Matching function encryption method

Abstract

The invention relates to the technical field of computer security, in particular to a matching function encryption method, which specifically comprises the following steps: in an initialization stage, a key generation center outputs a system public key and a master key according to security parameters; in an encryption key generation stage, the key generation center outputs an encryption key according to the master key and the identity identifier of the encryptor; in a decryption key generation stage, the key generation center outputs a decryption key according to the master key, the function f and the receiver identity identifier; in the encryption algorithm stage, a system public key is input, and an encryptor outputs a ciphertext by using an encryption algorithm according to an encryption key, a plaintext message and a target identity identifier specified by the encryptor; and in the decryption algorithm stage, the receiver outputs an inner product function by using a decryption algorithm according to the decryption key, the ciphertext and the target identity identifier specified by the receiver, and the receiver decodes the ciphertext by using the inner product function. According to the invention, the system security is improved, and the identity tracing of the data source is ensured by using two-way access control of matching encryption.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security, and in particular to a matching function encryption method. Background Art

[0002] Matchmaking Encryption (ME) is a new cryptographic primitive that provides a two-way access control mechanism. When the sender (identity: σ) requests the Key Generation Center (KGC) to generate its own encryption key ek σ When the target identity rcv is specified, the encryption algorithm is executed to obtain ek σ The ciphertext ct obtained by encrypting the message m with rcv m，σ，rcv Similarly, the receiver (identity: ρ) can request KGC to obtain its own decryption key sk ρ , specify the target identity snd, execute the decryption algorithm on ct m，σ，rcv Decryption. Only when σ=snd and ρ=rcv, the original message will be restored. Identity-Based Matchmaking Encryption (IB-ME) can be seen as a generalization of the identity-based encryption scheme. Its inherent structure helps to track data sources and filter interference information. It has received widespread attention from the academic community in the past two years.

[0003] Functional Encryption (FE), compared with traditional public key encryption, can achieve fine-grained access control for sensitive data and realize different functional encryption systems. In the functional encryption system, the private key owned by the user can solve a function of the encrypted data, namely the functional function. This function determines that the user with the decryption key can obtain the plaintext information from the ciphertext, which makes the access ability of the ciphertext determined by the relation. Since it allows users to define more fine-grained and flexible access control policies for sensitive data, it is very suitable for data security sharing, fine-grained access control and secure storage in cloud storage environments.

[0004] However, existing functional encryption methods cannot be dynamically adjusted according to attack scenarios and control requirements, have weak ability to resist attacks, and cannot ensure the traceability of data. Summary of the invention

[0005] To this end, the technical problem to be solved by the present invention is to overcome the problems in the prior art that the functional encryption method cannot be dynamically adjusted according to the attack scenario and control requirements, has a weak ability to resist attacks, and cannot ensure the traceability of data.

[0006] In order to solve the above technical problems, the present invention provides a matching function encryption method, the steps comprising:

[0007] In the initialization phase, the key generation center outputs the system public key PK and the master key MK according to the security parameter λ;

[0008] During the encryption key generation phase, the key generation center generates the encryption key based on the master key MK and the encryptor's identity. Output the encryption key ek for the encryptor identity σ σ ;in represents identity space;

[0009] In the decryption key generation phase, the key generation center generates the decryption key according to the master key MK and the function and the recipient's identity Output the decryption key dk for the receiver's identity ρ f，ρ ;in is a family of functions, represents the set of all plaintext labels, Represents the set of all ciphertext tags, with plaintext messages Cipher Message

[0010] In the encryption algorithm stage, the system public key PK is input, and the encryptor uses the encryption key ek σ , the plaintext message x and the target identity specified by the encryptor Use encryption algorithm to output ciphertext ct x，σ，rcv ;

[0011] In the decryption algorithm phase, the receiver uses the decryption key dk f，ρ 、Ciphertext ct x，σ，rcv and the target identity specified by the receiver Use the decryption algorithm to output the inner product function f(x); when σ=snd and ρ=rcv, the inner product function Used to obtain plaintext messages, otherwise the termination symbol ⊥ is output, and the inner product result will be hidden by a random value; the authenticated recipient uses the inner product function f(x) to decode the ciphertext.

