Evidence encryption method and device capable of updating ciphertext, electronic equipment and storage medium

Abstract

The invention relates to the technical field of evidence encryption, in particular to an evidence encryption method and device capable of updating a ciphertext, electronic equipment and a storage medium, and the evidence encryption method capable of updating the ciphertext comprises the steps that a key generation center determines a first encryption parameter, a decryption parameter and a master key based on a security parameter, an NP relation, a predicate relation and the security parameter, the encryptor obtains a plaintext message, and generates a first ciphertext based on the first encryption parameter, the label, the NP problem instance and the plaintext message; the key generation center generates an update token and an update tag based on the master key and the tag; and the ciphertext updater generates a second ciphertext based on the update token and the update tag. According to the application, the tag in the ciphertext is changed into other tags by using the update token, fine-grained access control after the ciphertext is created is realized, encryption parameters and decryption parameters generated by the key generation center can be transmitted in a public channel, and the communication cost and overhead of a secure channel during key transmission of a traditional public key encryption algorithm are reduced.

Description

Technical Field

[0001] The present application relates to the field of evidence encryption technology, and in particular to an evidence encryption method, device, electronic device and storage medium capable of updating ciphertext. Background Art

[0002] Evidence encryption is a new cryptographic primitive that does not require key generation and transmission, and can be used to plaintext messages under instances x of NP language L, where For evidence-encrypted files, anyone who knows valid evidence w and R(x,w)=1 can decrypt the file, that is, the decryptor does not need to be specified in advance, and anyone with decryption ability (that is, holding valid evidence) can decrypt and obtain the file. Evidence encryption can construct many cryptographic protocols, such as time-lock encryption, conditional payment based on blockchain cryptocurrency, multi-party secure computing, oblivious transmission, and paid data subscription; in addition, evidence encryption can also be applied to prize-winning quizzes, such as encrypting messages related to puzzles. Only by finding a solution can the message be decrypted and the prize be won. The puzzle here can be any problem whose solution can be effectively verified, such as crossword puzzles, circuit satisfiability problems, and subset sum problems.

[0003] However, in certain specific cases, such as paid data subscriptions, when new subscribers are added, if evidence encryption is used, then in theory all data needs to be re-encrypted to satisfy the new subscribers. This results in evidence encryption being unable to achieve timely updates of ciphertexts in this case, thus affecting the flexibility of the system and making it impossible to achieve ciphertext updatable and fine-grained control.

[0004] Therefore, how to achieve fine-grained control and ciphertext updatability in the process of evidence encryption has become an urgent problem that needs to be solved. Summary of the invention

[0005] The present application provides an evidence encryption method, device, electronic device and storage medium with updateable ciphertext, aiming to solve the problem that the prior art cannot support the updateable attribute of ciphertext and cannot support fine-grained access control evidence encryption.

[0006] In a first aspect, an embodiment of the present application provides an evidence encryption method for updateable ciphertext, the method comprising: step S1: a key generation center obtains a security parameter λ, and determines a first encryption parameter P based on an NP relation R, a predicate relation Γ(t) and the security parameter λ. e , decryption parameter P d , master key msk; Step S2: The encryptor obtains the plaintext message m, based on the first encryption parameter P e , label t, NP problem instance x and the plaintext message m, generate the first ciphertext ct t; Step S3: The key generation center generates an update token Δ based on the master key msk and the tag t t→t′ and update the tag t′; Step S4: The ciphertext updater updates the token Δ based on the t-→t′ and the updated label t′, generating the second ciphertext ct t′ , the second ciphertext ct t′ The first ciphertext ct t Updated evidence encrypted ciphertext.

[0007] In a possible implementation, the step S1 includes: the key generation center generates four PRF keys based on the security parameter λ: sk o，1 ,sk o，2 ,sk u，1 and sk u，2 Based on the sk o，1 and the sk o，2 , determine the first encryption parameter P e Based on the predicate Γ, the four PRF keys, the predicate relationship Γ (t) and the NP relationship R, determine the decryption parameter P d ; Based on the four PRF keys, determine the master key msk.

[0008] In a possible implementation, the sk o，1 and the sk o，2 , determine the first encryption parameter P e Including: based on the sk o，1 and the sk o，2 , generate encryption program P e :1[sk o，1 ,sk o，2 ]; Based on the P e :1[sk o，1 ,sk o，2 ], through program obfuscation, generate the first encryption parameter P e Based on the four PRF keys and the predicate Γ, determine the decryption parameter P d The method comprises: generating a decryption program P based on the predicate Γ, the four PRF keys, the predicate relation Γ(t) and the NP relation R. d :1[sk o，1 ,sk o，2 ,sk o，1 ,sk o，2 , Y]; based on the decryption program P d :1[sk o，1 ,sk o，2 ,sk o，1 ,sk o，2, Γ], through program obfuscation, determine the decryption parameter P d .

