Fine-grained security access control method and system, computer equipment and storage medium

Abstract

The invention discloses a fine-grained security access control method and system, computer equipment and a storage medium, and the method comprises the steps: obtaining a public parameter set through initializing global parameters, initializing each attribute authorization mechanism, and generating an attribute private key and an attribute public key corresponding to attributes administered by the attribute authorization mechanism; encrypting a plaintext, and encrypting a key of an encryption algorithm according to an access control policy defined by a data owner; acquiring a private key which is generated by an attribute authorization mechanism for each user and is included in an attribute administered by the user, and sending the private key to the user in a synthesized private key form through a key exchange protocol; decrypting the ciphertext according to the private key of the corresponding attribute set; or generating an outsourcing decryption key, and decrypting the ciphertext according to the outsourcing decryption key. The method is suitable for fine-grained security access control supporting attribute value comparison of cloud data sharing, and can provide a secure and low-sales outsourcing decryption scheme on the basis of supporting a complex access control strategy.

Description

Technical Field

[0001] The present invention relates to the field of secure access technology, and in particular to a fine-grained secure access control method, system, computer equipment, and storage medium. Background Art

[0002] Data access control is a means by which the system restricts the ability of a user to use data resources based on his or her identity or the policy group to which he or she belongs. Ciphertext Policy Attribute-based Encryption (CP-ABE) can define access control policies through attributes, providing a low-coupling access control method. However, traditional CP-ABE schemes still face the problem of insufficient flexibility in access control policies in complex environments. Therefore, it is necessary to design a scheme that can achieve fine-grained access control while ensuring forward and backward security of data and resistance to collusion attacks.

[0003] At the same time, with the popularization of mobile Internet, the hardware performance of data access devices varies greatly, and there is a problem that decryption takes a long time and the decryption key cannot be delivered to a third party for processing. Therefore, a decryption solution that can be safely outsourced is needed to assist in fast decryption without exposing the user's own key. Summary of the invention

[0004] The purpose of the present invention is to provide a fine-grained security access control method, system, computer device and computer storage medium, which are suitable for fine-grained security access control supporting attribute value comparison for cloud data sharing, and provide a secure outsourced decryption solution.

[0005] In order to solve the above technical problems, the present invention provides a fine-grained security access control method, comprising:

[0006] Initialize global parameters, obtain a public parameter set, and initialize each attribute authority to generate the attribute private key and attribute public key corresponding to the attribute it governs;

[0007] Encrypt the plaintext and encrypt the encryption algorithm key according to the access control policy defined by the data owner;

[0008] Obtain the private key included in the attribute under its jurisdiction generated by the attribute authority for each user, and send the private key to the user in the form of a synthetic private key through a key exchange protocol;

[0009] The ciphertext is decrypted according to the private key of the corresponding attribute set; or an outsourced decryption key is generated, and the ciphertext is decrypted according to the outsourced decryption key.

[0010] Optionally, the initialization of global parameters to obtain a common parameter set includes:

[0011] A bilinear map and a hash function are generated by a trusted third party organization, and a public parameter set that can be published to the cloud data sharing system is obtained based on the bilinear map and the hash function.

[0012] Optionally, the initializing each attribute authority to generate an attribute private key and an attribute public key corresponding to the attribute under its jurisdiction includes:

[0013] Each attribute authority randomly generates two parameters for each attribute, and generates an attribute private key according to the two parameters, wherein the attributes include comparison attributes and non-comparison attributes;

[0014] A parameter pair corresponding to the attribute public key is generated according to the attribute private key, and the attribute public key is obtained according to the parameter pair.

[0015] Optionally, encrypting the plaintext and encrypting the key of the encryption algorithm according to the access control policy defined by the data owner includes:

[0016] Each data owner encrypts the plain text using a predetermined encryption algorithm, wherein the encryption algorithm includes DES and AES;

[0017] Obtaining an access control policy defined by a data owner, and classifying comparison attributes and non-comparison attributes in the access control policy;

[0018] For the comparison attribute, a unique ciphertext part is generated, and encryption is performed according to the ciphertext part and the set of the comparison attributes to obtain a final ciphertext.

