Power Internet of Things anonymous access control method based on multi-authorization attribute encryption

Abstract

The invention discloses a power internet of things anonymous access control method based on multi-authorization attribute encryption, which relates to the technical field of network information security, and comprises the following steps: based on a central authorization mechanism, allocating identifiers for attribute authorization mechanisms and data users, carrying out anonymization processing on attributes of the users, and generating a key; data are encrypted through the power Internet of Things terminal and uploaded to the cloud server for storage, and the user identity is authenticated and decrypted through the edge node server; and executing user revocation and attribute revocation according to the user identifier. According to the method, data is encrypted through the power Internet of Things terminal, and offline and online encryption stages are adopted, so that data transmission and storage security is ensured, and unauthorized access is prevented; identity authentication and decryption are carried out through the edge node server, access control is enhanced, and data security is guaranteed; by quickly cancelling the user permission and dynamic attribute management, the flexibility, security and adaptability of the system are improved, and the consistency and data security of the system are ensured.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to an anonymous access control method for an electric power Internet of Things based on multi-authorization attribute encryption. Background Art

[0002] With the rapid development of the power Internet of Things, the large amount of data generated by the power Internet of Things is usually processed in the cloud to reduce the computing and storage overhead of Internet of Things devices. However, this also brings information security risks. Data may be leaked during transmission and use, especially data involving user privacy. If these private data are leaked or tampered with, the user's safety will be threatened. Therefore, it is crucial to ensure the confidentiality, integrity and access control of the power Internet of Things data. In order to cope with the data security issues in the power Internet of Things, it is necessary to establish corresponding protection mechanisms to avoid unnecessary losses.

[0003] In recent years, attribute encryption technology has been widely used to ensure data security and implement data access control. To meet the attribute management requirements of different authority bodies, several schemes based on Multi-Authority Attribute-Based Encryption (MA-ABE) have been proposed. By binding a user's identity to a series of attributes, a set of attributes or access structures is set for the user's private key and ciphertext. Decryption is only possible when the attribute set matches the access policy, thus achieving fine-grained access control over the data. However, existing MA-ABE schemes suffer from privacy leakage and low efficiency. Generally, to protect user privacy, user personal information is usually used to encrypt data. However, existing MA-ABE schemes do not consider the security of access policies during data transmission. Access policies are sent explicitly and can be used by anyone who receives the ciphertext. In addition, attributes are not fixed. When a user's attributes change, the access policy also changes. If the access policy is not protected, the user's sensitive information can be inferred from the changed attributes. Therefore, MA-ABE schemes must ensure the privacy of the access policy.

[0004] In addition, in the power Internet of Things, decryption calculations are performed by edge nodes, which can alleviate the computing pressure of end users and improve computing efficiency, but does not take into account the correctness of user identity. Therefore, user identity authentication is required. In order to meet the flexibility of the solution, user revocation and attribute revocation also need to be considered in the power Internet of Things system. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problems solved by the present invention are: the existing multi-authorization attribute encryption method has insufficient access policy security, low efficiency, lack of user identity authentication, and how to implement user revocation and attribute revocation to meet the data security requirements of the power Internet of Things.

[0007] To solve the above technical problems, the present invention provides the following technical solutions: an anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption, comprising allocating identifiers to attribute authorization agencies and data users based on a central authorization agency, anonymizing the user's attributes, and generating keys; encrypting data through the power Internet of Things terminal and uploading it to the cloud server for storage, authenticating and decrypting the user identity through the edge node server; and executing user revocation and attribute revocation according to the user identifier.

[0008] As a preferred solution of the anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption described in the present invention, the identifier allocation includes setting a security parameter λ based on a central authorization agency, outputting a system global parameter GP, generating an authority identifier aid for each attribute authorization agency, generating a unique user identifier uid for each data user, and calculating the system global parameter GP, which is expressed as:

[0009] GP={q,G1,G2,g,e,H},e:G1×G1→G2

[0010] Among them, G1 and G2 are different multiplicative groups, q is the order of G1 and G2, g is the generator of G1, e is a bilinear map, and H is a hash function.

