Grid-based hybrid revocable attribute encryption and decryption method and system

Abstract

The invention discloses a lattice-based hybrid revocable attribute encryption and decryption method and system, and the method comprises the steps: generating a common parameter and a master key according to an initialization algorithm, and constructing a binary tree structure; a binary tree leaf node is distributed to a user based on the binary tree structure, a user private key is generated in combination with a user attribute set and the master key, and the user private key comprises a path node key component; constructing a user revocation list according to the access strategy, and embedding a ciphertext in the user revocation list; verifying that the attribute set meets the access strategy and checking whether the secret key is consistent with the ciphertext version, and if yes, using the updated secret key to complete decryption. And through a key and ciphertext updating algorithm, the decryption capability of a specified attribute is periodically revoked to realize indirect attribute revocation.

Description

Technical Field

[0001] The present invention belongs to the technical field of cyberspace security, and in particular relates to a lattice-based hybrid revocable attribute encryption and decryption method and system. Background Art

[0002] In cloud storage applications, data encryption and access control are the core technologies to ensure secure data sharing. With the widespread application of cloud computing, more and more enterprises and individuals store sensitive data in the cloud. In order to ensure data security, traditional encryption technology and access control mechanisms are difficult to meet the increasingly complex security requirements in many cases, especially in scenarios that require flexible handling of user revocation and attribute revocation. Although traditional attribute-based encryption (ABE) schemes provide flexible access control methods, they still face many challenges in practical applications. Attribute-based encryption (ABE), as a flexible encryption technology, has been widely used in cloud storage and data sharing. It allows data owners to set access rights based on specific attributes of users, and only users who meet specific attribute conditions can access encrypted data. However, traditional ABE schemes have some difficult-to-solve bottlenecks when handling user revocation and attribute revocation, especially when combining the two. The specific problems are as follows: (1) Complexity of user revocation and attribute revocation: Existing ABE schemes usually adopt two modes: direct revocation and indirect revocation. Direct revocation broadcasts updated keys to non-revoked users through the key generation center (KGC) on a regular basis; while indirect revocation implements ciphertext delegation by embedding the identity of the revoked user in the ciphertext. Although these two modes can achieve certain access control, they rely on different mathematical constructions and security assumptions, which leads to technical difficulties in combining these two revocation mechanisms in the same scheme. (2) The threat of quantum computing to existing encryption schemes: With the rapid development of quantum computing technology, traditional encryption schemes based on elliptic curves and bilinear pairings may face the risk of being cracked by quantum computers. Existing identity-based encryption (IBE) and attribute-based encryption (ABE) schemes usually rely on mathematical problems such as discrete logarithms and bilinear maps that are vulnerable to quantum computing attacks, which makes their security in a quantum computing environment not effectively guaranteed. Summary of the invention

[0003] The present invention provides a lattice-based hybrid revocable attribute encryption and decryption method and system, which are used to solve the technical problem that the security of existing encryption methods cannot be effectively guaranteed in a quantum computing environment.

[0004] In a first aspect, the present invention provides a lattice-based hybrid revocable attribute encryption and decryption method, comprising: Generate public parameters and master key according to the initialization algorithm, and build a binary tree structure; Based on the binary tree structure, a binary leaf node is allocated to the user, and a user private key is generated by combining the user attribute set and the master key, wherein the user private key includes a path node key component; Constructing a user revocation list according to the access policy, and embedding ciphertext in the user revocation list; Verify that the attribute set satisfies the access policy and check whether the key and ciphertext versions are consistent. If they are consistent, use the updated key to complete the decryption.

[0005] In a second aspect, the present invention provides a lattice-based hybrid revocable attribute encryption and decryption system, comprising: A first generation module is configured to generate public parameters and a master key according to an initialization algorithm, and to construct a binary tree structure; A second generating module is configured to allocate binary tree leaf nodes to users based on the binary tree structure, and generate a user private key in combination with a user attribute set and the master key, wherein the user private key includes a path node key component; an embedding module configured to construct a user revocation list according to the access policy and embed the ciphertext in the user revocation list; The decryption module is configured to verify that the attribute set satisfies the access policy and check whether the key is consistent with the ciphertext version. If they are consistent, the updated key is used to complete the decryption.

