Access system based on CP-ABE to realize fine-grained access and key delegation

Abstract

The embodiment of the present application provides an access system for implementing fine-grained access and key delegation based on CP-ABE, which relates to the field of information security technology. In the system, a central server generates a target decryption key; a first user terminal receives the target decryption key; each access key is determined; each access key is encrypted to obtain a key array; and a target ciphertext of a target resource is generated, and the target ciphertext is reported to a cloud server for storage; the target identity information, target user attribute set, and target decryption key of the second user terminal are sent to a trusted intermediary; the trusted intermediary generates a target delegation key, and sends the target delegation key to the first user terminal; the first user terminal sends the target delegation key to the second user terminal; the second user terminal decrypts the target access key based on the target delegation key for the target ciphertext in the cloud server, and accesses the target resource based on the target access key. The present application can meet fine-grained access control.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an access system for implementing fine-grained access and key delegation based on CP-ABE. Background Art

[0002] CP-ABE (Ciphertext-Policy Attribute-Based Encryption) is a secure one-to-many asymmetric encryption scheme (one encryption for multiple decryptions, or one decryption for multiple encryptions), in which the access control of the target resource of the delegator as the encryption party is defined based on the attributes of the user (the delegate, who can be the decryption party). The attributes of the user can determine the user's access rights to the target resource. Key delegation is an important requirement of CP-ABE. During the key delegation process, the delegator can delegate all of the delegator's rights to the delegate, and the delegate can use these rights to access the delegator's target resources.

[0003] However, there is currently a demand for fine-grained key delegation. For example, if the patient's doctor is the delegating party, the doctor does not have to delegate all permissions to the delegating party, but only delegates part of the permissions to the delegating party. For example, the doctor may only need to give the nurse the permission to read the patient's relevant information, but does not have to delegate all permissions (such as treating the patient, or modifying the patient's relevant information, etc.) to the nurse.

[0004] It can be seen that in the related technology, the delegator can only delegate all permissions to the delegatee, which cannot meet the needs of fine-grained key delegation and thus cannot meet fine-grained access control. Summary of the invention

[0005] The purpose of the embodiment of the present application is to provide an access system for implementing fine-grained access and key delegation based on CP-ABE to meet fine-grained access control. The specific technical solution is as follows:

[0006] In a first aspect, an embodiment of the present application provides an access system for implementing fine-grained access and key delegation based on CP-ABE, including: a central server, a cloud server, a trusted intermediary, a first user terminal as a resource delegator, and a second user terminal as a trustee;

[0007] The central server is used to generate a target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal and the system initialization parameters, and send it to the first user terminal; and record the delegation relationship information corresponding to the first user terminal in the target tracking list; wherein the delegation relationship information is used to represent the information of the user terminal to which the first user terminal is allowed to delegate when performing key delegation; the system initialization parameters include public parameters and a master key;

[0008] The first user terminal is used to receive the target decryption key; determine each access key for different access rights to the target resource; encrypt the access key for each access right to obtain a key array; generate a target ciphertext for the target resource based on the key array, public parameters, and an access tree structure for characterizing the access control policy for each access right of the target resource, and report the target ciphertext to the cloud server so that the cloud server stores the target ciphertext; in response to the need to delegate the key for the target right for the target resource, send the target identity information of the second user terminal, the target user attribute set with the target right, and the target decryption key to the trusted intermediary;

[0009] The trusted intermediary is used to receive the target identity information, the target decryption key and the target user attribute set, access the target tracking list in the central server based on the target identity information, obtain the result of whether the second user terminal is allowed to be delegated, and if allowed, generate a target delegation key for the target authority of the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, and send the target delegation key to the first user terminal;

[0010] The first user terminal is further used to send the target delegation key to the second user terminal;

[0011] The second user terminal is used to receive the target delegation key; and in response to an access instruction to the target resource, decrypt the target access key regarding the target permission for the target ciphertext in the cloud server based on the target delegation key, and access the target resource contained in the target ciphertext regarding the target permission based on the target access key.

[0012] In a second aspect, an embodiment of the present application provides an access method for implementing fine-grained access and key delegation based on CP-ABE, which is applied to a first user terminal as a resource delegating party; the method includes:

[0013] Receive the target decryption key; determine each access key for different access rights of the target resource; encrypt the access key for each access right to obtain a key array; generate a target ciphertext of the target resource according to the key array, public parameters and an access tree structure used to characterize the access control policy for each access right of the target resource, and report the target ciphertext to the cloud server so that the cloud server stores the target ciphertext; wherein the target decryption key is the target decryption key required by the first user terminal generated by the central server according to the user attribute set and identity information of the first user terminal, as well as the system initialization parameters; the central server also records the delegation relationship information corresponding to the first user terminal in the target tracking list; the delegation relationship information is used to characterize the information of the user terminal to which the first user terminal is allowed to delegate when performing key delegation; the system initialization parameters include public parameters and a master key;

[0014] In response to the need to delegate the key regarding the target authority for the target resource, the target identity information of the second user terminal as the trustee, the target user attribute set with the target authority, and the target decryption key are sent to the trusted intermediary, so that the trusted intermediary receives the target identity information, the target decryption key, and the target user attribute set, and based on the target identity information, accesses the target tracking list in the central server to obtain the result of whether the second user terminal is allowed to be delegated, and if allowed, generates a target delegation key for the target authority for the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information, and the target user attribute set, and sends the target delegation key to the first user terminal;

[0015] The target delegation key is sent to the second user terminal; so that the second user terminal receives the target delegation key; and in response to the access instruction for the target resource, based on the target delegation key, the target access key regarding the target permission is decrypted for the target ciphertext in the cloud server, and based on the target access key, the target resource contained in the target ciphertext is accessed regarding the target permission.

[0016] In a third aspect, an embodiment of the present application provides an access device for implementing fine-grained access and key delegation based on CP-ABE, which is applied to a first user terminal as a resource delegating party; the device includes:

[0017] A generation module, used to receive the target decryption key; determine each access key for different access rights of the target resource; encrypt the access key for each access right to obtain a key array; generate a target ciphertext of the target resource according to the key array, public parameters and an access tree structure used to characterize the access control policy for each access right of the target resource, and report the target ciphertext to the cloud server so that the cloud server stores the target ciphertext; wherein the target decryption key is the target decryption key required by the first user terminal generated by the central server according to the user attribute set and identity information of the first user terminal and the system initialization parameters; the central server also records the delegation relationship information corresponding to the first user terminal in the target tracking list; the delegation relationship information is used to characterize the information of the user terminal to which the first user terminal is allowed to delegate when performing key delegation; the system initialization parameters include public parameters and a master key;

[0018] A first sending module is used for sending the target identity information of the second user terminal as the trustee, the target user attribute set with the target authority and the target decryption key to the trusted intermediary in response to the need to perform key delegation on the target authority for the target resource, so that the trusted intermediary receives the target identity information, the target decryption key and the target user attribute set, accesses the target tracking list in the central server based on the target identity information, obtains the result of whether the second user terminal is allowed to be delegated, and if allowed, generates a target delegation key for the target authority for the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, and sends the target delegation key to the first user terminal;

[0019] The second sending module is used to send the target delegation key to the second user terminal; so that the second user terminal receives the target delegation key; and in response to the access instruction for the target resource, based on the target delegation key, for the target ciphertext in the cloud server, decrypt the target access key regarding the target permission, and based on the target access key, access the target resource contained in the target ciphertext regarding the target permission.

[0020] In a fourth aspect, an embodiment of the present application provides an electronic device, including:

[0021] Memory, used to store computer programs;

[0022] The processor is used to implement the access method for fine-grained access and key delegation based on CP-ABE when executing the program stored in the memory.

[0023] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, an access method for fine-grained access and key delegation based on CP-ABE is implemented.

[0024] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the above-described access methods for implementing fine-grained access and key delegation based on CP-ABE.

