Inner product public key encryption method

Abstract

The invention relates to the technical field of computer security, in particular to an inner product public key encryption method, which specifically comprises the following steps: in a system initialization stage, a key generation center outputs a system main public key and a system main private key according to security parameters and a deterministic algorithm in a predicate coding function; in the key updating stage, the key generation center periodically updates a system main private key; in the key generation stage, the key generation center generates a user private key according to the new system main private key and the user predicate vector; in the encryption stage, a message sender encrypts a message plaintext according to a system main public key and user attributes to generate a ciphertext; in the decryption stage, the message receiver decrypts the ciphertext according to the user private key. The inner product public key encryption method has adaptive security and higher implementation efficiency, can resist attacks of attackers with continuous leakage capability, and has an attribute hiding function.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security, and in particular to an inner product public key encryption method. Background Art

[0002] Inner product encryption (IPE) is a special type of function encryption. Compared with traditional public key cryptography, inner product encryption can achieve fine-grained access control of ciphertext and has been widely used in emerging fields such as cloud computing. In modern network services, encryption technology is usually used in untrusted remote servers to ensure the privacy and security of a large amount of sensitive data. However, with the development of cryptanalysis technology, in addition to authorized users, attackers can also extract information from physical devices through side channel attacks, resulting in the leakage of decryption keys. Therefore, it is of great significance to construct an inner product encryption algorithm that can resist leakage attacks.

[0003] Most of the existing inner product public key encryption technologies that are resistant to leakage attacks are based on composite order groups, while the inner product public key encryption technology based on prime order groups is more efficient, and some scholars have conducted research on this. However, the two existing anonymous inner product public key encryption schemes based on prime order groups only have selective security. Therefore, how to determine a leakage-resistant inner product public key encryption scheme that achieves adaptive security and attribute hiding functions on prime order groups is a difficult problem that needs to be solved. Summary of the invention

[0004] Therefore, the technical problem to be solved by the present invention is to overcome the problem in the prior art that adaptive security and attribute hiding functions cannot be achieved in the inner product public key encryption scheme on a prime order group.

[0005] In order to solve the above technical problems, the present invention provides an inner product public key encryption scheme, the specific steps of which include:

[0006] In the system initialization phase, the key generation center outputs the system master public key mpk and the system master private key msk according to the deterministic algorithm in the predicate encoding function P in the security parameter λ and the prime order group that meets the anti-leakage and attribute hiding properties;

[0007] In the key update phase, the key generation center uses the deterministic algorithm in the predicate encoding function P to periodically update the system master private key msk and generate a new system master private key msk';

[0008] In the key generation phase, the key generation center generates the user private key sky based on the new system master private key msk' and the user predicate vector y using the deterministic algorithm in the predicate encoding function P;

[0009] In the encryption phase, the message sender encrypts the message plaintext m using the deterministic algorithm in the predicate encoding function P according to the system master public key mpk and the user attribute x to generate the ciphertext ct x ;

[0010] In the decryption phase, the message receiver uses the user's private key sk y , use the predicate encoding function P to encode the ciphertext ct x Decrypt.

[0011] In one embodiment of the present invention, the predicate encoding function in the prime order group that satisfies the anti-leakage and attribute hiding properties in is the user attribute set, is the user predicate set; the predicate encoding function P includes 7 deterministic algorithms And satisfy the following properties:

[0012] (1) For any Where x is the user attribute vector, y is the user predicate vector, v and z are user parameters, is the user parameter set, and have All satisfy the integer group modulo p Linearity on is the integer group of order n modulo p, is an L-order modulo p integer group, p is a prime number, taking values ​​in the prime field, and n and L are positive integers;

[0013] (2) For all the cases where P(x,y)=0 And all the random numbers distributed and distribution is statistically indistinguishable, where the user parameter w is randomly taken from the user parameter set have

[0014] (3) For all the cases where P(x,y)=0 And all the random numbers distributed and distribution is statistically indistinguishable, where the random number w is taken from the user parameter set f is a leaky function;

