Data access management method and device, server and storage medium
By receiving attribute updates and updating access attribute sets, generate new proxy update keys, directly manage the data access request of target users, solve the problem of complexity of user attribute permissions in the existing technology, and realize the simplified authority update process and the simplified authority update process and the simplified authority update process and Improve efficiency.
Patent Information
- Application Number
- CN202410952616.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-07-16
- Publication Date
- 2025-01-24
AI Technical Summary
Existing data access management technology is complicated when user attribute permissions are changed, and all permissions need to be revoked first and then register new permissions.
Update the data through receiving attributes, update the user's access attribute set, generate a new proxy update key, directly manage the data access request of the target user, and avoid the steps to be revoked first and then register.
Simplify the update process of user attribute permissions, reduce the complexity of the operation, and improve the efficiency of permissions change.
Smart Images
Figure CN119363324A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of user authority management, and in particular to a data access management method, device, server and storage medium. Background Art
[0002] In order to ensure the security of data, the existing technology provides an encryption (CP-ABE) algorithm, which can provide users with partial data attributes in the complete data that match the user's permissions when the user accesses the data; for example, a complete data includes multiple data attributes such as data content, data generation time, data effective time, data access history, etc. When a user registers, he is assigned attribute permissions to access the two data attributes of data content and data generation time. During subsequent access, the user can only access the partial data corresponding to these two attribute permissions.
[0003] The current encryption (CP-ABE) algorithm can revoke a user's access rights to all data attributes (i.e., the attribute permissions mentioned above). However, when a user's attribute permissions need to be changed, for example, from "data content & data generation time" to "data content & data effective time", it is necessary to first revoke all attribute permissions of the user and then register new attribute permissions for the user, which is a complicated operation.
[0004] Therefore, current data access management technology has the technical problem of complex changes in user attribute permissions. Summary of the invention
[0005] In order to alleviate the technical problem of complex changes in user attribute permissions in current data access management technologies, embodiments of the present invention provide a data access management method, device, server, and storage medium.
[0006] In a first aspect, an embodiment of the present invention provides a data access management method, including:
[0007] receiving attribute update data for updating attribute access rights of a user;
[0008] According to the attribute update data, the first access attribute set is updated to obtain a second access attribute set;
[0009] updating the first proxy update key to obtain a second proxy update key according to the second access attribute set;
[0010] The data access request of the target user identification is managed according to the second proxy update key.
[0011] In some embodiments, updating the first proxy update key to obtain the second proxy update key according to the second access attribute set includes:
[0012] Get public parameters and master key;
[0013] The second proxy update key is obtained according to the public parameter, the master key, the second access attribute set and the first proxy update key.
[0014] In some embodiments, updating the first access attribute set to obtain the second access attribute set according to the attribute update data includes:
[0015] Determine, according to the attribute update data, a first attribute permission set that needs to be granted to the target user identifier and a second attribute permission set that needs to be revoked;
[0016] The first access attribute set corresponding to the target user identifier is updated according to the first attribute permission set and the second attribute permission set to obtain the second access attribute set.
[0017] In some embodiments, updating the first access attribute set to obtain the second access attribute set according to the attribute update data includes:
[0018] Determining, according to the attribute update data, a first set of users to be granted a first attribute permission and a second set of users to be revoked a second attribute permission;
[0019] The first access attribute set is updated according to the first user set and the second user set to obtain the second access attribute set.
[0020] In some embodiments, the managing the data access request of the target user identification according to the second proxy updating key includes:
[0021] Obtain a user attribute set and a partial private key of the target user identifier;
[0022] According to the user attribute set of the target user identifier, the user partial private key and the second proxy update key, an updated user attribute set and user partial private key corresponding to the target user identifier are obtained.
[0023] In some embodiments, the managing the data access request of the target user identification according to the second proxy updating key includes:
[0024] Get user parameters, granted attribute set, updated granted attribute user list, public parameters and master key;
[0025] The attribute set added to the target user identifier is determined according to the user parameters, the granted attribute set, the updated granted attribute user list, the public parameters, the master key and the second proxy update key.
[0026] In some embodiments, before managing the data access request of the target user identification according to the second agent updating key, the method further includes:
[0027] Determine the ciphertext set that needs to be updated according to the attribute set that needs to be updated;
[0028] Outputting an updated ciphertext set according to the second access attribute set, the ciphertext set to be updated, and the second proxy update key.
