Traceable encryption method, device, equipment and medium based on file hierarchical attribute-based encryption and key delegation

Abstract

The present application relates to a traceable encryption method, apparatus, device, and medium based on hierarchical attribute-based encryption and key delegation. The method includes: a data owner selects attributes and constructs a polynomial to encrypt data, calculates and determines the encrypted ciphertext of each node, and calculates and determines the encrypted ciphertext of threshold nodes among the child nodes of the transmission node; a data user randomly selects a symmetric key and encrypts the corresponding message, and hierarchically encrypts the symmetric key, associating each symmetric key with a level node to calculate and determine the level ciphertext; the data user decrypts the data using the key SK and checks whether the attributes match; for non-leaf nodes, the child nodes are recursively decrypted; if the user's attributes match, the information of the node at a specific level is recovered and decrypted; and the decrypted information of nodes at other levels is recursively calculated to recover the symmetric key. The present application not only prevents multiple users from combining their existing keys to access unauthorized data, but also inhibits users from colluding with other users' keys.

Description

Technical Field

[0001] The present application relates to the field of data encryption, and in particular to a traceable encryption method based on file hierarchical attribute-based encryption and key delegation, a corresponding device, an electronic device and a computer-readable storage medium. Background Art

[0002] The emergence of cloud computing has transformed traditional computing models. While numerous individuals, companies, hospitals, and even governments are enjoying the benefits of cloud computing, cloud computing services are rapidly expanding and becoming ubiquitous in everyday life. However, unauthorized users are constantly attempting to steal, overwrite, and modify data stored on the internet, jeopardizing not only system security but also user safety. Cryptography has become a widely used technology in communications and network security to protect data.

[0003] Cloud storage, as a key service module of cloud computing, does not guarantee complete trustworthiness. To ensure the security of data stored on cloud services, users must encrypt their data before storing it. Traditional encryption methods only support one-to-one information exchange, making it difficult to efficiently share the same data among multiple users. Furthermore, fine-grained access control must be implemented to protect the data being accessed.

[0004] Attribute encryption technology implements many-to-many encryption and provides fine-grained access control to data users by formulating flexible access policies. However, traditional attribute encryption is not fully applicable to cloud storage services. In actual application scenarios, user attributes are often divided into different levels according to their importance. To address this problem, hierarchical attribute encryption has been proposed. The advantage of the delegation key method is that users can act as authorization agencies to a certain extent, allowing the entire system to accommodate more users. The key generation center can generate keys only for high-level users, while the delegator and the key generation center jointly construct delegation keys for other users, thus significantly reducing the workload of the key generation center. How to combine key delegation technology and attribute encryption technology is a problem that needs to be solved in the existing technology.

[0005] All of the above methods have achieved good results, but there are also certain shortcomings, mainly including:

[0006] (1) Currently, traditional traceable key delegation for file hierarchical attribute-based encryption (Traceable Key Delegation for File Hierarchy Attribute-Based encryption) encryption is performed by the data owner, which is costly.

[0007] (2) There is currently no work on attribute-based encryption key delegation for file-level ciphertext policies;

[0008] (3) The traditional Traceable Key Delegation for File Hierarchy Attribute-Based Encryption (TKDE) scheme handles the delegation of "read" permissions by delegating the user's private key to other users. This approach lacks further consideration of the granularity and traceability of permission delegation. When key delegation is performed between different users, the delegated key may be leaked, making it difficult to determine the identity of the user who leaked the delegated key.

[0009] To sum up, the hierarchical attribute-based encryption and key delegation scheme encryption of traceable encrypted files in the existing technology are both executed by the data owner, which has high overhead. In addition, when key delegation is carried out between different users, the delegation key may be leaked, and it is difficult to determine the identity of the user who leaked the delegation key. In order to solve this problem, the applicant has made corresponding explorations. Summary of the Invention

[0010] The purpose of this application is to solve the above problems and provide a traceable encryption method based on file hierarchical attribute-based encryption and key delegation, a corresponding device, an electronic device and a computer-readable storage medium.

[0011] In order to meet the various objectives of this application, this application adopts the following technical solutions:

[0012] A traceable encryption method based on hierarchical attribute-based encryption and key delegation is proposed to meet one of the purposes of this application, including:

[0013] Select the bilinear pair e∶G0×G0→G T , the key generation center randomly selects parameters α, β to generate the public key PK and the master key MSK. The key generation center uses a k-1 degree polynomial to initialize Shamir's (k, n) threshold scheme;

[0014] The key generation center calculates and determines the intermediate value based on the public key PK, the master key MSK, the user attribute set and the user identity information and generates the corresponding encrypted ciphertext. The key generation center selects a random number for the data user and calculates and determines the key K and the first part key D. i,1 and the second part of the key D i,2 , according to the key K, the first part of the key D i,1 and the second part of the key D i,2 Construct the key SK;

[0015] Trustee user u1 sends a key delegation request to delegator user u0. Delegator user u0 checks the access structure of the ciphertext in the key delegation request and records the minimum attribute set S′. The key generation center selects a random number for trustee user u1 and generates a key SK′. The relevant intermediate value is saved to establish a key delegation relationship between trustee user u1 and delegator user u0.

[0016] The data owner selects attributes and constructs polynomials to encrypt the data, calculates the encrypted ciphertext of each node, and calculates the encrypted ciphertext of the threshold node in the child node of the transmission node;

[0017] The data user randomly selects a symmetric key and encrypts the corresponding message, and performs hierarchical encryption on the symmetric key, associating each symmetric key with a level node to calculate a determined level ciphertext;

[0018] The data user decrypts the data using the key SK and checks whether the attributes match. For non-leaf nodes, the child nodes are recursively decrypted. If the user's attributes match, the information of the node at a specific level is recovered and decrypted. The decrypted information of nodes at other levels is recursively calculated to recover the symmetric key.

