Identity-based encryption method for revocable user

Abstract

The invention provides an identity-based encryption method of a revocable user, belongs to the technical field of cryptography, and solves the technical problem of high key updating overhead when the user is revoked in identity-based encryption. According to the technical scheme, the method comprises the following steps that S10, a system is initialized; s20, generating a user private key; s30, generating an update private key; s40, generating a user solution key; s50, performing an encryption algorithm; s60, a decryption algorithm; and S70, cancelling the user algorithm. The method disclosed by the invention has the beneficial effect that the calculation overhead of a system administrator during key updating is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptography, and in particular to an identity-based encryption method capable of revoking a user. Background Art

[0002] In 1984, Shamir et al. proposed the concept of identity-based encryption (IBE). In 2001, Boneh et al. proposed the first practical identity-based encryption scheme. In identity-based encryption, there are two entities: system administrators and users. The system administrator generates the system master key and uses the system master key to calculate the system public key. The system administrator secretly stores the system master key and makes the system public key public. Based on the unique global identity of each user, the system administrator uses the system master key to generate a user private key for the user and sends it to the user secretly. The sender encrypts the message using the receiver's identity and the system public key, and sends the ciphertext to the receiver; the receiver can successfully decrypt the ciphertext and restore the message using his own private key. Compared with traditional public key encryption, identity-based encryption does not require a public key infrastructure, that is, users do not need to prove the validity of their public keys, which greatly improves the efficiency of encryption.

[0003] When a user's private key is stolen or expires in an IBE system, the system administrator needs a method to effectively revoke the user. To address this problem, Boneh et al. implemented user revocation by periodically updating the user's private key. In their IBE scheme [1], the ciphertext is related to the user's identity and encryption time. When a user is revoked, the system administrator generates an update key for all non-revoked users and secretly sends the update key to the non-revoked users, thereby implementing user revocation. However, the workload of updating the key is linearly related to the number of users. When the number of users is large, the work of the system administrator may become a bottleneck of the system. Summary of the invention

[0004] The purpose of the present invention is to provide an identity-based encryption method that can revoke users. In order to solve the technical problem of excessive workload of system administrators when updating keys, the subset covering technology of complete binary trees is introduced into identity-based encryption. Through reasonable design, some users can share the updated keys, thereby greatly reducing the workload of system administrators and improving the efficiency of updating keys.

[0005] The inventive concept of the present invention is as follows: in the method of the present invention, the system administrator selects the system master key, calculates and publishes the system public key, sets and publishes the user revocation list, the user list and the latest system status; the user submits the identity to the system administrator, and the system administrator constructs a complete binary tree, connects each user to a leaf node of the binary tree, and obtains the path from the leaf node to the root node. For each node in the path, the system administrator constructs a node private key, and all the node private keys in the path constitute the user private key of the user. The present invention divides all time into several time periods, for example, each day is a time period, and each time period is called a cycle. At the end of each cycle, at time t, the system administrator publishes the update key of the next cycle. The system administrator uses the revocation list to obtain the set of binary tree leaf nodes corresponding to all revoked users, and generates a covering set of leaf nodes of all unrevoked users, so that all unrevoked users have and only have one leaf node or its ancestor node in the covering set, and the leaf node corresponding to the revoked user and its ancestor node are not in the covering set. For each node in the coverage set, the system administrator generates a node update key using the system master key. All node update keys constitute the system update key. The administrator makes the system update key public. According to the construction method of the coverage set, each unrevoked user can find a node in the binary tree. The user has both the user private key and the system update key of the node. These two keys constitute the decryption key of the unrevoked user at time t. However, the revoked user cannot find a node in the binary tree, which means that the user has both the user private key and the system update key of the node and cannot generate the decryption key. The ciphertext is related to the identity and time of the recipient, which makes the revoked user unable to decrypt the ciphertext. Through the above method, the system administrator periodically updates the system update key, so that some users can share the system update key, thereby reducing the workload of the system administrator when updating the key and improving efficiency.

