Identity-based anonymous broadcast encryption model and method

Abstract

The invention discloses an identity-based anonymous broadcast encryption model and method, and the model comprises a system model and a security model. The system model is used for providing a framework for implementation of the scheme; the security model is used for ensuring that the protocol can resist a specific type of attack in the framework; the invention discloses an identity-based anonymous broadcast encryption method. The method comprises the following stages: a first stage: initializing a system; in the second stage, secret keys of a user and an insurance mechanism are generated; a third stage: an encryption stage; a fourth stage: a decryption stage; according to the invention, anonymity between insurance mechanisms is ensured, price manipulation is prevented, and calculation and communication costs are reduced.

Description

Technical Field

[0001] The present invention relates to the field of anonymous broadcast encryption models and methods of identities, and in particular to an anonymous broadcast encryption model and method based on identities. Background Art

[0002] As a basic social welfare system for citizens, medical insurance promotes equal access to basic medical and health services and maintains social stability. People generally prefer insurance products with high coverage and low prices, and the goal of insurance institutions is to maximize profits by offering the highest possible prices. When individuals seek policy quotes from multiple insurance institutions, they send personal information, including some private information such as health status and insurance plan options. Some unethical insurance institutions may collude to manipulate insurance prices by exchanging information provided by users in order to raise quotes and maximize economic profits. This behavior can bring multiple harms: 1) Insurance institutions collude in price manipulation, resulting in policyholders having to pay premiums exceeding reasonable market levels; 2) Price monopoly in the industry limits the choices available to policyholders; 3) Collusion in price manipulation distorts the competitive landscape, weakens the price adjustment mechanism, and hinders effective resource allocation.

[0003] In order to mitigate the above hazards, the most direct solution is to ensure that the insurance agencies that the insured inquires about are unaware of each other's identities, that is, mutual anonymity. To achieve this goal, identity-based anonymous broadcast encryption (AIBBE) is a good choice because it ensures that multiple insurance agencies can decrypt the messages sent by users while ensuring mutual anonymity between insurance agencies.

[0004] Recently, many AIBBE schemes have been proposed. However, after studying these schemes, we found that most of them are based on time-consuming pairing operations, and none of them fully meet the requirements of CCA (chosen ciphertext attack) security in terms of confidentiality and anonymity. The main reason is that they are vulnerable to insider attacks, because a dishonest receiver in these schemes can identify the identities of other receivers. In addition, most of them rely on expensive pairing operations, resulting in huge computational costs. Therefore, developing a lightweight and secure AIBBE scheme remains an open challenge.

[0005] Based on the above reasons, we propose a novel identity-based anonymous broadcast encryption (AIBBE) scheme that can be applied to the medical insurance price inquiry system. This scheme ensures anonymity between insurance institutions and prevents price manipulation, while also reducing computational and communication costs.

[0006] Prior art 1

[0007] Cui et al. proposed an anonymous broadcast encryption scheme based on SM9, which achieved mutual anonymity among receivers and effectively protected the privacy of receivers.

[0008] Disadvantages of the prior art 1

[0009] Their solution uses expensive and time-consuming bilinear pairing operations, which requires high computational cost and communication overhead.

[0010] Prior art 2

[0011] Fazio et al. proposed an identity-anonymous broadcast encryption based on subset covering technology to meet external anonymity.

[0012] Disadvantages of the second prior art

[0013] In their scheme, the user's identity is anonymous from the perspective of users outside the receiver set, but it is not anonymous for users within the receiver set. Therefore, it cannot resist adaptive chosen ciphertext attack (CCA). Summary of the invention

[0014] In order to solve the problems existing in the prior art, the present invention provides an identity-based anonymous broadcast encryption model and method, which ensures the anonymity between insurance institutions, prevents price manipulation, and also reduces computing and communication costs.

[0015] The specific scheme provided by the present invention is as follows:

[0016] An identity-based anonymous broadcast encryption model includes a system model and a security model; the system model is used to provide a framework for the implementation of the scheme; the security model is used to ensure that the protocol can resist specific types of attacks within the framework.