[0019] Data users call the preset key tracking algorithm to track the identity of malicious users to complete the traceable encryption method based on file hierarchical attribute-based encryption and key delegation.

[0020] Optionally, select a bilinear pair e∶G0×G0→G T The key generation center randomly selects parameters α and β to generate the public key PK and the master key MSK. The key generation center uses a k-1 degree polynomial to initialize the steps of Shamir's (k, n) threshold scheme, including:

[0021] Select the bilinear pair e∶G0×G0→G T , where G0 and G T is a p-order multiplicative cyclic group, g and h are generators of the group G0, and the Lagrange coefficient is defined as:

[0022] △ ξ,S =∏ τ≠ξ,τ∈S (x-τ) / (ξ-τ),

[0023] Where S is a set, ξ is an element in the set;

[0024] Select hash function H1:G T →{0,1} l 、,H2∶Z p →G0 and H3: And determine the first symmetric key k1 and the second symmetric key k2;

[0025] Key generation center is randomly selected To generate a public key PK and a master key MSK, wherein the expression of the public key PK is:

[0026]

[0027] The expression of the master key MSK is:

[0028] MSK={β,g α ,k1,k2};

[0029] The key generation center uses the k-1 degree polynomial v = f(u) to initialize Shamir's (k,n) threshold scheme INS (k,n) .

[0030] Optionally, the key generation center calculates and determines the intermediate value based on the public key PK, the master key MSK, the user attribute set and the user identity information and generates the corresponding encrypted ciphertext. The key generation center selects a random number for the data user and calculates and determines the key K and the first part key D. i,1 and the second part of the key D i,2 , according to the key K, the first part of the key D i,1 and the second part of the key D i,2 The steps to construct the key SK include:

[0031] The key generation center uses the KeyGen algorithm to calculate and determine based on the public key PK, the master key MSK, the user attribute set S and the user identity information id:

[0032] Wherein, k1 is the first symmetric key;

[0033] v = f(u), where f(u) is a value calculated based on the encrypted value u;

[0034] Where k2 is the second symmetric key, u||v means concatenating u and v to form a composite message for encryption, and t is the encrypted value;

[0035] The key generation center provides a random number to the data user For each element j∈S in the user attribute set S, the key generation center randomly selects a value in, Is a finite field, the key generation center calculates and determines:

[0036]

[0037]

[0038] The key generation center generates the key K and the first part of the key D. i,1 and the second part of the key D i,2 Construct a key SK, wherein the expression of the key SK is:

[0039]

[0040] Optionally, the trustee user u1 sends a key delegation request to the delegator user u0, the delegator user u0 checks the access structure of the ciphertext in the key delegation request and records the minimum attribute set S′, the key generation center selects a random number for the trustee user u1 and generates a key SK′, and saves the relevant intermediate value to establish a key delegation relationship between the trustee user u1 and the delegator user u0, including:

[0041] The trustee user u1 sends a request with its identity identifier request||id′ to the delegator user u0. The delegator user u0 receives the request and sends a new key SK′ to the trustee u1. The key SK′ can only be used for the ciphertext set CT′. Decrypt the ciphertext in ;

[0042] The delegator user u0 checks the access structure of the ciphertext in CT′, finds the minimal attribute set that satisfies the access structure of the ciphertext in CT′, and records it as S′, where The delegator user u0 sends a delegation request request||S′||id′||K′ to the key generation center. Based on the delegation request request||S′||id′||K′, the key generation center calculates and determines:

[0043] Among them, u′ is the encrypted identity;

[0044] v′=f(u′), where v′ is the result of processing u′ by function f;

[0045] Among them, c′ is the encryption result of u′||v′;

[0046] The key generation center saves u′||v′ and selects a random number for the trustee user u1 The key generation center sends c′||r′ to the client user u0, and the client user u0 selects a random number To generate a delegation key, the expression of the delegation key is:

[0047]

[0048] A key delegation relationship is established between the delegator user u0 and the trustee user u1. The key delegation relationship is expressed as:

[0049] <(u0,S,SK),(u1,S′,SK′)>∈DK.

[0050] Optionally, the steps of the data owner selecting an attribute and constructing a polynomial to encrypt the data, calculating and determining the encrypted ciphertext of each node, and calculating and determining the encrypted ciphertext of the threshold node in the child node of the transmission node include:

[0051] The data owner accesses the tree based on the public key PK and multiple keys s1,s2,...,s k , for each node x of the visited tree, construct a polynomial F x , where the polynomial structure of each node is constructed from top to bottom, and the order of the polynomial is d x , d x =k x -1,k x is the threshold value of x;

[0052] If node x is a level node in the visited tree, then: F x (0)=s i ; If node x is not a level node in the visited tree, then: F x (0) = F parent(x) (index(x)), where att(x) represents the attribute of node x, which is used to identify the attribute or permission of the node;

[0053] For each node x, the data owner calculates and determines its ciphertext pair, which is expressed as:

[0054]

[0055] Determine the transmission node Y′ and TN-CT(x,y), where Y′ represents the access tree A transmission node in , the TN-CT (x, y) represents the set of threshold nodes in the child nodes of the transmission node, for node y and its corresponding child node ch y,k , which is calculated and determined by the data owner and is expressed as:

[0056]

[0057] Among them, αF y (0) and Represents node y and its corresponding child node ch respectively y,k weighting of the calculated polynomial values;

[0058] For each child node ch y,k , the data owner calculates and determines the corresponding encrypted ciphertext, which is expressed as:

[0059]

[0060] Among them, W y,k Is the key for node encryption.