[0015] (4) For all random numbers User Parameters There is a linear algorithm satisfy Similarly, for all random numbers User Parameters User predicate vector There is a linear algorithm satisfy

[0016] (5) For all random numbers User Parameters User predicate vector There is a linear algorithm satisfy

[0017] In one embodiment of the present invention, during the system initialization phase, the key generation center uses a polynomial time algorithm based on the security parameter λ. Output a parameter group Where p is a prime number with respect to the security parameter λ, G1, G2, G T are cyclic groups of order p, g1 and g2 are generators of cyclic groups G1 and G2, respectively, e: =G1×G2→G T is a bilinear map;

[0018] The key generation center distributes from a (k+1)×k dimensional matrix Randomly sample matrices A and B from the (k+1)th order modulo p integer group Select a random vector q from the (k+1)×(k+1) order modulo p integer group Randomly select matrices W1,…,W N ,in is the parameter of the predicate encoding function P, from the integer group of order k modulo p A random vector r is selected from the user parameter set of the predicate encoding function P Randomly select user parameters v; according to the parameter group Matrices A and B, random matrices W1,…,W N , random vectors q and r, user parameters v, the key generation center generates the system master public key mpk, and uses the deterministic algorithm in the predicate encoding function P to generate the system master private key msk.

[0019] In one embodiment of the present invention, the system master public key mpk and the system master private key msk are respectively:

[0020]

[0021]

[0022] Among them e([A]1,[B]2):=[A TB] T .

[0023] In one embodiment of the present invention, during the key update phase, the key generation center periodically generates a key from a k-order modulo p integer group. Pick a random vector from Randomly select user parameter v' from the user parameter set V of the predicate encoding function P to obtain the vector According to the user parameter v' and the vector r', the key generation center uses the deterministic algorithm in the predicate encoding function P to periodically update the system master private key to obtain a new system master private key msk'.

[0024] In one embodiment of the present invention, the new system master private key msk' is:

[0025]

[0026] In one embodiment of the present invention, during the key generation phase, the key generation center obtains the user parameter set of the predicate encoding function P from the user parameter set of the predicate encoding function P. The user parameter z is randomly selected as redundant information, and the user private key sk is generated according to the system master private key msk' and the user predicate vector y y .

[0027] In one embodiment of the present invention, the user private key sk y for:

[0028]

[0029] In one embodiment of the present invention, during the encryption phase, the message sender uses a k-order modulo p integer group A random vector s is selected from the system master public key mpk and the user attribute x, and the message plaintext m is encrypted using the deterministic algorithm in the predicate encoding function P to generate a ciphertext

[0030] In one embodiment of the present invention, during the decryption phase, the message receiver uses the user's private key sk y , use the predicate encoding function P to encode the ciphertext ct x Decryption is performed, and the decryption result is:

[0031]

[0032] in

[0033] The above technical solution of the present invention has the following advantages compared with the prior art:

[0034] The inner product public key encryption method described in the present invention proposes a universal predicate encoding function that is resistant to continuous leakage attacks and has attribute hiding function. The predicate encoding function perfectly expands the parameters in the composite order group to the prime order group, and obtains the inner product public key encryption scheme based on the prime order group, which has higher efficiency than the inner product public key encryption scheme of the composite order group.

[0035] The inner product public key encryption method described in the present invention updates the user private key sk by periodically updating the system master private key msk during the key update phase. y , which realizes the anti-continuous leakage property of this method; in the key generation stage, redundant information is added to the user's private key to blind the attribute encoding transformation, thereby preventing the leakage of attribute information; in the encryption stage, the deterministic algorithm in the predicate encoding function P is used The user attribute vector is encrypted to achieve the attribute hiding function.