[0006] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is specifically: a revocable user identity-based encryption method, comprising the following steps:

[0007] S10, system initialization phase, the system administrator selects a security parameter, specifies the maximum number of users and a complete binary tree, selects the system master key MK, calculates and publishes the public parameter PK, sets and publishes the user revocation list rl, the user list UL and the latest system status st;

[0008] S20, private key generation phase, the user submits his identity to the system administrator, the system administrator assigns the user to a leaf node in the binary tree, and obtains all nodes on the path from the leaf node to the root node of the binary tree; for each node on the above path, the system administrator uses the system master key MK to calculate a node private key of the user, and all node private keys constitute the user's private key; the system administrator secretly sends the user's private key to the user and updates the state st′;

[0009] S30, key update phase, at the update system time t, the system administrator obtains the leaf node set in the binary tree corresponding to the revoked users according to the revocation list rl and the user list UL, and obtains the non-revoked user coverage set using the subset cover algorithm of the complete binary tree; for each node in the coverage set, the system administrator calculates a node private key using the system master key, and all the above node private keys constitute the system update key, and the system administrator publicly updates the key;

[0010] S40, decryption key generation stage, according to the subset cover algorithm of the complete binary tree, each unrevoked user can find two node private keys in his own private key and system update key, so that these two node private keys have a common node; the user uses these two node private keys as his own decryption key;

[0011] S50, encryption stage, user ω' uses the public parameter PK and the identity of user ω to encrypt the message m and time t to obtain the ciphertext C, and then sends the ciphertext to user ω;

[0012] S50, decryption phase, after user ω receives ciphertext C, if user ω has not been revoked at time t, he uses his decryption key at time t to obtain message m; otherwise, decryption fails;

[0013] S70, user revocation stage, if the user ω is revoked at time t, the system administrator adds the user to the user revocation list rl and updates the status ';

[0014] Furthermore, the step S10 includes:

[0015] S101. The system administrator selects a security parameter κ and sets the maximum number of users N. max , construct a complete binary tree BT with a height of h. The binary tree has 2 h-1 leaf nodes, and satisfy 2 h-1 ≥N max , for each node v∈BT in the binary tree, select a random number a v ∈Z p *, set a function f corresponding to the node v (y) = a vy+1, and each node's binary pair (v, f v (y)) is stored in a function list FL;

[0016] S102, the system administrator first generates a prime number p-order cyclic group G, G T and the bilinear map e:G×G→G T , select a generator g∈G, select four random numbers a1, a2, b1, b2∈Z p *,calculate Set both the user list UL and the revoked user list rl to empty sets.

[0017] S103. System administrators open public Revocation list rl and state st = (BT, UL), and secretly save the system master key MK = (a1, a2, b1, b2, FL);

[0018] Furthermore, the step S20 includes:

[0019] S201. Assume that the user has a globally unique identity ω∈Z p *, submit identity ω∈Z to the system administrator p *, the system administrator randomly selects an unspecified leaf node u∈BT in the binary tree BT, maps the user identity ω to the leaf node u, stores (ω.u) in the user list UL, and then updates the state st=(BT,UL);

[0020] S202, the system administrator traverses the set of all nodes on the path from the leaf node u to the root node, denoted as Path(u). For any node x∈Path(u), the system administrator retrieves the function list The function f corresponding to the middle node x x (y) = a x y+1, choose a random number r 1，x ∈Z p *, calculated using the system master key Get the user private key SKω={(x,r 1，x , D x )|x∈Path(u)}, where the user with identity ω is assigned to leaf node u, Path(u) is the set of all nodes on the path from leaf node u to the root node, and x is any node in the set Path(u);

[0021] S203, the system administrator converts the user's private key SKω={(x,r 1，x , D x )|x∈Path(u)} is secretly sent to user ω and the state st is updated;

[0022] Furthermore, the step S30 includes:

[0023] S301. In order to revoke a specified user in the system at time t, the system administrator needs to calculate the updated private key at time t for the non-revoked user; assuming that the user ω' is revoked at time t' and t'≤t, the system administrator adds (ω', t') to the user revocation list rl at time t, and obtains the leaf node set R corresponding to all revoked users in the binary tree BT according to the user list UL={(ω, v)}, and obtains the covering set CV of the non-revoked user set using the subset covering algorithm in the complete subtree scheme R , so that CV R The leaf node and its ancestor node corresponding to the revoked user are not included in CV R It only contains the leaf nodes corresponding to the unrevokated users or one of their ancestor nodes.

[0024] S302, for each node x∈CV R , the system administrator retrieves a list of functions The function f corresponding to the middle node x x (y) = a x y+1, choose a random number r 2，x ∈Z p *,calculate Get the updated private key KU t ={(x, r 2，x , E x )|x∈CV R}, where CV R is the covering set of leaf node set R corresponding to the unrevokated users at time t, and x is the covering set CV R Nodes in

[0025] S303: The system administrator publishes the updated status st and the updated private key KU t ={(x, r 2，x , E x )|x∈CV R}; Further, the step S40 includes:

[0026] S401, the user does not revoke his private key SKω={(x,r 1，x , D x )|x∈Path(u)} and the system update key KU published by the system administrator t ={(x, r 2，x , E x )|x∈CV R}, find a node x∈Path(u)∩CV in the binary tree R, take out a tuple (x, r 1，x , D x ), from the update key KU t Take out a tuple (x, r) corresponding to the node x 2，x , E x ), combine these two tuples to get the decryption key DK at time t ω，t ={x,r 1，x , D x , r 2，x , E x}, where node x is the private key SKω of the unrevokated user ω and the system updated private key KU at time t t The only identical node, user ω will use the private key SKω of node x and the system update private key KU t Construct the decryption key DK ω，t ; Otherwise, if the user is a revoked user, the decryption key at time t cannot be obtained;

[0027] Furthermore, the step S50 includes:

[0028] S501. In order to construct a secret channel from user ω' to user ω at time t, user ω' encrypts the message m using the public parameter PK and selects a random number s∈Z p *, calculate C0 = m·e(g, g) s , C1=(X1g ω ) s , C2=(Y1) s , C3=(X2g t ) s , C4=(Y2) s , get the ciphertext C = (ω, t, C0, C1, C2, C3, C4), and send this ciphertext C to user ω;

[0029] Furthermore, the step S60 includes:

[0030] S601. User ω receives the ciphertext C = (ω, t, C0, C1, C2, C3, C4). If user ω is not revoked at time t, it obtains its own decryption key DK at time t according to the time t in the ciphertext. ω，t = {r 1，x , D x , r 2，x , E x};calculate Get message m;

[0031] S602: If user ω has been revoked at time t, the ciphertext cannot be decrypted and message m cannot be obtained;

[0032] Furthermore, the step S70 includes:

[0033] S701. If the user ω is revoked at time t, the system administrator uses the user list UL={(ω,u)} to obtain the leaf node u corresponding to the revoked user ω in the binary tree, adds (u,t) to the user revocation list rl, and executes S301, S302, and S303 in sequence to complete the user revocation.

[0034] The RIBE scheme of the present invention is compared with the well-known related scheme BGK in terms of efficiency and performance. Assuming the bilinear group e:G×G→G of prime order p T In the above example, E represents the power multiplication operation in the group G, and P represents the bilinear pairing operation e:G×G→G T r represents the number of revoked users, N max represents the maximum number of users. The bilinear pairing operation P is e:G×G→G T The amount of computation is much greater than that of the power multiplication in group G.

[0035] Compared with the BGK[2] method, the encryption process of the BGK method requires 12 power multiplication operations on the elliptic curve. The encryption process of the scheme of the present invention requires 7 power multiplication operations on the elliptic curve. The decryption process of the BGK method requires 2 power multiplication operations and 4 bilinear pairing operations on the elliptic curve. The encryption process of the scheme of the present invention requires 4 power multiplication operations and 2 bilinear pairing operations on the elliptic curve, but the power multiplication operation is much faster than the bilinear pairing operation. Therefore, the encryption efficiency of the present method is much higher than that of the BGK. In addition, the key update workload of the present method is 14.3% of that of the BGK.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] (1) The present invention proposes an identity-based encryption method for revocable users, which uses a complete binary tree to greatly reduce the workload of the system administrator for key updates. When a new user is revoked within the current time period, the system administrator generates the latest user revocation list rl, and uses the user list UL and the subset cover algorithm of the complete binary tree to obtain a set of covered nodes of unrevoked users; for each node in the covered set, the updated private key corresponding to each node is calculated, and the updated private keys of all nodes constitute the system updated private key. The system administrator discloses the system updated private key. The above method can realize the sharing of updated private keys, thereby greatly reducing the workload of the system administrator when updating private keys. When the key is updated by this method, the key update workload of the system administrator is 14.3% of BGK.

[0038] (2) In the identity-based encryption method for revocable users provided by the present invention, the ciphertext is related to the user identity and the encryption time. The ciphertext is composed of the user identity, the encryption time and four bilinear group elements. Decryption only requires four exponential operations of the bilinear group and two bilinear pairing operations. Compared with the BGK scheme, the workload of the system administrator during key update is reduced without increasing the workload of user encryption and decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0040] Figure 1 The present invention provides a flowchart of a revocable user identity-based encryption method.

[0041] Figure 2 This is an example diagram of a leaf node path in a binary tree provided by the present invention and an overlay combination when a user is revoked. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. Of course, the specific embodiments described here are only used to explain the present invention and are not used to limit the present invention.

[0043] Example 1

[0044] See also Figure 1 to Figure 2 This embodiment provides a technical solution, which is a revocable user identity-based encryption method, such as Figure 1 As shown, it includes: system initialization, user private key generation, update key generation, user decryption key generation, encryption, decryption and user revocation. The system administrator selects and secretly saves the system master key, calculates and publishes the system public parameters. Generates user private keys for users, calculates and publishes system update keys. Unrevoked users use their own private keys and system update keys to construct their own decryption keys. User ω uses the system public key, user ω' identity and time t to calculate the ciphertext. After receiving the ciphertext, the unrevoked user ω' uses his own decryption key to decrypt the ciphertext and obtain the message. Finally, the system administrator generates the system update key for the next period according to the latest user revocation list to realize user revocation.

