol (TLS / SSL) to protect the security and correctness of data during transmission through encrypted communication channels to prevent data from being intercepted and tampered. Different wireless communication protocols can be selected as needed for wireless communication, such as Wi-Fi, LoRaWAN, etc., to meet the data transmission requirements in different application scenarios and ensure the flexibility and security of data transmission.

[0054] The data layer is primarily a distributed database, responsible for receiving and encrypting data transmitted from the physical layer and providing access to it to applications at the application layer. The database utilizes a multi-node architecture to improve data storage reliability and stability, enabling it to meet the concurrent storage and user access requests for large amounts of data. To ensure data security in different partitions, different encryption strategies are employed. For functional partitions with privacy levels above a preset threshold, data is encrypted using CKKS homomorphic encryption technology. This encryption method ensures that data remains encrypted during storage and processing, preventing data leakage and unauthorized access. After data processing is complete, the data is decrypted and encrypted again according to data acquisition rules and public keys. For functional partitions with privacy levels below the preset threshold, such as monitoring partitions and flow control partitions, data is directly encrypted according to data acquisition rules and public keys, enabling fine-grained access control to ensure data security.

[0055] The application layer includes all applications within the security control center and distribution terminals, including:

[0056] The security control center includes:

[0057] A functional partitioning module is used to divide all applications within the power distribution terminal into several functional partitions according to their functions, and to assign attributes and data acquisition rules to each application in the same functional partition, wherein the data acquisition rules specify the attributes that an application must have in order to obtain its data;

[0058] A key generation module, used to generate public keys and user encryption keys, and publish the public keys to all applications;

[0059] A user private key generation module is configured to, upon receiving a first access request, parse the attributes of the accessing application therefrom, generate a user private key that matches the attributes of the accessing application based on the user encryption key, and return the key to the accessing application; and, upon receiving a second access request, after the identity and permissions of the accessing application are authenticated, dynamically update the attributes of the accessing application into the data acquisition rules of the accessed application, parse the attributes of the accessing application from the second access request, generate a user private key that matches the attributes of the accessing application based on the user encryption key, and return the key to the accessing application;

[0060] The applications include:

[0061] an access request sending module, configured to, when accessing data of an application in the same functional partition is required, cause the accessing application to send a first access request including its own attributes to the security control center and the accessed application; and, when accessing data of an application in a different functional partition is required, cause the accessing application to send a second access request including its own attributes to the security control center and the accessed application;

[0062] An access data transmission module, configured to return corresponding ciphertext data to the access application upon receiving the first access request or the second access request; wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key;

[0063] The decryption module is used to decrypt the received ciphertext data according to the user's private key and public key when receiving the ciphertext data, so as to realize the secure sharing of data within the partition or across the partitions.

[0064] Furthermore, the system also includes an audit module for recording and auditing all access requests and operations, and generating access log records, operation log records and audit reports.

[0065] The system provided in the embodiment of the present invention can be used to execute the method provided in the first embodiment of the present invention, and has the corresponding functions and beneficial effects of executing the method.

[0066] It is worth noting that in the embodiment of the above system, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0067] The embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, i.e., they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Those skilled in the art will readily appreciate that each embodiment may be implemented using software plus a necessary general-purpose hardware platform, or may be implemented solely through hardware, as long as the functionality or effect can be achieved.

Claims

1. A method for securely sharing internal data of a power distribution terminal based on lightweight attribute encryption, characterized in that: This method uses all applications within the security control center and distribution terminals as the application layer and implements the following steps: The security control center divides all applications within the power distribution terminal into several functional partitions according to their functions, and assigns attributes and data acquisition rules to each application in the same functional partition. The data acquisition rules specify the attributes that applications must possess to obtain their data. The security control center generates public keys and user encryption keys, and makes the public keys public to all applications; When accessing data of an application in the same functional partition, the accessing application sends a first access request including its own attributes to the security control center and the accessed application. When accessing data of an application in a different functional partition, the accessing application sends a second access request including its own attributes to the security control center and the accessed application. When the security control center receives the first access request, it parses the attributes of the access application from it, generates a user private key that matches the attributes of the access application based on the user encryption key, and returns it to the access application. When it receives the second access request, after the access application's identity and permissions are authenticated, it dynamically updates the attributes of the access application to the data acquisition rules of the accessed application, parses the attributes of the access application from the second access request, generates a user private key that matches the attributes of the access application based on the user encryption key, and returns it to the access application. When the accessed application receives the first access request or the second access request, it returns the corresponding ciphertext data to the accessing application; wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key; The access application decrypts the received ciphertext data based on the user's private key and public key to achieve secure data sharing within a partition or across zones.