[0029] In a second aspect, an embodiment of the present invention provides a data access management device, including:
[0030] A receiving module, used for receiving attribute update data for updating user attribute access rights;
[0031] A first updating module, configured to update the first access attribute set to obtain a second access attribute set according to the attribute update data;
[0032] A second updating module, configured to update the first proxy update key to obtain a second proxy update key according to the second access attribute set;
[0033] A management module is used to manage the data access request of the target user identification according to the second agent update key.
[0034] In a third aspect, an embodiment of the present invention provides a server, comprising a memory and a processor; a computer program is stored in the memory, and when the computer program is executed by the processor, the method described in the first aspect is implemented.
[0035] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by one or more processors, the method described in the first aspect is implemented.
[0036] Compared with the prior art, one or more embodiments of the present invention can at least bring the following beneficial effects:
[0037] The embodiment of the present invention provides a data access management method, device, server and storage medium; the method includes: receiving attribute update data for updating user attribute access rights, updating a first access attribute set to obtain a second access attribute set according to the attribute update data, updating a first proxy update key to obtain a second proxy update key according to the second access attribute set, and managing data access requests of a target user identifier according to the second proxy update key. In the scheme provided by the present application, after receiving the attribute update data, the first access attribute set is directly updated to obtain a second access attribute set according to the attribute update data, and then the first proxy update key is updated to obtain a second proxy update key according to the second access attribute set, and then the data access request of the target user identifier is managed according to the second proxy update key. The whole process does not need to revoke the user first and then register the user attribute rights, which simplifies the update process of the user attribute rights and alleviates the technical problem of complex changes in user attribute rights in the current data access management technology. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.
[0039] Figure 1 This is a first flow chart of the data access management method provided by an embodiment of the present invention;
[0040] Figure 2 This is a second flow chart of the data access management method provided by an embodiment of the present invention;
[0041] Figure 3 It is a structural diagram of a data access management device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0042] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents the selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present invention.
[0043] Embodiment 1
[0044] Figure 1 The first flow chart of the data access management method provided in the embodiment of the present application is as follows: Figure 1 , describes the data access management method provided by this application. Figure 1 , the data access management method provided in this embodiment includes:
[0045] Step S110: receiving attribute update data for updating user attribute access rights.
[0046] In this application, the data access management method is used for the data access management system. The data access management system model includes five entities: attribute authority, data owner, user, proxy server and cloud server. The attribute authority (Auth) is a completely trustworthy party, responsible for system establishment, new user authorization, attribute distribution and private key generation; when a user's attribute changes (revokes or adds) in the system, the attribute authority establishes a user list for attribute revocation and addition, and updates public parameters, master keys and proxy keys. The data owner (Do) has a large number of data files that need to be stored in the cloud server. The user (U), that is, the data accessor, tries to search and download data from the cloud server. The proxy server (PS) helps the user establish a keyword index, generate a trapdoor, and use the proxy service key to update the ciphertext in time. Before the user attribute verification, the user's version number, attributes and private key are updated respectively to facilitate normal access by the user, and in the decryption stage, it helps the user decrypt most of the parameters to facilitate further decryption by the user. The cloud server (CS) has a large amount of storage space and computing resources. When it receives a ciphertext storage task, it assigns a unique identity to the ciphertext, uses a partial order relationship to establish a file index, and stores the file in a certain format. When it receives a query request, it first interactively verifies the user's attributes. After each success, it searches for index files that meet the user's attributes based on the file index and search trap, and outputs the corresponding ciphertext to the user, otherwise it does not output it.
[0047] In the present application, the attribute update data includes the target user ID or target user ID list of the user whose user attribute access rights need to be updated, the attribute change status of the target user (such as revoking or adding permissions), etc.
[0048] In this embodiment, when a user (ie, a target user) needs to change the user attribute access rights, the attribute authority receives attribute update data for updating the user attribute access rights.
[0049] Step S120: According to the attribute update data, the first access attribute set is updated to obtain a second access attribute set.
[0050] In some embodiments, updating the first access attribute set to obtain the second access attribute set according to the attribute update data includes: determining, according to the attribute update data, a first attribute permission set that needs to be granted and a second attribute permission set that needs to be revoked for the target user identifier; and updating, according to the first attribute permission set and the second attribute permission set, the first access attribute set corresponding to the target user identifier to obtain the second access attribute set.
[0051] In this application, the first attribute authority and the second attribute authority are attribute private keys.