[0036] Therefore, the inner product public key encryption method described in the present invention has adaptive security, can solve the problem of privacy data on non-trusted servers being leaked when attacked by adversaries, achieves a higher level of security and higher implementation efficiency, can resist attacks from attackers with continuous leakage capabilities, and has the function of attribute hiding. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to make the content of the present invention more clearly understood, the present invention is further described in detail below according to specific embodiments of the present invention in conjunction with the accompanying drawings, wherein

[0038] Figure 1 It is a process framework diagram of the present invention. DETAILED DESCRIPTION

[0039] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0040] The present invention extends the inner product public key encryption scheme from the traditional composite order group to the prime order group, and realizes the anti-leakage and attribute hiding function of the system master private key msk. Before introducing the specific scheme, some symbol definitions used in the present invention are first given:

[0041] For natural numbers Define [n] and <n>is the set {1,2,…n} and {0,1,…n}. represents an asymmetric bilinear group on a prime order p group, where p is prime with respect to the security parameter λ, G1, G2, G T are cyclic groups of order p, g1 and g2 are generators of cyclic groups G1 and G2, respectively, e: =G1×G2→G T is a bilinear map. For s∈{1,2,T} and a group of integers modulo p A matrix A on If [A]1 and [B]2 are given, then define e([A]1,[B]2): = [A T B] T For s∈{1,2,T} and a group of integers modulo p A matrix A on If [A]1 and [B]2 are given, then define e([A]1,[B]2): = [A T B] T .

[0042] mpk is the system master public key, msk is the system master private key, sk y is the user's private key, ct x is the encrypted ciphertext. A ciphertext ct x can be correctly decrypted if and only if there is a private key sk y Satisfy x T y=0, where x is the user attribute vector and y is the user predicate vector. is the user attribute set, is the user predicate set. sk y Generated by msk and y, ct x Generated by mpk and x.

[0043] The inner product public key encryption scheme using composite order bilinear groups is as follows:

[0044]

[0045] msk:α,u,w1,…,w n

[0046]

[0047]

[0048] where α, a, and b are integer groups modulo p. A random number.

[0049] The inner product public key encryption scheme of composite order groups is extended to prime order groups, that is, [A]1, [B]2 are used to replace g1, g2. The variables in the inner product public key encryption scheme of composite order groups are transformed into the following form:

[0050]

[0051]

[0052]

[0053] Therefore, the inner product public key encryption scheme on prime order groups is as follows:

[0054]

[0055] msk:q,U,W1,…,W n

[0056]

[0057]

[0058] Among them, A and B are (k+1)×k order modulo p integer groups The random matrices in , s and r are integer groups of order k modulo p The random vector in , q is the (k+1) order modulo p integer group Random vectors in, U and W i is a (k+1)×(k+1)-order modulo p integer group A random matrix in .

[0059] In order to construct an adaptively secure inner product public key encryption scheme that has both leakage resistance and attribute hiding functions in a continuous leakage model, starting from the inner product public key encryption scheme ZCG18 scheme of composite order groups (Jie Zhang, Jie Chen, Junqing Gong, Aijun Ge, and Chuangui Ma. Leakage-resilient attribute based encryption in prime-order groups via predicate encodings. Designs, Codes and Cryptography, 86(6):1339–1366, 2018.), this paper provides a solution that can extend the adaptively secure attribute-based encryption scheme to the continuous leakage-resistant model, that is, for a predicate encoding function The leakage-resistant attribute-based encryption scheme is as follows:

[0060]

[0061]

[0062]

[0063]

[0064] Where z is redundant information, ε, Hide encoding transformation for attributes.

[0065] The ZCG18 solution is able to resist continuous leakage attacks through the following four conditions:

[0066] (1) α-Privacy. For all For example, the distribution and is statistically indistinguishable. The random number w is randomly taken from the user parameter set If the random number w is removed, an attacker can easily distinguish the two distributions.

[0067] (2) α-leakage resistance. For all and all distributed and distribution are statistically indistinguishable, where is the user parameter set, and f is a leakage function.

[0068] In addition, the distribution and distribution They are indistinguishable, thus achieving the anti-leakage property of the system master private key msk.