[0061] Optionally, the data user randomly selects a symmetric key and encrypts the corresponding message, and hierarchically encrypts the symmetric key, and associates each symmetric key with a level node to calculate and determine the level ciphertext, including:

[0062] The data user calls the OnlineEnc algorithm and randomly selects k symmetric keys ck to encrypt the corresponding k messages E ck (M), and hierarchically encrypt the symmetric key ck, wherein ck={ck1, ck2, ..., ck k},

[0063] Data users will each symmetric key ck i With a level node L1, L2, ..., L k Associated, calculate the determined level ciphertext, which includes:

[0064]

[0065] Optionally, the data user decrypts the data using the key SK and checks whether the attributes match; for non-leaf nodes, recursively decrypts the child nodes; if the user's attributes match, recovers and decrypts the information of the node at a specific level; and recursively calculates the decrypted information of nodes at other levels to recover the symmetric key, including the following steps:

[0066] If the attribute set S associated with the key SK and the access structure of the ciphertext CT If the key SK matches, the data user uses the key SK to perform a decryption algorithm, which includes:

[0067] For a leaf node (x, y), let i = att(x). If i∈S, then:

[0068]

[0069] If x is a non-leaf node, then: DecryptNode(SK,CT,x), perform the decryption operation on node x, which includes:

[0070] Calculate F for each child node z of node x z =DecryptNode(SK,CT,x), where S xBy any k x The set of child nodes z, such that F z ≠⊥, its expression is:

[0071]

[0072] If the attributes of the data user meet all or part of Through the above decryption operation, the data user can obtain For level node L i , calculate and determine:

[0073]

[0074] If the data user can decrypt the level node L i of And can decrypt Node L in the subtree i The root level node L j of CS through ciphertext These level nodes are recursively evaluated, which include:

[0075]

[0076] Data user recovery ck i , calculate and determine:

[0077]

[0078] A traceable encryption device based on hierarchical attribute-based encryption and key delegation is provided to meet another purpose of the present application, including:

[0079] The system initialization module is set to select the bilinear pair e∶G0×G0→G T , the key generation center randomly selects parameters α, β to generate the public key PK and the master key MSK. The key generation center uses a k-1 degree polynomial to initialize Shamir's (k, n) threshold scheme;

[0080] The key generation module, the key generation center calculates and determines the intermediate value and generates its corresponding encrypted ciphertext based on the public key PK, the master key MSK, the user attribute set and the user identity information. The key generation center selects a random number for the data user, calculates and determines the key K, the first part of the key D i,1 and the second part of the key D i,2 , according to the key K, the first part of the key D i,1 and the second part of the key D i,2 Construct the key SK;

[0081] The delegation key generation module is configured such that the trustee user u1 sends a key delegation request to the delegator user u0. The delegator user u0 checks the access structure of the ciphertext in the key delegation request and records the minimum attribute set S′. The key generation center selects a random number for the trustee user u1 and generates a key SK′, and saves the relevant intermediate value to establish a key delegation relationship between the trustee user u1 and the delegator user u0.

[0082] The data offline encryption module is set to select attributes of the data owner and construct a polynomial to encrypt the data, calculate the encrypted ciphertext of each node, and calculate the encrypted ciphertext of the threshold node in the child node of the transmission node;

[0083] The data online encryption module is configured to randomly select a symmetric key for the data user and encrypt the corresponding message, and perform hierarchical encryption on the symmetric key, associating each symmetric key with a level node to calculate a determined level ciphertext;

[0084] The data decryption module is set to use the key SK for the data user to decrypt the data and check whether the attributes match. For non-leaf nodes, the child nodes are decrypted recursively. If the user's attributes match, the information of the node at a specific level is recovered and decrypted. The decrypted information of nodes at other levels is recursively calculated to recover the symmetric key.

[0085] The malicious user tracking module is configured to call a preset key tracking algorithm for data users to track the identity of malicious users, so as to complete a traceable encryption method based on file hierarchical attribute-based encryption and key delegation.

[0086] An electronic device provided to meet another purpose of the present application includes a central processing unit and a memory, wherein the central processing unit is used to call and run a computer program stored in the memory to execute the steps of the traceable encryption method based on file hierarchical attribute-based encryption and key delegation described in the present application.

[0087] A computer-readable storage medium is provided to meet another purpose of the present application, which stores a computer program implemented according to the traceable encryption method based on file hierarchical attribute-based encryption and key delegation in the form of computer-readable instructions. When the computer program is called and executed by a computer, it executes the steps included in the corresponding method.

[0088] Compared with the existing technology, this application addresses the following issues: hierarchical attribute-based encryption and key delegation scheme encryption for traceable encrypted files are both performed by the data owner, resulting in high overhead; when key delegation is performed between different users, the delegation key may be leaked, making it difficult to determine the identity of the user who leaked the delegation key. This application provides, but is not limited to, the following beneficial effects:

[0089] First, in response to the limitations of the existing traceable encrypted file hierarchical attribute-based encryption and key delegation schemes, the encryption algorithm is improved by dividing it into offline and online encryption processes. This allows offline encryption to perform encryption preprocessing in the preparation stage, while online encryption can complete the final encryption quickly and efficiently based on the preprocessing results.

[0090] Second, to address the issue of fine-grained key delegation, a fine-grained key delegation mechanism is designed. The delegator is responsible for selecting the attribute set used to construct the key. The principal analyzes the ciphertext access structure to be delegated and selects a minimum attribute set for the delegate based on the requirements and the principle of minimum decryption capability. The delegate can only decrypt specific ciphertext using the delegated key.