[0052] In the present application, the target user identifiers include the user identifiers of registered users whose access attributes need to be updated and the user identifiers of newly registered users.
[0053] Specifically, this embodiment is applicable to the revocation or granting of attributes of a single target user; in this embodiment, the attribute authority determines which target users need to be granted which attribute permissions, and which target users need to revoke which attribute permissions based on the attribute update data, and takes the attribute permissions that need to be granted to the target users as the first attribute permission set, and takes the attribute permissions that need to be revoked by the target users as the second attribute permission set; after the first attribute permission set and the second attribute permission set are determined, the first access attribute set corresponding to the target user identifier is updated according to the first attribute permission set and the second attribute permission set to obtain the second access attribute set.
[0054] In some embodiments, updating the first access attribute set to obtain the second access attribute set according to the attribute update data includes: determining, according to the attribute update data, a first user set of first attribute permissions that need to be granted and a second user set of second attribute permissions that need to be revoked; and updating the first access attribute set to obtain the second access attribute set according to the first user set and the second user set.
[0055] Specifically, this embodiment is applicable to the revocation or granting of a certain attribute by some users (the first user set or the second user set). In this embodiment, the attribute authority determines which users need to be granted the first attribute permission and which users need to revoke the second attribute permission based on the attribute update data, and takes the users who need to be granted the first attribute permission as the first user set, and takes the users who need to revoke the second attribute permission as the second user set. Then, the first attribute permission is granted to the first user set, and the second attribute permission is revoked from the second user set, that is, according to the first user set and the second user set, the first access attribute set is updated to obtain the second access attribute set.
[0056] Step S130: According to the second access attribute set, the first proxy update key is updated to obtain a second proxy update key.
[0057] In some embodiments, updating the first proxy update key to obtain the second proxy update key according to the second access attribute set includes: obtaining public parameters and a master key; and obtaining the second proxy update key according to the public parameters, the master key, the second access attribute set and the first proxy update key.
[0058] Specifically, after obtaining the second access attribute set, the public parameters and the master key are obtained, and the attribute authority executes the version update algorithm, that is, The algorithm inputs public parameters, a master key, a second access attribute set (i.e., an attribute set to be revoked and an attribute set to be granted), and a first proxy update key, and outputs updated public parameters, a master key, and a second proxy update key, i.e., obtains the second proxy update key based on the public parameters, the master key, the second access attribute set, and the first proxy update key.
[0059] Step S140: managing the data access request of the target user identifier according to the second proxy update key.
[0060] In some embodiments, managing the data access request of the target user identifier according to the second proxy update key includes: obtaining a user attribute set and a user partial private key of the target user identifier; and obtaining an updated user attribute set and a user partial private key corresponding to the target user identifier according to the user attribute set, the user partial private key and the second proxy update key. That is, this embodiment corresponds to revoking an attribute.
[0061] In some embodiments, managing the data access request of the target user identification according to the second proxy update key includes: obtaining user parameters, a set of granted attributes, an updated user list of granted attributes, public parameters, and a master key; and determining the set of attributes added to the target user identification according to the user parameters, the set of granted attributes, the updated user list of granted attributes, public parameters, the master key, and the second proxy update key. That is, this embodiment corresponds to granting (adding) attributes.
[0062] In some embodiments, before managing the data access request of the target user identification according to the second proxy update key, it also includes: determining the ciphertext set that needs to be updated according to the attribute set that needs to be updated; outputting the updated ciphertext set according to the second access attribute set, the ciphertext set that needs to be updated and the second proxy update key.
[0063] Specifically, the proxy server executes the ciphertext update algorithm, which is: PS.ReEnc(γ,rk,C γ). Input the updated attribute set and the second agent update key, and output the updated ciphertext set.
[0064] The data access management method provided in this embodiment directly updates the first access attribute set according to the attribute update data to obtain the second access attribute set after receiving the attribute update data, and then updates the first proxy update key according to the second access attribute set to obtain the second proxy update key, and then manages the data access request of the target user identification according to the second proxy update key. The whole process does not need to revoke the user first and then register the user attribute authority, which simplifies the update process of the user attribute authority and alleviates the technical problem of complex user attribute authority change existing in the current data access management technology; and the data access management method is not only applicable to the revocation or granting of a single attribute, but also to the revocation or granting of a certain attribute set of some users, and to some users who need to revoke some attributes and add another part of attributes.