[0045] This embodiment provides an identity-based encryption method for revocable users, which specifically includes the following steps:

[0046] S10, system initialization phase, the system administrator selects a security parameter, specifies the maximum number of users and a complete binary tree, selects the system master key MK, calculates and publishes the public parameter PK, sets and publishes the user revocation list rl, the user list UL and the latest system status st;

[0047] S20, private key generation phase, the user submits his identity to the system administrator, the system administrator assigns the user to a leaf node in the binary tree, and obtains all nodes on the path from the leaf node to the root node of the binary tree; for each node on the above path, the system administrator uses the system master key MK to calculate a node private key of the user, and all node private keys constitute the user's private key; the system administrator secretly sends the user's private key to the user and updates the state st′;

[0048] S30, key update phase, at the update system time t, the system administrator obtains the leaf node set in the binary tree corresponding to the revoked users according to the revocation list rl and the user list UL, and obtains the non-revoked user coverage set using the subset cover algorithm of the complete binary tree; for each node in the coverage set, the system administrator calculates a node private key using his own private key, and all the above node private keys constitute the system update key, and the system administrator publicly updates the key;

[0049] S40, decryption key generation stage, according to the subset cover algorithm of the complete binary tree, each unrevoked user can find two node private keys in his own private key and system update key, so that these two node private keys have a common node; the user uses these two node private keys as his own decryption key;

[0050] S50, encryption stage, user ω' uses the public parameter PK and the identity of user ω to encrypt the message m and time t to obtain the ciphertext C, and then sends the ciphertext to user ω;

[0051] S50, decryption stage, after user ω receives the ciphertext C, if user ω has not been revoked at time t, he uses his decryption key at time t to obtain message m; otherwise, decryption fails;

[0052] S70, user revocation stage, if the user ω is revoked at time t, the system administrator adds the user to the user revocation list rl and updates the status ';

[0053] Furthermore, the step S10 includes:

[0054] S101. The system administrator selects a security parameter κ and sets the maximum number of users N. max , construct a complete binary tree BT with a height of h. The binary tree has 2 h-1 leaf nodes, and satisfy 2 h-1 ≥Nmax , for each node v∈BT in the binary tree, select a random number a v ∈Z p *, set a function f corresponding to the node v (y) = a v y+1, and each node's binary pair (v, f v (y)) is stored in a function list FL;

[0055] S102, the system administrator first generates a prime number p-order cyclic group G, G T and the bilinear map e:G×G→G T , select a generator g∈G, select four random numbers a1, a2, b1, b2∈Z p *,calculate Set both the user list UL and the revoked user list rl to empty sets.

[0056] S103. System administrators open public Revocation list rl and state st = (BT, UL), and secretly save the system master key MK = (a1, a2, b1, b2, FL);

[0057] Furthermore, the step S20 includes:

[0058] S201. Assume that the user has a globally unique identity ω∈Z p *, submit identity ω∈Z to the system administrator p *, the system administrator randomly selects an unspecified leaf node u∈BT in the binary tree BT, maps the user identity ω to the leaf node u, stores (ω.u) in the user list UL, and then updates the state st=(BT,UL);

[0059] S202, the system administrator traverses the set of all nodes on the path from the leaf node u to the root node, denoted as Path(u). For any node x∈Path(u), the system administrator retrieves the function list The function f corresponding to the middle node x x (y) = a x y+1, choose a random number r 1，x ∈Z p *, calculated using the system master key Get the user private key SKω={(x,r 1，x , D x )|x∈Path(u)}, where the user with identity ω is assigned to leaf node u, Path(u) is the set of all nodes on the path from leaf node u to the root node, and x is any node in the set Path(u);

[0060] S203, the system administrator converts the user's private key SKω={(x,r 1，x , D x )|x∈Path(u)} is secretly sent to user ω and the state st is updated;

[0061] Furthermore, the step S30 includes:

[0062] S301. In order to revoke a specified user in the system at time t, the system administrator needs to calculate the system update key at time t for the non-revoked user; assuming that the user ω' is revoked at time t' and t'≤t, the system administrator adds (ω', t') to the user revocation list rl at time t, and obtains the leaf node set R corresponding to all revoked users in the binary tree BT according to the user list UL={(ω, u)}, and obtains the covering set CV of all non-revoked users using the subset covering algorithm in the complete subtree scheme. R , so that CV R The leaf node and its ancestor node corresponding to the revoked user are not included in CV R It only contains the leaf nodes corresponding to the unrevokated users or one of their ancestor nodes.