[0006] According to a third aspect, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the lattice-based hybrid revocable attribute encryption and decryption method of any embodiment of the present invention.

[0007] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor is caused to execute the steps of the lattice-based hybrid revocable attribute encryption and decryption method of any embodiment of the present invention.

[0008] The lattice-based hybrid revocable attribute encryption and decryption method and system of the present application have the following beneficial effects: Adopt encryption technology based on the LWE problem, because the LWE problem is still considered difficult in the quantum computing environment, has quantum resistance, and can effectively cope with the security challenges brought by quantum computing; It combines direct revocation and indirect revocation mechanisms to provide flexible revocation functions. By embedding the revocation list in the ciphertext, it ensures that the revoked user cannot access the ciphertext, thereby achieving direct user revocation and instant access control. By regularly updating the key and combining the binary tree structure to update the revoked attribute, it ensures that the revoked attribute cannot continue to decrypt data, while not affecting the access rights of other unrevoked users, thus achieving indirect attribute revocation; It provides users with flexible revocation mode options. Users can freely choose direct or indirect revocation according to their needs, and manage access rights to ciphertext at both user-level revocation and attribute-level revocation levels, thereby improving the flexibility and adaptability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1 A flowchart of a lattice-based hybrid revocable attribute encryption and decryption method provided by an embodiment of the present invention; Figure 2 A structural block diagram of a lattice-based hybrid revocable attribute encryption and decryption system provided by an embodiment of the present invention; Figure 3 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0011] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0012] See also Figure 1 , which shows a flowchart of a lattice-based hybrid revocable attribute encryption and decryption method of the present application.

[0013] like Figure 1 As shown, the lattice-based hybrid revocable attribute encryption and decryption method specifically includes the following steps: Step S101, generate public parameters and a master key according to an initialization algorithm, and construct a binary tree structure.

[0014] In this step, enter the security parameters , attribute space , and the maximum number of users in the system ,in, is the first attribute, For the Attributes; According to the grid parameters , , and the original matrix ,run , and obtain the public matrix and the trapdoor matrix ,in, To generate a full rank matrix and the trapdoor matrix The algorithm, , is a real number; Random Selection Matrix , , and construct a full-rank difference mapping ,in, is a matrix with n rows and m columns, is a matrix of n rows and m columns consisting of the group elements of a group of order q, is a matrix with n rows and m columns, is an n-dimensional vector consisting of group elements of a group of order q; Build with A binary tree with leaf nodes , for each node in the tree Select Identifier ; Initialize property version ; Initialize version update polynomial ,in, is the incremental change of the attribute version number, Indicates the number of times the attribute is updated. is a group of order q The update factor randomly selected in ; Output common parameters and the master key ,in, The public matrix.

[0015] Step S102, assigning binary tree leaf nodes to users based on the binary tree structure, and generating user private keys in combination with the user attribute set and the master key, wherein the user private keys include path node key components.

[0016] In this step, enter the common parameters , Master Key ,User ID , and the user's attribute set ,in, , , , , is the attribute value, is the number of attributes, is the number of default attributes, is the number space of attributes; For user identity From a binary tree Select an unoccupied leaf node , and the user identity Assign to leaf nodes For each node on the user path , randomly selected Polynomial To construct the first vector ,for , construct the second vector ,in, For leaves The set of nodes on the path to the root, is the first polynomial function, is the nth polynomial function, is the nth polynomial function when x=i, is the symbol of the column vector, is a function that maps to group elements of a group of order q; For each node , generate key components according to preset rules, the preset rules are specifically: For user attribute sets , the key component is calculated by the sampling algorithm ,in, for The statistical distribution of is approximately a Gaussian distributed vector, is a Gaussian distributed vector, is a sampling algorithm that outputs a vector whose statistical distribution is approximately Gaussian. is the i-th full-rank difference mapping; System property sets , the key component is calculated by the sampling algorithm ; For user attribute sets ,make ; System property sets ,make ,in, ; The output user key is: ,in, To satisfy the private key of user id and attribute S, For collection.

[0017] Step S103: construct a user revocation list according to the access policy, and embed ciphertext in the user revocation list.