[0011] As a preferred solution of the anonymous access control method of the power Internet of Things based on multi-authorization attribute encryption described in the present invention, wherein: the user's attributes are anonymized to generate a key including, based on the system global parameter GP, each attribute authorization agency constructs a private key SK for all attributes in its own attribute set. aid , public key PK aid and Attribute Conversion Key AAK aid , construct the private key SK aid , expressed as:

[0012] SK aid ={α a ,β a},a∈A aid ,(α a ,β a )∈Z q

[0013] Among them, a is the attribute authority AA aid Managed attribute set A aid A single attribute in Z qis the set of integers in the sense of q, α a , β a Z q Random number in; construct public key PK aid , expressed as:

[0014]

[0015] Among them, i is the attribute number, PK 1,i PK 2,i The component of the public key calculated for each attribute in the attribute set; construct the attribute conversion key AAK aid , expressed as:

[0016]

[0017] Among them, δ a , θ is Z q The random number in the attribute anonymous algorithm, input system global parameter GP, attribute conversion key AAK aid and user attribute set A uid , calculate the user anonymous attribute set A' uid , expressed as:

[0018]

[0019] Among them, a' is the user's anonymous attribute set A' uid When the end user accesses the data, the attribute authority AA aid Set the attribute Distribute to the data user whose identifier is uid, and use the attribute anonymity algorithm to convert the attribute set A aid,uid Each attribute in is anonymously output as anonymous attribute set A' aid,uid , and transmit it to the cloud server and add it to the attribute list Set to in, A' is a list of attribute sets representing all attribute authorities for the same user. uid Represents the attribute set composed of all attribute authority attributes of the same user after anonymization, and the attribute list and user anonymous attribute set A' uid The data is transmitted to the user terminal through the cloud server for storage, and the key generation algorithm is executed by the attribute authorization agency, and the system global parameters GP and user attribute set A are input. uid , user identifier uid, private key SK aid and attribute b∈A uid , calculate the user's private key K b,uid , expressed as:

[0020]

[0021] The user's private key K b,uid Transmit to the cloud server for user identity authentication; execute the key conversion algorithm through the data user terminal and input the user's private key K b,uid , calculate the pre-decryption key PreK b,uid and user recovery key K uid , expressed as:

[0022]

[0023] K uid ={z},z∈Z q

[0024] Where z is Z q The random number in the pre-decryption key PreK b,uid Transfer to the cloud server, add to the key list LK, set to LK = LK {uid, PreK b,uid ,K b,uid}, user recovery key K uid Held by the end user.

[0025] As a preferred solution of the anonymous access control method of the power Internet of Things based on multi-authorization attribute encryption described in the present invention, the encrypted data includes executing the encrypted data through the power Internet of Things terminal, and in the offline encryption stage, outputting the intermediate ciphertext EM', which is expressed as:

[0026]

[0027]

[0028] EM'={E 1,i ,E 2,i ,E 3,i ,EM 1,i ,EM 2,i},i∈[1,n

[0029] Where n is the number of attributes, λ' i ,α' i ,β' i 、ω' i , γ i Z q The random number in are the two components of the public key calculated based on random numbers, E 1,i 、E 2,i 、E 3,i , EM 1,i , EM2,i It is the component of the calculated intermediate ciphertext; in the online encryption stage, the input system global parameters GP, intermediate ciphertext EM', public key PK aid , matrix M, message m, encrypt message m, calculate the encrypted ciphertext EM, expressed as:

[0030] E0=m·e(g,g) s

[0031] E 4,i =λ i -λ' i

[0032] E 5,i =ω i -ω' i

[0033]

[0034] EM={E0,E 1,i ,E 2,i ,E 3,i ,E 4,i ,E 5,i ,EM 1,i ,EM 2,i ,D 1,i ,D 2,i},i∈[1,n]

[0035] Where s is Z q The random number in, ρ(i) is the attribute mapped to each row of the matrix M, E0, E 4,i 、E 5,i 、D 1,i 、D 2,i It is the component of the calculated ciphertext.

[0036] As a preferred solution of the anonymous access control method of the power Internet of Things based on multi-authorization attribute encryption described in the present invention, wherein: the authentication and decryption of the user identity includes performing user identity authentication and decryption through the edge node server, when the terminal user with the user identifier uid sends a data access request to the cloud server, the cloud server is sent to the attribute list View the relevant user anonymous attribute set A' uid , and sent to the edge node server, the edge node server performs anonymous attribute set A' uid For authentication, enter the system global parameter GP, ciphertext EM, user identifier uid and user private key K a,uid , calculate the authentication result, expressed as:

[0037]

[0038] in, is a set of non-zero integers in the sense of q, c i To satisfy ∑ a c i M i =(1,0,…,0); if v user =1, the edge node server will perform the decryption operation, input the system global parameter GP, ciphertext EM, authentication result v user and the pre-decryption key PreKb ,uid , calculate the partial decrypted ciphertext EM after pre-decryption out , expressed as:

[0039]

[0040] E' 2,i =E 2,i

[0041]

[0042]

[0043] EM out ={EM1,EM2}

[0044] Among them, E' 1,i 、E' 2,i 、E' 3,i is the intermediate result of calculating the pre-decrypted ciphertext, EM1 and EM2 are the calculated pre-decrypted ciphertext EM out The two components of the pre-decrypted partial decryption ciphertext EM out = {EM1, EM2} is sent to the data user, and the user decryption process is performed through the data user terminal, inputting the system global parameter GP, ciphertext EM, and partial decryption ciphertext EM out , user recovery key K uid , calculate the message m, expressed as:

[0045]

[0046] EM=EM'2·EM1

[0047] EM z =e(g,g) s

[0048]

[0049] Among them, EM'2 is based on the user recovery key K uid The calculated value of the pre-decrypted ciphertext component EM2, EM z To recover the key K based on the useruid The calculated value of the ciphertext EM; if v user ≠1, a terminator will be output and the decryption algorithm will stop immediately.