[0063] S302, for each node x∈CV R , the system administrator retrieves a list of functions The function f corresponding to the middle node x x (y) = a x y+1, choose a random number r 2，x ∈Z p *,calculate Get the updated private key KU t ={(x, r 2，x , E x )|x∈CV R}, where CV R is the covering set of leaf node set R corresponding to the unrevokated users at time t, and x is the covering set CV R Nodes in

[0064] S303: The system administrator publishes the updated status st and the updated private key KU t ={(x, r 2，x , E x )|x∈CV R};

[0065] Furthermore, the step S40 includes:

[0066] S401, the user does not revoke his private key SKω={(x,r 1，x , D x)|x∈Path(u)} and the updated private key KU published by the system administrator t ={(x, r 2，x , E x )|x∈CV R}, find a node x∈Path(u)∩CV in the binary tree R , take out a tuple (x, r 1，x , D x ), from the update key KU t Take out a tuple (x, r) corresponding to the node x 2，x , E x ), combine these two tuples to get the decryption key DK at time t ω，t ={x,r 1，x , D x , r 2，x , E x}, where node x is the private key SKω of the unrevokated user ω and the system updated private key KU at time t t The only identical node, user ω will use the private key SKω of node x and the system update private key KU t Construct the decryption key DK ω，t ; Otherwise, if the user is a revoked user, the decryption key at time t cannot be obtained;

[0067] Furthermore, the step S50 includes:

[0068] S501. In order to construct a secret channel from user ω' to user ω at time t, user ω' encrypts the message m using the public parameter PK and selects a random number s∈Z p *, calculate C0 = m·e(g, g) s , C1=(X1g ω ) s , C2=(Y1) s , C3=(X2g t ) s , C4=(Y2) s , get the ciphertext C = (ω, t, C0, C1, C2, C3, C4), and send this ciphertext C to user ω;

[0069] Furthermore, the step S60 includes:

[0070] S601. User ω receives the ciphertext C = (ω, t, C0, C1, C2, C3, C4). If user ω is not revoked at time t, it obtains its own decryption key DK at time t according to the time t in the ciphertext. ω，t = {r 1，x , D x , r2，x , E x};calculate Get message m;

[0071] S602: If user ω has been revoked at time t, the ciphertext cannot be decrypted and message m cannot be obtained;

[0072] Furthermore, the step S70 includes:

[0073] S701. If the user ω is revoked at time t, the system administrator uses the user list UL={(ω, v)} to obtain the leaf node v corresponding to the revoked user ω in the binary tree, adds (v, t) to the user revocation list rl, and executes steps S301, S302, and S303 in sequence to complete the user revocation.

[0074] Some of the terms mentioned in this embodiment are explained below:

[0075] Complete binary tree: All nodes except leaf nodes have two child nodes. If v is a non-leaf node, use v l , v r Let u be a leaf node, and Path(u) represents the set of all nodes from the leaf node u to the root node root. Figure 2 As shown, user 1's path in the binary tree is Path(1) = {1, 9, 13, 15}.

[0076] Subset Covering Algorithm CV R , let R be the set of leaf nodes in the binary tree corresponding to all revoked users. First, mark the leaf nodes in R as revoked nodes in the binary tree, then mark the ancestor nodes of the above nodes as revoked nodes, and finally output the left and right child nodes of all revoked nodes as the covering set CV of non-revoked users R , so that CV R The leaf node and its ancestor node corresponding to the revoked user are not included in CV R Only the leaf nodes corresponding to the unrevoked users or one of their ancestor nodes are included in the table. For example, if u4 revokes a user, first mark the node corresponding to u4 and its ancestor nodes as revoked nodes, and the left or right child nodes of these revoked nodes are the covering nodes of the unrevoked users. Figure 2 As shown in the figure, when user 4 is revoked, the revoked user set R = {4}, then the covering set CV of the unrevoked users is R ={3, 9, 14}.

[0077] Let G, G T is a cyclic group of prime order p, e:G×G→G T is a mapping. If:

[0078] 1) Bilinear: For any g1, g2∈G, x, y∈Zp, e(g1 x , g2 y ) = e(g1, g2) xy

[0079] 2) Non-degenerate: If g is a generator of G, then e(g, g) is G T The generator of .

[0080] 3) Computability: G, G T If the group action and e are both computable in polynomial time, then we say e:G×G→G T is a bilinear pairing, and G is a bilinear group.