[0025] Beneficial effects of the embodiments of the present application:

[0026] The access system for implementing fine-grained access and key delegation based on CP-ABE provided by the embodiment of the present application includes: a central server, a cloud server, a trusted intermediary, a first user terminal as a resource entrusting party, and a second user terminal as a trustee; the central server generates a target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal, as well as public parameters and a master key, and sends it to the first user terminal; and records the information of the user terminal corresponding to the first user terminal and allowed to be delegated when performing key delegation in the target tracking list. The first user terminal can receive the target decryption key and determine the access keys for different access rights of the target resource in order to perform fine-grained access control. For security reasons, the access keys for each access right can be encrypted to obtain a key array, and the target ciphertext of the target resource is generated according to the key array, public parameters, and an access tree structure representing the access control policy for each access right of the target resource, and reported to the cloud server for storage; when the target resource needs to be delegated to the key of the target right, the target identity information of the second user terminal, the target user attribute set with the target right, and the target decryption key can be sent to the trusted intermediary. The trusted intermediary can receive the target identity information, target decryption key and target user attribute set sent by the first user terminal, and based on the target identity information, access the target tracking list of the central server to obtain the result of whether the second user terminal is allowed to delegate. If allowed, a target delegation key for the target authority of the target resource is generated according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, and the target delegation key is sent to the first user terminal. The first user terminal can receive the target delegation key and send the target delegation key to the second user terminal. The second user terminal receives the target delegation key, responds to the access instruction for the target resource, decrypts the target ciphertext in the cloud server based on the target delegation key, obtains the target access key for the target authority, and accesses the target resource contained in the target ciphertext based on the target access key.In the present application, based on CP-ABE, attributes are used to specify the permissions that users have, and the first user terminal, which is the resource delegator, formulates an access control policy and controls the second user terminal that can decrypt the target ciphertext according to its access tree structure; through information interaction among the central server, the cloud server, the trusted intermediary, the first user terminal and the second user terminal, the first user terminal can determine the access keys for different access permissions of the target resource, that is, encrypt multiple fine-grained access permissions, and the second user terminal can decrypt the target access key of the target permission possessed by the attributes of the second user terminal, and access the target permission to the target resource; therefore, the present application can perform fine-grained delegation for different access permissions through the access keys for different access permissions, so that the second user terminal can only access the target permission for the target resource, rather than all permissions, and thus, the present application can meet fine-grained access control.

[0027] Of course, implementing any product or method of the present application does not necessarily require achieving all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0029] Figure 1 A schematic diagram of an access system for implementing fine-grained access and key delegation based on CP-ABE provided in an embodiment of the present application;

[0030] Figure 2 Another schematic diagram of an access system for implementing fine-grained access and key delegation based on CP-ABE provided in an embodiment of the present application;

[0031] Figure 3 Another schematic diagram of an access system for implementing fine-grained access and key delegation based on CP-ABE provided in an embodiment of the present application;

[0032] Figure 4 A schematic diagram of the user registration process provided in the embodiment of the present application;

[0033] Figure 5 A schematic diagram of the key delegation process provided in the embodiment of the present application;

[0034] Figure 6 A schematic diagram of the data access and verification process provided in the embodiment of the present application;

[0035] Figure 7A flowchart of an access method for implementing fine-grained access and key delegation based on CP-ABE provided in an embodiment of the present application;

[0036] Figure 8 A schematic diagram of the structure of an access device for implementing fine-grained access and key delegation based on CP-ABE provided in an embodiment of the present application;

[0037] Fig. 9 A block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0039] In order to meet the needs of key delegation, researchers have proposed many key delegation methods, one of which is based on proxy re-encryption. This method uses a trusted proxy to convert the ciphertext associated with an access policy into the ciphertext of the same plaintext associated with another access policy, and the proxy cannot understand any plaintext. In the key delegation process based on proxy re-encryption, each ciphertext requires an additional encryption step, which reduces the performance of the CP-ABE scheme.

[0040] In order to achieve further key delegation, some researchers have proposed a method of limited further key delegation based on counting. In this method, a token is generated each time a delegation is made, which contains information about all previous delegations of the user, and the token is generated by permissions. Therefore, in this method, each delegation requires the participation of permissions. In addition, the size of the token will also increase with the number of delegations. Another method is for a trusted institution to maintain a delegation list DL, and the delegator can decide whether to allow the delegatee to further delegate (for example, allowing the delegatee to further access the delegator's target resources according to additional permissions), and these operations will be recorded in the delegation list.

[0041] The existing key delegation methods using CP-ABE have the following shortcomings:

[0042] 1. The delegation of specific fine-grained access rights needs to be improved: Some key delegation methods are not fine-grained enough and can only delegate all attributes or resources. Key delegation needs to be more fine-grained. The delegator needs to be able to specify different access rights related to the specific resources he wants to delegate to the delegate. For example, the patient's doctor is the delegator, and the doctor does not have to delegate all his permissions and a whole set of resources to anyone. For example, the doctor's subordinates (such as the head nurse) have update permissions, but the doctor may only need to give the relevant nurses read permissions.

[0043] 2. The restrictions on the specified access delegation content and further delegation need to be enhanced: For example, the delegate can be restricted to access the target resources of the delegator only a certain number of times, rather than unlimited access. When the restrictions on further key delegation are partially implemented, the performance is reduced, or the size of the delegation key increases with each delegation.

[0044] It can be seen that the relevant technology needs to improve the specific fine-grained access rights delegation, so that the delegator can delegate a specific set of attributes to the delegatee, rather than the complete set of attributes (all permissions). This means that the delegator can selectively delegate the attributes (permissions) required by the delegatee according to specific needs to achieve more precise fine-grained access control. In addition, the relevant technology needs to enhance the restrictions on the content of the specified access delegation and further delegation: the delegator should be able to specify the number of times the delegatee can access the specified resource, which can prevent the delegatee from accessing the resource too much. The delegator should be able to specify the number of times the delegatee can access, which means that the delegatee can only access the delegator's target resources within the specified number of times. This restriction can effectively control the delivery and management of access rights and prevent abuse or accidental disclosure of permissions.

[0045] Compared to the delegation of all permissions in existing solutions, the delegator should be able to delegate only specific permissions or resources, and the delegator should be able to specify different access rights related to the specific resources he / she wants to delegate to his / her colleagues. In this way, the delegator can selectively authorize the delegatee according to the importance or sensitivity of the resource to ensure data security and privacy protection.

[0046] Based on this, the embodiment of the present application provides an access system for implementing fine-grained access and key delegation based on CP-ABE to meet fine-grained access control. In this solution, the entrusting party can specify different access rights related to the specific resources that it wants to entrust to the entrustee.

[0047] The following first introduces the access system for implementing fine-grained access and key delegation based on CP-ABE provided by this application.

[0048] Among them, the access system based on CP-ABE for implementing fine-grained access and key delegation provided by the embodiment of the present application includes a central server, a cloud server, a trusted intermediary, a first user terminal as a resource entrustor, and a second user terminal as a trustee; the central server can be any server, used for user terminal registration and user terminal information management; the trusted intermediary is used by the entrustee to decrypt the target resource of the entrustor and prevent unauthorized decryption and tracing; the cloud server can be a cloud server for data storage; the first user terminal can upload the target resource and generate access keys with different access rights for the target resource, the second user terminal can decrypt to obtain the access key of the corresponding access right, and access the target resource according to the corresponding authority. In addition, any user terminal can be used as a resource entrustor and / or a resource entrustee. In some scenarios, any user terminal of the first user terminal and the second user terminal can be used as a resource entrustor, or a resource entrustee, or a entrustor of a resource and a trustee of another resource. This application does not limit this.

[0049] In addition, the access system for implementing fine-grained access and key delegation based on CP-ABE provided in the embodiments of the present application can be applied to any scenario with fine-grained access control requirements for resources, data, etc., for example: three types of access rights for reading, writing, and updating operations on resources, and scenarios in which different access rights are controlled for the second user terminals of different delegates. The present application does not limit the specific application scenarios of the access system for implementing fine-grained access and key delegation based on CP-ABE.

[0050] Specifically, an access system for implementing fine-grained access and key delegation based on CP-ABE provided in an embodiment of the present application includes: a central server, a cloud server, a trusted intermediary, a first user terminal as a resource delegator, and a second user terminal as a trustee;

[0051] The central server is used to generate a target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal and the system initialization parameters, and send it to the first user terminal; and record the delegation relationship information corresponding to the first user terminal in the target tracking list; wherein the delegation relationship information is used to represent the information of the user terminal to which the first user terminal is allowed to delegate when performing key delegation; the system initialization parameters include public parameters and a master key;

[0052] The first user terminal is used to receive the target decryption key; determine each access key for different access rights to the target resource; encrypt the access key for each access right to obtain a key array; generate a target ciphertext for the target resource based on the key array, public parameters, and an access tree structure for characterizing the access control policy for each access right of the target resource, and report the target ciphertext to the cloud server so that the cloud server stores the target ciphertext; in response to the need to delegate the key for the target right for the target resource, send the target identity information of the second user terminal, the target user attribute set with the target right, and the target decryption key to the trusted intermediary;

[0053] The trusted intermediary is used to receive the target identity information, the target decryption key and the target user attribute set, access the target tracking list in the central server based on the target identity information, obtain the result of whether the second user terminal is allowed to be delegated, and if allowed, generate a target delegation key for the target authority of the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, and send the target delegation key to the first user terminal;

[0054] The first user terminal is further used to send the target delegation key to the second user terminal;

[0055] The second user terminal is used to receive the target delegation key; and in response to an access instruction to the target resource, decrypt the target access key regarding the target permission for the target ciphertext in the cloud server based on the target delegation key, and access the target resource contained in the target ciphertext regarding the target permission based on the target access key.