[0050] As a preferred solution of the anonymous access control method of the power Internet of Things based on multi-authorization attribute encryption described in the present invention, the user revocation includes deleting the user key and attribute set from the key and attribute list through the cloud server according to the user identifier UID of the user to be revoked.

[0051] As a preferred solution of the anonymous access control method of the power Internet of Things based on multi-authorization attribute encryption described in the present invention, wherein: the attribute revocation includes using A R Represents user uid from the authority AA aid The revoked attribute set, for all the attributes with attribute set A R For unrevoked users, change the stored data, execute the key update algorithm through the attribute authority, and calculate the updated key UK i , expressed as:

[0052]

[0053] in, Z q Random numbers in A R Attributes, update the public key to The private key is

[0054] Execute the private key update algorithm through the cloud server to calculate the updated private key and pre-decryption key Expressed as:

[0055]

[0056]

[0057] Among them, K i,uid is the user private key belonging to the i-th attribute; the ciphertext update algorithm is executed through the power Internet of Things terminal, and when the update key UK is received from the attribute authority i When , the ciphertext is updated and the updated ciphertext is calculated, which is expressed as:

[0058]

[0059] in, is the EM in the original ciphertext 1,i 、D 1,i Updated results.

[0060] Another object of the present invention is to provide an anonymous access control system for the power Internet of Things based on multi-authorization attribute encryption, which can encrypt data through the power Internet of Things terminal and upload it to the cloud server for storage, and authenticate and decrypt the user identity through the edge node server, thereby solving the problem of insufficient security of access policies contained in the current encryption technology in the power Internet of Things.

[0061] As a preferred solution of the anonymous access control system of the power Internet of Things based on multi-authorization attribute encryption described in the present invention, it includes: a system initialization module, an encryption and decryption module, and a revocation module; the system initialization module is used to assign identifiers to attribute authorization agencies and data users based on a central authorization agency, anonymize the user's attributes, and generate a key; the encryption and decryption module is used to encrypt data through the power Internet of Things terminal, upload it to the cloud server for storage, and authenticate and decrypt the user identity through the edge node server; the revocation module is used to perform user revocation and attribute revocation based on the user identifier.

[0062] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a step of an anonymous access control method for an electric power Internet of Things based on multi-authorization attribute encryption.

[0063] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of an anonymous access control method for an electric power Internet of Things based on multi-authorization attribute encryption.

[0064] Beneficial effects of the invention: The anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption provided by the invention generates keys by allocating identifiers to attribute authorization agencies and data users based on a central authorization agency, and anonymizing the user's attributes to generate keys, thereby achieving the concealment and uniqueness of user identities, improving the security of the system, preventing the leakage of user identity information, and laying the foundation for subsequent data encryption and decryption processes; by constructing private keys, public keys and attribute conversion keys, and using attribute anonymity algorithms to calculate user anonymous attribute sets, the encryption conversion of user attributes is achieved, the security of user data is improved, so that even if the data is intercepted, the attacker cannot obtain the user's real information, and at the same time provides technical support for user identity authentication; the encrypted data is executed by the power Internet of Things terminal, and the intermediate ciphertext is output in the offline encryption stage, and the encrypted ciphertext is calculated in the online encryption stage, thereby achieving secure transmission and storage of data and protecting data. It is not subject to unauthorized access, and even in the event of data leakage, the information cannot be interpreted; user identity authentication and decryption are performed through the edge node server, which realizes the verification of user identity and the secure decryption of data, ensuring that only legitimate users can access the data, improving the access control capability of the system, preventing illegal access, and ensuring the secure decryption of data on the user side; by deleting the user key and attribute set from the key and attribute list according to the user identifier, the user access rights are quickly revoked, the flexibility and controllability of the system are enhanced, and the security of the system is ensured; by using the attribute set revoked from the attribute authorization agency on behalf of the user and executing the key update algorithm, the dynamic management of user attributes is realized, the adaptability of the system is improved, the validity of user attributes is guaranteed, and at the same time, the consistency and security of the system data are ensured through key update. The present invention achieves better results in terms of security, flexibility and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0066] Figure 1 This is an overall flow chart of an anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption provided by the first embodiment of the present invention;