[0081] 2(l+1)-DBDHI Assumption. Randomly select x, z∈Z p , g∈G is the generator of G. Given a 2l+4 tuple g,g x , T, if any polynomial practice algorithm A determines Or T = e(g,g) z G T The advantages of the random elements are all negligible, and the 2(l+1)-DBDHI assumption holds.

[0082] In this example, the communication overhead and privacy protection of the participants will be explained, pointing out that this method reduces the communication overhead of the participants and protects the privacy of the participants.

[0083] The reduction in communication overhead is explained below:

[0084] Table 1 Performance comparison of the schemes

[0085]

[0086] Note: E stands for exponential operation and P stands for bilinear pairing operation.

[0087] The RIBE scheme of this embodiment is compared with the well-known related scheme BGK in terms of efficiency and performance. Assume that the bilinear group e:G×G→G of prime order p T In the above example, E represents the power multiplication operation in the group G, and P represents the bilinear pairing operation e:G×G→G T r represents the number of revoked users, N max represents the maximum number of users. The bilinear pairing operation P is e:G×G→G T The amount of computation is much greater than that of the power multiplication in group G.

[0088] Compared with the BGK method, the encryption process of this method needs to perform 12 power multiplication operations on the elliptic curve. The encryption process of this embodiment needs to perform 7 power multiplication operations on the elliptic curve. The decryption process of BGK needs to perform 2 power multiplication operations and 4 bilinear pairing operations on the elliptic curve. The encryption process of this embodiment needs to perform 4 power multiplication operations and 2 bilinear pairing operations on the elliptic curve, but the power multiplication operation is much faster than the bilinear pairing operation. Therefore, the encryption efficiency of this method is much higher than that of BGK. In addition, the key update workload of this method is 14.3% of that of BGK.

[0089] The following is a proof of safety:

[0090] Theorem: Assuming there is an attacker A who can break the RIBOOE scheme, then we can construct an algorithm B to break the 2(l+1)-DBDHI hypothesis.

[0091] Start: A submits a challenge identity ω * , Challenge time t * and t * Moment Challenge Revocation List RL * .

[0092] Initialization: B receives in Or Z∈G T , B generates a complete binary tree, a user list UL and a function list FL, and converts ω * Assign to a random leaf node u * , and save (ω * ,u * ) to UL. Assume t * The revocation list at this moment is RL * , if ω * ∈R, define FixedSubset(ω * )={Path(u * )}, otherwise, define Set the function list FL as follows:

[0093] (1) Randomly select y∈Z p , save (x = ω * ,αy) to FL;

[0094] (2) Randomly select y∈Z p , save (x = t * ,αy) to FL, note that the linear function f u (X) is determined by two points (0, 1) and (x, αy).

[0095] B sets the revocation list RL and state ST = (BT, UL), and randomly selects w1, w2, ... w l-1 For system running time t1, ..., t π-1 ,t π =t * ,t π+1 ,...,t l , calculate the 2(l-1)th degree polynomial

[0096]

[0097] structure

[0098] When i∈{1,2,...,l-1}, B calculates

[0099]

[0100]

[0101] When i∈{1,...,l}\{π}, B calculates

[0102]

[0103] Notice Will be used to construct user private keys and update keys.

[0104] B Calculation

[0105] when hour, Otherwise T h G T Random elements in .

[0106] B randomly selects a,b,c,d∈Z p *, so that ab = ω*, cd = t*,

[0107] calculate

[0108] X1=(P α ) -a P -ab =P -a(α+b) ,Y1=P α ,

[0109] X2=(P 3α ) -c P -cd =P -c(3α+d) ,Y2=P 3α .

[0110] Publish public parameters = (P, X1, Y1, X2, Y2). Note that the public parameters implicitly set the administrator's private key.

[0111] a1=-a(α+b), b1=α, a2=-c(3α+d), b2=3α,

[0112] And a1+ab1=-ab=-ω*, a2+cb2=-cd=-t*.

[0113] Phase 1A adaptively performs private key update key query

[0114] Targeting identity i The private key query, when ω i ≠ω*, first construct the temporary key component at (0, 1)

[0115]

[0116] If (ω i ,*)∈UL, then download (ω i ,u), otherwise u is randomly selected so that And save (ω i ,u) to UL, get

[0117] Path(u) retrieves the function list (u,f u (x)), if z∈FixedSubset(ω*), construct the temporary key component of (x=ω*,αy)

[0118]

[0119] According to the Lagrange interpolation formula, the private key at this point is

[0120]

[0121] like Construct the temporary key component of (x=t*,ay)

[0122]

[0123] According to the Lagrange interpolation formula, the private key at this point is

[0124]