[0012] In one embodiment of the present invention, during the initialization phase, the key generation center outputs the system public key PK and the master key MK according to the security parameter λ, including:

[0013] Identity Space Bilinear Map Input the security parameter λ and the dimension n of the basis and call the algorithm Output

[0014] in is a polynomial time algorithm, the parameter set where p is a prime number with respect to the security parameter λ, G1, G2, G T are cyclic groups of order p, g1 and g2 are generators of groups G1 and G2 respectively, e: =G1×G2→G T is a bilinear map;

[0015] In the dual vector space, for Define a bilinear map

[0016] base base where b i and Both n-dimensional vector on, for any i, j∈[n],

[0017] From the non-zero elements in the field of integers modulo p Select random integers η, ω from the non-zero integer field of n-dimensional modulo p Select a random n-element vector t,u from the equation: t:=(t1,…,t n ), u:=(u1,…,u n );

[0018] The system public key Master Key

[0019] In one embodiment of the present invention, in the encryption key generation phase, the encryption key ek related to the encryptor identity σ σ for:

[0020]

[0021] The random number definition

[0022] In one embodiment of the present invention, in the decryption key generation phase, the decryption key dk related to the receiver identity ρ is f，ρ for:

[0023]

[0024]

[0025]

[0026]

[0027] The random number definition

[0028] In one embodiment of the present invention, during the encryption algorithm stage, the ciphertext ct x，σ，rcv for:

[0029] ct x，σ，rcv :=(c1,...,c n , c)

[0030] in Random Numbers

[0031] In one embodiment of the present invention, during the decryption algorithm phase, the receiver uses the decryption key dk f，ρ 、Ciphertext ct x，σ，rcv and the target identity specified by the receiver The output function f(x) using the decryption algorithm includes:

[0032] calculate

[0033]

[0034] And calculate the inner product m of x, y =<x,y> , if m is taken from the set of polynomials but Established, output inner product function f(x) =<x,y> .

[0035] The above technical solution of the present invention has the following advantages compared with the prior art:

[0036] The matching function encryption method described in the present invention uses identity-based function encryption to verify the target identity of the receiver and the encryptor in the decryption algorithm stage, which can effectively prevent unauthorized illegal access and malicious attacks and improve the security of the system. The inner product function for obtaining the plaintext message finally output by the present invention is It allows attackers to adaptively query any key, including decryption keys, without leaking the ciphertext content, realizing flexible privacy computing, improving the privacy and confidentiality of ciphertext data, and satisfying the multi-functional computing of encrypted data. At the same time, it can also be dynamically adjusted according to different attack scenarios and access control requirements to improve the system's anti-attack capabilities. Therefore, it is suitable for multiple fields and scenarios and can meet the data security needs of different industries and organizations.

[0037] A matching function encryption method described in the present invention limits the conditions for successful decryption. The ciphertext can only be successfully decrypted when the identity identifiers specified by the receiver and the encryptor match, the identity identifiers specified by the encryptor and the receiver match, and the evaluation results of the inner product function f(x) outputted for obtaining the plaintext message are equal. The two-way access control of matching encryption is utilized to ensure the identity traceability of the data source. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to make the content of the present invention more clearly understood, the present invention is further described in detail below according to specific embodiments of the present invention in conjunction with the accompanying drawings, wherein

[0039] Figure 1 The present invention provides a flowchart of a matching function encryption method. DETAILED DESCRIPTION

[0040] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0041] First, the basic symbol definitions used in the present invention are given:

[0042] for [n] represents the set {1, 2, ...n}. and definition and where b i and Both n-dimensional vector on (for any i∈[n]), and

[0043] make is a polynomial time algorithm. When the security parameter λ is input, the algorithm A parameter group will be output where p is a prime number with respect to parameter λ, G1, G2, G T are cyclic groups of order p, g1 and g2 are generators of groups G1 and G2 respectively, e: =G1×G2→G T is a computationally efficient and non-degenerate bilinear map.