2. The method for securely sharing internal data of a power distribution terminal based on lightweight attribute encryption according to claim 1, characterized in that: The method further includes: The sensors or actuators of the distribution terminal are used as the physical layer. All applications inside the distribution terminal collect data through the physical layer and transmit the data through a wireless or wired communication network. The transmission adopts the transport layer security protocol and is transmitted through an encrypted communication channel.

3. The method for securely sharing internal data of a power distribution terminal based on lightweight attribute encryption according to claim 2, characterized in that: The method further includes: A distributed database is used as the data layer, and different encryption strategies are adopted to process the data belonging to different functional partitions transmitted at the physical layer. Specifically: for functional partitions with privacy levels higher than the preset threshold, the data is first encrypted using homomorphic encryption technology, and then encrypted according to data acquisition rules and public keys. For functional partitions with privacy levels lower than the preset threshold, the data is directly encrypted according to data acquisition rules and public keys.

4. The method for securely sharing internal data of a power distribution terminal based on lightweight attribute encryption according to claim 1, characterized in that: The security control center divides all applications within the power distribution terminal into several functional partitions according to their functions, including: The security control center divides all applications inside the distribution terminal into monitoring partitions, control partitions and analysis partitions according to their functions. The monitoring partition is used to collect and monitor the operating status and environmental information of the distribution terminal in real time. The control partition is used to receive and execute control commands to ensure the normal operation of the distribution terminal. The analysis partition is used to conduct in-depth analysis and modeling of the collected data to provide decision support and optimization suggestions.

5. The method for securely sharing internal data of a power distribution terminal based on lightweight attribute encryption according to claim 1, characterized in that: The method further includes: All access requests and operations are recorded and audited, and access logs, operation logs and audit reports are generated.

6. A distribution terminal internal data security sharing system based on lightweight attribute encryption, characterized in that: The system includes an application layer, which includes all applications within the security control center and the distribution terminal, including: The security control center includes: A functional partitioning module is used to divide all applications within the power distribution terminal into several functional partitions according to their functions, and to assign attributes and data acquisition rules to each application in the same functional partition, wherein the data acquisition rules specify the attributes that an application must have in order to obtain its data; A key generation module, used to generate public keys and user encryption keys, and publish the public keys to all applications; A user private key generation module is configured to, upon receiving a first access request, parse the attributes of the accessing application therefrom, generate a user private key that matches the attributes of the accessing application based on the user encryption key, and return the key to the accessing application; and, upon receiving a second access request, after the identity and permissions of the accessing application are authenticated, dynamically update the attributes of the accessing application into the data acquisition rules of the accessed application, parse the attributes of the accessing application from the second access request, generate a user private key that matches the attributes of the accessing application based on the user encryption key, and return the key to the accessing application; The applications include: an access request sending module, configured to, when accessing data of an application in the same functional partition is required, cause the accessing application to send a first access request including its own attributes to the security control center and the accessed application; and, when accessing data of an application in a different functional partition is required, cause the accessing application to send a second access request including its own attributes to the security control center and the accessed application; An access data transmission module, configured to return corresponding ciphertext data to the access application upon receiving the first access request or the second access request; wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key; The decryption module is used to decrypt the received ciphertext data according to the user's private key and public key when receiving the ciphertext data, so as to realize the secure sharing of data within the partition or across the partitions.

7. The power distribution terminal internal data security sharing system based on lightweight attribute encryption according to claim 6 is characterized in that: The system also includes a physical layer, which includes sensors or actuators of the distribution terminal. All applications inside the distribution terminal collect data through the physical layer and transmit it through a wireless or wired communication network. The transmission adopts the transport layer security protocol and is transmitted through an encrypted communication channel.

8. The power distribution terminal internal data security sharing system based on lightweight attribute encryption according to claim 7 is characterized in that: The system also includes a data layer, which includes a distributed database and is used to process data belonging to different functional partitions transmitted by the physical layer using different encryption strategies. Specifically, for functional partitions with a privacy level higher than a preset threshold, the data is first encrypted using homomorphic encryption technology, and then encrypted according to data acquisition rules and public keys. For functional partitions with a privacy level lower than the preset threshold, the data is directly encrypted according to data acquisition rules and public keys.

9. The power distribution terminal internal data security sharing system based on lightweight attribute encryption according to claim 6 is characterized in that: The security control center divides all applications inside the distribution terminal into monitoring partitions, control partitions and analysis partitions according to their functions. The monitoring partition is used to collect and monitor the operating status and environmental information of the distribution terminal in real time. The control partition is used to receive and execute control commands to ensure the normal operation of the distribution terminal. The analysis partition is used to conduct in-depth analysis and modeling of the collected data to provide decision support and optimization suggestions.

10. The power distribution terminal internal data security sharing system based on lightweight attribute encryption according to claim 6, characterized in that: The system also includes an audit module for recording and auditing all access requests and operations, and generating access log records, operation log records and audit reports.

Images