[0125] When i =ω * At this time, there must be ω * ∈R * , download from UL (ω * ,u * ),get for At this time, (x=ω * ,αy), the private key of this point is

[0126]

[0127] Generate a private key for

[0128] Attacker A targets time T i The update key query is i ≠t*, first construct the temporary key component at (0, 1)

[0129]

[0130] If we define t i The revoked user set R at the moment, and the coverage set CV is obtained RI , retrieve the function list (u,f u (x)), if Construct the temporary key component at (x=ω*,αy)

[0131]

[0132] According to the Lagrange interpolation formula, the update key of this point is

[0133]

[0134] like Construct the temporary key component at (x=t*,αy)

[0135]

[0136] According to the Lagrange interpolation formula, the update key of this point is

[0137]

[0138] When t i = t*, define t * The revoked user set R at the moment * , and get the covering set

[0139] When ω*∈R*, FixedSubset(ω*)=Path u *,CV RI* ∩FixedSubset(ω*)=φ.

[0140] when When, FixedSubset(ω*)=φ,CV RI*∩FixedSubset(ω*)=φ.

[0141] In short CV RI* ∩FixedSubset(ω*)=φ, for nodes Retrieve function list (u,f u (x)). We can get (x=t*,αy), and generate the update key of this node as

[0142] Generate an update key

[0143] Challenge: A submits two messages M0, M1, and B randomly selects μ∈{0,1} to construct the challenge ciphertext: B implicitly sets

[0144] calculate:

[0145]

[0146] C2=Y1 s =P,

[0147] C4=(Y2) s =P 3 ,

[0148] when When C0=M μ e(P, P) s , the ciphertext of C1, C2, C3, C4,.

[0149] When Z∈G T , C0, C1, C2, C3, and C4 are the ciphertexts of the random message.

[0150] Guess, when A outputs μ'∈{0,1}, when μ'=μ, B outputs 1. Otherwise, B outputs 0.

[0151] Table 2 gives the main symbols of this scheme.

[0152]

[0153]

[0154] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A revocable user identity-based encryption method, characterized in that: The following steps are involved: S10, system initialization phase, the system administrator selects a security parameter, specifies the maximum number of users and a complete binary tree, selects the system master key MK, calculates and publishes the public parameter PK, sets and publishes the user revocation list r1, the user list UL and the latest system status st; S20, private key generation stage, the user submits his identity to the system administrator, the system administrator assigns the user to a leaf node in the binary tree, and obtains all nodes on the path from the leaf node to the root node of the binary tree; for each node on the above path, the system administrator uses the system master key MK to calculate a node private key of the user, and all node private keys constitute the user's private key; the system administrator secretly sends the user's private key to the user and updates the state st′; S30, key update phase, at the update system time t, the system administrator obtains the leaf node set in the binary tree corresponding to the revoked users according to the revocation list rl and the user list UL, and obtains the non-revoked user coverage set by using the subset cover algorithm of the complete binary tree; for each node in the coverage set, the system administrator calculates a node update private key using the system master key, and all the above node update private keys constitute the system update key, and the system administrator discloses the system update key; S40, decryption key generation stage, according to the subset cover algorithm of the complete binary tree, each unrevoked user finds two node private keys in his own private key and the system update key, so that the two node private keys have a common node; the user uses the two node private keys as his own decryption key; S50, encryption stage, user ω' uses the public parameter PK and the identity of user ω to encrypt the message m and time t to obtain the ciphertext C, and then sends the ciphertext to user ω; S50, decryption stage, after user ω receives the ciphertext C, if user ω has not been revoked at time t, he uses his decryption key at time t to obtain message m; Otherwise, decryption fails; S70, user revocation stage, if the user ω is revoked at time t, the system administrator adds the user to the user revocation list rl and updates the status '.

2. The identity-based encryption method for revocable users according to claim 1, characterized in that: The step S10 comprises the following steps: S101. The system administrator selects a security parameter κ and sets the maximum number of users N. max , construct a complete binary tree BT with a height of h. The binary tree has 2 h-1 leaf nodes, and satisfy 2 h-1 ≥N max , for each node v∈BT in the binary tree, select a random number a v ∈Z p *, set a function f corresponding to the node v (y) = a v y+1, and each node's binary pair (v, f v (y)) is stored in a function list FL; S102, the system administrator first generates a prime number p-order cyclic group G, G T and the bilinear map e:G×G→G T , select a generator g∈G, select four random numbers a1, a2, b1, b2∈Z p *,calculate Set both the user list UL and the revoked user list r1 to empty sets; S103. System administrators open public The revocation list rl and state st = (BT, UL), and the system master key MK = (a1, a2, b1, b2, FL) are secretly saved.