[0009] In a possible implementation, step S2 includes: the encryptor selects a first random number within a preset range, and the first random number is: r∈{0, 1} λ Based on the first encryption parameter P e , the plaintext message m, the label t and the sk o，1 , determine the ciphertext ct1; based on the ct1, the first encryption parameter P e , the plaintext message m, the sk o，2 and the NP problem instance x, determine the ciphertext ct2; based on the NP problem instance x, the label t, the ciphertext ct1, the ciphertext ct2 and the first random number, determine the first ciphertext ct t .

[0010] In a possible implementation, step S3 includes: the key generation center generates the update tag t′ based on the master key msk and the tag t; and generates a program P based on the master key msk, the tag t and the update tag t′. u :1[sk o，1 ,sk o，2 ,sk u，1 ,sk u，2 , t, t′]; based on the procedure P u :1[sk o，1 ,sk o，2 ,sk u，1 ,sk u，2 , t, t′], generate the obfuscation program P_u; based on the obfuscation program P_u, generate the update token Δ t→t′ .

[0011] In a possible implementation, step S4 includes: the ciphertext updater selects a second random number within a preset range, where the second random number is: r′∈{0, 1} λ Based on the second random number, the update token Δ t→t′ and the updated label t′, determine the second ciphertext ct t′ .

[0012] In a possible implementation, after step S4, the method further includes: the decryptor obtains the decryption parameter P d , the evidence w and the preset label t d ; Based on the decryption parameter P d , the evidence w, the preset label t dand the ciphertext to be decrypted, determine the plaintext message m, the ciphertext to be decrypted includes the first ciphertext ct t Or the second ciphertext ct t′ .

[0013] In this implementation, the user can, as needed, decrypt the d , evidence w, preset label t d For the first ciphertext ct t Or the second ciphertext ct t′ , thereby determining the plaintext message m. This improves the universality of decryption, and the same plaintext message m can be obtained for the ciphertext before and after the update.

[0014] In a second aspect, an embodiment of the present application provides an evidence encryption device capable of updating ciphertext, the device comprising: a key generation module for obtaining a security parameter λ, and determining a first encryption parameter P based on the NP relationship R, the predicate relationship Y(t) and the security parameter λ. e , decryption parameter P d , master key msk; an encryption module, used to obtain a plaintext message m, based on the first encryption parameter P e , the label t, the NP problem instance x and the plaintext message m, generate the first ciphertext ct t The key generation module is also used to generate an update token Δ based on the master key msk and the tag t t→t′ and an update tag t′; a ciphertext update module for updating the token Δ based on the t→t′ and the updated label t′, generating the second ciphertext ct t′ , the second ciphertext ct t′ The first ciphertext ct t Updated evidence encrypted ciphertext.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method described in the first aspect or any one of the implementation methods thereof is implemented.

[0016] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect or any one of the implementation methods thereof is implemented.

[0017] Compared with the prior art, the embodiment of the present application has the following beneficial effects: the key generation center obtains the security parameter λ, and determines the first encryption parameter P based on the NP relation R, the predicate relation Γ(t) and the security parameter λ. e , decryption parameter Pd , master key msk; the encryptor obtains the plaintext message m, based on the first encryption parameter P e , label t, NP problem instance x and plaintext message m, generate the first ciphertext ct t ; The key generation center generates an update token Δ based on the master key msk and tag t t→t′ and update tag t′; the ciphertext updater is based on the update token Δ t→t′ And update the label t′ to generate the second ciphertext ct t′ , the second ciphertext ct t′ is the first ciphertext ct t Updated evidence encrypted ciphertext. This application achieves the feature of maintaining evidence encryption without key transmission. On the one hand, it allows ciphertext to be identified by labels and NP instances. Decryption will only succeed when the label of the decryption parameter matches the ciphertext and there is valid evidence. On the other hand, the update token can be used to change the label t in the ciphertext to any other label, thereby achieving fine-grained access control after the ciphertext is created. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A flowchart of an evidence encryption method for updateable ciphertext provided in one embodiment of the present application;

[0020] Figure 2 A schematic diagram of the process of step S1 provided in an embodiment of the present application;

[0021] Figure 3 A flowchart of another evidence encryption method capable of updating ciphertext provided in an embodiment of the present application;

[0022] Figure 4 A structural block diagram of an evidence encryption device capable of updating ciphertext provided in one embodiment of the present application;

[0023] Figure 5 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0024] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0025] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0026] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0027] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0028] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0029] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0030] For ease of understanding, the technical solution of the present application will be described in detail below with reference to the accompanying drawings.