[0067] Figure 2 A scheme model diagram of an anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption provided by the first embodiment of the present invention;

[0068] Figure 3A schematic diagram of a module of an anonymous access control system for the power Internet of Things based on multi-authorization attribute encryption provided in the third embodiment of the present invention. DETAILED DESCRIPTION

[0069] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0070] Example 1, with reference to Figure 1-Figure 2 , as an embodiment of the present invention, provides an anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption, comprising:

[0071] S1: Based on the central authority, identifiers are assigned to attribute authority and data users, the user's attributes are anonymized, and keys are generated.

[0072] Furthermore, assigning identifiers includes setting security parameters λ based on the central authority and outputting the system global parameter GP to generate permission identifiers for each attribute authority. aid , generate a unique user identifier uid for each data user, and calculate the system global parameter GP, which is expressed as:

[0073] GP={q,G1,G2,g,e,H},e:G1×G1→G2

[0074] Among them, G1 and G2 are different multiplicative groups, q is the order of G1 and G2, g is the generator of G1, e is a bilinear map, and H is a hash function.

[0075] It should be noted that the generation of keys by anonymizing the user's attributes includes constructing a private key SK for all attributes in its own attribute set based on the system global parameter GP. aid , public key PK aid and Attribute Conversion Key AAK aid , construct the private key SK aid , expressed as:

[0076] SK aid ={α a ,β a},a∈A aid ,(α a ,β a )∈Z q

[0077] Among them, a is the attribute authority AA aid Managed attribute set A aid A single attribute in Z q is the set of integers in the sense of q, α a , β a Z q Random number in; construct public key PK aid , expressed as:

[0078]

[0079] Among them, i is the attribute number, PK 1,i PK 2,i The component of the public key calculated for each attribute in the attribute set; construct the attribute conversion key AAK aid , expressed as:

[0080]

[0081] Among them, δa and θ are Z q The random number in the attribute anonymous algorithm, input system global parameter GP, attribute conversion key AAK aid and user attribute set A uid , calculate the user anonymous attribute set A' uid , expressed as:

[0082]

[0083] Among them, a' is the user's anonymous attribute set A' uid When the end user accesses the data, the attribute authority AA aid Set the attribute Distribute to the data user whose identifier is uid, and use the attribute anonymity algorithm to convert the attribute set A aid,uid Each attribute in is anonymously output as anonymous attribute set A' aid,uid , and transmit it to the cloud server and add it to the attribute list Set to in, A' is a list of attribute sets representing all attribute authorities for the same user. uid Represents the attribute set composed of all attribute authority attributes of the same user after anonymization, and the attribute list and user anonymous attribute set A' uid The data is transmitted to the user terminal through the cloud server for storage, and the key generation algorithm is executed by the attribute authorization agency, and the system global parameters GP and user attribute set A are input. uid , user identifier uid, private key SK aid and attribute b∈Auid , calculate the user's private key K b,uid , expressed as:

[0084]

[0085] The user's private key K b,uid Transmit to the cloud server for user identity authentication; execute the key conversion algorithm through the data user terminal and input the user's private key K b,uid , calculate the pre-decryption key PreK b,uid and user recovery key K uid , expressed as:

[0086]

[0087] K uid ={z},z∈Z q

[0088] Where z is Z q The random number in the pre-decryption key PreK b,uid Transfer to the cloud server, add to the key list LK, set to LK = LK {uid, PreK b,uid ,K b,uid}, user recovery key K uid Held by the end user.

[0089] It should also be noted that if Figure 2 As shown in the figure, the central authorization agency is mainly responsible for setting the system global parameter GP, generating the authority identifier AID for each attribute authorization agency, and generating a unique user identifier UID for each data user (step ①). Since the central authorization agency does not participate in any attribute and key distribution process, the central authorization agency is completely trustworthy. The attribute authorization agency is mainly responsible for anonymizing the attributes (step ②) and managing and maintaining them, and sending them to the relevant power Internet of Things terminals. Any two attribute authorization agencies have no intersection. Each attribute authorization agency generates a corresponding key based on the attribute set of the authenticated user and distributes it (step ③). It is completely trustworthy. When the user revokes the attribute, the attribute authorization agency will generate an updated key for the non-revoked user. By anonymizing the attributes during the authentication process, the privacy of the access policy during data transmission is enhanced. When the user's attributes change, sensitive information will not be inferred to be leaked based on the changed attributes, thereby achieving privacy protection and improving security and flexibility.