[0091] Third, to address the traceability issue of key delegation, the Key Generation Center (KGC) calculates key components related to the trustee's user identity, allowing the KGC to monitor the key delegation process and track the identity of users suspected of leaking keys. This scheme supports collusion resistance, not only preventing multiple users from combining their existing keys to access unauthorized data, but also inhibiting users from colluding with other users' keys. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0093] Figure 1 This is an exemplary network architecture adopted by the traceable encryption system based on file hierarchical attribute-based encryption and key delegation in this application;

[0094] Figure 2 Schematic diagram of the structure of the computer device in the embodiment of the present application. DETAILED DESCRIPTION

[0095] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and are not to be construed as limiting the present application.

[0096] It will be understood by those skilled in the art that, unless expressly stated otherwise, the singular forms "a", "an", "said" and "the" used herein may also include the plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, "connected" or "coupled" as used herein may include wireless connections or wireless couplings. The term "and / or" used herein includes all or any units and all combinations of one or more associated listed items.

[0097] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art and will not be interpreted in an idealized or overly formal sense unless specifically defined as herein.

[0098] It will be understood by those skilled in the art that the terms "client," "terminal," and "terminal device" as used herein include both devices that are wireless signal receivers, i.e., devices that only have wireless signal receivers without transmission capabilities, and devices that have receiving and transmitting hardware capable of two-way communication over a two-way communication link. Such devices may include: cellular or other communication devices such as personal computers and tablet computers, which have single-line displays, multi-line displays, or cellular or other communication devices without multi-line displays; PCS (Personal Communications Service), which may combine voice, data processing, fax, and / or data communication capabilities; PDA (Personal Digital Assistant), which may include a radio frequency receiver, a pager, Internet / Intranet access, a web browser, a notepad, a calendar, and / or a GPS (Global Positioning System) receiver; and conventional laptop and / or palmtop computers or other devices, which have and / or include a radio frequency receiver. As used herein, the terms "client," "terminal," or "terminal device" may be portable, transportable, or installed in a vehicle (air, sea, and / or land), or may be adapted and / or configured to operate locally and / or in a distributed manner at any other location on Earth and / or in space. As used herein, the terms "client," "terminal," or "terminal device" may also refer to a communication terminal, an Internet terminal, or a music / video playback terminal, such as a PDA, an MID (Mobile Internet Device), and / or a mobile phone with music / video playback capabilities, or may include a smart TV, a set-top box, or other device.

[0099] The hardware referred to by names such as "server", "client", and "service node" in this application is essentially an electronic device with capabilities equivalent to those of a personal computer. It is a hardware device that has the necessary components revealed by the von Neumann principle, such as a central processing unit (including an arithmetic unit and a controller), a memory, an input device, and an output device. Computer programs are stored in its memory, and the central processing unit loads the program stored in the external memory into the internal memory for execution, executes the instructions in the program, and interacts with the input and output devices to complete specific functions.

[0100] It should be noted that the concept of "server" referred to in this application can also be extended to server clusters. Based on the network deployment principles understood by those skilled in the art, the servers described should be logically divided. In physical space, these servers can be independent of each other but callable through interfaces, or integrated into a single physical computer or a computer cluster. Those skilled in the art should understand this flexibility and should not use it to constrain the implementation of the network deployment method of this application.

[0101] Unless expressly specified, one or more technical features of the present application can be deployed on a server for implementation and accessed by a client through a remote call to obtain an online service interface provided by the server, or can be directly deployed and run on a client for implementation.

[0102] Unless expressly specified otherwise, the neural network models referenced or may be referenced in this application may be deployed on a remote server and remotely called on the client, or may be deployed and directly called on a client with sufficient device capabilities. In some embodiments, when it runs on the client, its corresponding intelligence may be obtained through transfer learning to reduce the requirements for the client's hardware operating resources and avoid excessive occupation of the client's hardware operating resources.

[0103] Unless explicitly specified, the various data involved in this application can be stored remotely on a server or on a local terminal device, as long as they are suitable for being called by the technical solution of this application.

[0104] Those skilled in the art should be aware that although the various methods of this application are described based on the same concept and thus exhibit commonality, unless otherwise specified, these methods can be independently executed. Similarly, the various embodiments disclosed in this application are all based on the same inventive concept. Therefore, concepts with the same expression, as well as concepts that are appropriately transformed for convenience despite different expression, should be understood as equivalent.

[0105] Unless expressly stated to be mutually exclusive, the various embodiments disclosed in this application may be cross-combined with the relevant technical features of the various embodiments to flexibly construct new embodiments, as long as such combination does not deviate from the creative spirit of this application and can meet the needs of the prior art or resolve certain deficiencies in the prior art. Those skilled in the art should be aware of such flexibility.

[0106] See also Figure 1This embodiment provides a traceable encryption system based on hierarchical attribute-based encryption and key delegation. The system includes a key generation center. The key generation center generates public and secret parameters for the system, participates in the key delegation process, embeds the trustee's identity information into the delegation key, and realizes the traceability of the delegation key. The key delegation process is completed under the supervision of the key generation center. The traceable encryption system based on hierarchical attribute-based encryption and key delegation includes a cloud server, a data owner, a delegator user u0, and a trustee user u1.

[0107] In some embodiments, a cloud server, which is responsible for storing and sharing data;

[0108] Data owners, who own data, share their data to the cloud server and define the access structure. Before uploading data, The system public key encrypts its data m and generates ciphertext CT;

[0109] Delegator user u0, who is the entity accessing the data, decrypts the ciphertext CT with the key SK. User u0 participates in key delegation and constructs the delegation key SK′ together with the key generation center.