[0018] In this step, the output user key is: ,in, To satisfy the private key of user id and attribute S, For collection.

[0019] Randomly select vector and , , calculate the main ciphertext component as: ,in, is a group element in a distribution, is the noise distribution, is a vector, is the noise distribution vector, is the primary ciphertext component, is the first vector, , For the order of the group, is one of the ciphertext components; for , randomly generated matrix , the ciphertext component is calculated as: ,in, is the jth attribute, , For attributes, is the jth full-rank difference mapping, is the jth ciphertext component, For public parameters The j-th matrix in ; for , randomly generated matrix , the ciphertext component is calculated as: , ; For each revocation node , is a binary tree for revoking users, For the revocation list, randomly generate a matrix ,calculate , To revoke the ciphertext component of the node, is the identifier, An algorithm for outputting a minimum node subset that contains the ancestors of the corresponding leaf nodes of all unrevokated users; The attribute version number in the ciphertext As part of the ciphertext; Output ciphertext .

[0020] Step S104, verify that the attribute set meets the access policy and check whether the key and the ciphertext version are consistent. If they are consistent, use the updated key to complete decryption.

[0021] In this step, the key update algorithm is specifically as follows: Enter the old version and user key The execution process is: Calculate the key update version number: ; Calculate the version difference: , is the modulo symbol, is the order of the group; Update each key component: , is the updated i-th key component, is the i-th key component; Update the key version to and output the updated key ; The ciphertext update algorithm is as follows: Enter the old version , New Version 、Ciphertext The execution process is: Calculate the version difference: ; Ciphertext , updated to ; Update the ciphertext version; .

[0022] Output updated ciphertext .

[0023] Enter common parameters , User Key 、Ciphertext , the attribute set of the user is , the access policy of the ciphertext is , and includes the property version number ,in, , is the attribute value. The decryption process is as follows: Check the set of attributes that a user has Whether the access policy of the ciphertext is met : if When the user cancels In, return , indicating that decryption failed; Check the version consistency of the key and ciphertext: if , call the key update algorithm, Update to version ; if , call the ciphertext update algorithm, Update to version ; Construct a subset of attributes for decryption: from Select a subset of attributes that satisfies the policy , so that .

[0024] Verify the path node in the user Is there a key component required for decryption? Corresponding to attribute subset All properties in .

[0025] Calculate intermediate results: For each , calculate the Lagrange interpolation coefficients: , where Take the remainder modulo q, For attribute subset In addition to the current attribute j, is the current attribute, To remove the current attribute j; right Each attribute in the ciphertext Extract the corresponding ciphertext component , and combined with the user key Calculate partial decryption value ; Combined partial decryption results: Aggregate partially decrypted values , calculate the decryption auxiliary value ; Restore plaintext: Will The message part in is restored to plain text , Take the remainder modulo 2; verify Is it correct: If restored If the verification condition is met, it will be returned ; otherwise return Indicates that decryption failed.

[0026] In summary, the method of this application combines direct user revocation and indirect attribute revocation mechanisms to achieve a flexible, efficient, and quantum-resistant access control scheme. Direct user revocation is achieved by embedding a user revocation list in the ciphertext to revoke the access rights of a specific user; indirect attribute revocation is achieved by regularly revoking the decryption capability of a specified attribute through a key and ciphertext update algorithm.

[0027] See also Figure 2 , which shows a structural block diagram of a lattice-based hybrid revocable attribute encryption and decryption system of the present application.

[0028] like Figure 2 As shown, the hybrid revocable attribute encryption and decryption system 200 includes a first generation module 210 , a second generation module 220 , an embedding module 230 and a decryption module 240 .

[0029] Among them, the first generation module 210 is configured to generate public parameters and a master key according to an initialization algorithm, and to construct a binary tree structure; the second generation module 220 is configured to assign binary tree leaf nodes to users based on the binary tree structure, and to generate a user private key in combination with the user attribute set and the master key, wherein the user private key includes a path node key component; the embedding module 230 is configured to construct a user revocation list according to an access policy, and to embed a ciphertext in the user revocation list; the decryption module 240 is configured to verify that the attribute set satisfies the access policy and to check whether the key is consistent with the ciphertext version. If they are consistent, the updated key is used to complete the decryption.