[0056] The access system for implementing fine-grained access and key delegation based on CP-ABE provided by the embodiment of the present application includes: a central server, a cloud server, a trusted intermediary, a first user terminal as a resource entrusting party, and a second user terminal as a trustee; the central server generates a target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal, as well as public parameters and a master key, and sends it to the first user terminal; and records the information of the user terminal corresponding to the first user terminal and allowed to be delegated when performing key delegation in the target tracking list. The first user terminal can receive the target decryption key and determine the access keys for different access rights of the target resource in order to perform fine-grained access control. For security reasons, the access keys for each access right can be encrypted to obtain a key array, and the target ciphertext of the target resource is generated according to the key array, public parameters, and an access tree structure representing the access control policy for each access right of the target resource, and reported to the cloud server for storage; when the target resource needs to be delegated to the key of the target right, the target identity information of the second user terminal, the target user attribute set with the target right, and the target decryption key can be sent to the trusted intermediary. The trusted intermediary can receive the target identity information, target decryption key and target user attribute set sent by the first user terminal, and based on the target identity information, access the target tracking list of the central server to obtain the result of whether the second user terminal is allowed to delegate. If allowed, a target delegation key for the target authority of the target resource is generated according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, and the target delegation key is sent to the first user terminal. The first user terminal can receive the target delegation key and send the target delegation key to the second user terminal. The second user terminal receives the target delegation key, responds to the access instruction for the target resource, decrypts the target ciphertext in the cloud server based on the target delegation key, obtains the target access key for the target authority, and accesses the target resource contained in the target ciphertext based on the target access key.In the present application, based on CP-ABE, attributes are used to specify the permissions that users have, and the first user terminal, which is the resource delegator, formulates an access control policy and controls the second user terminal that can decrypt the target ciphertext according to its access tree structure; through information interaction among the central server, the cloud server, the trusted intermediary, the first user terminal and the second user terminal, the first user terminal can determine the access keys for different access permissions of the target resource, that is, encrypt multiple fine-grained access permissions, and the second user terminal can decrypt the target access key of the target permission possessed by the attributes of the second user terminal, and access the target permission to the target resource; therefore, the present application can perform fine-grained delegation for different access permissions through the access keys for different access permissions, so that the second user terminal can only access the target permission for the target resource, rather than all permissions, and thus, the present application can meet fine-grained access control.

[0057] In conjunction with the accompanying drawings, the access system for implementing fine-grained access and key delegation based on CP-ABE provided in an embodiment of the present application is exemplarily introduced below.

[0058] like Figure 1 As shown, the access system for implementing fine-grained access and key delegation based on CP-ABE provided in the embodiment of the present application includes: a central server 110, a cloud server 120, a trusted intermediary 130, a first user terminal 140 as a resource delegator, and a second user terminal 150 as a trustee;

[0059] The central server 110 is used to generate the target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal and the system initialization parameters, and send it to the first user terminal; and record the delegation relationship information corresponding to the first user terminal 140 in the target tracking list; wherein the delegation relationship information is used to represent the information of the user terminal to which the first user terminal 140 is allowed to delegate when performing key delegation; the system initialization parameters include public parameters and master keys;

[0060] The first user terminal 140 is used to receive the target decryption key; determine each access key for different access rights of the target resource; encrypt the access key for each access right to obtain a key array; generate a target ciphertext of the target resource according to the key array, public parameters, and an access tree structure for characterizing the access control policy for each access right of the target resource, and report the target ciphertext to the cloud server 120 so that the cloud server 120 stores the target ciphertext; in response to the need to delegate the key for the target right for the target resource, send the target identity information of the second user terminal, the target user attribute set with the target right, and the target decryption key to the trusted intermediary 130;

[0061] The trusted intermediary 130 is used to receive the target identity information, the target decryption key and the target user attribute set, and based on the target identity information, access the target tracking list in the central server 110 to obtain the result of whether the second user terminal is allowed to be delegated, and if allowed, generate a target delegation key for the target authority of the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, and send the target delegation key to the first user terminal 140;

[0062] The first user terminal 140 is further used to send the target delegation key to the second user terminal 150;

[0063] The second user terminal 150 is used to receive the target delegation key; and in response to an access instruction to the target resource, based on the target delegation key, decrypt the target access key regarding the target permission for the target ciphertext in the cloud server 120, and based on the target access key, access the target resource contained in the target ciphertext regarding the target permission.

[0064] In the access system for implementing fine-grained access and key delegation based on CP-ABE provided by the present application, first, in the system initialization phase, the central server can run the system application Setup to obtain system initialization parameters, and generate a target tracking list and a target function list in the initialization phase; thereafter, the first user terminal as the resource delegator registers with the system, and the central server can generate a target decryption key for the first user terminal based on the user attribute set and identity information of the first user terminal, as well as the system initialization parameters, and send it to the first user terminal; the central server can also maintain a target tracking list, which records the delegation relationship information corresponding to the first user terminal, so as to facilitate subsequent access control of the target resources of the first user terminal.

[0065] Exemplarily, in one implementation, the central server generates a target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal and the system initialization parameters, specifically:

[0066] Substituting the user attribute set and identity information of the first user terminal and the system initialization parameter as input parameters into a predetermined first key generation function to generate a key and obtain an initial decryption key;

[0067] The obtained initial decryption key is split into key components, and one of the key components obtained by the split is used as the target decryption key required by the first user terminal.

[0068] Among them, taking the identity information of the first user end as a doctor of the first hospital as an example, the user attribute set of the first user end may include the attributes of the identity and position of the first user end, as well as the attributes of the unit to which it belongs, etc. For example: the attributes of the first hospital, such as: the authority of the municipal hospital; the attributes of the first user end, such as: the authority of the director of surgery of the municipal hospital. The so-called attributes can represent the corresponding authority, for example: the first user end, as the director of surgery of the municipal hospital, has the authority to treat patients, the authority to manage subordinate doctors and nurses, and the authority to delegate some authority (such as information viewing authority) to subordinates, and even has the authority to view the information of the county hospital, etc.

[0069] When the central server generates the target decryption key required by the first user terminal, it can use the user attribute set, identity information and system initialization parameters of the first user terminal as input parameters, substitute them into the predetermined first key production function to generate the key and obtain the initial decryption key; in order to achieve fine-grained access control, the present application can also split the obtained initial decryption key into key components, and use one of the key components obtained by the split as the target decryption key required by the first user terminal.

[0070] The first key generation function may be any function having a key generation function, for example, a KeyGen (keygenerate) function, which is not limited in this application.

[0071] Furthermore, the initial decryption key can be understood as an initial key string. When the initial decryption key is split, the initial decryption key can be split into multiple key components in the order of characters, and one of the key components obtained by the split (i.e., a partial string in the initial key string) is used as the target decryption key required by the first user terminal; in a preferred manner, the initial decryption key can be split into two key components in the order of characters, one of the key components is used as the target decryption key required by the first user terminal, and the other key component is stored in the target tracking list. At this time, the key component stored in the target tracking list can represent the delegation relationship corresponding to the first user terminal.

[0072] The first user terminal can receive the target decryption key issued by the central server; and determine the access keys for different access rights of the target resource shared by the first user terminal, for example: each operation in the read, write and update operations corresponds to an access key; for security considerations, the access keys of each access right can be encrypted to obtain a key array, and the target ciphertext of the target resource is generated according to the key array, public parameters and the access tree structure used to characterize the access control policy of each access right of the target resource, and the target ciphertext is reported to the cloud server for storage; wherein, the target ciphertext can be understood as the ciphertext generated after the access policy about the target resource is embedded in the target resource. In addition, the target decryption key can contain attribute information implicitly, and the implicit attribute information satisfies the access policy about the target resource in the target ciphertext, so that the target delegation key generated by the target decryption key later can also contain attribute information implicitly in the target delegation key. When the attribute information implicit in the target delegation key satisfies the access policy about the target resource in the target ciphertext, the target access key can be successfully decrypted, and based on the target access key, the target resource contained in the target ciphertext is accessed with respect to the target authority.