[0110] The trustee user u1 is the original unauthorized user. The trustee user u1 sends a delegation request to the delegator user u0, obtains the delegation key SK′ and completes the work on behalf of the delegator user u0.

[0111] In one embodiment, the traceable encryption method based on hierarchical attribute-based encryption and key delegation of the present application includes:

[0112] Step S10: Select a bilinear pair e: G0×G0→G T , the key generation center randomly selects parameters α, β to generate the public key PK and the master key MSK. The key generation center uses a k-1 degree polynomial to initialize Shamir's (k, n) threshold scheme;

[0113] The traceable encryption system based on file hierarchical attribute-based encryption and key delegation can select the bilinear pairing e∶G0×G0→G T , the key generation center randomly selects parameters α, β to generate the public key PK and the master key MSK. The key generation center uses a k-1 degree polynomial to initialize Shamir's (k, n) threshold scheme;

[0114] In some embodiments, a bilinear pair e:G0×G0→G TThe key generation center randomly selects parameters α and β to generate the public key PK and the master key MSK. The key generation center uses a k-1 degree polynomial to initialize the steps of Shamir's (k, n) threshold scheme, including:

[0115] Step S101: Select a bilinear pair e: G0×G0→G T , where G0 and G T is a p-order multiplicative cyclic group, g and h are generators of the group G0, and the Lagrange coefficient is defined as:

[0116] △ ξ,S =∏ τ≠ξ,τ∈S (x-τ) / (ξ-τ),

[0117] Where S is a set, ξ is an element in the set;

[0118] Step S102: Select hash function H1:G T →{0,1} l 、,H2∶Z p →G0 and H3: And determine the first symmetric key k1 and the second symmetric key k2;

[0119] Step S103: The key generation center randomly selects To generate a public key PK and a master key MSK, wherein the expression of the public key PK is:

[0120]

[0121] The expression of the master key MSK is:

[0122] MSK={β,g α ,k1,k2};

[0123] Step S104: The key generation center (KGC) uses the k-1 degree polynomial v = f(u) to initialize Shamir's (k, n) threshold scheme INS (k,n) .

[0124] Specifically, we select the bilinear pair e∶G0×G0→G T , where G0,G T It is a p-order multiplicative cyclic group, g and h are generators of the group G0. ξ,S =∏ τ≠ξ,τ∈S (x-τ) / (ξ-τ) is the Lagrange coefficient. Select the hash function H1∶G T →{0,1} l ,H2∶Z p →G0,H3: Suppose two different symmetric keys are k1 and k2.

[0125] Initialization phase:

[0126] Setup(1 λ )→(PK,MSK): KGC executes Setup with security parameter λ. KGC randomly selects α,β and provides the system with public key PK={G0,G T ,H1,H2,H3,g,g β ,e(g,g) α} and master key MSK={β,g α ,k1,k2}. KGC uses the k-1 degree polynomial v = f(u) to initialize Shamir's (k,n) threshold scheme INS (k,n) .

[0127] Step S20: The key generation center (KGC) calculates and determines the intermediate value and generates the corresponding encrypted ciphertext based on the public key PK, the master key MSK, the user attribute set and the user identity information. The key generation center selects a random number for the data user and calculates and determines the key K and the first part key D. i,1 and the second part of the key D i,2 , according to the key K, the first part of the key D i,1 and the second part of the key D i,2 Construct the key SK;

[0128] After the key generation center uses a k-1 degree polynomial to initialize Shamir's (k, n) threshold scheme, the key generation center calculates and determines the intermediate value based on the public key PK, the master key MSK, the user attribute set and the user identity information and generates the corresponding encrypted ciphertext. The key generation center selects a random number for the data user and calculates and determines the key K and the first part key D. i,1 and the second part of the key D i,2 , according to the key K, the first part of the key D i,1 and the second part of the key D i,2 Construct the key SK;

[0129] In some embodiments, the key generation center (KGC) calculates and determines the intermediate value and generates the corresponding encrypted ciphertext based on the public key PK, the master key MSK, the user attribute set and the user identity information. The key generation center selects a random number for the data user, calculates and determines the key K, the first part key D i,1 and the second part of the key D i,2 , according to the key K, the first part of the key D i,1 and the second part of the key D i,2 The steps to construct the key SK include:

[0130] Step S201: The key generation center (KGC) uses the KeyGen algorithm to calculate and determine based on the public key PK, the master key MSK, the user attribute set S, and the user identity information id:

[0131] Wherein, k1 is the first symmetric key;

[0132] v = f(u), where f(u) is a value calculated based on the encrypted value u;

[0133] Where k2 is the second symmetric key, u||v means concatenating u and v to form a composite message for encryption, and t is the encrypted value;

[0134] Step S202: The key generation center generates a random number for the data user. For each element j∈S in the user attribute set S, the key generation center randomly selects a value in, Is a finite field, the key generation center calculates and determines:

[0135]

[0136] Step S203: The key generation center (KGC) generates a key according to the key K and the first part of the key D. i,1 and the second part of the key D i,2 Construct a key SK, wherein the expression of the key SK is:

[0137]

[0138] Step S30: The trustee user u1 sends a key delegation request to the delegator user u0. The delegator user u0 checks the access structure of the ciphertext in the key delegation request and records the minimum attribute set S′. The key generation center selects a random number for the trustee user u1 and generates a key SK′. The relevant intermediate value is saved to establish a key delegation relationship between the trustee user u1 and the delegator user u0.