[0030] It should be understood that Figure 2 Modules and references documented in Figure 1 Therefore, the operations and features described above for the method and the corresponding technical effects are also applicable to Figure 2 The modules in it will not be described in detail here.

[0031] In some other embodiments, the embodiments of the present invention further provide a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor is caused to execute the lattice-based hybrid revocable attribute encryption and decryption method in any of the above method embodiments; As an implementation mode, the computer-readable storage medium of the present invention stores computer-executable instructions, and the computer-executable instructions are configured as follows: Generate public parameters and master key according to the initialization algorithm, and build a binary tree structure; Based on the binary tree structure, a binary leaf node is allocated to the user, and a user private key is generated by combining the user attribute set and the master key, wherein the user private key includes a path node key component; Constructing a user revocation list according to the access policy, and embedding ciphertext in the user revocation list; Verify that the attribute set satisfies the access policy and check whether the key and ciphertext versions are consistent. If they are consistent, use the updated key to complete the decryption.

[0032] The computer-readable storage medium may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required by at least one function; the data storage area may store data created according to the use of a hybrid revocable attribute encryption and decryption system based on a grid, etc. In addition, the computer-readable storage medium may include a high-speed random access memory, and may also include a memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the computer-readable storage medium may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the hybrid revocable attribute encryption and decryption system based on a grid via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0033] Figure 3 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, such as Figure 3 As shown, the device includes: a processor 310 and a memory 320. The electronic device may also include: an input device 330 and an output device 340. The processor 310, the memory 320, the input device 330 and the output device 340 may be connected via a bus or other means. Figure 3 In the example, the bus connection is used. The memory 320 is the above-mentioned computer-readable storage medium. The processor 310 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 320, that is, the hybrid revocable attribute encryption and decryption method based on the grid of the above-mentioned method embodiment is realized. The input device 330 can receive input digital or character information, and generate key signal input related to user settings and function control of the hybrid revocable attribute encryption and decryption system based on the grid. The output device 340 may include a display device such as a display screen.

[0034] The electronic device can execute the method provided by the embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not described in detail in this embodiment, please refer to the method provided by the embodiment of the present invention.

[0035] As an implementation mode, the electronic device is applied to a lattice-based hybrid revocable attribute encryption and decryption system, and is used for a client, and includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can: Generate public parameters and master key according to the initialization algorithm, and build a binary tree structure; Based on the binary tree structure, a binary leaf node is allocated to the user, and a user private key is generated by combining the user attribute set and the master key, wherein the user private key includes a path node key component; Constructing a user revocation list according to the access policy, and embedding ciphertext in the user revocation list; Verify that the attribute set satisfies the access policy and check whether the key and ciphertext versions are consistent. If they are consistent, use the updated key to complete the decryption.

[0036] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0037] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A lattice-based hybrid revocable attribute encryption and decryption method, characterized in that: include: Generate public parameters and master key according to the initialization algorithm, and build a binary tree structure; Based on the binary tree structure, a binary leaf node is allocated to the user, and a user private key is generated by combining the user attribute set and the master key, wherein the user private key includes a path node key component; Constructing a user revocation list according to the access policy, and embedding ciphertext in the user revocation list; Verify that the attribute set satisfies the access policy and check whether the key and ciphertext versions are consistent. If they are consistent, use the updated key to complete the decryption.

2. A lattice-based hybrid revocable attribute encryption and decryption method according to claim 1, characterized in that: The generating of public parameters and a master key according to an initialization algorithm and constructing a binary tree structure includes: Enter security parameters , attribute space , and the maximum number of users in the system ,in, is the first attribute, For the Attributes; According to the grid parameters , , and the original matrix ,run , and obtain the public matrix and the trapdoor matrix ,in, To generate a full rank matrix and the trapdoor matrix The algorithm, , is a real number; Random Selection Matrix , , and construct a full-rank difference mapping ,in, is a matrix with n rows and m columns, is a matrix of n rows and m columns consisting of the group elements of a group of order q, is a matrix with n rows and m columns, is an n-dimensional vector consisting of group elements of a group of order q; Build with A binary tree with leaf nodes , for each node in the tree Select Identifier ; Initialize property version ; Initialize version update polynomial ,in, is the incremental change of the attribute version number, Indicates the number of times the attribute is updated. is a group of order q The update factor randomly selected in ; Output common parameters and the master key ,in, The public matrix.