[0069] (3) Heavy randomness. There is a y and msk's updateable algorithm, and make it public

[0070] (4) Delegability. There is an algorithm that, when inputted with y and msk, will output a new private key sk y .

[0071] In order to adapt the above scheme to the inner product public key encryption scheme on prime number order groups and achieve resistance to continuous leakage attacks, the above mpk The W in the following mpk i B is made public while realizing the anti-leakage and attribute hiding functions of msk. Therefore, the inner product public key encryption scheme that is resistant to continuous leakage is obtained on this basis as follows:

[0072]

[0073] [B]2,[UB]2,{[W i B]2} i∈[n] ,{[U j B]2} j∈[L]

[0074]

[0075]

[0076]

[0077] However, it can be seen that when msk, i.e. [Br]2, [W1Br]2, [W2Br]2 and ct x When there is a leak, some scalars in W appear twice, violating the randomness of W and thus destroying the α-privacy property, so the scheme does not satisfy α-privacy.

[0078] To solve this problem, we continue to optimize the inner product public key encryption scheme on the prime order group mentioned above to ensure that W in q and msk i To improve privacy, we add some redundant information z to msk to hide W i The purpose is to increase the msk as follows:

[0079]

[0080] Among them, for any i,j,

[0081] By replacing the msk in the above inner product public key encryption scheme that is resistant to continuous leakage with the msk with redundant information, a prime order group inner product public key encryption scheme with adaptive security is obtained. The performance analysis of this scheme is as follows:

[0082] (1) Security. To achieve α-privacy, this scheme ensures that the leaked msk and ct x , avoid any duplication of components in W. On the other hand, W i Redundant information Blinding is performed so that the attacker cannot obtain any information of W when leaking msk. Therefore, the scheme has α-privacy and resistance to continuous leakage, thus achieving adaptive security.

[0083] (2) Heavy randomness. Since W in mpk i B is the public state, and sk in this scheme y And msk has heavy randomness.

[0084] (3) Delegability. The scheme adds multiple redundant information to the msk and separates msk and sk y The redundant information in is distinguished, and a linear mapping is defined to make use of the user predicate vector y and the components z0,…,z in msk n To calculate sk y The component z in .

[0085] (4) Efficiency. The inner product public key encryption scheme on prime order groups is highly efficient.

[0086] Reference Figure 1 As shown, the present invention provides a general framework for predicate encoding in prime-order groups that satisfies the properties of anti-leakage and attribute hiding: modulo p integer groups -Linear leakage-resistant predicate encoding function in is the user attribute set, is the user predicate set; the predicate encoding function P includes 7 deterministic algorithms And satisfy the following properties:

[0087] (1) Linearity: For any Where x is the user attribute vector, y is the user predicate vector, v and z are user parameters, is the user parameter set, and have All satisfy the integer group modulo p Linearity on is the integer group of order n modulo p, is an L-order modulo p integer group, p is a prime number, taking values ​​in the prime field, and n and L are positive integers;

[0088] (2) α-Privacy: For all And all the random numbers distributed and distribution is statistically indistinguishable, where the user parameter w is randomly taken from the user parameter set have

[0089] (3) α-leakage resistance: For all And all the random numbers distributed and distribution is statistically indistinguishable, where the random number w is taken from the user parameter set f is a leaky function;

[0090] (4) Re-randomness: For all random numbers User Parameters There is a linear algorithm satisfy Similarly, for all random numbers User Parameters User predicate vector There is a linear algorithm satisfy

[0091] (5) Delegability: For all random numbers User Parameters User predicate vector There is a linear algorithm satisfy

[0092] If the algorithm and If exists, then the algorithm can be and Based on linearity and heavy randomness, the inner product public key encryption scheme can dynamically update the system master private key msk and the user private key sk y , to resist continuous leakage attacks.