[0073] When it is necessary to delegate the key of the target authority for the target resource, the first user terminal can obtain the target identity information of the second user terminal as the resource delegate, and send the target identity information of the second user terminal, the target user attribute set with the target authority, and the target decryption key to the trusted intermediary, so that the trusted intermediary can verify whether the second user terminal is allowed to be delegated, etc.

[0074] Among them, the first user terminal can encrypt the access keys of different access rights as needed, and the encryption method of the access keys of each access right can be the same or different. The specific encryption method can be similar to the prior art and will not be repeated here. The access tree structure can be understood as a tree structure containing all authorization sets, and the access tree structure is a monotonous non-empty set. In this application, it is specifically a tree structure of the set of user terminals that the first user terminal allows to be authorized for each access right.

[0075] The trusted intermediary can receive target identity information, target decryption key and target user attribute set. First, the target tracking list records the delegation relationship information corresponding to the first user terminal. Based on the target identity information, the trusted intermediary accesses the target tracking list in the central server to obtain the result of whether the second user terminal is allowed to delegate. Of course, it can also obtain the delegated target authority if delegation is allowed; if allowed, the trusted intermediary can generate a target delegation key for the target authority of the target resource based on the target decryption key, the identity information of the first user terminal, the target identity information of the second user terminal and the target user attribute set, and send the target delegation key to the first user terminal for key delegation of the first user terminal.

[0076] Exemplarily, in one implementation, the trusted intermediary generates a target delegation key for the target authority of the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, specifically:

[0077] Substituting the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set as input parameters into a predetermined second key generation function to generate a key, thereby obtaining an initial delegation key;

[0078] The obtained initial delegation key is split into key components, and one of the key components obtained by the split is used as a target delegation key for the target authority for the target resource.

[0079] When generating a target delegation key for a target permission for a target resource, the trusted intermediary can use the target decryption key, the identity information of the first user terminal, the target identity information, and the target user attribute set as input parameters, substitute them into a predetermined second key generation function to generate a key, and obtain an initial delegation key; in order to achieve fine-grained access control, the present application can also split the obtained initial delegation key into key components, and use one of the key components obtained by the split as the target delegation key for the target permission for the target resource.

[0080] The second key generation function may also be any function having a key generation function, such as a Delegate function, which is not limited in this application.

[0081] Furthermore, the initial delegation key can be understood as an initial key string. When the initial delegation key is split, the initial delegation key can be split into multiple key components in the order of characters, and one of the key components obtained by the split (i.e., a partial string in the initial key string) is used as the target delegation key for the target authority for the target resource; in a preferred manner, the initial delegation key can be split into two key components in the order of characters, one of the key components is used as the target delegation key for the target authority for the target resource, and the other key component is stored in the target function list. At this time, the key components stored in the target function list can represent the number of accesses allowed by the first user terminal to the resource to be accessed by the second user terminal.

[0082] The first user terminal can receive the target delegation key sent by the trusted intermediary, and send the target delegation key to the second user terminal. After receiving the target delegation key, the second user terminal can respond to the access instruction for the target resource, which can be an access instruction for the target resource issued by the user of the second user terminal regarding the target permission; and, since the target resource needs to be accessed according to the access key of the access permission of the target resource, and the first user terminal encrypts the access keys of different access permissions to generate the target ciphertext of the target resource; correspondingly, the second user terminal can first decrypt the target access key regarding the target permission for the target ciphertext in the cloud server based on the target delegation key, and then, based on the target access key, perform access to the target resource contained in the target ciphertext regarding the target permission, for example: perform access to read, write and / or update permissions, and the target permission can be all permissions or partial permissions for different access permissions of the target resource, which is specifically determined by the attributes of the second user terminal.

[0083] Optionally, the second user terminal decrypts the target access key for the target permission based on the target delegation key for the target ciphertext in the cloud server, specifically:

[0084] Sending a target access request for the target resource to the trusted intermediary, so that when the trusted intermediary receives the target access request, it obtains a target user attribute set, the target delegation key sent by the first user terminal to the second user terminal, and the target ciphertext in the cloud server, and partially decrypts the target ciphertext based on the target delegation key, the target user attribute set, and the access tree structure of the access control policy for each access right of the target resource to obtain the partially decrypted target ciphertext; and feeds back the partially decrypted target ciphertext to the second user terminal;

[0085] Based on the target delegation key, the partially decrypted target ciphertext is decrypted to obtain a target access key related to the target authority.

[0086] When the second user terminal decrypts the target access key for the target authority, it can also partially decrypt the target ciphertext with the help of a trusted intermediary, and then the second user terminal continues to decrypt the partially decrypted target ciphertext based on the target delegation key to decrypt the target access key for the target authority, thereby reducing the decryption cost for the second user terminal and increasing the efficiency of decryption.

[0087] Specifically, the second user terminal can send a target access request for the target resource to the trusted intermediary. When receiving the target access request, the trusted intermediary obtains the target user attribute set, the target delegation key sent by the first user terminal to the second user terminal, and the target ciphertext in the cloud server, and partially decrypts the target ciphertext based on the target delegation key, the target user attribute set, and the access tree structure of the access control policy for each access permission of the target resource to obtain the partially decrypted target ciphertext, and feeds the partially decrypted target ciphertext back to the second user terminal.

[0088] Among them, the trusted intermediary partially decrypts the target ciphertext based on the target delegation key, the target user attribute set and the access tree structure of the access control policy for each access right of the target resource, which is equivalent to using the attributes of the second user terminal, the target user attribute set and the access tree structure of the access control policy for each access right of the target resource to determine the target authority of the second user terminal, and partially decrypts the target ciphertext according to the target authority and the target delegation key; and the so-called partial decryption can be any part of the decryption of the target ciphertext. Under the condition that the target ciphertext is decrypted as a whole by the trusted intermediary and the second user terminal to decrypt the target access key for the target authority, the present application does not limit the target ciphertext partially decrypted by the trusted intermediary.

[0089] In addition, the central server may also store a target function list to achieve fine-grained control of the number of accesses, wherein the central server further stores a target function list; wherein the target function list is used to record the number of accesses of the first user terminal to the resource allowed to be accessed by the second user terminal;

[0090] The first user terminal is also used for:

[0091] In response to the need to perform a key delegation on the target authority for the target resource, determine a target access count, and send the target access count to the trusted intermediary; wherein the target access count is used to represent the number of times the second user terminal is allowed to access the target resource according to the target authority;

[0092] The trusted intermediary is further used to receive the target access count and update the target access count to the target function list in the central server;

[0093] The trusted intermediary is further used to identify whether the current remaining number of accesses of the second user terminal is zero based on the number of times represented by the target access times recorded in the target function list in the central server before obtaining the target user attribute set, the target delegation key sent by the first user terminal to the second user terminal, and the target ciphertext in the cloud server, and if not zero, execute the steps of obtaining the target user attribute set, the target delegation key sent by the first user terminal to the second user terminal, and the target ciphertext in the cloud server;

[0094] The trusted intermediary is further configured to update the number of target access times recorded in the target function list in the central server after feeding back the partially decrypted target ciphertext to the second user terminal.

[0095] The first user terminal can also determine the target access number that the second user terminal is allowed to access the target resource in accordance with the target authority in response to the key delegation regarding the target authority for the target resource, and send the target access number (i.e., the other key component of the initial delegation key stored in the target function list mentioned above) to the trusted intermediary; the number can be directly set to a default value, such as 3 times, or flexibly adjusted as needed; the trusted intermediary can receive the target access number and update the target access number to the target function list of the central server.

[0096] Before obtaining the target user attribute set, the target delegation key sent from the first user terminal to the second user terminal, and the target ciphertext in the cloud server, the trusted intermediary can first identify whether the current remaining access times of the second user terminal are zero based on the times represented by the target access times recorded in the target function list in the central server. If not, the trusted intermediary will obtain the target user attribute set, the target delegation key sent from the first user terminal to the second user terminal, and the target ciphertext in the cloud server. In this way, although the second user terminal has access rights, when the remaining access times are zero, it still cannot access the target resource, avoiding the execution of useless and redundant steps, thereby reducing the waste of resources.

[0097] Furthermore, after the trusted intermediary feeds back the partially decrypted target ciphertext to the second user terminal, the second user terminal is equivalent to using one access count, and the trusted intermediary can update the number of times represented by the target access count recorded in the target function list in the central server, or, after the second user terminal accesses the target resource contained in the target ciphertext regarding the target authority, the trusted intermediary can update the number of times represented by the target access count recorded in the target function list in the central server; for example: the number of times represented by the target access count recorded in the target function list is reduced by one to ensure that the number of times represented by the target access count recorded in the target function list is real-time and accurate.