[0139] The key generation center selects a random number for the data user and calculates the key K and the first part of the key D. i,1 and the second part of the key D i,2 Afterwards, the trustee user u1 sends a key delegation request to the delegator user u0. The delegator user u0 checks the access structure of the ciphertext in the key delegation request and records the minimum attribute set S′. The key generation center selects a random number for the trustee user u1 and generates a key SK′. The relevant intermediate value is saved to establish a key delegation relationship between the trustee user u1 and the delegator user u0.

[0140] In some embodiments, a trustee user u1 sends a key delegation request to a delegator user u0, the delegator user u0 checks the access structure of the ciphertext in the key delegation request and records the minimum attribute set S′, a key generation center selects a random number for the trustee user u1 and generates a key SK′, and saves related intermediate values ​​to establish a key delegation relationship between the trustee user u1 and the delegator user u0, including the following steps:

[0141] Step S301: The trustee user u1 sends a request with its identity identifier request||id′ to the delegator user u0. The delegator user u0 receives the request and sends a new key SK′ to the trustee u1. The key SK′ can only be used for the ciphertext set CT′. Decrypt the ciphertext in ;

[0142] Step S302: The delegator user u0 checks the access structure of the ciphertext in CT′, finds the minimum attribute set that satisfies the access structure of the ciphertext in CT′, and records it as S′, where The delegator user u0 sends a delegation request request||S′||id′||K′ to the key generation center. Based on the delegation request request||S′||id′||K′, the key generation center calculates and determines:

[0143] Among them, u′ is the encrypted identity;

[0144] v′=f(u′), where v′ is the result of processing u′ by function f;

[0145] Among them, c′ is the encryption result of u′||v′;

[0146] Step S303: The key generation center saves u′||v′ and selects a random number for the trustee user u1. The key generation center sends c′||r′ to the client user u0, and the client user u0 selects a random number To generate a delegation key, the expression of the delegation key is:

[0147]

[0148] Step S304: Establish a key delegation relationship between the delegator user u0 and the trustee user u1. The key delegation relationship is expressed as:

[0149] <(u0,S,SK),(u1,S′,SK′)>∈DK.

[0150] Specifically, from the perspective of the key delegation model, we now get the following distribution relationship:

[0151] (u0,S)∈UA,(u0,S,SK)∈UAK,

[0152] Delegate(SK,S′,id′)→SK′: The key delegation algorithm is jointly completed by KGC and the delegator. User u1 (trustee) sends a request with its identity identifier request||id′ to the delegator u0. After receiving it, u0 hopes to send a new key SK′ to the trustee u1. The key SK′ can only be used for the ciphertext set CT′. Therefore, u0 checks the access structure of the ciphertext in CT′, finds the minimal attribute set that satisfies the access structure of the ciphertext in CT′, and records it as S′, where u0 sends request||S′||id′||K′ to KGC. Based on the delegation request, KGC calculates:

[0153] v=f(u′),

[0154] KGC saves the point (u′||v′) and selects a random number r′ for u1. KGC sends c′||r′ to u0. u0 selects a random number The delegation key is of the form

[0155]

[0156] Finally, the distribution relationship (u1, S′, SK′)∈UAK is established. The delegation relationship of the key can be expressed as

[0157] <(u0,S,SK),(u1,S′,SK′)>∈DK

[0158] If u1 wants to further delegate the key SK″ to another user to allow him to decrypt CT * The ciphertext in CT * ∈CT. Then u1 acts as the delegator, and KGC helps u1 construct the key. Therefore, a delegation relationship <(u1,S′,SK′),(u2,S″,SK″)>∈DK is established. The key delegation process initiated by multiple delegators can form multiple delegation paths through multiple steps of delegation. From u0 to u n The delegation path is: (u0,S,SK)→(u1,S′,SK′)→...→(u n ,S (n) ,SK (n) ).

[0159] Step S40: The data owner selects an attribute and constructs a polynomial to encrypt the data, calculates and determines the encrypted ciphertext of each node, and calculates and determines the encrypted ciphertext of the threshold node among the child nodes of the transmission node;

[0160] After establishing the key delegation relationship between the trustee user u1 and the delegator user u0, the data owner selects attributes and constructs polynomials to encrypt the data, calculates and determines the encrypted ciphertext of each node, and calculates and determines the encrypted ciphertext of the threshold node in the child node of the transmission node;

[0161] In some embodiments, the steps of selecting an attribute and constructing a polynomial to encrypt data, calculating and determining the encrypted ciphertext of each node, and calculating and determining the encrypted ciphertext of a threshold node among the child nodes of the transmission node include:

[0162] Step S401: The data owner accesses the tree based on the public key PK. and multiple keys s1,s2,...,s k , for each node x of the visited tree, construct a polynomial F x , where the polynomial structure of each node is constructed from top to bottom, and the order of the polynomial is d x , d x =k x -1,k x is the threshold value of x;

[0163] Step S402: If node x is a level node in the access tree, then: F x (0)=s i ; If node x is not a level node in the visited tree, then: F x (0) = F parent(x) (index(x)), where att(x) represents the attribute of node x, which is used to identify the attribute or permission of the node;

[0164] Step S403: For each node x, the data owner calculates and determines its ciphertext pair, which is expressed as:

[0165]

[0166] Step S404: Determine the transmission node Y' and TN-CT (x, y), where Y' represents the access tree A transmission node in , the TN-CT (x, y) represents the set of threshold nodes in the child nodes of the transmission node, for node y and its corresponding child node ch y,k , which is calculated and determined by the data owner and is expressed as:

[0167]

[0168] Among them, αF y (0) and Represents node y and its corresponding child node ch respectively y,k weighting of the calculated polynomial values;

[0169] Step S405: For each child node ch y,k , the data owner calculates and determines the corresponding encrypted ciphertext, which is expressed as:

[0170]

[0171] Among them, W y,k Is the key for node encryption.