[0090] S2: Encrypt data through the power Internet of Things terminal and upload it to the cloud server for storage, and authenticate and decrypt the user identity through the edge node server.

[0091] Furthermore, encrypting data includes executing encryption data through the power Internet of Things terminal. In the offline encryption stage, the intermediate ciphertext EM' is output, which is expressed as:

[0092]

[0093]

[0094]

[0095] EM'={E 1,i ,E 2,i ,E 3,i ,EM 1,i ,EM 2,i},i∈[1,n]

[0096] Where n is the number of attributes, λ' i ,α' i ,β' i 、ω' i , γ i Z q The random number in are the two components of the public key calculated based on random numbers, E 1,i 、E 2,i 、E 3,i , EM 1,i , EM 2,i It is the component of the calculated intermediate ciphertext; in the online encryption stage, the input system global parameters GP, intermediate ciphertext EM', public key PK aid , matrix M, message m, encrypt message m, calculate the encrypted ciphertext EM, expressed as:

[0097] E0=m·e(g,g) s

[0098] E 4,i =λ i -λ' i

[0099] E 5,i =ω i -ω' i

[0100]

[0101] EM={E0,E 1,i ,E 2,i ,E 3,i ,E 4,i ,E 5,i ,EM 1,i ,EM 2,i,D 1,i ,D 2,i},i∈[1,n]

[0102] Where s is Z q The random number in, ρ(i) is the attribute mapped to each row of the matrix M, E0, E 4,i 、E 5,i 、D 1,i 、D 2,i It is the component of the calculated ciphertext.

[0103] It should be noted that the authentication and decryption of user identity includes performing user identity authentication and decryption through the edge node server. When the terminal user with the user identifier uid sends a data access request to the cloud server, the cloud server is sent a data access request from the attribute list. View the relevant user anonymous attribute set A' uid , and sent to the edge node server, the edge node server performs anonymous attribute set A' uid For authentication, enter the system global parameter GP, ciphertext EM, user identifier uid and user private key Ka ,uid , calculate the authentication result, expressed as:

[0104]

[0105] in, is a set of non-zero integers in the sense of q, c i To satisfy ∑ a c i M i =(1,0,…,0); if v user =1, the edge node server will perform the decryption operation, input the system global parameter GP, ciphertext EM, authentication result v user and the pre-decryption key PreK b,uid , calculate the partial decrypted ciphertext EM after pre-decryption out , expressed as:

[0106]

[0107] E' 2,i =E 2,i

[0108]

[0109] EM out ={EM1,EM2}

[0110] Among them, E' 1,i 、E' 2,i 、E' 3,iis the intermediate result of calculating the pre-decrypted ciphertext, EM1 and EM2 are the calculated pre-decrypted ciphertext EM out The two components of the pre-decrypted partial decryption ciphertext EM out = {EM1, EM2} is sent to the data user, and the user decryption process is performed through the data user terminal, inputting the system global parameter GP, ciphertext EM, and partial decryption ciphertext EM out , user recovery key K uid , calculate the message m, expressed as:

[0111]

[0112] EM=EM'2·EM1

[0113] EM z =e(g,g) s

[0114]

[0115] Among them, EM'2 is based on the user recovery key K uid The calculated value of the pre-decrypted ciphertext component EM2, EM z To recover the key K based on the user uid The calculated value of the ciphertext EM; if v user ≠1, a terminator will be output and the decryption algorithm will stop immediately.

[0116] It should also be noted that if Figure 2As shown, the power Internet of Things terminal realizes the information collection of the power Internet of Things, and securely encrypts the data according to the access policy, and then uploads the encrypted data and anonymous attributes to the cloud server (step ④). Once the user's attributes are revoked, the power Internet of Things terminal needs to update the corresponding ciphertext. The cloud server mainly stores the ciphertext from the data user, and is also responsible for the request from the edge node server (step ⑤), and updates the attribute list and key list for the revoked user. The cloud server is not completely trustworthy, so both the ciphertext and the access policy need to be protected. The edge node server is distributed on the edge node and is located between the cloud server and the data user terminal. It has storage and computing capabilities, transmits data from the cloud server, manages user authentication and outsources decryption (step ⑥), and the data user terminal obtains the key from the corresponding attribute authorization agency (step ③) and can arbitrarily access any ciphertext in the cloud server. After the edge node server receives the data decryption request (step ⑥), it obtains the partially decrypted key from the data user terminal (step ⑦) Pre-decryption is performed, and then the data user terminal downloads the remaining ciphertext from the edge node server (step ⑧), and uses its own key to restore the encrypted data. In most attribute encryption methods, the access strategy will become more and more complicated due to the increase in the number of attributes, increasing the computational burden of encryption and decryption. Generally, the computational overhead is unaffordable for sensor devices. The present invention can alleviate the computational pressure of power Internet of Things terminals and user terminals by adopting online and offline technologies in the encryption stage, because some complex calculations can be completed based on the user's attributes in the offline stage, and the data is encrypted according to the access structure after it is collected. Only a small amount of encryption processing is required in the online stage. Since most of the complex operations have been processed in advance, the efficiency of data encryption can be improved. User identity authentication is performed by the edge node server. By introducing user identity authentication and pre-decryption operations supported by edge computing in the decryption stage, the legitimacy of the user in the decryption process is guaranteed, and at the same time, the user's computational pressure can be reduced, thereby improving the decryption efficiency.