[0044] for Define a bilinear map make is a random standard dual orthogonal basis generator. When the security parameter λ and the dimension n of the basis are input, Will output: in The following conditions must be met:

[0045]

[0046] in Can Any value in , i = 1,…n, j = 1,…n.

[0047] The following are detailed definitions of the assumptions used in the present invention:

[0048] DDH Assumption (Decisional Diffie-Hellman Assumption): When a security parameter λ is given, if in G s (s∈{1,2}), for any probabilistic polynomial-time adversary is a negligible function of λ, then the DDH hypothesis holds, where

[0049]

[0050] Among them, randomly selected satisfy a, b, c from Randomly selected from .

[0051] SXDH Assumption (Symmetric External Diffie-Hellman Assumption): If the DDH assumption holds in both G1 and G2, then the SXDH assumption holds.

[0052] XDLIN Assumption (External Decisional Linear Assumption): When the security parameter λ is given, if in G s (s∈{1,2}), for any probabilistic polynomial-time adversary is a negligible function of λ, then the XDLIN assumption holds, where

[0053]

[0054] Among them, randomly selected satisfy a1, a2, b1, b2, c from Randomly selected from .

[0055] Reference Figure 1 As shown, the present invention provides a matching function encryption method, the specific steps include:

[0056] S1. Initialization phase: the key generation center outputs the system public key PK and the master key MK according to the security parameter λ.

[0057] Identity Space Bilinear Map Calling Algorithm Output From the non-zero elements in the field of integers modulo p Select random integers η, ω from the non-zero integer field of n-dimensional modulo p Select a random n-element vector t,u from the equation: t:=(t1,…,t n ), u:=(u1,…,u n ).

[0058] System public key

[0059] Master Key

[0060] S2, encryption key generation stage, the key generation center generates the encryption key according to the master key MK and the encryptor identity. Output the encryption key for the encryptor identity σ

[0061] in Represents identity space, random number

[0062] S3, decryption key generation stage, the key generation center generates the decryption key according to the master key MK, function and the recipient's identity Output the decryption key for the receiver's identity ρ:

[0063]

[0064]

[0065]

[0066]

[0067] in is a family of functions, represents the set of all plaintext labels, Represents the set of all ciphertext tags, with plaintext messages Cipher Message Random Numbers

[0068] S4, encryption algorithm stage, input system public key PK, encryptor according to the encryption key ek σ , the plaintext message x and the target identity specified by the encryptor Use the encryption algorithm to output ciphertext:

[0069] ct x，σ，rcv :=(c1,...,c n , c)

[0070] in Random Numbers

[0071] S5, decryption algorithm stage, the receiver uses the decryption key dk f，ρ 、Ciphertext ct x，σ，rcv and the target identity specified by the receiver The decryption algorithm is used to output the function f(x), including:

[0072] calculate

[0073]

[0074] And calculate the inner product m of x, y =<x,y> , if m is taken from the set of polynomials but Established, the output function f(x) =<x,y> .

[0075] If σ=snd and ρ=rcv, then

[0076]

[0077] Therefore, when σ = snd and ρ = rcv, the inner product function It is used to obtain the plaintext message. In other cases, the terminal symbol ⊥ is output, and the inner product result will be hidden by a random value. The authenticated receiver uses the inner product function f(x) to decode the ciphertext.

[0078] The present invention restricts the conditions for successful decryption to ensure that the decryption is successful only when the identity of the receiver matches the target identity specified by the sender (σ=snd∧ρ=rcv) and the inner product function evaluation result is also equal This is done to prevent attackers from easily obtaining ciphertext messages by simply matching the key or function result.

[0079] The security of the present invention meets the following two conditions:

[0080] (1) Privacy: The selective security and adaptive security models of the present invention can be given based on the selective attacker and adaptive attacker attack confrontation games respectively.

[0081] (2) Authenticity. It requires that an attacker cannot forge a legitimate ciphertext about the sender, as shown in the following formula:

[0082]

[0083] The present invention is analyzed below based on security.