[0093] Using the above predicate encoding function with anti-persistent leakage and attribute hiding properties The present invention provides an inner product public key encryption scheme with both anti-continuous leakage and attribute hiding functions, and the specific steps include:

[0094] Step 1: During the system initialization phase, the key generation center uses a polynomial time algorithm based on the security parameter λ Output a parameter group And distribute from (k+1)×k dimensional matrix Randomly sample matrices A and B from the (k+1)th order modulo p integer group Select a random vector q from the (k+1)×(k+1) order modulo p integer group Randomly select matrices W1,…,W N ,in is the parameter of the predicate encoding function P, from the integer group of order k modulo p A random vector r is selected from the user parameter set of the predicate encoding function P Randomly select user parameters v; according to the parameter group Matrices A and B, random matrices W1,…,W N , random vectors q and r, user parameters v, the key generation center generates the system master public key mpk, and uses the deterministic algorithm in the predicate encoding function P to generate the system master private key msk.

[0095] The system master public key mpk and system master private key msk are respectively:

[0096]

[0097]

[0098] Step 2: Key update phase: The key generation center periodically updates the key from the k-order modulo p integer group. Pick a random vector from From the user parameter set of the predicate encoding function P Randomly select user parameter v' and get vector According to the user parameter v' and the vector r', the key generation center uses the deterministic algorithm in the predicate encoding function P to periodically update the system master private key to obtain a new system master private key msk'.

[0099] The new system master private key msk' is:

[0100]

[0101] Step 3: Key generation phase: The key generation center uses the user parameter set of the predicate encoding function P The user parameter z is randomly selected as redundant information, and the user private key sk is generated according to the system master private key msk' and the user predicate vector y y .

[0102] The user private key sk y for:

[0103]

[0104] Step 4: Encryption phase: The message sender uses the k-order modulo p integer group A random vector s is selected from the system master public key mpk and the user attribute x, and the message plaintext m is encrypted using the deterministic algorithm in the predicate encoding function P to generate a ciphertext

[0105] Step 5: Decryption phase: The message receiver uses the user's private key sk y , use the predicate encoding function P to encode the ciphertext ct x Decryption is performed, and the decryption result is:

[0106]

[0107] in

[0108] The above inner product public key encryption scheme updates the user private key sk by periodically updating the system master private key msk y , achieving resistance to continuous leakage; in the encryption stage, the deterministic algorithm in the predicate encoding function P is used The user attribute vector x is encrypted to achieve the attribute hiding function. The specific performance analysis is as follows:

[0109] Correctness Analysis

[0110] For any equation that satisfies P(x,y)=1 The following derivation process is established.

[0111]

[0112] In the above equation, the linear properties of bilinear mapping are used, and it can be concluded that the correctness of the above inner product public key encryption scheme is established.

[0113] Security Analysis

[0114] If the k-Lin assumption holds, the above inner product public key encryption scheme also achieves Continuous anti-leakage security and attribute hiding functions. More specifically, for all polynomial time attackers who satisfy the following two conditions

[0115] (1) A maximum of a limited number of leak queries can be performed.

[0116] (2) Decryption key sk y Leakage shall not exceed Bit, the master private key msk leaks no more than L msk Bit.

[0117] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0118] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0119] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0120] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0121] Obviously, the above embodiments are merely examples for clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from these are still within the protection scope of the invention.< / n>

Claims

1. An inner product public key encryption method, characterized in that: The specific steps include: In the system initialization phase, the key generation center outputs the system master public key mpk and the system master private key msk according to the deterministic algorithm in the predicate encoding function P in the security parameter λ and the prime order group that meets the anti-leakage and attribute hiding properties; In the key update phase, the key generation center uses the deterministic algorithm in the predicate encoding function P to periodically update the system master private key msk and generate a new system master private key msk'; In the key generation phase, the key generation center generates the user private key sk based on the new system master private key msk' and the user predicate vector y using the deterministic algorithm in the predicate encoding function P y ; In the encryption phase, the message sender encrypts the message plaintext m using the deterministic algorithm in the predicate encoding function P according to the system master public key mpk and the user attribute x to generate the ciphertext ct x ; In the decryption phase, the message receiver uses the user's private key sk y , use the predicate encoding function P to encode the ciphertext ct x Decrypt.