[0117] S3: Perform user revocation and attribute revocation based on the user identifier.

[0118] Furthermore, user revocation includes deleting the user key and attribute set from the key and attribute list through the cloud server according to the user identifier uid of the user to be revoked.

[0119] It should be noted that the attribute revocation includes using A R Represents user uid from the authority AA aid The revoked attribute set, for all the attributes with attribute set A R For unrevoked users, change the stored data, execute the key update algorithm through the attribute authority, and calculate the updated key UK i , expressed as:

[0120]

[0121] in, Z q Random numbers in A R Attributes, update the public key to The private key is Execute the private key update algorithm through the cloud server to calculate the updated private key and pre-decryption key Expressed as:

[0122]

[0123] Among them, K i,uid is the user private key belonging to the i-th attribute; the ciphertext update algorithm is executed through the power Internet of Things terminal, and when the update key UK is received from the attribute authority i When , the ciphertext is updated and the updated ciphertext is calculated, which is expressed as:

[0124]

[0125] in, is the EM in the original ciphertext 1,i 、D 1,i Updated results.

[0126] It should also be noted that for all unrevoked users with attribute sets, for each user belonging to A R The purpose of updating the public and private keys is to prevent the revoked users from decrypting again. In practical applications, users who are no longer used need to be deleted, and the corresponding data needs to be appropriately updated. By providing user and attribute revocation, the flexibility of the entire access control method can be enhanced. When a user identity needs to be revoked, there is no need to update the key and re-encrypt the ciphertext. Just send the identifier uid of the user to be revoked to the cloud server. After receiving the revocation signal, the cloud server will delete the key of the revoked user. Without the relevant key, the original data cannot be decrypted and restored. When revoking the attribute, the update key, user private key and ciphertext must be calculated. In a secure channel, the attribute authority can distinguish the revoked users, and then send the update key to the non-revoked users and the power Internet of Things terminal.

[0127] Example 2 is an embodiment of the present invention, which provides an anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0128] The present invention's experiment selected 20 power Internet of Things terminals, divided into two groups: one group used existing encryption methods (the control group), and the other group used the encryption method proposed by this invention (the experimental group). During the experiment, the data upload time, data decryption time, identity authentication success rate, system resource consumption, and user revocation time of each terminal were recorded. First, an identifier was assigned to each terminal, and user attributes were anonymized to generate a key. Next, the terminal encrypted the data and uploaded it to the cloud server. Identity authentication and decryption were performed by the edge node server. Finally, user revocation and attribute revocation operations were performed, and the relevant data was recorded.

[0129] The experimental group adopted the method of the present invention, including the calculation of system global parameters, the application of attribute anonymity algorithm, the execution of key generation and conversion algorithm, and the encryption and decryption processes, while the control group used the traditional encryption method.

[0130] Refer to Table 1 to record and analyze the experimental data.

[0131] Table 1 Experimental data record table

[0132]

[0133]

[0134] By comparing and analyzing the data of the power Internet of Things terminals in the experimental group and the control group in terms of data upload time, data decryption time, identity authentication success rate, system resource consumption and user revocation time, the beneficial effects brought by the method of the present invention can be clearly observed. For example, the data upload time of the experimental group was significantly shortened, with an average reduction of about 5 seconds, which shows that the method of the present invention has obvious advantages in data encryption and transmission efficiency. At the same time, the reduction in data decryption time, with an average of about 4 seconds, further confirms the effectiveness of the method of the present invention in improving decryption efficiency. In addition, the identity authentication success rate of the experimental group increased by about 10% on average. This data highlights the innovation of the present invention in enhancing system security. In terms of system resource consumption, the experimental group reduced by about 8% on average compared with the control group. This result shows that the method of the present invention has obvious advantages in resource consumption. It is more efficient in source utilization, helps to reduce unnecessary waste of resources, and reduces the user revocation time by an average of about 3 seconds, which also demonstrates the optimization effect of the present invention on the user management process. Based on these data analyses, the method of the present invention has demonstrated its innovation and advantages in the field of anonymous access control of the power Internet of Things. It not only improves the efficiency of data processing, but also enhances the security of the system, while optimizing resource utilization and user management. Compared with the existing technology, the present invention provides a more efficient and secure anonymous access control method. Through multi-authorization attribute encryption technology, it realizes the refined management of the power Internet of Things terminals and ensures the stable operation of the power system. Therefore, the present invention has obvious creativity and novelty at the technical level, and provides a new solution for the security management of the power Internet of Things. Therefore, our invention is creative.