[0031] Figure 1 The following is a schematic flowchart of an evidence encryption method for updating ciphertext provided by an embodiment of the present application. For ease of description, only parts related to this embodiment are shown. The method provided by this embodiment includes the following steps:

[0032] Step S1: The key generation center obtains the security parameter λ, and determines the first encryption parameter P based on the NP relation R, the predicate relation Γ(t), and the security parameter λ e , the decryption parameter P d , and the master key msk.

[0033] Specifically, the NP relation language L adopted by the embodiment provided by the present application is the subset sum problem: Let S = {a1,..., a n} be a set of positive integers, and s be a target integer. The subset sum problem is to find a subset of S such that the sum of the elements in is equal to n That is, an NP instance x of the subset sum problem is x = {s, a1,..., a n}, and the witness satisfies Then R(x, w) = 1. To encode the instance x, we adopt Horner's rule to compress an n + 1-dimensional vector into a number; specifically, select a real number R and calculate X = a0 + a1R + a2R 2 +... + a n R n , and use the binary string of X during encryption; the tag t adopted by the embodiment represents time, t d <t represents the current decryption time t d satisfies the time t required during encryption, and Γ(t) = 1 represents that the time tag t required during encryption satisfies the maximum time requirement set during system initialization.

[0034] Furthermore, under the action of the security parameter λ, a general access structure definition (the access structure definition of the NP relation and the predicate relation) is given based on the subset sum problem and time: for the subset sum problem instance x = {s, a1,..., a n}, the witness satisfies Then the NP relation R(x, w) = 1, and the NP relation language the time tag t, the predicate Y, and Γ(t) = 1 represent that the time t satisfies the maximum time upper limit set by the system; thus, an authorized access structure for evidence encryption is constructed: R(x, w) = 1 ∧ Γ(t) = 1.

[0035] Furthermore, in the system initialization phase, the key generation center generates the first encryption parameter p based on the obtained security parameter λ, the NP relation R, the predicate relation Γ(t) and the security parameter λ. e , decryption parameter p d and the master key msk, and the first encryption parameter p e and the decryption parameter p d The master key is sent to the encryptor and decryptor respectively, and kept secret.

[0036] Step S2: The encryptor obtains the plaintext message m and, based on the first encryption parameter P e , label t, NP problem instance x and plaintext message m, generate the first ciphertext ct t .

[0037] Furthermore, the first ciphertext ct generated t Send to decryptor.

[0038] Step S3: The key generation center generates an update token Δ based on the master key msk and the tag t t→t′ And update the label t′.

[0039] Furthermore, the key generation center generates the update token Δ t→t′ And the update tag t′ is sent to the ciphertext updater.

[0040] Step S4: The ciphertext updater updates the token Δ t→t′ And update the label t′ to generate the second ciphertext ct t′ , the second ciphertext ct t′ is the first ciphertext ct t Updated evidence encrypted ciphertext.

[0041] Specifically, the ciphertext updater draws on the idea of ​​proxy re-encryption and updates the token Δ t→t′ and update the label t′, and change the ciphertext ct under label t t Update to the ciphertext ct under label t′ t′ , and sends the updated ciphertext to the decryptor.

[0042] The technical solution provided by this embodiment is as follows: the key generation center obtains the security parameter λ, and determines the first encryption parameter P based on the NP relationship R, the predicate relationship Γ(t) and the security parameter λ. e , decryption parameter P d , master key msk; the encryptor obtains the plaintext message m, based on the first encryption parameter P e , label t, NP problem instance x and plaintext message m, generate the first ciphertext ct t ; The key generation center generates an update token Δ based on the master key msk and tag t t→t′and update tag t′; the ciphertext updater is based on the update token Δ t→t′ And update the label t′ to generate the second ciphertext ct t′ , the second ciphertext ct t′ is the first ciphertext ct t Updated evidence encrypted ciphertext. The solution provided by the present application has high privacy protection security. The encrypted data can only be obtained by the decryptor who has the corresponding subset and problem instance evidence and is within a specific time range. When the decryption time is required to change (such as increasing the decryption time), the time tag in the created ciphertext can be updated to other times t', realizing an evidence encryption method with updateable ciphertext with fine-grained access control. Secondly, the encryption parameters and decryption parameters generated by the key generation center in the present invention can be transmitted on a public channel, which greatly reduces the communication cost and overhead of the secure channel during key transmission of the traditional public key encryption algorithm.

[0043] Figure 2 A schematic diagram of the process of step S1 provided in an embodiment of the present application. Figure 2 As shown, based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. In this embodiment, according to the security parameter λ, the encryption parameter p is generated. e , decryption parameter p d And the master key msk, and send the encryption parameter and decryption parameter to the encryptor and decryptor respectively, and keep the master key secretly. Specifically, step S1 includes:

[0044] S110, the key generation center generates four PRF keys based on the security parameter λ: sk o，1 ,sk o，2 ,sk u，1 and sk u，2 .