3. A lattice-based hybrid revocable attribute encryption and decryption method according to claim 2, characterized in that: The allocating binary tree leaf nodes to the user based on the binary tree structure and generating the user private key in combination with the user attribute set and the master key comprises: Enter common parameters , Master Key ,User ID , and the user's attribute set ,in, , , , , is the attribute value, is the number of attributes, is the number of default attributes, is the number space of attributes; For user identity From a binary tree Select an unoccupied leaf node , and the user identity Assign to leaf nodes For each node on the user path , randomly selected Polynomial To construct the first vector ,for , construct the second vector ,in, For leaves The set of nodes on the path to the root, is the first polynomial function, is the nth polynomial function, is the nth polynomial function when x=i, is the symbol of the column vector, is a function that maps to group elements of a group of order q; For each node , generate key components according to preset rules, the preset rules are specifically: For user attribute sets , the key component is calculated by the sampling algorithm ,in, for The statistical distribution of is approximately a Gaussian distributed vector, is a Gaussian distributed vector, is a sampling algorithm that outputs a vector whose statistical distribution is approximately Gaussian. is the i-th full-rank difference mapping; System property sets , the key component is calculated by the sampling algorithm ; For user attribute sets ,make ; System property sets ,make ,in, ; The output user key is: ,in, To satisfy the private key of user id and attribute S, For collection.

4. A lattice-based hybrid revocable attribute encryption and decryption method according to claim 2, characterized in that: The constructing a user revocation list according to the access policy and embedding ciphertext in the user revocation list comprises: Enter common parameters , attribute collection ,parameter , Revocation List , and the plaintext ,in, is the attribute value, ; Randomly select vector and , , calculate the main ciphertext component as: ,in, is a group element in a distribution, is the noise distribution, is a vector, is the noise distribution vector, is the primary ciphertext component, is the first vector, , For the order of the group, is one of the ciphertext components; for , randomly generated matrix , the ciphertext component is calculated as: ,in, is the jth attribute, , For attributes, is the jth full-rank difference mapping, is the jth ciphertext component, For public parameters The j-th matrix in ; for , randomly generated matrix , the ciphertext component is calculated as: , ; For each revocation node , is a binary tree for revoking users, For the revocation list, randomly generate a matrix ,calculate , To revoke the ciphertext component of the node, is the identifier, An algorithm for outputting a minimum node subset that contains the ancestors of the corresponding leaf nodes of all unrevokated users; The attribute version number in the ciphertext As part of the ciphertext; Output ciphertext .

5. The lattice-based hybrid revocable attribute encryption and decryption method according to claim 2, characterized in that: The verification attribute set satisfies the access policy and checks whether the key and the ciphertext version are consistent. If they are consistent, the updated key is used to complete the decryption, including: inputting public parameters , User Key 、Ciphertext , the attribute set of the user is , the access policy of the ciphertext is , and includes the property version number ,in, , is the attribute value; Validation attribute collection Whether the access policy of the ciphertext is met , and check the revocation status; if the key version and the ciphertext version are inconsistent, call the key update algorithm or the ciphertext update algorithm for synchronization; Select a subset of attributes that satisfy the policy , calculate the Lagrange interpolation coefficients And combine the partial decrypted values ; According to the main ciphertext and Recover Plaintext .

6. A lattice-based hybrid revocable attribute encryption and decryption system, characterized in that: include: A first generation module is configured to generate public parameters and a master key according to an initialization algorithm, and to construct a binary tree structure; A second generating module is configured to allocate binary tree leaf nodes to users based on the binary tree structure, and generate a user private key in combination with a user attribute set and the master key, wherein the user private key includes a path node key component; an embedding module configured to construct a user revocation list according to the access policy and embed the ciphertext in the user revocation list; The decryption module is configured to verify that the attribute set satisfies the access policy and check whether the key is consistent with the ciphertext version. If they are consistent, the updated key is used to complete the decryption.

7. An electronic device, characterized in that: include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images