[0135] Example 3, reference Figure 3 , as an embodiment of the present invention, provides an anonymous access control system for the power Internet of Things based on multi-authorization attribute encryption, including a system initialization module, an encryption and decryption module, and a revocation module.

[0136] The system initialization module is used to assign identifiers to attribute authorization agencies and data users based on the central authorization agency, anonymize the user's attributes, and generate keys; the encryption and decryption module is used to encrypt data through the power Internet of Things terminal, upload it to the cloud server storage, and authenticate and decrypt the user identity through the edge node server; the revocation module is used to perform user revocation and attribute revocation based on the user identifier.

[0137] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0138] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0139] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0140] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having logic gate circuits for implementing logical functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field-programmable gate array (FPGA), etc. It should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention and are not intended to be limiting. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced with equivalents without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications should be encompassed by the scope of the claims of the present invention.

[0141] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An anonymous access control method for power Internet of Things based on multi-authorization attribute encryption, characterized in that: include: Based on the central authority, identifiers are assigned to attribute authority and data users, the user's attributes are anonymized, and keys are generated; The data is encrypted through the power IoT terminal and uploaded to the cloud server for storage, and the user identity is authenticated and decrypted through the edge node server; Perform user revocation and attribute revocation based on the user identifier.

2. The anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption according to claim 1 is characterized in that: The identifier allocation includes setting the security parameter λ based on the central authorization agency, outputting the system global parameter GP, generating the authority identifier aid for each attribute authorization agency, generating the unique user identifier uid for each data user, and calculating the system global parameter GP, which is expressed as: GP={q,G1,G2,g,e,H},e:G1×G1→G2 Among them, G1 and G2 are different multiplicative groups, q is the order of G1 and G2, g is the generator of G1, e is a bilinear map, and H is a hash function.

3. The anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption as claimed in claim 2 is characterized in that: The method of generating a key by anonymizing the user's attributes includes constructing a private key SK for all attributes in its attribute set based on the system global parameter GP. aid , Public Key PK aid and Attribute Transfer Key AAK aid , construct the private key SK aid , expressed as: SK aid ={a a ,b a },a∈A aid ,(a a ,b a )∈Z q Among them, a is the attribute authority AA aid Managed attribute set A aid A single attribute in Z q is the set of integers in the sense of q, α a , β a Z q Random numbers in ; Construct public key PK aid , expressed as: Among them, i is the attribute number, PK 1,i ,PK 2,i is the component of the public key calculated for each attribute in the attribute set; Construct attribute conversion key AAK aid , expressed as: Among them, δ a , θ is Z q Random numbers in ; Through the attribute anonymity algorithm, input the system global parameter GP and attribute conversion key AAK aid and user attribute set A uid , calculate the user anonymous attribute set A' uid , expressed as: Among them, a' is the user's anonymous attribute set A' uid A single attribute in ; When an end user accesses data, the attribute authority AA aid Set the attribute Distribute to the data user with the identifier uid, and use the attribute anonymity algorithm to convert the attribute set A aid,uid Each attribute in is anonymously output as an anonymous attribute set A' aid,uid , and transmitted to the cloud server and added to the attribute list Set to in, A' is a list of attribute sets representing all attribute authorities for the same user. uid It represents the attribute set composed of all attribute authority attributes of the same user after anonymization. and user anonymous attribute set A' uid The data is transmitted to the user terminal through the cloud server for storage, and the key generation algorithm is executed by the attribute authorization agency, and the system global parameter GP and user attribute set A are input. uid , user identifier uid, private key SK aid and attribute b∈A uid , calculate the user's private key K b,uid , expressed as: The user's private key K b,uid Transmit to the cloud server for user identity authentication; Execute the key conversion algorithm through the data user terminal and input the user's private key K b,uid , calculate the pre-decryption key PreK b,uid and user recovery key K uid , expressed as: K uid ={Z},z∈Z q Where z is Z q Random numbers in ; The pre-decryption key PreK b,uid Transmit to the cloud server, add to the key list LK, set to LK = LK {uid, PreK b,uid ,K b,uid }, user recovery key K uid Held by the end user.