[0045] Specifically, the key generation center generates four PRF keys: sk o，1 ←PRF.G1(1 λ ), sk u，1 ←PRF.G1(1 λ ), sk o，2 ←PRF.G2(1 λ ), sk u，2 ←PRF.G2(1 λ ).

[0046] S120, based on sk o，1 and sk o，2 , determine the first encryption parameter P e .

[0047] In one possible implementation, based on two original PRF keys sko，1 and sk o，2 , generate encryption program P e :1[sk o，1 ,sk o，2 ], the program outputs the key and parameters required for the encryption phase of the NP instance (r g , k1, k2);

[0048] Specifically, the parameters required for the encryption phase of the output NP instance (r g , k1, k2) is as follows:

[0049] Constants:PRF keys sk o.1 , sk2

[0050] Input: r∈{0, 1} λ

[0051] 1. Generate a random number r g =PRG.G(r). / / G:{0,1} λ →{0, 1} λ

[0052] 2. Let k1 = PRF.F1 (sk o，1 , r g ). / / F1: {0, 1} λ →{0, 1} l

[0053] 3. Order / / F2: {0, 1} l →{0, 1} λ

[0054] 4. Output (r g , k1, k2)

[0055] Further, based on the P e :1[sk o，1 ,sk o，2 ], through program obfuscation, generate the first encryption parameter P e ,

[0056] S130, based on the predicate Γ, the four PRF keys, the predicate relation F(t) and the NP relation R, determine the decryption parameter P d .

[0057] In a possible implementation, based on the four PRF keys sk o，1 ,sk o，2 ,sk u，1 ,sk u，2 and predicate Γ, generate the decryption program Pd : 1[sk o，1 , sk o，2 , sk o，1 , sk o，2 , Γ], the program outputs the plaintext message m required in the evidence decryption phase.

[0058] Specifically, the process of outputting the plaintext message m required in the evidence decryption phase is as follows:

[0059] Constants: PRF keys sk o，1 , sk o，2 , sk u，1 , sk u，2 , Predicate Γ

[0060] Input: t d , w, ct t = (x, t, ct1, ct2, r g )

[0061] If R(x, w) ≠ 1 ∨ t d < t ∨ Y(t) = 0, output ⊥.

[0062] If ct t is the updated ciphertext, let sk1 = sk u，1 , sk2 = sk u，2 , otherwise sk1 =

[0063] sk o.1 , sk2 = sk o.2 ·

[0064] Calculate k1 = PRF.F1(sk1, r g ). / / F1: {0, 1} λ →{0, 1} l Calculate / / F2: {0, 1} l →{0, 1} λ Calculate

[0065] If output ⊥; otherwise, output m.

[0066] Furthermore, based on the decryption program P d : 1[sk o，1 , sk o，2 , sk o，1 , sk o，2 , Γ], through program obfuscation, determine the decryption parameters

[0067] S140, determining a master key msk based on the four PRF keys.

[0068] Specifically, the master key msk = (sk o，1 ,sk o，2 ,sk u，1 ,sk u，2 ).

[0069] Furthermore, based on the access structure definition of NP relation and predicate relation, the authorized access structure of evidence encryption is determined, wherein the access structure definition of predicate relation includes: NP problem instance x, evidence w, NP relation R, NP relation language Label t, predicate Γ and predicate relation Γ(t)=1. The authorized access structure of evidence encryption is used in the decryption stage to determine whether the predicate Γ satisfies the predicate relation Γ(t)=1, and whether the evidence satisfies the NP relation R(x, w)=1; this constructs the authorized access structure of evidence encryption: R(x, w)=1∧Γ(t)=1, and the authorized access structure must be satisfied to be correctly decrypted. Based on the above embodiment, this embodiment further explains and optimizes the technical solution of step S2. Specifically, in this embodiment, the encryptor generates the ciphertext ct of label t based on the instance x and label t of the NP language and the plaintext message m. t , and send it to the decryptor. The specific step S2 includes:

[0070] S210, the encryptor selects a first random number within a preset range, the first random number is: r∈{0, 1} λ ;

[0071] S220, based on the first encryption parameter P e , plaintext message m, label t and sk o，1 , determine the ciphertext ct1.

[0072] Specifically, call the first encryption parameter P e , based on plaintext message m, label t and sk o，1 , calculate (r g , k1, k2)←P e (r), so further calculation

[0073] S230, based on ct1 and the first encryption parameter P e , plaintext message m, sk o，2 and NP problem instance x, determine the ciphertext ct2;

[0074] Specifically, based on ct1, the first encryption parameter P e , plaintext message m, sk 0，2 And NP problem instance x, calculate

[0075] S240, determining a first ciphertext ct based on the NP problem instance x, the label t, the ciphertext ct1, the ciphertext ct2 and the first random number t .