[0098] In addition, the central server may also store a target revocation list of user terminals whose delegated qualifications for various access rights have been revoked. The trusted intermediary identifies whether the current remaining number of accesses of the second user terminal is zero based on the number of times represented by the target access times recorded in the target function list in the central server, and is further used to:

[0099] Detecting whether the second user terminal is recorded in a target revocation list; wherein the target revocation list is used to record user terminals whose trusteeship is revoked, and the trusteeship is a trusteeship for various access rights;

[0100] When it is detected that there is no record of the second user terminal's delegation qualification for the target authority to the target resource being revoked, it is identified whether the current remaining number of accesses of the second user terminal is zero based on the number of target accesses recorded in the target function list in the central server.

[0101] The trusted intermediary accesses the target function list of the central server and identifies whether the current remaining access count of the second user terminal is zero before it can detect whether the second user terminal is recorded in the target revocation list. If the second user terminal is recorded in the target revocation list, it means that the second user terminal's delegation qualification for various access rights to the target resource has been revoked by the first user terminal, that is, the second user terminal currently does not have various access rights to the target resource, and there is no need to identify whether the current remaining access count of the second user terminal is zero; in the case where it is detected that there is no record of the second user terminal's delegation qualification for the target authority of the target resource being revoked, it can be identified whether the current remaining access count of the second user terminal is zero based on the number of times represented by the target access count recorded in the target function list in the central server; in the case where the second user terminal's delegation qualification for the target authority of the target resource is revoked, the second user terminal cannot access the target resource, and there is no need to identify the current remaining access count of the second user terminal, thereby avoiding the execution of useless and redundant steps to reduce waste of resources.

[0102] In the technical solution of the present application, the acquisition, storage, use, processing, transmission, provision and disclosure of user attribute sets, identity information, various keys, key arrays, access tree structures, ciphertexts, etc. are all carried out with the user's authorization.

[0103] The access system for implementing fine-grained access and key delegation based on CP-ABE provided by the embodiment of the present application includes: a central server, a cloud server, a trusted intermediary, a first user terminal as a resource entrusting party, and a second user terminal as a trustee; the central server generates a target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal, as well as public parameters and a master key, and sends it to the first user terminal; and records the information of the user terminal corresponding to the first user terminal and allowed to be delegated when performing key delegation in the target tracking list. The first user terminal can receive the target decryption key and determine the access keys for different access rights of the target resource in order to perform fine-grained access control. For security reasons, the access keys for each access right can be encrypted to obtain a key array, and the target ciphertext of the target resource is generated according to the key array, public parameters, and an access tree structure representing the access control policy for each access right of the target resource, and reported to the cloud server for storage; when the target resource needs to be delegated to the key of the target right, the target identity information of the second user terminal, the target user attribute set with the target right, and the target decryption key can be sent to the trusted intermediary. The trusted intermediary can receive the target identity information, target decryption key and target user attribute set sent by the first user terminal, and based on the target identity information, access the target tracking list of the central server to obtain the result of whether the second user terminal is allowed to delegate. If allowed, a target delegation key for the target authority of the target resource is generated according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, and the target delegation key is sent to the first user terminal. The first user terminal can receive the target delegation key and send the target delegation key to the second user terminal. The second user terminal receives the target delegation key, responds to the access instruction for the target resource, decrypts the target ciphertext in the cloud server based on the target delegation key, obtains the target access key for the target authority, and accesses the target resource contained in the target ciphertext based on the target access key.In the present application, based on CP-ABE, attributes are used to specify the permissions that users have, and the first user terminal, which is the resource delegator, formulates an access control policy and controls the second user terminal that can decrypt the target ciphertext according to its access tree structure; through information interaction among the central server, the cloud server, the trusted intermediary, the first user terminal and the second user terminal, the first user terminal can determine the access keys for different access permissions of the target resource, that is, encrypt multiple fine-grained access permissions, and the second user terminal can decrypt the target access key of the target permission possessed by the attributes of the second user terminal, and access the target permission to the target resource; therefore, the present application can perform fine-grained delegation for different access permissions through the access keys for different access permissions, so that the second user terminal can only access the target permission for the target resource, rather than all permissions, and thus, the present application can meet fine-grained access control.

[0104] In conjunction with a specific embodiment, an access system for implementing fine-grained access and key delegation based on CP-ABE provided by the present application is introduced in detail below.

[0105] An access system based on CP-ABE to implement fine-grained access and key delegation, such as Figure 3 As shown, the system includes: a central server, a cloud server, a trusted intermediary, a data owner (first user end), and a data user (second user end); the central server is responsible for the registration and information management of users and IoT devices (each user end, including the data owner and the data user); the data owner is responsible for encrypting the target resources and entrusting the key; the data user obtains the access key and decrypts the encrypted target resources; the trusted intermediary is responsible for preventing unauthorized decryption and tracing; the cloud server is used for data storage. The system composition is as follows:

[0106] The main modules and functions of the central server are as follows:

[0107] User information management module: reviews user registration requests and manages user identity and attribute information.

[0108] System parameter generation module: generates system public parameters and is responsible for distributing decryption keys to data users.

[0109] Tracking list and function list management module: responsible for the management of the tracking list TL (target tracking list) and the function list CL (target function list). The tracking list stores the information related to each user's delegated authority, and the function list stores the number of accesses to each user's delegated authority. The tracking list and function list are accessible to trusted intermediaries.

[0110] Data Owner:

[0111] Upload ciphertext function: The data owner generates data content and uploads the generated ciphertext embedded with a single access policy to the central server to record the data owner's delegated authority related information in the tracking list.

[0112] Key delegation function: The data owner generates access keys for different access permissions to the target resources and encrypts each access key. In addition, the target permissions of the target resources can be delegated to the data user so that the data user can access the target resources according to the target permissions. When delegating, the data owner obtains the user information of the data user and feeds it back to the trusted intermediary for verification.

[0113] Data owners can upload data to the cloud server, for example, uploading target resources to the cloud server for data users to access.

[0114] Data User:

[0115] Key acquisition function: If the data user's attributes meet the data owner's access policy for the target resource, the data user can obtain the access key for the target resource uploaded by the data owner to the central server.

[0116] Data access function: If the data user is a delegate (the attributes may or may not meet the data owner's access policy for the target resource, and the data user delegates the access rights of the target resource to the data user), then the data user can only access the delegated content delegated by the data owner, and the specific number of times is limited, which is specified by the principal (data owner). In the access process, the trusted intermediary verifies the user information of the data user fed back by the data owner from the tracking list function list management module of the central server, and after verification, sends the key and partially decrypted ciphertext to the data user (the key is the delegation key, and the delegation key can also be sent to the data owner first, and then sent to the data user by the data owner). The data user obtains the key from the trusted intermediary, further decrypts the partially decrypted ciphertext, obtains the access key, and uses the access key to access the target resource according to the target authority.

[0117] Trusted intermediary:

[0118] Key delegation check function: Serves as a checkpoint for controlled key delegation and is also responsible for preventing unauthorized decryption.

[0119] Traceability: Prevent unauthorized key authorization and track the authorizer.

[0120] Cloud Server:

[0121] Storage function: Cloud servers can be understood as devices with unlimited storage capacity. Data owners upload encrypted target resources to cloud servers for data users to obtain and access.

[0122] An access system interaction based on CP-ABE to achieve fine-grained access and key delegation includes the following processes: 1) system initialization; 2) user registration; 3) data upload; 4) key delegation; 5) data access and verification; Figure 2 As shown, in the access system for implementing fine-grained access and key delegation based on CP-ABE, the interactions among the cloud server, the central server, the first user terminal, the trusted intermediary, and the second user terminal are as follows:

[0123] 1) System initialization

[0124] In the system initialization phase, the central server runs Setup to initialize system parameters, including public parameters and master keys. Function lists and tracking lists are also generated in this phase. Specifically, Setup(U) → (PP, MSK): Input the set of attribute domain U (the attribute set of all users), and the algorithm outputs public parameters PP and master key MSK.