[0065] Figure 2 A second flow chart of the data access management method provided in the embodiment of the present application is shown below in combination with Figure 2 And CP-ABE (Cipher Policy Attribute Based Encryption) algorithm, the data access management method provided by this application is explained.
[0066] In this application, the CP-ABE algorithm has the functions of revoking and granting attributes.
[0067] See also Figure 1 , the data access management method provided in this embodiment includes:
[0068] S1: Auth.Setup(λ,U) initialization algorithm.
[0069] In this embodiment, the Auth.Setup(λ,U) initialization algorithm is executed by the attribute authority. Specifically, the security parameters and the full set of attributes are input, and the public parameters, the master key, and the proxy update key are output.
[0070] S2: DO.Enc (PK, M, T) encryption algorithm.
[0071] In this embodiment, the DO.Enc (PK, M, T) encryption algorithm is executed by the data owner's terminal. The data owner (Do) has a large number of data files that need to be stored in the cloud server. With the help of the proxy server, a keyword index is established, and an attribute-based access policy is used to encrypt the data. Finally, the indexed and encrypted data is uploaded to the cloud server. When executing the DO.Enc (PK, M, T) encryption algorithm, public parameters, messages (data provided by the data owner, including data under multiple attributes) and an access tree (i.e., which access permission attributes correspond to which data under which attributes) are input, and the ciphertext (i.e., encrypted data) is output.
[0072] S3: Private key generation algorithm.
[0073] In this embodiment, The private key generation algorithm is executed by the attribute authority. Specifically, the master key, identity (i.e., the user ID mentioned above) and the corresponding attribute set are input, and the private key of the data accessor is output.
[0074] S4: Decryption algorithm.
[0075] In this embodiment, The decryption algorithm is jointly executed by the user and the proxy server. The ciphertext and the user's private key are input, that is, the access end initiates an access request, carrying the visitor's user ID; the encrypted data is determined according to the access request; if the access structure of the tree is satisfied, the message corresponding to the ciphertext is output, otherwise the output is terminated.
[0076] In this application, when a user attempts to search and download data from a cloud server, he first generates a trapdoor with the help of a proxy server, and then the proxy server updates its version, attributes, and some private keys (that is, updates the private keys of attributes that do not need to be revoked, and grants the corresponding private keys to the attributes that need to be granted); then sends the updated attributes and trapdoors to the cloud server; after receiving the request, the cloud server first interactively verifies its attributes, and after success, searches for matching file indexes based on the trapdoor, and then outputs the corresponding ciphertext. In order to reduce the decryption load, after receiving the ciphertext, the user hands over most of the decryption tasks to the proxy server, and successfully decrypts without leaking the data content, and finally successfully decrypts with his own private key.
[0077] In this application, the proxy server helps users establish keyword indexes, generate trapdoors, and use the proxy server key to update the ciphertext in a timely manner. Before the user attribute verification, the user's version number, attributes, and private key are updated separately to facilitate normal user access, and help users decrypt most parameters in the decryption stage to facilitate further decryption.
[0078] In this application, the cloud server has a large amount of storage space and computing resources. When it receives a ciphertext storage task, it assigns a unique identity to the ciphertext, uses a partial order relationship to establish a file index, and stores the file in a certain format; when it receives a query request, it first interactively verifies the user attributes. After each success, it searches for index files that meet the user attributes based on the file index and search trap, and outputs the corresponding ciphertext to the user, otherwise it does not output it.
[0079] S5: Version update algorithm.
[0080] In this embodiment, The version update algorithm is executed by the authority. Specifically, the algorithm inputs public parameters, the master key, the attribute set to be revoked and the attribute set to be granted (corresponding to the second access attribute set mentioned above), and the proxy update key (corresponding to the first proxy update key mentioned above), and outputs the updated public parameters, the master key, and the proxy update key (corresponding to the second proxy update key mentioned above).
[0081] S6: PS.ReEnc(γ,rk,C γ ) Ciphertext update algorithm.
[0082] In this embodiment, PS.ReEnc(γ,rk,C γ ) The ciphertext update algorithm is executed by the proxy server. Specifically, the attribute set to be updated, the updated partial proxy update key, and the partial ciphertext set are input, and the updated partial ciphertext set is output.
[0083] S7: Private key update algorithm.
[0084] In this embodiment, The private key update algorithm is executed by the proxy server. Specifically, the algorithm inputs the user identity, the user attribute set, the user partial private key and the updated proxy update key, and outputs the updated user attribute set and the user partial private key; that is, this embodiment corresponds to revoking attributes.