[0019] Optionally, the obtaining of the private key included in the attribute governed by the attribute authority for each user, and sending the private key to the user in the form of a synthesized private key through a key exchange protocol, includes:

[0020] The attribute authority generates a non-comparative attribute private key for each user's attribute.

[0021] Generate a new attribute set for the user according to the comparison attribute set and the corresponding attribute values, and generate a unique partial private key according to the attributes in the new attribute set;

[0022] The non-comparative attribute private key and the partial private key are sent to the corresponding user through a key exchange protocol in the form of a synthetic private key.

[0023] Optionally, decrypting the ciphertext according to the private key of the corresponding attribute set includes:

[0024] According to the comparison attribute set included in the ciphertext, the type of the comparison attribute in the comparison attribute set is obtained, and the attribute key of the user is checked according to the required type;

[0025] If the corresponding attribute key exists, the decryption component can be restored and the secret allocated in the access control tree in the access control policy can be restored by the first predetermined formula, and the plaintext content key can be obtained by using the secret;

[0026] The plaintext of the access data is obtained through a predetermined decryption algorithm according to the plaintext content key.

[0027] Optionally, the generating an outsourced decryption key and decrypting the ciphertext according to the outsourced decryption key includes:

[0028] Generate an outsourced decryption key for operation by the service provider based on the user's own key, wherein the outsourced decryption key is generated by the user and saved as a recovery key for recovering the ciphertext;

[0029] The service provider performs decryption according to the outsourced decryption key and the ciphertext to be decrypted by using a second predetermined formula to obtain decrypted data;

[0030] The symmetric encryption key is obtained by decrypting according to the recovery key, and the plain text of the access data is obtained through a predetermined decryption algorithm.

[0031] To solve the above technical problems, an embodiment of the present invention further provides a fine-grained security access control system, including:

[0032] The initialization module is used to initialize global parameters, obtain a public parameter set, and initialize each attribute authority to generate the attribute private key and attribute public key corresponding to the attribute it governs;

[0033] The encryption module is used to encrypt the plain text and encrypt the key of the encryption algorithm according to the access control policy defined by the data owner;

[0034] A key generation module, used to obtain the private key included in the attribute under its jurisdiction generated by the attribute authority for each user, and send the private key to the user in the form of a synthesized private key through a key exchange protocol;

[0035] The decryption module is used to decrypt the ciphertext according to the private key of the corresponding attribute set; or to generate an outsourced decryption key and decrypt the ciphertext according to the outsourced decryption key.

[0036] To solve the above technical problem, an embodiment of the present invention further provides a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the above-mentioned fine-grained security access control method.

[0037] In order to solve the above technical problem, an embodiment of the present invention further provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the above-mentioned fine-grained security access control method.

[0038] The beneficial effects of the embodiments of the present invention are as follows: by initializing global parameters, a public parameter set is obtained, and each attribute authorization agency is initialized to generate an attribute private key and an attribute public key corresponding to the attribute under its jurisdiction; the plaintext is encrypted, and the key of the encryption algorithm is encrypted according to the access control policy defined by the data owner; the private key included in the attribute under its jurisdiction generated by the attribute authorization agency for each user is obtained, and the private key is sent to the user in the form of a synthesized private key through a key exchange protocol; the ciphertext is decrypted according to the private key of the corresponding attribute set; or an outsourced decryption key is generated, and the ciphertext is decrypted according to the outsourced decryption key. The present invention designs a data security access control scheme that supports attribute value comparison, and the data owner only needs to encrypt the data once, which greatly reduces the amount of calculation of the data owner. In addition, the fine-grained access control strategy provided can meet the data sharing needs of different types of owners. Finally, the scheme also provides an optional secure outsourced decryption method, which reduces the difficulty of user decryption and greatly improves the work efficiency of the encryption end and the decryption end. In an environment based on cloud data sharing, the present invention can not only ensure personalized and secure sharing of data, but also reduce the computing overhead of data owners and users. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0040] Figure 1 A flowchart of an embodiment of the fine-grained security access control method of the present application;

[0041] Figure 2 A schematic diagram of the interaction of various entities in an embodiment of the fine-grained security access control system of the present application;