[0017] Preferably, the system model includes a key center, a user and an insurance agency;

[0018] The key center connects users through private keys and identity information, and connects insurance institutions through ciphertext and a list of insurance institutions. The key center connects insurance institutions through private keys and identity information.

[0019] Preferably, the key center is responsible for initializing system parameters;

[0020] It is used by users to encrypt their personal information and send the encrypted text to the insurance agency that the user wishes to request a quote from;

[0021] Insurance agencies use this to provide insurance quotes and have the ability to decrypt ciphertext containing user personal information.

[0022] Preferably, the security model includes an indistinguishability model under chosen ciphertext attacks and an anonymity model under chosen ciphertext attacks; the indistinguishability model under chosen ciphertext attacks is used to ensure the confidentiality of the data and ensure that the ciphertext does not reveal information about the original message; the anonymity model under chosen ciphertext attacks is used to ensure the anonymity of the identity of the insurance institution and ensure that the identity of any institution in the list of insurance institutions cannot be revealed through ciphertext.

[0023] Preferably, an identity-based anonymous broadcast encryption method comprises the following stages:

[0024] Phase 1: System initialization;

[0025] Phase 2: User and insurance institution key generation;

[0026] The third stage: encryption stage;

[0027] The fourth stage: decryption stage.

[0028] The technical effects of the identity-based anonymous broadcast encryption model and method of the present invention are as follows:

[0029] 1. The present invention realizes the anonymity of identities among insurance institutions, effectively resists collusion among them to manipulate prices, protects the legitimate rights and interests of users, and maintains the healthy development of the insurance industry.

[0030] 2. The present invention avoids time-consuming bilinear pairing operations and exponential operations, saving computational costs and communication overhead.

[0031] 3. The present invention ensures the integrity of personal information transmitted by users and the integrity of the list of designated insurance institutions, thereby improving the reliability of the medical insurance inquiry system. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a model diagram of the medical insurance inquiry system of the present invention. DETAILED DESCRIPTION

[0033] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0034] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0035] An identity-based anonymous broadcast encryption model includes a system model and a security model; the system model is used to provide a framework for the implementation of the scheme; the security model is used to ensure that the protocol can resist specific types of attacks within the framework.

[0036] The system model of this implementation scheme includes a key center, a user and an insurance agency;

[0037] The key center connects to users through private keys and identity information, users connect to insurance institutions through ciphertext and insurance institution lists, and the key center connects to insurance institutions through private keys and identity information.

[0038] The key center of this implementation scheme is responsible for initializing system parameters;

[0039] It is used by users to encrypt their personal information and send the encrypted text to the insurance agency that the user wishes to request a quote from;

[0040] Insurance agencies use this to provide insurance quotes and have the ability to decrypt ciphertext containing user personal information.

[0041] The security model of this implementation scheme includes an indistinguishability model under chosen ciphertext attacks and an anonymity model under chosen ciphertext attacks; the indistinguishability model under chosen ciphertext attacks is used to ensure the confidentiality of data and ensure that the ciphertext does not reveal information about the original message; the anonymity model under chosen ciphertext attacks is used to ensure the anonymity of the identity of the insurance institution and ensure that the identity of any institution in the list of insurance institutions cannot be revealed through ciphertext.

[0042] An identity-based anonymous broadcast encryption method, characterized in that it includes the following stages:

[0043] Phase 1: System initialization;

[0044] Phase 2: User and insurance institution key generation;

[0045] The third stage: encryption stage;

[0046] The fourth stage: decryption stage.

[0047] When implementing this implementation scheme, in the present invention, a system model and a security model are defined. The system model provides a framework for the implementation of the scheme, while the security model ensures that the protocol can resist specific types of attacks within the framework, provides a formal security proof for the scheme, and evaluates whether the protocol can remain secure under different types of attacks.