[0085] S8: Attribute addition granting algorithm.
[0086] In this embodiment, The attribute addition granting algorithm is executed by the proxy server. Specifically, the algorithm inputs the user identity, user parameters, the granted attribute set, the updated granted attribute user list, public parameters, and the master key, and outputs the attribute set that the user needs to add and the added partial private key.
[0087] That is, the data access management method provided in this embodiment does not need to revoke the user first and then register the user attribute permissions during the entire process, which simplifies the update process of user attribute permissions and alleviates the technical problem of complex user attribute permission changes in current data access management technologies; and the data access management method is not only applicable to the revocation or granting of a single attribute, but also to the revocation or granting of a certain attribute set of some users, and to the revocation of some attributes and the addition of other attributes for some users.
[0088] Embodiment 2
[0089] Based on the foregoing embodiments, the embodiments of the present application provide a data access management device, wherein each module included in the device and each unit included in each module can be implemented by a processor in a computer device; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU, Central Processing Unit), a microprocessor (MPU, Microprocessor Unit), a digital signal processor (DSP, Digital Signal Processing) or a field programmable gate array (FPGA, Field Programmable Gate Array), etc.
[0090] Figure 3 For a structural diagram of the data access management device provided in the embodiment of the present application, please refer to Figure 3 The data access management device provided in this embodiment includes a receiving module 310, a first updating module 320, a second updating module 330 and a management module 340.
[0091] A receiving module 310, configured to receive attribute update data for updating user attribute access rights;
[0092] A first updating module 320, configured to update the first access attribute set to obtain a second access attribute set according to the attribute update data;
[0093] A second updating module 330, configured to update the first proxy update key to obtain a second proxy update key according to the second access attribute set;
[0094] The management module 340 is used to manage the data access request of the target user identification according to the second proxy update key.
[0095] In some embodiments, the first update module 320 is further used to determine, based on the attribute update data, a first attribute permission set that needs to be granted to the target user identifier and a second attribute permission set that needs to be revoked; and based on the first attribute permission set and the second attribute permission set, update the first access attribute set corresponding to the target user identifier to obtain the second access attribute set.
[0096] In some embodiments, the first update module 320 is further used to determine, based on the attribute update data, a first user set that needs to be granted first attribute permissions and a second user set that needs to revoke second attribute permissions; and based on the first user set and the second user set, update the first access attribute set to obtain the second access attribute set.
[0097] In some embodiments, the second update module 330 is further used to obtain public parameters and a master key; and obtain the second proxy update key according to the public parameters, the master key, the second access attribute set and the first proxy update key.
[0098] In some embodiments, the management module 340 is also used to obtain the user attribute set and the user partial private key of the target user identifier; based on the user attribute set, the user partial private key and the second agent update key of the target user identifier, the updated user attribute set and the user partial private key corresponding to the target user identifier are obtained.
[0099] In some embodiments, the management module 340 is also used to obtain user parameters, a set of granted attributes, an updated user list of granted attributes, public parameters and a master key; and determine the set of attributes added to the target user identifier based on the user parameters, the set of granted attributes, the updated user list of granted attributes, public parameters, the master key and the second agent update key.
[0100] The specific implementation example of executing the data access management method based on the above modules has been described in detail in the first embodiment and will not be repeated here.
[0101] Embodiment 3
[0102] This embodiment provides a server, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the data access management method described in Embodiment 1 is implemented. It can be understood that the server may also include an input / output (I / O) interface and a communication component.
[0103] The processor is used to execute all or part of the steps in the data access management method in Embodiment 1. The memory is used to store various types of data, which may include instructions of any application or method in the server, and data related to the application.
[0104] The processor can be an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller, a microprocessor or other electronic components, and is used to execute the data access management method in the above-mentioned embodiment 1.
[0105] The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.
[0106] Embodiment 4
[0107] This embodiment also provides a computer-readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (for example, an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a disk, an optical disk, a server, an App application store, etc., on which a computer program is stored. When the computer program is executed by a processor, the following method steps can be implemented:
[0108] receiving attribute update data for updating attribute access rights of a user;
[0109] According to the attribute update data, the first access attribute set is updated to obtain a second access attribute set;
[0110] updating the first proxy update key to obtain a second proxy update key according to the second access attribute set;
[0111] The data access request of the target user identification is managed according to the second proxy update key.