[0172] Specifically, the offline encryption algorithm is called to perform Enter PK and DO selects s1,s2,...,s k . Is a visit tree. For each node x of the visit tree, construct a polynomial F x , the order of the polynomial d x =k x -1, where k x is the threshold value of x. The structure of all polynomials is top-down, as shown below. The algorithm sets if x is a level node, F x (0)=s i Otherwise, F x (0) = F parent(x) (index(x)). att(x) represents the attribute of node x. Then the data owner (DO) calculates and determines:

[0173]

[0174] Assume that Y′ is The transmission node, TN-CT(x,y) represents the set of threshold nodes in the child nodes of the transmission node, and the data owner (DO) calculates:

[0175]

[0176] In some embodiments, It is an offline encryption function that is executed by the data owner (DO) and accepts a public key PK and an access tree and perform encryption operations.

[0177] Step S50: The data user randomly selects a symmetric key and encrypts the corresponding message, and performs hierarchical encryption on the symmetric key, associating each symmetric key with a level node to calculate and determine the level ciphertext;

[0178] The data owner selects attributes and constructs polynomials to encrypt the data. The encrypted ciphertext of each node is calculated and the encrypted ciphertext of the threshold node in the child node of the transmission node is calculated. The data user randomly selects a symmetric key and encrypts the corresponding message. The symmetric key is hierarchically encrypted and each symmetric key is associated with a level node to calculate the level ciphertext.

[0179] In some embodiments, the online encryption algorithm is called to run OnlineEnc(PK, IT, ck) → CT:DU; the data user (DU) randomly selects a symmetric key and encrypts the corresponding message, and hierarchically encrypts the symmetric key, associates each symmetric key with a level node, and calculates the level ciphertext, including:

[0180] Step S501: The data user calls the OnlineEnc algorithm and randomly selects k symmetric keys ck to encrypt the corresponding k messages E ck (M), and hierarchically encrypt the symmetric key ck, wherein ck={ck1, ck2, ..., ck k},

[0181] Step S502: The data user sends each symmetric key ck i With a level node L1, L2, ..., L k Associated, calculate the determined level ciphertext, which includes:

[0182]

[0183] Specifically, the online encryption algorithm is called to run OnlineEnc(PK,IT,ck)→CT:DU; k symmetric keys ck={ck1,ck2,...,ck k} to encrypt the corresponding k messages The data user (DU) encrypts each symmetric key ck i With a level node L1, L2, ..., L k The associated, computational level ciphertext is as follows:

[0184]

[0185] In some embodiments, OnlineEnc() is an online encryption function executed by a cloud server.

[0186] Step S60: The data user decrypts the data using the key SK and checks whether the attributes match. For non-leaf nodes, the child nodes are recursively decrypted. If the user's attributes match, the information of the node at the specific level is recovered and decrypted. The decrypted information of nodes at other levels is recursively calculated to recover the symmetric key.

[0187] The data user (DU) randomly selects a symmetric key and encrypts the corresponding message, and performs hierarchical encryption on the symmetric key, associating each symmetric key with a level node to calculate the level ciphertext. The data user decrypts the data using the key SK and checks whether the attributes match. For non-leaf nodes, the child nodes are recursively decrypted. If the user's attributes match, the information of the node at a specific level is recovered and decrypted. The decrypted information of nodes at other levels is recursively calculated to recover the symmetric key.

[0188] In some embodiments, the decryption algorithm is called to perform Decrypt(PK, CT, SK) → ck i The data user decrypts the data using the key SK and checks whether the attributes match. For non-leaf nodes, the child nodes are recursively decrypted. If the user's attributes match, the information of the node at a specific level is recovered and decrypted. The decrypted information of nodes at other levels is recursively calculated to recover the symmetric key. The steps include:

[0189] Step S601: If the attribute set S and the access structure of the ciphertext CT related to the key SK are If the key SK matches, the data user uses the key SK to perform a decryption algorithm, which includes:

[0190] For a leaf node (x, y), let i = att(x). If i∈S, then:

[0191]

[0192] Step S602: If x is a non-leaf node, then: DecryptNode(SK,CT,x), perform a decryption operation on node x, which includes:

[0193] Calculate F for each child node z of node x z =DecryptNode(SK,CT,x), where S x By any k x The set of child nodes z, such that F z ≠⊥, its expression is:

[0194]

[0195] Step S603: If the data user's attributes meet all or part of the Through the above decryption operation, the data user can obtain For level node L i , calculate and determine:

[0196]

[0197] Step S604: If the data user can decrypt the level node L i of And can decrypt Node L in the subtree i The root level node L j of Cloud server (cloud server) through ciphertext These level nodes are recursively evaluated, which include:

[0198]

[0199] Step S605: Data user recovery ck i , calculate and determine:

[0200]

[0201] In some embodiments, Decrypt() is a decryption algorithm, input Decrypt(PK,CT,SK)→ck i Indicates that the input PK, CT, SK, the decryption algorithm will output a session key set ck i The data user (DU) obtains the session key set ck according to the decryption algorithm i .

[0202] Step S70: The data user calls a preset key tracing algorithm to trace the identity of the malicious user, so as to complete a traceable encryption method based on file hierarchical attribute-based encryption and key delegation.

[0203] The data user uses the key SK to decrypt the data and check whether the attributes match; for non-leaf nodes, the child nodes are recursively decrypted; if the user's attributes match, the information of the node at a specific level is restored and decrypted; after recursively calculating the decrypted information of nodes at other levels to restore the symmetric key, the data user calls the preset key tracking algorithm to track the identity of the malicious user to complete a traceable encryption method based on file hierarchical attribute-based encryption and key delegation.