[0125] 2) User Registration

[0126] KeyGen(PP,MSK,S,I i ) → ((SK S ) = {(SK S,Ii,1 ),( SK S,Ii,2 )}), in the user registration stage, for each user, the central server can i And user attribute set S), as well as public parameters PP and master key MSK, use the KeyGen function to generate the user's decryption key SK S , and a decryption key component SK S,Ii,2 Send to user i, another decryption key component SK S,Ii,1 The first user terminal stores the user i in the tracking list TL to record the entrustment relationship of the user i. i , S is sent to the central server, the central server generates a decryption key for the first user terminal, and a decryption key component SK S,Ii,2 and the public parameter PP are sent to the first user terminal, and the target tracking list TL of the central server is associated with the cloud server, and the central server updates TL to store SK S,Ii,1 The central server can also send the public parameter PP to the trusted intermediary (the public parameter PP can also be used in the subsequent trusted intermediary's key delegation and data access and verification processes).

[0127] 3) Data upload

[0128] The data owner encrypts different access keys for read, write, and update operations on the target resource to obtain a key array, and generates a target ciphertext CT (which can be understood as containing the target resource), and stores CT on the cloud server. Specifically, through the Encrypt function, the key array KEY, the access tree structure A, the public parameter PP, and the target resource M are input, and the target ciphertext CT is generated, that is, Encrypt(KEY,A,PP,M) → CT. Among them, for the first user end, the first user end uses the public parameter PP, the key array KEY, the access tree structure A, and the target resource M sent by the central server to generate the target ciphertext CT, and sends the target ciphertext to the cloud server for storage.

[0129] 4) Key delegation

[0130] When user i needs to delegate part of his access rights to another user j, the trusted intermediary i , user j's identity information I j , user j's attribute set S' and user i's decryption key SK S,Ii,2 (decryption key component sent by the central server to user i), using the Delegate function, generate the delegation key, namely Delegate(I i ,SK S,Ii,2 ,S',I j ) → (SK S,Ij,2 ,S S→S’ ), the function outputs two parts, one part of the key (i.e., the target delegation key) SK S,Ij,2 Send it to user j and convert the key (which can be understood as a string representing the number of delegated accesses) S S→S’ The trusted intermediary verifies whether user i is allowed to further delegate (i.e., whether user i is allowed to delegate access rights to user j) based on the access TL. If allowed, the trusted intermediary updates TL and CL based on the conversion key. j , and I i (identity information of the first user), I j (identity information of the second user) is uploaded to the trusted intermediary, and the second user uploads S' (the attribute set of the second user) and m (the target resource that the second user can access according to the target authority) to the trusted intermediary; the trusted intermediary verifies the second user from the central server and updates TL and CL (i.e., the trusted intermediary verifies the second user based on I j Access the I in the central server iThe corresponding target tracking list verifies whether the second user terminal allows to be delegated. If it is allowed, the first user terminal is informed and the trusted intermediary generates the delegation key SK S,Ij,2 And send it to the first user end, the first user end then converts SK S,Ij,2 Sent to the second user terminal; the first user terminal counts the conversion key S S→S’ , S S→S’ Sent to the trusted intermediary, the trusted intermediary updates the delegation relationship of TL and the number of delegations of CL; of course, the conversion key S S→S’ It can also be generated by a trusted intermediary while generating the delegation key, without limitation).

[0131] 5) Data access and verification

[0132] When user j decrypts the access key, the trusted intermediary partially decrypts CT and sends the partially decrypted intermediate ciphertext CT' to user j; specifically, the TM_Decrypt function is used to obtain the target ciphertext CT, the attribute set S' of user j, and the delegation key SK. S,Ij,2 , the target resource m that user j can access according to the target permission (M can be understood as all target resources that can be accessed according to all permissions), and the access policy Access_Mode for the target resource of user i (which can represent the target user attribute set with target permissions) are taken as input, and the intermediate ciphertext CT' is obtained by partially decrypting CT, that is, TM_Decrypt (CT, S', SK S,Ij,1 ,m,Access_Mode) → CT'; then, user j uses SK S,Ij,2 Further decrypt CT' to obtain different access keys of m (that is, the access keys of the target permissions. If the target permissions are multiple permissions, each permission corresponds to an access key). That is, user j uses the Decrypt function to use SK S,Ij,2 Further decrypt CT', Decrypt(CT',SK S,Ii,2 ) →key, and use the access key key to access the target resource m according to the target permission. For the second user end, when decrypting the access key, the trusted intermediary first obtains the target ciphertext containing different access keys of the target resource from the cloud server, and partially decrypts the target ciphertext to obtain the intermediate ciphertext CT', and then sends CT' to the second user end. The second user end decrypts the ciphertext based on the SK sent by the first user end. S,Ij,2 Continue to decrypt the intermediate ciphertext CT' to obtain the access key of the target permission, and use the access key to access the target resource m according to the target permission.

[0133] The user registration process is as follows: Figure 4 As shown, the specific steps are as follows:

[0134] First, for each user i, the user sends his identity (I j ) and attribute set (S) are sent to the central server, and the central server generates a key (SK S ), is divided into two components, namely SK S = (SK S,Ii,1 ), (SK S,Ii,2 ), the central server will (SK S,Ii,1 ) is stored in TL, and the central server stores (SK S,Ii,2 ) is sent to user i.

[0135] The key delegation process is as follows: Figure 5 As shown, the specific steps are as follows:

[0136] When user i needs to delegate part of his access rights to another data user j, he obtains the identity I of user j j The trusted intermediary accesses TL and checks whether further delegation authorization is allowed (i.e., checks whether user j is delegated by user i), and identifies whether the detection is passed. If not, that is, the detection fails and delegation is not allowed, then the process ends directly. If yes, that is, the detection passes and delegation is allowed, then a part of the decryption key is generated and sent to user i, i.e., the delegation key SK is generated. S,Ij,2 and sent to user i; user i sends part of the decryption key to user j and counts the conversion key (S S→S’ ) further records the number of delegations (i.e., the number of delegations is recorded through the conversion key), and user i sends the conversion key to the trusted intermediary. Then, the trusted intermediary updates TL and CL according to the conversion key.

[0137] The data access and verification process is as follows: Figure 6 As shown, the specific steps are as follows:

[0138] In order to decrypt the ciphertext CT, user (j) sends the attribute set (S') and the content m he wants to access to the trusted intermediary; the trusted intermediary checks whether the user is in the revocation list and identifies whether the detection is passed. If it is, that is, the delegation authority of user j is revoked, then the process ends directly; if it is not, that is, user j currently has delegation authority, the trusted intermediary updates the information in CL to request the user's count +1, that is, the user's access times +1, and the remaining access times -1; the trusted intermediary partially decrypts CT and sends the intermediate ciphertext CT' to user j; user (j) decrypts CT' to obtain different access keys for m, and finally uses this key to access the content m, that is, user j uses the delegation key SK S,Ij,2 Further decrypt CT' to obtain the access key of m with respect to the target permission, and use the access key to access m according to the target permission.

[0139] The solution proposed in this application is an access system for implementing fine-grained access and key delegation based on CP-ABE. The solution effectively shares access keys of different access rights associated with target resources, provides specific content delegation, specific access rights delegation and limited access to the delegated content; and also provides identity-based delegator / user revocation. Through this solution, users can grant access rights to other users or entities according to actual needs. In addition, due to the flexibility of the key delegation system, users can dynamically adjust access rights as needed. This solution is more efficient than existing solutions and has lower encryption and decryption costs. It is particularly suitable for providing an efficient, flexible and secure access control solution for large-scale data sharing environments based on cloud computing platforms. In addition, this application can achieve fully flexible key delegation with finer-grained access control by setting up trusted intermediaries, tracking lists and function lists, reducing the performance consumption caused by frequent counting during the key delegation process and reducing the resources required for storage. The trusted intermediary first decrypts part of the ciphertext, reducing the decryption cost of data users.

[0140] Based on the above system embodiment, the present application also provides an access method for implementing fine-grained access and key delegation based on CP-ABE, which is applied to a first user terminal as a resource delegating party; Figure 7 As shown, the method includes:

[0141] S701: Receive the target decryption key; determine each access key for different access rights of the target resource; encrypt the access key for each access right to obtain a key array; generate a target ciphertext of the target resource according to the key array, public parameters, and an access tree structure for characterizing the access control policy for each access right of the target resource, and report the target ciphertext to the cloud server so that the cloud server stores the target ciphertext;

[0142] The target decryption key is a target decryption key required by the first user terminal, generated by the central server according to the user attribute set and identity information of the first user terminal and the system initialization parameters; the central server also records the delegation relationship information corresponding to the first user terminal in the target tracking list; the delegation relationship information is used to characterize the information of the user terminal to which the first user terminal is allowed to delegate when performing key delegation; the system initialization parameters include public parameters and master keys;

[0143] S702: In response to the need to perform key delegation on the target authority for the target resource, the target identity information of the second user terminal as the trustee, the target user attribute set with the target authority, and the target decryption key are sent to the trusted intermediary, so that the trusted intermediary receives the target identity information, the target decryption key, and the target user attribute set, and based on the target identity information, accesses the target tracking list in the central server to obtain the result of whether the second user terminal is allowed to be delegated, and if allowed, generates a target delegation key for the target authority of the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information, and the target user attribute set, and sends the target delegation key to the first user terminal;

[0144] S703: Send the target delegation key to the second user terminal; so that the second user terminal receives the target delegation key; and in response to the access instruction for the target resource, based on the target delegation key, decrypt the target access key regarding the target permission for the target ciphertext in the cloud server, and based on the target access key, access the target resource contained in the target ciphertext regarding the target permission.