[0042] Figure 3 This is a schematic diagram of the structure of each entity in an embodiment of the fine-grained security access control system of the present application;

[0043] Figure 4 This is a basic structural block diagram of a computer device according to a specific embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to enable those skilled in the art to better understand the solutions of the present invention, the embodiments of the present invention will be described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0045] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0046] Ciphertext Policy Attribute-based Encryption (CP-ABE) allows data owners to independently customize access control policies, store shared data and access control policies in the cloud in ciphertext form, and finally download the ciphertext and decrypt it with their own attribute keys, thereby achieving data security access control. Since the access control policy is bound to the ciphertext, the encrypted ciphertext can be stored on other entities that are not in the same trust domain. This feature is particularly suitable for access control in cloud storage, Internet of Things and other environments. However, the policies in the traditional CP-ABE scheme can only express logical relationships such as tn gates and NAND gates, and cannot express logical relationships based on attribute values ​​such as "greater than" and "less than". Therefore, the traditional CP-ABE scheme still faces the problem of insufficient flexibility of access control policies in complex environments. It is necessary to design a scheme that can achieve fine-grained access control while ensuring forward and backward security of data and anti-collusion attacks.

[0047] The embodiment of the present invention is applicable to a cloud data sharing system, in which the data owner shares data with different users by customizing data access policies; the attribute authorization agency (i.e., AA) is considered to be completely trustworthy, and the service provider is considered to be semi-trustworthy, that is, it will strictly execute various processes according to the owner's requirements, but will also do its best to obtain data information.

[0048] See also Figure 1 , 2 , Figure 1 The following is a basic flow chart of the fine-grained security access control method of this embodiment. Figure 2 The present invention provides a fine-grained security access control method, which is applied to a cloud data sharing system, such as Figure 2As shown in the figure, AA is the attribute authority, GlobalSetup refers to the system-wide initialization algorithm before the system runs. GPP Refers to the global public parameters, gid It refers to the unique identity of each user in the system, and AASetup refers to the initialization algorithm of the attribute authorization agency. APK Refers to the user's attribute public key, EncryptData refers to the encrypted data, and KeyGen refers to the key generation algorithm. SK gid ,D It means that the attribute authorization agency generates a key for the user for access control. Application Data means that the user obtains the ciphertext for access control from the service provider. CT It refers to the ciphertext after data encryption, DecryptData refers to the data after decryption for the user, and Decrypt refers to the outsourced decryption algorithm provided by the service provider. OutKey It refers to the key generated by the user for outsourcing decryption. The cloud data sharing system includes data owners, users, service providers and attribute authorization agencies, such as Figure 1 As shown, the steps include:

[0049] 1100. Initialize global parameters, obtain a public parameter set, and initialize each attribute authority to generate attribute private keys and attribute public keys corresponding to the attributes it manages;

[0050] First, a bilinear map and a hash function are generated by a trusted third party organization, and a public parameter set that can be published to the cloud data sharing system is obtained based on the bilinear map and the hash function.

[0051] Specifically, the trusted third-party organization will not participate in any link in the operation of the cloud data sharing system. It is run by a trusted organization that is not involved in the access control process and generates necessary parameters for subsequent steps. The trusted third-party organization generates a bilinear mapping ,in and Is a prime number The bilinear group of The generator of In addition, a hash function is generated Based on the parameters generated above, a common parameter set can be obtained . It will be published to all entities in the trusted third-party organization. In addition, during this phase, a unique identity will be generated for all users currently in the trusted third-party organization. .

[0052] Furthermore, the initialization of each attribute authority to generate an attribute private key and an attribute public key corresponding to the attribute under its jurisdiction includes:

[0053] Each attribute authority randomly generates two parameters for each attribute, and generates an attribute private key according to the two parameters, wherein the attributes include comparison attributes and non-comparison attributes;

[0054] A parameter pair corresponding to the attribute public key is generated according to the attribute private key, and the attribute public key is obtained according to the parameter pair.

[0055] Specifically, each attribute authority Running independently, they manage the properties for themselves Generate the corresponding attribute public and private key pairs.