4. The anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption as claimed in claim 3 is characterized in that: The encrypted data includes executing the encrypted data through the power Internet of Things terminal, and outputting the intermediate ciphertext EM' in the offline encryption stage, which is expressed as: IN'={AND 1,i ,AND 2,i ,AND 3,i ,IN 1,i ,IN 2,i },i∈[1,n] Where n is the number of attributes, λ' i , α' i , β' i ,ω' i , γ i Z q The random numbers in are the two components of the public key calculated based on random numbers, E 1,i 、E 2,i 、E 3,i , EM 1,i , EM 2,i It is the component of the calculated intermediate ciphertext; In the online encryption phase, input the system global parameter GP, intermediate ciphertext EM', public key PK aid , matrix M, message m, encrypt message m, calculate the encrypted ciphertext EM, expressed as: E0=m·e(g,g) s E 4,i =λ i -l' i E 5,i =ω i -oh' i EM={E0,E 1,i ,E 2,i ,E 3,i ,E 4,i ,E 5,i ,EM 1,i ,EM 2,i ,D 1,i ,D 2,i },i∈[1,n] Where s is Z q The random number in, ρ(i) is the attribute mapped to each row of the matrix M, E0, E 4,i 、E 5,i , D 1,i , D 2,i It is the component of the calculated ciphertext.

5. The anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption as claimed in claim 4 is characterized in that: The user identity authentication and decryption includes performing user identity authentication and decryption through the edge node server. When a terminal user with a user identifier uid sends a data access request to the cloud server, the cloud server sends a data access request to the cloud server from the attribute list. View the anonymous attribute set A' of the relevant user uid , and sent to the edge node server, the edge node server performs anonymous attribute set A' uid For authentication, enter the system global parameter GP, ciphertext EM, user identifier uid and user private key Ka ,uid , calculate the authentication result, expressed as: in, is the set of non-zero integers in the sense of q, c i To satisfy Σ a c i M i = a constant of (1,0,…,0); If v user =1, the edge node server will perform the decryption operation, input the system global parameter GP, ciphertext EM, authentication result v user and the pre-decryption key PreK b,uid , calculate the partial decrypted ciphertext EM after pre-decryption out , expressed as: AND' 2,i =And 2,i IN out ={EM1,EM2} Among them, E' 1,i , E' 2,i , E' 3,i is the intermediate result of calculating the pre-decrypted ciphertext, EM1 and EM2 are the calculated pre-decrypted ciphertext EM out The two components of The pre-decrypted partial decryption ciphertext EM out = {EM1, EM2} is sent to the data user, and the user decryption process is performed through the data user terminal, and the system global parameter GP, ciphertext EM, and partial decryption ciphertext EM are input. out , user recovery key K uid , calculate the message m, expressed as: EM=EM'2·EM1 EM z =e(g,g) s Among them, EM'2 is based on the user recovery key K uid The calculated value of the pre-decrypted ciphertext component EM2, EM z Based on the user recovery key K uid The calculated value of the ciphertext EM; If v user ≠1, a terminator will be output and the decryption algorithm will stop immediately.

6. The anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption as claimed in claim 5 is characterized by: The user revocation includes deleting the user key and attribute set from the key and attribute list through the cloud server according to the user identifier uid of the user to be revoked.

7. The anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption according to claim 6 is characterized in that: The attribute revocation includes using A R Represents user uid from attribute authority AA aid Revoked attribute set, for all attributes with attribute set A R The unrevokated user changes the stored data and executes the key update algorithm through the attribute authority to calculate the updated key UK i , expressed as: in, Z q Random numbers in ; Each belonging to A R , update the public key to The private key is Execute the private key update algorithm through the cloud server to calculate the updated private key and the pre-decryption key It is expressed as: Among them, K i,uid is the user private key belonging to the i-th attribute; The ciphertext update algorithm is executed by the power Internet of Things terminal. When the update key UK is received from the attribute authority i When , the ciphertext is updated and the updated ciphertext is calculated, which is expressed as: in, is the EM in the original ciphertext 1,i , D 1,i Updated results.

8. A system using the anonymous access control method for power Internet of Things based on multi-authorization attribute encryption as described in any one of claims 1 to 7, characterized in that: Including system initialization module, encryption and decryption module, and revocation module; The system initialization module is used to assign identifiers to attribute authorization agencies and data users based on the central authorization agency, anonymize the user's attributes, and generate a key; The encryption and decryption module is used to encrypt data through the power Internet of Things terminal, upload it to the cloud server for storage, and authenticate and decrypt the user identity through the edge node server; The revocation module is used to perform user revocation and attribute revocation according to the user identifier.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the anonymous access control method for the power Internet of Things based on multi-authorization attribute encryption described in any one of claims 1 to 7 are implemented.

Images