[0048] System Model

[0049] like Figure 1As shown, for ease of description, we simplify the system model into three entities: key center (PKG), user (US), and insurance agency (IO). Users and insurance agencies submit their identity information to PKG for key generation. The task of PKG is to generate private keys for individual users and insurance agencies. Users send encrypted personal information to designated insurance agencies to seek policy quotes. These insurance agencies can then use their private keys to recover users' personal information. Further details about these entities are described as follows:

[0050] Key Center (PKG): Responsible for initializing system parameters. At the same time, the private keys of users and insurance institutions are distributed by the Key Center (PKG).

[0051] User (US): The user encrypts their personal information and sends the encrypted text to the insurance agency that the user wants to request a quote from.

[0052] Insurance Institution (IO): They are the insurance institutions that users wish to contact to obtain insurance quotes and they have the ability to decrypt ciphertext containing user personal information.

[0053] Security Model

[0054] The AIBBE scheme must ensure both the confidentiality of data and the anonymity of the identity of the insurance institution. Therefore, we consider the following two security models.

[0055] 1) Indistinguishability under chosen-ciphertext attacks (IND-CCA): aims to ensure the confidentiality of data and ensure that the ciphertext does not reveal information about the original message.

[0056] 2) Anonymity under Chosen-ciphertext Attacks (ANO-CCA): Aims to ensure the anonymity of the insurance institution’s identity and ensure that the identity of any institution in the insurance institution list cannot be revealed through ciphertext.

[0057] Both security models are defined through an interactive game between the adversary and the challenger. If the adversary cannot win with a non-negligible advantage in probabilistic polynomial time (PPT), the scheme is called IND-CCA and ANO-CCA secure.

[0058] Design goals

[0059] First, we propose a new AIBBE scheme, which not only achieves identity anonymity among different insurance institutions by blinding their public keys, but also avoids time-consuming exponential operations and pairing operations.

[0060] Secondly, the scheme can achieve the integrity of the transmitted data and the list of designated insurance institutions, and proves its security against ANO-CCA attacks and IND-CCA attacks in the random oracle model.

[0061] Finally, compared with several existing AIBBE schemes, experimental results show that the proposed scheme has lower computational and communication costs, as well as higher efficiency.

[0062] Proposed anonymous broadcast encryption scheme

[0063] Design Overview

[0064] We will introduce the definitions and security concepts in the AIBBE scheme. An identity-based anonymous broadcast encryption (AIBBE) scheme is defined on the message space M and consists of four phases: 1) system initialization; 2) user and insurance institution key generation; 3) encryption; 4) decryption. Table 1 lists the symbol definitions used in the whole scheme. The whole process will be introduced step by step.

[0065] Table 1: Symbols and descriptions

[0066]

[0067] Main architecture

[0068] Step 1: System Initialization

[0069] At this stage, the system is initialized, including generating the parameters and master key required by the system. PKG selects a large prime number p and uses its order large prime number p to determine the finite field F p , in the finite field F p Select a secure elliptic curve E p Then, in E p Determine the multiplication cyclic group G and select a generator g on the multiplication cyclic group G. First, PKG selects a random number s as the system master private key msk=s, and then calculates the public key P pub =g s ; Secondly, PKG selects several secure hash functions H1:{0,1} * ×G→Z p , H2:G→{0,1} l (l is the sum of the message and signature lengths); finally, PKG broadcasts the system parameters pp = (p, G, g, H1, H2) and keeps s confidential.

[0070] Step 2: Key generation phase for users and insurance institutions

[0071] At this stage, the user US and the insurance agency IO send their identity information ID to the key center PKG, and PKG distributes keys to the user and the insurance agency. The specific process is as follows: The insurance agency submits its identity ID to PKG i (i∈{1,…,n}), PKG selects a random number r i ←Z q ,calculate And calculate the private key s i =r i +s·H1(ID i ,R i ), and then use the security pass to pass R i and i Sent to the insurance agency. The insurance agency will verify the equation After verification, the insurance agency calculates its public key The key generation process for user US and insurance institution IO is the same (user identity is ID d ). US will send the public key PK d , IO will send the public key PK i .