[0076] Specifically, based on the NP problem instance x, the label t, the ciphertext ct1, the ciphertext ct2 and the first random number, determine the first ciphertext ct under the label t t =(x, t, ct1, ct2, r g ).

[0077] Based on the above embodiment, this embodiment further illustrates and optimizes the technical solution of step S3. Specifically, in this embodiment, the key generation center generates an update token Δ according to the master key msk. t→t′ , and sends the update token to the ciphertext updater. The specific step S3 includes:

[0078] S310, the key generation center generates the update tag t′ based on the master key msk and the tag t.

[0079] S320, based on the master key msk, the label t and the update label t′, generate the program P u :1[sk o，1 ,sk o，2 ,sk u，1 ,sk u，2 , t, t′].

[0080] Furthermore, the program outputs the updated ciphertext ct under the label t′ t′ .

[0081] Specifically, output the updated ciphertext ct under label t′ t′ The process is:

[0082] Constants:PRF keys sk o，1 ,sk o，2 ,sk u，1 ,sk u，2 , t, t′

[0083] Input: ct t =(x, t, ct1, ct2, r g ), r∈{0,1} λ

[0084] 1. Calculate k1 = PRF.F1 (sk o，1 , r g ). / / F1: {0, 1} λ →{0, 1} l

[0085] 2. Calculation / / F2: {0, 1} l →{0, 1} λ

[0086] 3. Calculation

[0087] 4. Generate a random number r′ g =PRG.G(r). / / G:{0,1} λ →{0, 1} λ

[0088] 5. Let k′1 = PRF.F1(sk u，1 , r g ). / / F1: {0, 1} λ →{0, 1} l

[0089] 6. Order / / F2: {0, 1} l →{0, 1} λ

[0090] 7. Calculation

[0091] 8. Calculation

[0092] 9. Output ct t′ =(x,t′,ct′1,ct′2,r′ g ).

[0093] S330, based on program P u :1[sk o，1 ,sk o，2 ,sk u，1 ,sk u，2 , t, t′], generate the obfuscated program P_u, the specific generation method of the obfuscated program P_u is:

[0094] S340, based on the obfuscation program P_u, generate the update token Δ t→t′ =P_u.

[0095] Based on the above embodiment, this embodiment further illustrates and optimizes the technical solution of step S4. Specifically, in this embodiment, the ciphertext updater updates the ciphertext according to the update token Δ t→t′ The ciphertext ct under label t t Update to the ciphertext ct under label t′ t′ , and send the updated ciphertext to the decryptor. The specific step S4 includes:

[0096] S410, the ciphertext updater selects a second random number within a preset range, the second random number is: r′∈{0, 1} λ .

[0097] Specifically, the ciphertext updater selects a second random number r′∈{0, 1} within a preset range λ .

[0098] S420, based on the second random number, update the token Δ t→t′ And update the label t′, determine the second ciphertext ct t′ .

[0099] Specifically, based on the second random number r′, the token Δ is updated t→t′ and update the tag t′, determine the second ciphertext ctt, where the update token Δ t→t′ =P_u,ct t ,=(x,t′,ct′1,ct′2,r′ g )←P u (ct t , r′).

[0100] Further, output the second ciphertext ct t′ , the second ciphertext ct t′ is the first ciphertext ct t Updated evidence encrypted ciphertext.

[0101] In a possible implementation, after step S4, the method further includes: the decryptor obtains the decryption parameter P d , evidence w and preset label t d ; Based on the decryption parameter P d , evidence w, the preset label t d and the ciphertext to be decrypted, determine the plaintext message m, the ciphertext to be decrypted includes the first ciphertext ct t Or the second ciphertext ct t′ .

[0102] As an example, for the first ciphertext ct t , the decryptor runs the decryption parameter P d , calculate m←P d (t d ,w,ct t =(x, t, ct1, ct2, r g )), so that the plaintext message m can be obtained.

[0103] As another example, for the second ciphertext ct t′ , the decryptor runs the decryption parameter P d Calculate m←P d (t d,w,ct t′ =(x,t′,ct′1,ct′2,r′ g )), so that the plaintext message m can be obtained.

[0104] Figure 3 A flowchart of another evidence encryption method for updating ciphertext provided in an embodiment of the present application. Figure 3 As shown, the process includes system initialization phase (A), NP instance encryption phase (B), generation and update token phase (C), ciphertext update phase (D) and evidence decryption phase (E). The system initialization phase (A) and generation and update token phase (C) belong to the key generation center.

[0105] Among them, the system initialization phase generates the master key msk, encryption parameter Pe and decryption parameter Pd according to the security parameter λ. The master key msk is applied in the generation and update token phase (C), the encryption parameter Pe is applied in the NP instance encryption phase (B), and the decryption parameter Pd is applied in the evidence decryption phase (E).