[0056] First, each attribute authority For each attribute (including comparison attributes and non-comparison attributes) Randomly generate two parameters Furthermore, the attribute private key generated is , through the attribute private key , the attribute authority can generate the corresponding parameter pair for the attribute public key and , where g is the generator, a and b are random parameters generated by the attribute authority; the attribute public key is . Attribute public key The attribute private key is disclosed to all entities in the system by the attribute authority. They are owned by each property authority and are not exchanged to other entities under any circumstances.

[0057] It should be noted that whenever a new entity (including data owners and users) in the system sends registration information to the attribute authority, the attribute authority also needs to publish the attribute public key to it. Figure 2 As shown, complete the AASetup step in initialization.

[0058] 1200. Encrypt the plain text and encrypt the key of the encryption algorithm according to the access control policy defined by the data owner;

[0059] Specifically, in the cloud data sharing system, each data owner encrypts the plaintext with a predetermined encryption algorithm, wherein the encryption algorithm includes DES and AES. That is, in order to simplify the encryption overhead of the data owner, before data encryption, the data owner first encrypts the plaintext with a secure encryption algorithm, such as a symmetric encryption algorithm DES, AES, etc., and then encrypts the encryption algorithm key using CP-ABE according to the access control policy.

[0060] In the specific implementation of the present invention, the access control policy defined by the data owner is generated using the (tn)-ShamirSecret Sharing Scheme, and the secret assigned to the access control tree is . Obtain the access control policy, and classify the comparison attributes and non-comparison attributes in the access control policy. For the comparison attribute, generate its unique ciphertext part, and encrypt it according to the set of the ciphertext part and the comparison attribute to obtain the final ciphertext. That is, after formulating the access control policy, the data owner classifies the comparison attributes and non-comparison attributes that appear in the policy. For the comparison attribute, generate its unique ciphertext part , is a set of comparison attributes. The encryption process needs to generate three parts C1, C2, and C3 in the ciphertext CT, which are: , , , where K is the key for symmetric encryption of the ciphertext. The final ciphertext CT is a set consisting of the above parts and the set of comparison attributes. .in, It is only used to declare those attributes as comparison attributes, and does not include the specific values ​​that these attributes need to be compared.

[0061] It can be seen that in the encryption stage, the data owner performs a symmetric encryption on the plaintext that meets its security requirements. , M is the plaintext data shared by the data owner, and the encryption key is encrypted using CP-ABE Encryption. The data owner defines the access control policy and generates the 0 and 1 codes required by them according to the set of comparison attributes in the policy. Depending on the type of attribute, use your own private key and attribute public key Encrypt them.

[0062] The present invention converts the attribute values ​​to be compared into corresponding encodings by introducing 0-encoding and 1-encoding. Since the size comparison between encodings is to find the same subset from each encoding, the attribute comparison can be converted into a logical operation of an OR gate, thereby meeting the requirement of supporting attribute value comparison.

[0063] 1300. Obtain the private key included in the attribute under its jurisdiction generated by the attribute authority for each user, and send the private key to the user in the form of a synthesized private key through a key exchange protocol;

[0064] Specifically, an attribute authorization agency generates a non-comparative attribute private key for each user's attributes; generates a new attribute set for the user based on the user's comparative attribute set and the corresponding attribute values, and generates a unique partial private key based on the attributes in the new attribute set; and sends the non-comparative attribute private key and the partial private key to the corresponding user in the form of a synthetic private key through a key exchange protocol.

[0065] In the embodiment, during the key generation phase, the attribute authority AA runs and generates for each user a private key included in the attribute under its jurisdiction. The attribute authority first generates a non-comparative attribute private key for the attribute owned by the user. , and based on the comparison attribute set sent by the user And the corresponding attribute value generates a new attribute set for it , which includes not only the attribute name, but also the 0-code and 1-code of the attribute value owned by the user. Then, the attribute authority generates its own partial private key for the attributes in these sets. .in, The security parameter is randomly generated by the attribute authority AA. For collection The serial number is The comparison property of .

[0066] Finally, all attribute authorization agencies use the key exchange protocol to exchange the private keys under their own authorization domains in the form of a synthetic private key.

[0067] Sent to the user, where a, b, u are security parameters generated by the attribute authority, and D is the unique private key of the comparison attribute. Since the attribute key can only be generated after the data owner completes the definition of the comparison attribute, in actual scenarios, the data owner will constantly customize new strategies to share data, thereby generating different keys for the same user.