3. The identity-based encryption method for revocable users according to claim 1, characterized in that: The step S20 comprises the following steps: S201. Assume that the user has a globally unique identity ω∈Z p *, submit identity ω∈Z to the system administrator p *, the system administrator randomly selects an unspecified leaf node u∈BT in the binary tree BT, maps the user identity ω to the leaf node u, stores (ω.u) in the user list UL, and then updates the state st=(BT,UL); S202, the system administrator traverses the set of all nodes on the path from the leaf node u to the root node, denoted as Path(u). For any node x∈Path(u), the system administrator retrieves the function list The function f corresponding to the middle node x x (y) = a x y+1, choose a random number r 1，x ∈Z p *, calculated using the system master key Get the user private key SKω={(x,r 1，x , D x )x∈Path(u)}, where the user with identity ω is assigned to leaf node u, Path(u) is the set of all nodes on the path from leaf node u to the root node, and x is any node in the set Path(u); S203, the system administrator converts the user's private key SKω={(x, r 1，x , D x )x∈Path(u)} is secretly sent to user ω and the state st is updated.

4. The identity-based encryption method for revocable users according to claim 1, characterized in that: The step S30 comprises the following steps: S301. In order to revoke a specified user in the system at time t, the system administrator needs to calculate the updated private key at time t for the unrevoked user; assuming that the user ω' is revoked at time t' and t'≤t, the system administrator adds (ω', t') to the user revocation list rl at time t, and obtains the leaf node set R corresponding to all revoked users in the binary tree BT according to the user list UL={(ω, u)}, and obtains the covering set CV of the leaf node set R using the subset covering algorithm in the complete subtree scheme R , so that CV R The leaf node and its ancestor node corresponding to the revoked user are not included in CV R Only the leaf nodes or one of their ancestor nodes corresponding to the unrevokated users are included; S302, for each node x∈CV R , the system administrator retrieves a list of functions The function f corresponding to the middle node x x (y) = axy + 1, select a random number r 2，x ∈Z p *,calculate Get the updated private key KU at time t t ={(x, r 2，x , E x )x∈CV R }, where CV R is the covering set of leaf node set R corresponding to the unrevokated users at time t, and x is the covering set CV R Nodes in S303: The system administrator announces the update status st and the update private key KU t ={(x, r 2，x , E x )|x∈CV R }.

5. The identity-based encryption method for revocable users according to claim 1, characterized in that: The step S40 comprises the following steps: S401, the user does not revoke his private key SKω={(x,r 1，x , D x )x∈Path(u)} and the updated private key KU published by the system administrator t ={(x, r 2，x , E x )x∈CV R }, find a node x∈Path(u)∩CV in the binary tree R , extract a tuple (x, r) corresponding to the node x from the user private key SKω 1，x , D x ), update the key KU from the system t Take out a tuple (x, r) corresponding to the node x 2，x , E x ), combine these two tuples to get the decryption key DK at time t ω，t = {x,r 1，x , D x , r 2，x , E x }, where node x is the private key SKω of the unrevokated user ω and the system updated private key KU at time t t The only identical node, user ω will use the private key SKω of node x and the system update private key KU t Construct the decryption key DK ω，t ; Otherwise, if the user is a revoked user, the decryption key at time t cannot be obtained.

6. The identity-based encryption method for revocable users according to claim 1, characterized in that: The step S50 comprises the following steps: S501. In order to construct a secret channel from user ω' to user ω at time t, user ω' encrypts the message m and time t using the public parameter PK and selects a random number s∈Z p *, calculate C0 = m·e(g, g) s , C1=(X1g ω ) s , C2=(Y1) s , C3=(X2g t ) s , C4=(Y2) s , get the ciphertext C = (ω, t, C0, C1, C2, C3, C4), and send this ciphertext C to user ω.

7. The identity-based encryption method for revocable users according to claim 1, characterized in that: The step S60 comprises the following steps: S601. User ω receives the ciphertext C = (ω, t, C0, C1, C2, C3, C4). If user ω is not revoked at time t, it obtains its own decryption key DK at time t based on the time t in the ciphertext. ω，t = {r 1，x , D x , r 2，x , E x };calculate Get message m; S602: If user ω has been revoked at time t, the ciphertext cannot be decrypted and message m cannot be obtained.

8. The identity-based encryption method for revocable users according to claim 1, characterized in that: The step S70 includes the following steps: S701. If the user ω is revoked at time t, the system administrator uses the user list UL={(ω, v)} to obtain the leaf node v corresponding to the revoked user ω in the binary tree, adds (v, t) to the user revocation list rl, and executes step S301, step S302, and step S303 in sequence to complete the user revocation.

Images