[0145] The access method for implementing fine-grained access and key delegation based on CP-ABE provided in the embodiment of the present application is applied to the first user terminal as the resource delegating party. The central server generates the target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal, as well as the public parameters and the master key, and sends it to the first user terminal; and records the information of the user terminal corresponding to the first user terminal and allowed to be delegated to when performing key delegation in the target tracking list. The present application can receive a target decryption key and determine each access key for different access rights to a target resource so as to perform fine-grained access control. For security reasons, the access key for each access right can be encrypted to obtain a key array, and based on the key array, public parameters, and an access tree structure representing the access control policy for each access right of the target resource, a target ciphertext of the target resource is generated and reported to a cloud server for storage. When a key delegation regarding target rights is required for a target resource, the target identity information of the second user terminal, a target user attribute set with target rights, and a target decryption key can be sent to a trusted intermediary. The trusted intermediary receives the target identity information, target decryption key, and target user attribute set sent by the first user terminal, and based on the target identity information, accesses the target tracking list of the central server to obtain a result of whether the second user terminal is allowed to be delegated. If allowed, a target delegation key for the target right of the target resource is generated based on the target decryption key, the identity information of the first user terminal, the target identity information, and the target user attribute set, and the target delegation key is sent to the first user terminal. The present application can receive a target delegation key and send the target delegation key to a second user terminal, so that the second user terminal receives the target delegation key, responds to the access instruction for the target resource, decrypts the target ciphertext in the cloud server based on the target delegation key, obtains the target access key for the target permission, and performs access to the target resource contained in the target ciphertext based on the target access key. In the present application, based on CP-ABE, the user's permissions are specified using attributes, and the first user terminal as the resource entrusting party formulates an access control policy, and controls the second user terminal that can decrypt the target ciphertext according to its access tree structure; the first user terminal can encrypt multiple fine-grained access permissions for each access key of the target resource, that is, multiple fine-grained access permissions, and the second user terminal can decrypt the target access key of the target permission of the attribute of the second user terminal, and perform access to the target permission for the target resource; therefore, the present application can perform fine-grained delegation for different access permissions through each access key of different access permissions, so that the second user terminal can only access the target permission for the target resource, rather than all permissions, so that the present application can meet fine-grained access control.

[0146] Based on the above method embodiment, the present application also provides an access device for implementing fine-grained access and key delegation based on CP-ABE, which is applied to a first user terminal as a resource delegating party; Figure 8 As shown, the device comprises:

[0147] A generation module 810 is used to receive the target decryption key; determine each access key for different access rights of the target resource; encrypt the access key for each access right to obtain a key array; generate a target ciphertext of the target resource according to the key array, public parameters and an access tree structure used to characterize the access control policy for each access right of the target resource, and report the target ciphertext to the cloud server so that the cloud server stores the target ciphertext; wherein the target decryption key is the target decryption key required by the first user terminal generated by the central server according to the user attribute set and identity information of the first user terminal and the system initialization parameters; the central server also records the delegation relationship information corresponding to the first user terminal in the target tracking list; the delegation relationship information is used to characterize the information of the user terminal to which the first user terminal is allowed to delegate when performing key delegation; the system initialization parameters include public parameters and a master key;

[0148] The first sending module 820 is used for sending the target identity information of the second user terminal as the trustee, the target user attribute set with the target authority, and the target decryption key to the trusted intermediary in response to the need to perform key delegation on the target authority for the target resource, so that the trusted intermediary receives the target identity information, the target decryption key, and the target user attribute set, and based on the target identity information, accesses the target tracking list in the central server to obtain the result of whether the second user terminal is allowed to be delegated, and if allowed, generates a target delegation key for the target authority of the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information, and the target user attribute set, and sends the target delegation key to the first user terminal;

[0149] The second sending module 830 is used to send the target delegation key to the second user terminal; so that the second user terminal receives the target delegation key; and in response to the access instruction for the target resource, based on the target delegation key, decrypt the target access key regarding the target permission for the target ciphertext in the cloud server, and based on the target access key, access the target resource contained in the target ciphertext regarding the target permission.

[0150] The access device for implementing fine-grained access and key delegation based on CP-ABE provided in the embodiment of the present application is applied to the first user terminal as the resource delegating party. The central server generates the target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal, as well as the public parameters and the master key, and sends it to the first user terminal; and records the information of the user terminal corresponding to the first user terminal and allowed to be delegated to when performing key delegation in the target tracking list. The present application can receive a target decryption key and determine each access key for different access rights to a target resource so as to perform fine-grained access control. For security reasons, the access key for each access right can be encrypted to obtain a key array, and based on the key array, public parameters, and an access tree structure representing the access control policy for each access right of the target resource, a target ciphertext of the target resource is generated and reported to a cloud server for storage. When a key delegation regarding target rights is required for a target resource, the target identity information of the second user terminal, a target user attribute set with target rights, and a target decryption key can be sent to a trusted intermediary. The trusted intermediary receives the target identity information, target decryption key, and target user attribute set sent by the first user terminal, and based on the target identity information, accesses the target tracking list of the central server to obtain a result of whether the second user terminal is allowed to be delegated. If allowed, a target delegation key for the target right of the target resource is generated based on the target decryption key, the identity information of the first user terminal, the target identity information, and the target user attribute set, and the target delegation key is sent to the first user terminal. The present application can receive a target delegation key and send the target delegation key to a second user terminal, so that the second user terminal receives the target delegation key, responds to the access instruction for the target resource, decrypts the target ciphertext in the cloud server based on the target delegation key, obtains the target access key for the target permission, and performs access to the target resource contained in the target ciphertext based on the target access key. In the present application, based on CP-ABE, the user's permissions are specified using attributes, and the first user terminal as the resource entrusting party formulates an access control policy, and controls the second user terminal that can decrypt the target ciphertext according to its access tree structure; the first user terminal can encrypt multiple fine-grained access permissions for each access key of the target resource, that is, multiple fine-grained access permissions, and the second user terminal can decrypt the target access key of the target permission of the attribute of the second user terminal, and perform access to the target permission for the target resource; therefore, the present application can perform fine-grained delegation for different access permissions through each access key of different access permissions, so that the second user terminal can only access the target permission for the target resource, rather than all permissions, so that the present application can meet fine-grained access control.

[0151] The present application also provides an electronic device, such as Fig. 9 As shown, including:

[0152] Memory 901, used for storing computer programs;

[0153] The processor 902 is used to implement an access method for fine-grained access and key delegation based on CP-ABE when executing a program stored in the memory 901.

[0154] Furthermore, the electronic device may further include a communication bus and / or a communication interface, and the processor 902, the communication interface, and the memory 901 communicate with each other via the communication bus.

[0155] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0156] The communication interface is used for communication between the above electronic device and other devices.

[0157] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0158] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0159] In another embodiment provided in the present application, a computer-readable storage medium is also provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned access methods for implementing fine-grained access and key delegation based on CP-ABE are implemented.

[0160] In another embodiment provided by the present application, a computer program product including instructions is also provided. When the computer is executed on the computer, the computer executes any of the access methods for implementing fine-grained access and key delegation based on CP-ABE in the above embodiments.

[0161] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a solid-state hard disk (SSD), etc.

[0162] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0163] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the method and device embodiments, since they are basically similar to the system embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the system embodiment.