[0084] Under the condition that the SXDH assumption and the XDLIN assumption hold, a matching function encryption method proposed in the present invention satisfies the selection of security and authenticity. Specifically, this scheme adopts the inner product function as the evaluation function of the identity-based matching function encryption, that is, the identity-based matching function encryption based on the inner product (IP). The inner product-based identity-based matching function encryption is constructed by directly combining the inner product-based function encryption and the identity-based encryption. More specifically, the decryption result of the identity-based matching function encryption of the present invention can be decomposed into a three-layer equation as follows.

[0085]

[0086] The structure in the above formula can be called a three-layer identity-based matching function encryption structure based on inner product. The first layer of inner product-based function encryption provides evaluation function and partial privacy. The second and third layers nest two anonymous identity-based encryption schemes to ensure authenticity and partial privacy. Next, the inner product-based function encryption construction and anonymous identity-based encryption construction are used to implement this three-layer structure, and finally the above-mentioned identity-based matching function encryption scheme that meets the selection security and authenticity is obtained.

[0087] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0088] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0089] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0090] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0091] Obviously, the above embodiments are merely examples for clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from these are still within the protection scope of the invention.

Claims

1. A matching function encryption method, characterized in that the steps include: In the initialization phase, the key generation center outputs the system public key PK and the master key MK according to the security parameter λ; During the encryption key generation phase, the key generation center generates the encryption key based on the master key MK and the encryptor's identity. Output the encryption key ek for the encryptor identity σ σ ;in represents identity space; In the decryption key generation phase, the key generation center generates the decryption key according to the master key MK and the function and the recipient's identity Output the decryption key dk for the receiver's identity ρ f，ρ ;in is a family of functions, represents the set of all plaintext labels, Represents the set of all ciphertext tags, with plaintext messages Cipher Message In the encryption algorithm stage, the system public key PK is input, and the encryptor uses the encryption key ek σ , the plaintext message x and the target identity specified by the encryptor Use encryption algorithm to output ciphertext ct x，σ，rcv ; In the decryption algorithm phase, the receiver uses the decryption key dk f，ρ 、Ciphertext ct x，σ，rcv and the target identity specified by the receiver Use the decryption algorithm to output the inner product function f(x); when σ=snd and ρ=rcv, the inner product function Used to obtain plaintext messages, otherwise the termination symbol ⊥ is output, and the inner product result will be hidden by a random value; the authenticated recipient uses the inner product function f(x) to decode the ciphertext.

2. A matching function encryption method according to claim 1, characterized in that: In the initialization phase, the key generation center outputs the system public key PK and the master key MK according to the security parameter λ, including: Identity Space Bilinear Map Input the security parameter λ and the dimension n of the basis and call the algorithm Output in is a polynomial time algorithm, the parameter set where p is a prime number with respect to the security parameter λ, G1, G2, G T are cyclic groups of order p, g1 and g2 are generators of groups G1 and G2 respectively, e: =G1×G2→G T is a bilinear map; In the dual vector space, for Define a bilinear map base base where b i and Both n-dimensional vector on, for any i, j∈[n], From the non-zero elements in the field of integers modulo p Select random integers η, ω from the non-zero integer field of n-dimensional modulo p Select a random n-element vector t,u from the equation: t:=(t1,…,t n ), u:=(u1,…,u n ); then the system public key Master Key 3. A matching function encryption method according to claim 2, characterized in that: In the encryption key generation phase, the encryption key ek related to the encryptor identity σ σ for: The random number definition 4. A matching function encryption method according to claim 3, characterized in that: In the decryption key generation phase, the decryption key dk about the receiver identity ρ f，ρ for: The random number definition 5. A matching function encryption method according to claim 4, characterized in that: In the encryption algorithm stage, the ciphertext ct x，σ，rcv for: ct x，σ，rcv :=(c1,...,c n ,c) in Random Numbers 6. A matching function encryption method according to claim 5, characterized in that: In the decryption algorithm phase, the receiver uses the decryption key dk f，ρ 、Ciphertext ct x，σ，rcv and the target identity specified by the receiver The output function f(x) using the decryption algorithm includes: calculate And calculate the inner product m of x, y =<x,y> , if m is taken from the set of polynomials but Established, Output inner product function f(x) =<x,y> .

Images