[0106] System initialization phase (A)

[0107] In this stage, the key distribution center generates the encryption parameter pp according to the security parameter λ. e , decryption parameter PP d And the master key msk, and send the encryption parameters and decryption parameters to the encryptor and decryptor respectively, and keep the master key secretly;

[0108] NP instance encryption phase (B)

[0109] In this stage, the encryptor generates the ciphertext ct of the label t based on the instance x and label t of the NP language and the plaintext message m. t , and send it to the decryptor;

[0110] Generate update token phase (C)

[0111] In this phase, the key generation center generates an update token Δ based on the master key msk t→t′ , and send the update token to the ciphertext updater;

[0112] Ciphertext update phase (D)

[0113] In this stage, the ciphertext updater draws on the idea of ​​proxy re-encryption and updates the token Δ t→t′ The ciphertext ct under label t t Update to the ciphertext ct under label t′ t′ , and send the updated ciphertext to the decryptor;

[0114] Evidence Decryption Phase (E)

[0115] In this stage, the decryptor uses the evidence w and label t corresponding to the NP instance d Decrypt the original ciphertext or update the ciphertext to obtain the message m;

[0116] This application achieves the characteristics of keeping evidence encrypted without key transmission. On the one hand, it allows ciphertext to be identified by labels and NP instances. Decryption will succeed only when the label of the decryption parameter matches the ciphertext and there is valid evidence. On the other hand, the label t in the ciphertext can be changed to any other label by using the update token, thereby achieving fine-grained access control after the ciphertext is created.

[0117] Figure 4 This is a block diagram of a proof encryption device for updating ciphertext provided by an embodiment of the present application. For the sake of convenience, only the part related to the embodiment of the present application is shown. Figure 4 The evidence encryption device 400 capable of updating ciphertext may include: a key generation module 401, an encryption module 402, and a ciphertext update module 403.

[0118] Key generation module 401, the key generation center obtains the security parameter λ, and determines the first encryption parameter P based on the NP relationship R, the predicate relationship Γ(t) and the security parameter λ. e , decryption parameter P d , master key msk.

[0119] The encryption module 402 is used to obtain a plaintext message m based on the first encryption parameter P e , label t, NP problem instance x and the plaintext message m, generate the first ciphertext ct t .

[0120] The key generation module 401 is further configured to generate an update token Δ based on the master key msk and the tag t. t→t′ And update the label t′.

[0121] Ciphertext update module 403, used to update the token Δ t→t′ and the updated label t′, generating the second ciphertext ct t′ , the second ciphertext ct t′ The first ciphertext ct t Updated evidence encrypted ciphertext.

[0122] In one embodiment, the key generation module 401 includes:

[0123] The key generation submodule is used for the key generation center to generate four PRF keys based on the security parameter λ: sk o，1 ,sk o，2 ,sk u，1 and sku，2 ;

[0124] The first encryption parameter determination submodule is used to determine the encryption parameter based on sk o，1 and sk o，2 , determine the first encryption parameter P e ;

[0125] The decryption parameter determination submodule is used to determine the decryption parameter P based on the predicate Y, the four PRF keys, the predicate relationship Y(t) and the NP relationship R. d ;

[0126] A master key determination submodule, used to determine the master key msk based on four PRF keys;

[0127] The authorized access structure determination submodule is used to determine the authorized access structure of evidence encryption based on the access structure definition of NP relations and predicate relations.

[0128] In one embodiment, the first encryption parameter determination submodule includes:

[0129] Encryption program generation unit for sk-based o，1 and sk o，2 , generate encryption program P e :1[sk o，1 ,sk o，2 ];

[0130] Encryption parameter generation unit, used to generate encryption parameters based on P e :1[sk o，1 ,sk o，2 ], generate the first encryption parameter P through program obfuscation e ;

[0131] The decryption parameter determination submodule includes:

[0132] A decryption program generation unit is used to generate a decryption program P based on the predicate Γ, the four PRF keys, the predicate relation Γ(t) and the NP relation R. d :1[sk o，1 ,sk o，2 ,sk o，1 ,sk o，2 , Γ];

[0133] A decryption parameter generating unit is used to generate a decryption parameter based on a decryption program P d :1[sk o，1 ,sk o，2 ,sk o，1 ,sk o，2 ,Γ], through program obfuscation, determine the decryption parameter P d .

[0134] In one embodiment, the encryption module 402 includes:

[0135] The first random number selection submodule is used by the encryptor to select a first random number within a preset range. The first random number is: r∈{0, 1} λ ;

[0136] The ciphertext generation submodule is used to generate a ciphertext based on the first encryption parameter P e , plaintext message m, label t and sk o，1 , determine the ciphertext ct1;

[0137] The ciphertext generation submodule is also used to generate a ciphertext based on ct1 and the first encryption parameter P e , plaintext message m, sk o，2 and NP problem instance x, determine the ciphertext ct2;

[0138] The ciphertext generation submodule is further used to determine the first ciphertext ct based on the NP problem instance x, the label t, the ciphertext ct1, the ciphertext ct2 and the first random number. t .