[0164] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. An access system for implementing fine-grained access and key delegation based on CP-ABE, characterized in that: It includes: a central server, a cloud server, a trusted intermediary, a first user terminal as a resource entrustor, and a second user terminal as a trustee; The central server is used to generate a target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal and the system initialization parameters, and send it to the first user terminal; and record the delegation relationship information corresponding to the first user terminal in the target tracking list; wherein the delegation relationship information is used to represent the information of the user terminal to which the first user terminal is allowed to delegate when performing key delegation; the system initialization parameters include public parameters and a master key; The first user terminal is used to receive the target decryption key; determine each access key for different access rights to the target resource; encrypt the access key for each access right to obtain a key array; generate a target ciphertext for the target resource based on the key array, public parameters, and an access tree structure for characterizing the access control policy for each access right of the target resource, and report the target ciphertext to the cloud server so that the cloud server stores the target ciphertext; in response to the need to delegate the key for the target right for the target resource, send the target identity information of the second user terminal, the target user attribute set with the target right, and the target decryption key to the trusted intermediary; The trusted intermediary is used to receive the target identity information, the target decryption key and the target user attribute set, access the target tracking list in the central server based on the target identity information, obtain the result of whether the second user terminal is allowed to be delegated, and if allowed, generate a target delegation key for the target authority of the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, and send the target delegation key to the first user terminal; The first user terminal is further used to send the target delegation key to the second user terminal; The second user terminal is used to receive the target delegation key; and in response to an access instruction to the target resource, decrypt the target access key regarding the target permission for the target ciphertext in the cloud server based on the target delegation key, and access the target resource contained in the target ciphertext regarding the target permission based on the target access key.

2. The system according to claim 1, characterized in that The second user terminal decrypts the target access key for the target permission based on the target delegation key for the target ciphertext in the cloud server, specifically: Sending a target access request for the target resource to the trusted intermediary, so that when the trusted intermediary receives the target access request, it obtains a target user attribute set, the target delegation key sent by the first user terminal to the second user terminal, and a target ciphertext in the cloud server, and partially decrypts the target ciphertext based on the target delegation key, the target user attribute set, and an access tree structure of an access control policy for each access right of the target resource to obtain a partially decrypted target ciphertext; and feeding back the partially decrypted target ciphertext obtained to the second user terminal; Based on the target delegation key, the partially decrypted target ciphertext is decrypted to obtain a target access key related to the target authority.

3. The system according to claim 2, characterized in that The central server also stores a target function list; wherein the target function list is used to record the number of times the first user terminal accesses resources allowed to be accessed by the second user terminal; The first user terminal is also used for: In response to the need to perform a key delegation on the target authority for the target resource, determine a target access count, and send the target access count to the trusted intermediary; wherein the target access count is used to represent the number of times the second user terminal is allowed to access the target resource according to the target authority; The trusted intermediary is further used to receive the target access count and update the target access count to the target function list in the central server; The trusted intermediary is further used to identify whether the current remaining number of accesses of the second user terminal is zero based on the number of times represented by the target access times recorded in the target function list in the central server before obtaining the target user attribute set, the target delegation key sent by the first user terminal to the second user terminal, and the target ciphertext in the cloud server, and if not zero, execute the steps of obtaining the target user attribute set, the target delegation key sent by the first user terminal to the second user terminal, and the target ciphertext in the cloud server; The trusted intermediary is further configured to update the number of target access times recorded in the target function list in the central server after feeding back the partially decrypted target ciphertext to the second user terminal.

4. The system according to claim 3, characterized in that The trusted intermediary is further used to: before identifying whether the current remaining number of accesses of the second client is zero based on the number of times represented by the target access times recorded in the target function list in the central server: Detecting whether the second user terminal is recorded in a target revocation list; wherein the target revocation list is used to record user terminals whose entrustment qualifications are revoked, and the entrustment qualifications are entrustment qualifications for various access rights; When it is detected that there is no record of the second user terminal's delegation qualification for the target authority to the target resource being revoked, it is identified whether the current remaining number of accesses of the second user terminal is zero based on the number of target accesses recorded in the target function list in the central server.

5. The system according to claim 1, characterized in that The central server generates a target decryption key required by the first user terminal according to the user attribute set and identity information of the first user terminal and the system initialization parameters, specifically: Substituting the user attribute set and identity information of the first user terminal and the system initialization parameter as input parameters into a predetermined first key generation function to generate a key and obtain an initial decryption key; The obtained initial decryption key is split into key components, and one of the key components obtained by the split is used as the target decryption key required by the first user terminal.

6. The system according to claim 1, characterized in that The trusted intermediary generates a target delegation key for the target authority of the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, specifically: Substituting the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set as input parameters into a predetermined second key generation function to generate a key, thereby obtaining an initial delegation key; The obtained initial delegation key is split into key components, and one of the key components obtained by the split is used as a target delegation key for the target authority for the target resource.

7. An access method for implementing fine-grained access and key delegation based on CP-ABE, characterized in that: The method is applied to a first user terminal as a resource entrusting party; the first user terminal belongs to an access system for implementing fine-grained access and key entrustment based on CP-ABE, and the access system for implementing fine-grained access and key entrustment based on CP-ABE also includes: a central server, a cloud server, a trusted intermediary, and a second user terminal as a trustee; the method includes: Receive a target decryption key; determine each access key for different access rights to a target resource; encrypt the access key for each access right to obtain a key array; generate a target ciphertext for the target resource based on the key array, public parameters, and an access tree structure used to characterize the access control policy for each access right of the target resource, and report the target ciphertext to the cloud server so that the cloud server stores the target ciphertext; wherein the target decryption key is a target decryption key required by the first user terminal generated by the central server based on the user attribute set and identity information of the first user terminal, as well as system initialization parameters; the central server also records the delegation relationship information corresponding to the first user terminal in a target tracking list; the delegation relationship information is used to characterize the information of the user terminal to which the first user terminal is allowed to delegate when performing key delegation; the system initialization parameters include public parameters and a master key; In response to the need to delegate the key regarding the target authority for the target resource, the target identity information of the second user terminal as the trustee, the target user attribute set with the target authority, and the target decryption key are sent to the trusted intermediary, so that the trusted intermediary receives the target identity information, the target decryption key, and the target user attribute set, and based on the target identity information, accesses the target tracking list in the central server to obtain the result of whether the second user terminal is allowed to be delegated, and if allowed, generates a target delegation key for the target authority for the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information, and the target user attribute set, and sends the target delegation key to the first user terminal; The target delegation key is sent to the second user terminal; so that the second user terminal receives the target delegation key; and in response to the access instruction for the target resource, based on the target delegation key, the target access key regarding the target permission is decrypted for the target ciphertext in the cloud server, and based on the target access key, the target resource contained in the target ciphertext is accessed regarding the target permission.

8. An access device for implementing fine-grained access and key delegation based on CP-ABE, characterized in that: The device is applied to a first user terminal as a resource entrusting party; the first user terminal belongs to an access system for implementing fine-grained access and key entrustment based on CP-ABE, and the access system for implementing fine-grained access and key entrustment based on CP-ABE also includes: a central server, a cloud server, a trusted intermediary, and a second user terminal as a trustee; the device includes: A generation module, used to receive a target decryption key; determine each access key for different access rights to a target resource; encrypt the access key for each access right to obtain a key array; generate a target ciphertext for the target resource based on the key array, public parameters, and an access tree structure used to characterize the access control policy for each access right of the target resource, and report the target ciphertext to the cloud server so that the cloud server stores the target ciphertext; wherein the target decryption key is a target decryption key required by the first user terminal generated by the central server based on the user attribute set and identity information of the first user terminal, as well as system initialization parameters; the central server also records the delegation relationship information corresponding to the first user terminal in a target tracking list; the delegation relationship information is used to characterize the information of the user terminal to which the first user terminal is allowed to delegate when performing key delegation; the system initialization parameters include public parameters and a master key; A first sending module is used for sending the target identity information of the second user terminal as the trustee, the target user attribute set with the target authority and the target decryption key to the trusted intermediary in response to the need to perform key delegation on the target authority for the target resource, so that the trusted intermediary receives the target identity information, the target decryption key and the target user attribute set, accesses the target tracking list in the central server based on the target identity information, obtains the result of whether the second user terminal is allowed to be delegated, and if allowed, generates a target delegation key for the target authority for the target resource according to the target decryption key, the identity information of the first user terminal, the target identity information and the target user attribute set, and sends the target delegation key to the first user terminal; The second sending module is used to send the target delegation key to the second user terminal; so that the second user terminal receives the target delegation key; and in response to the access instruction for the target resource, based on the target delegation key, for the target ciphertext in the cloud server, decrypt the target access key regarding the target permission, and based on the target access key, access the target resource contained in the target ciphertext regarding the target permission.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; The processor is used to implement the method described in claim 7 when executing the program stored in the memory.

10. A computer program product comprising instructions, characterized in that When the method is run on a computer, the computer is caused to execute the method according to claim 7 .

Images