[0068] It can be seen that before generating attribute keys for users, it is necessary to first confirm which attributes are compared in the access control policy and generate a set of attributes corresponding to data encryption. The key generation phase is run by the attribute authority, and different private keys are generated for attributes that need to be compared and attributes that do not need to be compared, and are securely sent to the corresponding users through a pre-defined key exchange protocol.

[0069] 1400. Decrypt the ciphertext according to the private key of the corresponding attribute set; or generate an outsourced decryption key, and decrypt the ciphertext according to the outsourced decryption key.

[0070] In the embodiment of the present invention, the algorithm for data decryption by users can be divided into two cases. For those users who have high privacy protection requirements and strong terminal node computing power, they can choose to decrypt the data by themselves; for nodes with weak computing power, they can also choose to generate a proxy decryption key and hand over most of the decryption operations to the data service provider to reduce computing overhead.

[0071] Specifically, when the user performs decryption by himself, the decryption of the ciphertext according to the private key of the corresponding attribute set includes:

[0072] According to the comparison attribute set included in the ciphertext, the type of the comparison attribute in the comparison attribute set is obtained, and the attribute key of the user is checked according to the required type;

[0073] If the corresponding attribute key exists, the decryption component can be restored and the secret allocated in the access control tree in the access control policy can be restored by the first predetermined formula, and the plaintext content key can be obtained by using the secret;

[0074] The plaintext of the access data is obtained through a predetermined decryption algorithm according to the plaintext content key.

[0075] When the user's own computing power is strong and there is no need to outsource the decryption operation, the decryption algorithm will run on the user side. Similar to the encryption process of the encryption algorithm, the user needs to decrypt the comparison attributes and non-comparison attributes separately. When a user tries to access a certain data, it will first be decrypted according to the comparison attribute set included in its ciphertext. , get the type of comparison attribute. According to the required type, the user checks its own attribute key. If the user does not have the key of a comparison attribute required by the policy, it needs to request the corresponding comparison attribute key from AA first. For the comparison attribute, the user first recovers the decryption component , where the parameters are derived from the public parameters, ciphertext C and comparison attribute key D mentioned above. If the user's comparison attribute meets the requirements of the access control policy, the first predetermined formula can be used: , recover the secret S assigned in the access control tree. The user can further use the secret S to recover the plaintext content key, as shown in the following formula:

[0076] ;

[0077] The user obtains the symmetric encryption key After that, the plaintext of the access data can be obtained through a predetermined decryption algorithm, such as a fast symmetric decryption algorithm.

[0078] Furthermore, in the case where the decryption operation needs to be outsourced, the generating of the outsourced decryption key and decrypting the ciphertext according to the outsourced decryption key include:

[0079] Generate an outsourced decryption key for operation by the service provider based on the user's own key, wherein the outsourced decryption key is generated by the user and saved as a recovery key for recovering the ciphertext;

[0080] The service provider performs decryption according to the outsourced decryption key and the ciphertext to be decrypted by using a second predetermined formula to obtain decrypted data;

[0081] The symmetric encryption key is obtained by decrypting according to the recovery key, and the plain text of the access data is obtained through a predetermined decryption algorithm.

[0082] When the user's own computing power is poor and needs to outsource the decryption operation, firstly, Generate an outsourced decryption key for data service provider calculation ,in Generated by the user and saved as the recovery key to recover the ciphertext. The user will need to decrypt the ciphertext, together with Submit it to the data service provider together. After obtaining the above data, the data service provider performs outsourcing decryption through the following second predetermined formula:

[0083]

[0084] The decryption method of this formula is similar to the decryption method of non-outsourced decryption, but because the data service provider's key is the outsourced decryption key, the data service provider cannot obtain any information about the ciphertext and the user. After the outsourced decryption is successful, the data service provider will decrypt the outsourced ciphertext. After the user obtains the key, he or she can use the previously saved recovery key to finally Decrypt and obtain the symmetric encryption key K, and then obtain the plaintext of the access data through a predetermined symmetric decryption algorithm.