[0139] In one embodiment, the key generation module 401 further includes:

[0140] An update tag generation submodule is used to generate an update tag t′ based on the master key msk and the tag t;

[0141] The program generation submodule is used to generate a program P based on the master key msk, the label t and the update label t′. u :1[sk o，1 ,sk o，2 ,sk u，1 ,sk u，2 , t, t′];

[0142] Obfuscated program generation submodule, used to generate the obfuscated program based on the program P u :1[sk o，1 ,sk o，2 ,sk u，1 ,sk u，2 ,t,t′], generate obfuscated program

[0143] Update token generation submodule, used to generate update token Δ based on obfuscation program P_u t-→t′ .

[0144] In one embodiment, the ciphertext update module 403 includes:

[0145] The second random number selection submodule is used to select a second random number within a preset range. The second random number is: r′∈{0, 1} λ ;

[0146] The second ciphertext determination submodule is used to update the token Δ based on the second random number. t-→t′ And update the label t′ to determine the second ciphertext ct t′ .

[0147] In one embodiment, the evidence encryption device 400 capable of updating ciphertext further includes:

[0148] Decryption module, used to obtain decryption parameter P d , evidence w and preset label t d ; Based on the decryption parameter P d , evidence w, preset label t d and the ciphertext to be decrypted, determine the plaintext message m, the ciphertext to be decrypted includes the first ciphertext ct t Or the second ciphertext ct t′ .

[0149] The present application provides a scheme for an evidence encryption device capable of updating ciphertext: a key generation center obtains a security parameter λ, and determines a first encryption parameter P based on the NP relation R, the predicate relation Γ(t) and the security parameter λ. e , decryption parameter P d , master key msk; the encryptor obtains the plaintext message m, based on the first encryption parameter P e , label t, NP problem instance x and plaintext message m, generate the first ciphertext ct t ; The key generation center generates an update token Δ based on the master key msk and tag t t-→t′ and update tag t′; the ciphertext updater is based on the update token Δ t-→t′ And update the label t′ to generate the second ciphertext ct t′ , the second ciphertext ct t′ is the first ciphertext ct t Updated evidence encrypted ciphertext. This allows ciphertext to be identified by tags and NP instances while maintaining evidence encryption without key transmission. Decryption will only succeed when the tag of the decryption parameter matches the ciphertext and there is valid evidence. On the other hand, the update token can be used to change the tag t in the ciphertext to any other tag, thereby achieving fine-grained access control after the ciphertext is created.

[0150] In addition, the scheme provided by this application has high privacy protection security. The encrypted data can only be obtained by the decryptor who has the corresponding subset and problem instance evidence and is within a specific time range. When the decryption time is required to change (such as increasing the decryption time), the time label in the created ciphertext can be updated to another time t', realizing an evidence encryption method with updateable ciphertext with fine-grained access control. Secondly, the encryption parameters and decryption parameters generated by the key generation center in this application can be transmitted on a public channel, which greatly reduces the communication cost and overhead of the secure channel when transmitting the key of the traditional public key encryption algorithm.

[0151] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0152] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0153] Figure 5 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Figure 5 As shown, the electronic device 5 of this embodiment includes: at least one processor 50 ( Figure 5 Only one is shown in the figure), a memory 51, and a computer program 52 stored in the memory 51 and executable on at least one processor 50, the processor 50 executes the computer program 52 to implement the above Figures 1 to 3 The steps in any method embodiment, or the implementation of the above Figure 4 Functions of each module / unit in the device embodiment.

[0154] The electronic device 5 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The electronic device 5 may include but is not limited to a processor 50 and a memory 51. Those skilled in the art will appreciate that Figure 5It is only an example of the electronic device 5 and does not constitute a limitation on the electronic device 5. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0155] The processor 50 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0156] In some embodiments, the memory 51 may be an internal storage unit of the electronic device 5, such as a hard disk or memory of the electronic device 5. In other embodiments, the memory 51 may also be an external storage device of the electronic device 5, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 5. Further, the memory 51 may also include both an internal storage unit of the electronic device 5 and an external storage device. The memory 51 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as program codes of a computer program. The memory 51 may also be used to temporarily store data that has been output or is to be output.

[0157] The embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0158] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include at least: any entity or device capable of carrying the computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0159] A computer-readable storage medium provided in an embodiment of the present application has the same beneficial effects as the above-mentioned evidence encryption method with updateable ciphertext.