[0072] Step 3: Encryption Phase

[0073] In this stage, the user selects a group of insurance institutions that he wants to inquire about prices, broadcasts them blindly, and encrypts the messages for broadcast. The specific process is as follows: The user selects a group of insurance institutions R = {ID1,…,ID n} as the receiver. Their public keys correspond to {PK1,…,PK n}.

[0074] The user chooses a random number t←Z q As a blinding factor, calculate g t .

[0075] The user uses the blinding factor to blind the insurance institution's public key: Calculate Where i∈{1,…,n}, generate the blinded insurance agency list R'={PK′1,…,PK' n}.

[0076] The user uses his own private key d Generate signature σ d ←Sign(m,s d ,R'). Where Sign(·) represents any signature algorithm.

[0077] Generate ciphertext

[0078] Finally, the user broadcasts the ciphertext and the blinded list of insurance agencies.

[0079] Step 4: Decryption Phase

[0080] At this stage, after the insurance agency selected by the user receives the ciphertext broadcast by the user, it uses its own private key to decrypt and obtain the personal information sent by the user. The specific process is as follows:

[0081] Use private key i calculate

[0082] calculate If the calculated g t If the value is valid, the correct (m||σ d ), which means the insurance agency ID i In the list of insurance agencies selected by the user.

[0083] Insurance institution operation algorithm Ver(σ d ,PK d ) to verify σ d The effectiveness of PK d is the user’s public key. If σ d If the information is valid, the algorithm will return 1, otherwise, it will return 0. Based on this result, the insurance agency decides whether to accept or reject the information.

[0084] After obtaining the personal information provided by the user, the insurance agency will provide the user with corresponding insurance quotes.

[0085] In addition to the method used in the present invention, the bilinear pairing method can also be used to complete anonymous broadcast encryption to achieve the same purpose of the invention.

[0086] Key technical points: Starting from the public key of the insurance institution, the public key of the insurance institution is blinded by selecting a blinding factor, thereby achieving identity anonymity between them. At the same time, this approach also avoids time-consuming exponential operations and bilinear pairing operations.

[0087] Points to be protected: the anonymity of the identity of the insurance agency selected by the user when making an insurance inquiry, the integrity of the personal information transmitted by the user and the list of insurance agencies.

Claims

1. An identity-based anonymous broadcast encryption model, characterized in that: It includes a system model and a security model; the system model is used to provide a framework for the implementation of the solution; the security model is used to ensure that the protocol can resist specific types of attacks within the framework.

2. The identity-based anonymous broadcast encryption model according to claim 1, characterized in that: The system model includes a key center, a user and an insurance agency; The key center is connected to the user through the private key and identity information, the user is connected to the insurance institution through the ciphertext and the insurance institution list, and the key center is connected to the insurance institution through the private key and identity information.

3. The identity-based anonymous broadcast encryption model according to claim 1, characterized in that: The key center is responsible for initializing system parameters; The user encrypts their personal information and sends the encrypted text to the insurance agency that the user wishes to obtain a quote from; The insurance agency is used to provide insurance quotes and has the ability to decrypt ciphertext containing user personal information.

4. The identity-based anonymous broadcast encryption model according to claim 1, characterized in that: The security model includes an indistinguishability model under chosen ciphertext attacks and an anonymity model under chosen ciphertext attacks; the indistinguishability model under chosen ciphertext attacks is used to ensure the confidentiality of data and ensure that the ciphertext does not reveal information about the original message; the anonymity model under chosen ciphertext attacks is used to ensure the anonymity of the identity of the insurance institution and ensure that the identity of any institution in the insurance institution list cannot be revealed through the ciphertext.

5. An identity-based anonymous broadcast encryption method, characterized in that: The following phases are included: Phase 1: System initialization; Phase 2: User and insurance institution key generation; The third stage: encryption stage; The fourth stage: decryption stage.

Images