2. The inner product public key encryption method according to claim 1, characterized in that: Predicate encoding function in the prime order group that satisfies the anti-leakage and attribute hiding properties in is the user attribute set, is the user predicate set; the predicate encoding function P includes 7 deterministic algorithms And satisfy the following properties: (1) For any Where x is the user attribute vector, y is the user predicate vector, v and z are user parameters, is the user parameter set, and have All satisfy the integer group modulo p Linearity on is the integer group of order n modulo p, is an L-order modulo p integer group, p is a prime number, taking values ​​in the prime field, and n and L are positive integers; (2) For all the cases where P(x,y)=0 And all the random numbers distributed and distribution is statistically indistinguishable, where the user parameter w is randomly taken from the user parameter set have (3) For all the cases where P(x,y)=0 And all the random numbers distributed and distribution is statistically indistinguishable, where the random number w is taken from the user parameter set f is a leaky function; (4) For all random numbers User Parameters There is a linear algorithm satisfy Similarly, for all random numbers User Parameters User predicate vector There is a linear algorithm satisfy (5) For all random numbers User Parameters User predicate vector There is a linear algorithm satisfy 3. The inner product public key encryption method according to claim 1, characterized in that: In the system initialization phase, the key generation center uses a polynomial time algorithm based on the security parameter λ. Output a parameter group Where p is a prime number with respect to the security parameter λ, G1, G2, G T are cyclic groups of order p, g1 and g2 are generators of cyclic groups G1 and G2, respectively, e: =G1×G2→G T is a bilinear map; The key generation center distributes from a (k+1)×k dimensional matrix Randomly sample matrices A and B from the (k+1)th order modulo p integer group Select a random vector q from the (k+1)×(k+1) order modulo p integer group Randomly select matrices W1,…,W N ,in is the parameter of the predicate encoding function P, from the integer group of order k modulo p A random vector r is selected from the user parameter set of the predicate encoding function P Randomly select user parameters v; according to the parameter group Matrices A and B, random matrices W1,…,W N , random vectors q and r, user parameters v, the key generation center generates the system master public key mpk, and uses the deterministic algorithm in the predicate encoding function P to generate the system master private key msk.

4. The inner product public key encryption method according to claim 3, characterized in that: The system master public key mpk and system master private key msk are respectively: Where e([A]1,[B]2) :=[A T B] T .

5. The inner product public key encryption method according to claim 1, characterized in that: In the key update phase, the key generation center periodically generates a key from a k-order modulo p integer group. Pick a random vector from Randomly select user parameter v' from the user parameter set ν of the predicate encoding function P to obtain the vector According to the user parameter v' and the vector r', the key generation center uses the deterministic algorithm in the predicate encoding function P to periodically update the system master private key to obtain a new system master private key msk'.

6. The method according to claim 5, characterized in that: The new system master private key msk' is:

7. The inner product public key encryption method according to claim 1, characterized in that: In the key generation phase, the key generation center obtains the user parameter set of the predicate encoding function P. The user parameter z is randomly selected as redundant information, and the user private key sk is generated according to the system master private key msk' and the user predicate vector y y .

8. The inner product public key encryption method according to claim 7, characterized in that: The user private key sk y for:

9. The inner product public key encryption method according to claim 1, characterized in that: In the encryption phase, the message sender uses the k-order modulo p integer group A random vector s is selected from the system master public key mpk and the user attribute x, and the message plaintext m is encrypted using the deterministic algorithm in the predicate encoding function P to generate a ciphertext C T : = [q T As] T ·m).

10. The inner product public key encryption method according to claim 1, characterized in that: In the decryption stage, the message receiver uses the user's private key sk y , use the predicate encoding function P to encode the ciphertext ct x Decryption is performed, and the decryption result is: in K0=[Br']2.

Images