[0112] The specific implementation process of the above method steps can be found in Example 1, and this embodiment will not be repeated here.
[0113] In summary, the present application provides a data access management method, device, server and storage medium; the method includes: receiving attribute update data for updating user attribute access rights, updating a first access attribute set to obtain a second access attribute set according to the attribute update data, updating a first proxy update key to obtain a second proxy update key according to the second access attribute set, and managing data access requests of a target user identifier according to the second proxy update key. In the scheme provided by the present application, after receiving the attribute update data, the first access attribute set is directly updated to obtain a second access attribute set according to the attribute update data, and then the first proxy update key is updated to obtain a second proxy update key according to the second access attribute set, and then the data access request of the target user identifier is managed according to the second proxy update key. The whole process does not require revoking the user first and then registering the user attribute rights, which simplifies the update process of the user attribute rights and alleviates the technical problem of complex changes in user attribute rights in the current data access management technology.
[0114] In the several embodiments provided in the embodiments of the present invention, it should be understood that the disclosed system and method can also be implemented in other ways. The system and method embodiments described above are merely illustrative.
[0115] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.
[0116] Although the embodiments disclosed in the present invention are as above, the above contents are only embodiments adopted for facilitating the understanding of the present invention and are not intended to limit the present invention. Any technician in the technical field to which the present invention belongs can make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed in the present invention, but the patent protection scope of the present invention shall still be subject to the scope defined in the attached claims.
Claims
1. A data access management method, characterized in that: include: receiving attribute update data for updating attribute access rights of a user; According to the attribute update data, the first access attribute set is updated to obtain a second access attribute set; updating the first proxy update key to obtain a second proxy update key according to the second access attribute set; The data access request of the target user identification is managed according to the second proxy update key.
2. The data access management method according to claim 1, characterized in that: The updating of the first proxy update key to obtain the second proxy update key according to the second access attribute set includes: Get public parameters and master key; The second proxy update key is obtained according to the public parameter, the master key, the second access attribute set and the first proxy update key.
3. The data access management method according to claim 1, characterized in that: The updating of the first access attribute set to obtain the second access attribute set according to the attribute update data includes: Determine, according to the attribute update data, a first attribute permission set that needs to be granted to the target user identifier and a second attribute permission set that needs to be revoked; The first access attribute set corresponding to the target user identifier is updated according to the first attribute permission set and the second attribute permission set to obtain the second access attribute set.
4. The data access management method according to claim 1, characterized in that: The updating of the first access attribute set to obtain the second access attribute set according to the attribute update data includes: Determining, according to the attribute update data, a first set of users to be granted a first attribute permission and a second set of users to be revoked a second attribute permission; The first access attribute set is updated according to the first user set and the second user set to obtain the second access attribute set.
5. The data access management method according to claim 1, characterized in that: The step of updating the key according to the second agent and managing the data access request of the target user identifier includes: Obtain a user attribute set and a partial private key of the target user identifier; According to the user attribute set of the target user identifier, the user partial private key and the second proxy update key, an updated user attribute set and user partial private key corresponding to the target user identifier are obtained.
6. The data access management method according to claim 1, characterized in that: The step of updating the key according to the second agent and managing the data access request of the target user identifier includes: Get user parameters, granted attribute set, updated granted attribute user list, public parameters and master key; The attribute set added to the target user identifier is determined according to the user parameters, the granted attribute set, the updated granted attribute user list, the public parameters, the master key and the second proxy update key.
7. The data access management method according to any one of claims 1 to 6, characterized in that: Before the step of updating the key according to the second agent and managing the data access request of the target user identification, the method further includes: Determine the ciphertext set that needs to be updated according to the attribute set that needs to be updated; Outputting an updated ciphertext set according to the second access attribute set, the ciphertext set to be updated, and the second proxy update key.
8. A data access management device, characterized in that: include: A receiving module, used for receiving attribute update data for updating user attribute access rights; A first updating module, configured to update the first access attribute set to obtain a second access attribute set according to the attribute update data; A second updating module, configured to update the first proxy update key to obtain a second proxy update key according to the second access attribute set; A management module is used to manage the data access request of the target user identification according to the second agent update key.
9. A server, characterized in that: The method comprises a memory and a processor; a computer program is stored in the memory, and when the computer program is executed by the processor, the method according to any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by one or more processors, the method according to any one of claims 1 to 7 is implemented.