[0085] It can be seen that in the data decryption stage of the method provided by the present invention, when the user decrypts the data, the user can try to decrypt the ciphertext through the corresponding attribute set private key. In addition, if the user believes that the computing power of his own device is insufficient, he can also outsource most of the decryption operations to the data service provider by generating an outsourcing key, thereby reducing the user's computing overhead.

[0086] Please refer to Figure 3 , Figure 3Schematic diagram of the basic structure of the fine-grained security access control system of this embodiment. The fine-grained security access control system includes a signal initialization module 100, an encryption module 110, a key generation module 120 and a decryption module 130.

[0087] like Figure 3 As shown,

[0088] Initialization module 100, used to initialize global parameters, obtain a public parameter set, and initialize each attribute authority to generate attribute private keys and attribute public keys corresponding to the attributes it manages;

[0089] The encryption module 110 is used to encrypt the plain text and encrypt the key of the encryption algorithm according to the access control policy defined by the data owner;

[0090] The key generation module 120 is used to obtain the private key included in the attribute under its jurisdiction generated by the attribute authority for each user, and send the private key to the user in the form of a synthetic private key through a key exchange protocol;

[0091] The decryption module 130 is used to decrypt the ciphertext according to the private key of the corresponding attribute set; or to generate an outsourced decryption key and decrypt the ciphertext according to the outsourced decryption key.

[0092] The above-mentioned embodiments are suitable for sharing environments where data owners pay attention to data security. On the one hand, the owner needs to meet the access needs of a large number of users through encryption means with the lowest possible overhead; on the other hand, after the owner encrypts the data, only users who meet the access control policy can correctly decrypt the data. The present invention proposes a practical attribute value comparison method and a data security access control scheme that can outsource decryption, which expands the application of the CP-ABE method in scenarios such as privacy protection and fine-grained access control. It not only has the access control capability of comparing attribute values, but also can meet the low computational overhead encryption and decryption requirements of different types of entities in specific situations, effectively improving the data security and policy flexibility in the access control scheme.

[0093] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0094] like Figure 4As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a non-volatile storage medium, a memory, and a network interface connected via a system bus. Among them, the non-volatile storage medium of the computer device stores an operating system, a database, and computer-readable instructions. The database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor can implement a fine-grained security access control method. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor can execute a fine-grained security access control method. The network interface of the computer device is used to connect and communicate with a terminal. Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0095] In this embodiment, the processor is used to execute Figure 3 The memory stores the program codes and various data required to execute the above modules. The network interface is used to transmit data between user terminals or servers. The memory in this embodiment stores the program codes and data required to execute all submodules in the fine-grained security access control system, and the server can call the program codes and data of the server to execute the functions of all submodules.

[0096] The computer device receives a data signal through a receiving end by configuring an adaptive control technology function service; the receiving end includes a broadband waveform receiver and a narrowband waveform receiver; at the receiving end, the data signal is demodulated based on the adaptive control technology function service, and the channel state information of the data signal is calculated, and the channel state information is fed back to the transmitting end; at the transmitting end, the communication mode is adaptively adjusted according to the channel state information based on the adaptive control technology function service, and the communication waveform rule of the transmitting end is determined; and a target waveform signal is determined based on the communication waveform rule, and the target waveform signal is modulated by the transmitting end and then sent. The target waveform signal includes at least one of a broadband waveform model suitable for communication quality satisfying a first condition and a narrowband waveform signal suitable for communication quality satisfying a second condition; the communication quality is associated with the channel state information, and in a scenario with good communication quality, a broadband communication mode is adaptively adopted to meet the transmission requirements of high-speed business data and video services, and in an application scenario with poor communication quality, a narrowband communication mode is adaptively adopted to meet the transmission requirements of conventional network topology maintenance, status data and short data services with an extremely low signal-to-noise ratio demodulation threshold, thereby improving the adaptability of self-organizing network communication to complex application scenarios and ensuring high-reliability communication requirements in complex electromagnetic environments.

[0097] The present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the fine-grained security access control method of any of the above embodiments.