[0160] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0161] A computer program product provided in an embodiment of the present application has the same beneficial effects as the above-mentioned evidence encryption method with updateable ciphertext.

[0162] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0163] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0164] In the embodiments provided in the present application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0165] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0166] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for encrypting evidence with updatable ciphertext, characterized in that: The method comprises: Step S1: The key generation center obtains the security parameter λ, and determines the first encryption parameter P based on the NP relation R, the predicate relation Γ(t) and the security parameter λ. e , decryption parameter P d , master key msk; Step S2: The encryptor obtains the plaintext message m and, based on the first encryption parameter P e , label t, NP problem instance x and the plaintext message m, generate the first ciphertext ct t ; Step S3: The key generation center generates an update token Δ based on the master key msk and the tag t. t→t′ and update the label t′; Step S4: The ciphertext updater updates the token Δ based on the t→t′ and the updated label t′, generating the second ciphertext ct t′ , the second ciphertext ct t′ The first ciphertext ct t Updated evidence encrypted ciphertext.

2. The method according to claim 1, characterized in that The step S1 comprises: The key generation center generates four PRF keys based on the security parameter λ: sk o,1 ,sk o,2 ,sk u,1 and sk u,2 ; Based on the sk o,1 and the sk o,2 , determine the first encryption parameter P e ; Determine the decryption parameter P based on the predicate Γ, the four PRF keys, the predicate relation Γ(t) and the NP relation R d ; Based on the four PRF keys, the master key msk is determined.

3. The method according to claim 2, characterized in that The sk based o,1 and the sk o,2 , determine the first encryption parameter P e include: Based on the sk o,1 and the sk o,2 , generate encryption program P e :1[sk o,1 ,sk o,2 ]; Based on the P e :1[sk o,1 ,sk o,2 ], through program obfuscation, generate the first encryption parameter P e ; The decryption parameter P is determined based on the four PRF keys and the predicate Γ. d include: Based on the predicate Γ, the four PRF keys, the predicate relation Γ(t) and the NP relation R, a decryption program P is generated. d :1[sk o,1 ,sk o,2 ,sk o,1 ,sk o,2 ,Γ]; Based on the decryption program P d :1[sk o,1 ,sk o,2 ,sk o,1 ,sk o,2 ,Γ], through program obfuscation, determine the decryption parameter P d .

4. The method according to claim 2, characterized in that: The step S2 comprises: The encryptor selects a first random number within a preset range, where the first random number is: r∈{0,1} λ ; Based on the first encryption parameter P e , the plaintext message m, the label t and the sk o,1 , determine the ciphertext ct1; Based on the ct1, the first encryption parameter P e , the plaintext message m, the sk o,2 and the NP problem instance x, determine the ciphertext ct2; Determine the first ciphertext ct based on the NP problem instance x, the label t, the ciphertext ct1, the ciphertext ct2 and the first random number. t .

5. The method according to claim 2, characterized in that: The step S3 comprises: The key generation center generates the update tag t′ based on the master key msk and the tag t; Based on the master key msk, the label t and the update label t′, a program P is generated. u :1[sk o,1 ,sk o,2 ,sk u,1 ,sk u,2 ,t,t′]; Based on the program P u :1[sk u,1 ,sk o,2 ,sk u,1 ,sk u,2 ,t,t′], generate the obfuscated program P_u; Based on the obfuscation program P_u, the update token Δ is generated t→t′ .

6. The method according to claim 2, characterized in that The step S4 comprises: The ciphertext updater selects a second random number within a preset range, where the second random number is: r′∈{0,1} λ ; Based on the second random number, the update token Δ t→t′ and the updated label t′, determine the second ciphertext ct t′ .

7. The method according to claim 1, characterized in that After step S4, the method further includes: The decryptor obtains the decryption parameter P d , the evidence w and the preset label t d ; Based on the decryption parameter P d , the evidence w, the preset label t d and the ciphertext to be decrypted, determine the plaintext message m, the ciphertext to be decrypted includes the first ciphertext ct t Or the second ciphertext ct t′ .

8. An evidence encryption device capable of updating ciphertext, characterized in that: The device comprises: A key generation module is used to obtain a security parameter λ, and determine a first encryption parameter P based on the NP relation R, the predicate relation Γ(t) and the security parameter λ. e , decryption parameter P d , master key msk; An encryption module, used to obtain a plaintext message m, based on the first encryption parameter P e , label t, NP problem instance x and the plaintext message m, generate the first ciphertext ct t ; The key generation module is further used to generate an update token Δ based on the master key msk and the tag t. t→t′ and update the label t′; A ciphertext update module is used to update the token Δ t→t′ and the updated label t′, generating the second ciphertext ct t′ , the second ciphertext ct t′ The first ciphertext ct t Updated evidence encrypted ciphertext.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images