[0098] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0099] The above detailed description of the embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0100] Those skilled in the art will appreciate that, unless otherwise stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0101] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0102] It will be understood by those skilled in the art that the term "terminal" as used herein includes both devices with wireless signal receivers, which are devices with only wireless signal receivers without transmission capability, and devices with receiving and transmitting hardware, which are devices with receiving and transmitting hardware capable of performing two-way communication on a two-way communication link. Such devices may include: cellular or other communication devices, which have a single-line display or a multi-line display or a cellular or other communication device without a multi-line display; PCS (Personal Communications Service), which may combine voice, data processing, fax and / or data communication capabilities; PDA (Personal Digital Assistant), which may include a radio frequency receiver, a pager, Internet / intranet access, a web browser, a notepad, a calendar and / or a GPS (Global Positioning System) receiver; conventional laptop and / or palmtop computers or other devices, which have and / or include a conventional laptop and / or palmtop computer or other device with a radio frequency receiver. The "terminal" used here can be portable, transportable, installed in a vehicle (air, sea and / or land), or suitable and / or configured to operate locally, and / or in a distributed form, at any other location on the earth and / or in space. The "terminal" used here can also be a communication terminal, an Internet terminal, a music / video playback terminal, such as a PDA, a MID (Mobile Internet Device) and / or a mobile phone with music / video playback function, or a smart TV, a set-top box and other devices.

[0103] The hardware referred to by the names such as "server", "client", and "service node" in this application is essentially an electronic device with capabilities equivalent to those of a personal computer. It is a hardware device that has the necessary components revealed by the von Neumann principle, such as a central processing unit (including an arithmetic unit and a controller), a memory, an input device, and an output device. The computer program is stored in its memory, and the central processing unit calls the program stored in the external memory into the internal memory for execution, executes the instructions in the program, and interacts with the input and output devices to complete specific functions.

[0104] It should be pointed out that the concept of "server" referred to in this application can also be extended to the case of server clusters. According to the network deployment principle understood by those skilled in the art, the servers should be logically divided. In physical space, these servers can be independent of each other but can be called through interfaces, or integrated into a physical computer or a set of computer clusters. Those skilled in the art should understand this flexibility, and should not use it to restrict the implementation of the network deployment method of this application.

[0105] Unless expressly specified, one or more technical features of the present application can be deployed on a server for implementation and accessed by a client through a remote call to obtain an online service interface provided by the server, or can be directly deployed and run on a client for access.

[0106] Unless explicitly specified, the various data involved in this application can be stored remotely on a server or on a local terminal device, as long as it is suitable for being called by the technical solution of this application.

[0107] Those skilled in the art should be aware that, although the various methods of the present application are described based on the same concept and thus present commonality to each other, unless otherwise specified, these methods can be independently executed. Similarly, for each embodiment disclosed in the present application, they are all proposed based on the same inventive concept, therefore, concepts with the same expression, and concepts that are appropriately changed for convenience despite different expressions, should be understood as equivalent.

[0108] Unless the mutually exclusive relationship between the embodiments to be disclosed in this application is explicitly stated, the relevant technical features involved in each embodiment can be cross-combined to flexibly construct a new embodiment, as long as such combination does not deviate from the creative spirit of this application and can meet the needs of the prior art or solve certain deficiencies in the prior art. Those skilled in the art should be aware of this flexibility.

[0109] Those skilled in the art will appreciate that the various operations, methods, steps, measures, and schemes in the processes discussed in this application may be alternated, altered, combined, or deleted. Further, other steps, measures, and schemes in the various operations, methods, and processes discussed in this application may also be alternated, altered, rearranged, decomposed, combined, or deleted. Further, the steps, measures, and schemes in the prior art that are similar to those disclosed in this application may also be alternated, altered, rearranged, decomposed, combined, or deleted.

[0110] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A fine-grained security access control method is applied to a cloud data sharing system, wherein the cloud data sharing system includes data owners, users, service providers, and attribute authorization agencies, and is characterized in that: The method comprises: Initialize global parameters, obtain a public parameter set, and initialize each attribute authority to generate the attribute private key and attribute public key corresponding to the attribute it governs; Encrypt the plaintext and encrypt the encryption algorithm key according to the access control policy defined by the data owner; Obtain the private key included in the attribute under its jurisdiction generated by the attribute authority for each user, and send the private key to the user in the form of a synthetic private key through a key exchange protocol; The ciphertext is decrypted according to the private key of the corresponding attribute set; or an outsourced decryption key is generated, and the ciphertext is decrypted according to the outsourced decryption key.

2. The fine-grained security access control method according to claim 1 is characterized in that: The global parameters are initialized to obtain a common parameter set, including: A bilinear map and a hash function are generated by a trusted third party organization, and a public parameter set that can be published to the cloud data sharing system is obtained based on the bilinear map and the hash function.

3. The fine-grained security access control method according to claim 1 is characterized in that: Initializing each attribute authority to generate attribute private keys and attribute public keys corresponding to the attributes it governs includes: Each attribute authority randomly generates two parameters for each attribute, and generates an attribute private key according to the two parameters, wherein the attributes include comparison attributes and non-comparison attributes; A parameter pair corresponding to the attribute public key is generated according to the attribute private key, and the attribute public key is obtained according to the parameter pair.

4. The fine-grained security access control method according to claim 1 is characterized in that: The encrypting of the plaintext and encrypting the key of the encryption algorithm according to the access control policy defined by the data owner include: Each data owner encrypts the plain text using a predetermined encryption algorithm, wherein the encryption algorithm includes DES and AES; Obtaining an access control policy defined by a data owner, and classifying comparison attributes and non-comparison attributes in the access control policy; For the comparison attribute, a unique ciphertext part is generated, and encryption is performed according to the ciphertext part and the set of the comparison attributes to obtain a final ciphertext.

5. The fine-grained security access control method according to claim 1, characterized in that: The obtaining of the private key included in the attribute governed by the attribute authority for each user, and sending the private key to the user in the form of a synthesized private key through a key exchange protocol, includes: The attribute authority generates a non-comparative attribute private key for each user's attribute. Generate a new attribute set for the user according to the comparison attribute set and the corresponding attribute values, and generate a unique partial private key according to the attributes in the new attribute set; The non-comparative attribute private key and the partial private key are sent to the corresponding user through a key exchange protocol in the form of a synthetic private key.

6. The fine-grained security access control method according to claim 1 is characterized in that: The decrypting of the ciphertext according to the private key of the corresponding attribute set includes: According to the comparison attribute set included in the ciphertext, the type of the comparison attribute in the comparison attribute set is obtained, and the attribute key of the user is checked according to the required type; If the corresponding attribute key exists, the decryption component can be restored and the secret allocated in the access control tree in the access control policy can be restored by the first predetermined formula, and the plaintext content key can be obtained by using the secret; The plaintext of the access data is obtained through a predetermined decryption algorithm according to the plaintext content key.

7. The fine-grained security access control method according to claim 1 is characterized in that: The generating of the outsourced decryption key and decrypting the ciphertext according to the outsourced decryption key comprises: Generate an outsourced decryption key for operation by the service provider based on the user's own key, wherein the outsourced decryption key is generated by the user and saved as a recovery key for recovering the ciphertext; The service provider performs decryption according to the outsourced decryption key and the ciphertext to be decrypted by using a second predetermined formula to obtain decrypted data; The symmetric encryption key is obtained by decrypting according to the recovery key, and the plain text of the access data is obtained through a predetermined decryption algorithm.

8. A fine-grained security access control system, characterized in that: include: The initialization module is used to initialize global parameters, obtain a public parameter set, and initialize each attribute authority to generate the attribute private key and attribute public key corresponding to the attribute it governs; The encryption module is used to encrypt the plain text and encrypt the key of the encryption algorithm according to the access control policy defined by the data owner; A key generation module, used to obtain the private key included in the attribute under its jurisdiction generated by the attribute authority for each user, and send the private key to the user in the form of a synthesized private key through a key exchange protocol; The decryption module is used to decrypt the ciphertext according to the private key of the corresponding attribute set; or to generate an outsourced decryption key and decrypt the ciphertext according to the outsourced decryption key.

9. A computer device comprising a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the fine-grained security access control method as claimed in any one of claims 1 to 7.

10. A storage medium storing computer-readable instructions, wherein when the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the fine-grained security access control method according to any one of claims 1 to 7.

Images