[0204] In some embodiments, a data user invokes a preset key tracing algorithm to track the identity of a malicious user, thereby completing the steps of a traceable encryption method based on hierarchical attribute-based encryption and key delegation, including:

[0205] S701. If the KGC suspects that a user has maliciously leaked a key, the KGC will execute a key tracing algorithm to track the identity of the malicious user. Key tracing includes two steps: The KGC first needs to check whether the components of the traced key are complete. The detailed process is as follows:

[0206] First, the key generation center checks K′, K∈G, D i,1 ,D i,2 ∈G;

[0207] Second, check if there is If the key meets both of the above conditions, it is considered intact.

[0208] S702: If the key SK is complete, the key generation center executes and get u * =u and v * =v; Key generation center execution The user identity ID that may intentionally disclose the key SK can be obtained.

[0209] As can be seen from the above embodiments, compared with the prior art, the present application addresses the following issues: hierarchical attribute-based encryption and key delegation scheme encryption for traceable encrypted files are both performed by the data owner, resulting in high overhead; when key delegation is performed between different users, the delegation key may be leaked, making it difficult to determine the identity of the user who leaked the delegation key. The present application includes but is not limited to the following beneficial effects:

[0210] First, in response to the limitations of the existing traceable encrypted file hierarchical attribute-based encryption and key delegation schemes, the encryption algorithm is improved by dividing it into offline and online encryption processes. This allows offline encryption to perform encryption preprocessing in the preparation stage, while online encryption can complete the final encryption quickly and efficiently based on the preprocessing results.

[0211] Second, to address the issue of fine-grained key delegation, a fine-grained key delegation mechanism is designed. The delegator is responsible for selecting the attribute set used to construct the key. The principal analyzes the ciphertext access structure to be delegated and selects a minimum attribute set for the delegate based on the requirements and the principle of minimum decryption capability. The delegate can only decrypt specific ciphertext using the delegated key.

[0212] Third, to address the traceability issue of key delegation, the Key Generation Center (KGC) calculates key components related to the trustee's user identity, allowing the KGC to monitor the key delegation process and track the identity of users suspected of leaking keys. This scheme supports collusion resistance, not only preventing multiple users from combining their existing keys to access unauthorized data, but also inhibiting users from colluding with other users' keys.

[0213] A traceable encryption device based on hierarchical attribute-based encryption and key delegation is provided to meet one of the purposes of this application, including a system initialization module 1100, a key generation module 1200, a delegation key generation module 1300, a data offline encryption module 1400, a data online encryption module 1500, a data decryption module 1600, and a malicious user tracking module 1700. The system initialization module 1100 is configured to select a bilinear pairing e:G0×G0→G T The key generation center randomly selects parameters α, β to generate a public key PK and a master key MSK. The key generation center uses a k-1 degree polynomial to initialize Shamir's (k, n) threshold scheme. The key generation module 1200 is configured such that the key generation center calculates and determines an intermediate value and generates its corresponding encrypted ciphertext based on the public key PK, the master key MSK, the user attribute set, and the user identity information. The key generation center selects a random number for the data user, calculates and determines the key K, the first part key D i,1 and the second part of the key D i,2 , according to the key K, the first part of the key D i,1 and the second part of the key D i,2 Constructing the key SK; the delegation key generation module 1300 is configured such that the trustee user u1 sends a key delegation request to the delegator user u0, the delegator user u0 checks the access structure of the ciphertext in the key delegation request and records the minimum attribute set S′; the key generation center selects a random number for the trustee user u1 and generates a key SK′, saves the relevant intermediate value, and establishes a key delegation relationship between the trustee user u1 and the delegator user u0; the data offline encryption module 1400 is configured such that the data owner selects attributes and constructs a polynomial to encrypt data, calculates and determines the encrypted ciphertext of each node, and calculates and determines the encrypted ciphertext of the threshold node in the child node of the transmission node; the data online encryption module 15 00, it is set for the data user to randomly select a symmetric key and encrypt the corresponding message, and perform hierarchical encryption on the symmetric key, and associate each symmetric key with a level node to calculate a certain level of ciphertext; the data decryption module 1600 is set for the data user to use the key SK to decrypt the data and check whether the attributes match; for non-leaf nodes, recursively decrypt the child nodes; if the user's attributes match, the information of the specific level node is restored and decrypted; the decryption information of other level nodes is recursively calculated to restore the symmetric key; the malicious user tracking module 1700 is set for the data user to call a preset key tracking algorithm to track the identity of the malicious user, so as to complete a traceable encryption method based on file hierarchical attribute-based encryption and key delegation.

[0214] Based on any embodiment of this application, please refer to Figure 2Another embodiment of the present application further provides an electronic device, which can be implemented by a computer device, such as Figure 2 As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. Among them, the computer-readable storage medium of the computer device stores an operating system, a database, and computer-readable instructions, and the database may store a control information sequence, and when the computer-readable instructions are executed by the processor, the processor may implement a traceable encryption method based on file hierarchical attribute-based encryption and key delegation. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor may execute the traceable encryption method based on file hierarchical attribute-based encryption and key delegation of the present application. The network interface of the computer device is used to connect and communicate with a terminal. Those skilled in the art will understand that Figure 2 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0215] In this embodiment, the processor is used to execute the specific functions of each module in the traceable encryption device based on hierarchical attribute-based encryption and key delegation. The memory stores the program code and various data required to execute the aforementioned modules and submodules. The network interface is used to transmit data between user terminals and servers. The memory in this embodiment stores the program code and data required to execute all modules and submodules in the traceable encryption device based on hierarchical attribute-based encryption and key delegation of this application. The server can call the server's program code and data to execute the functions of all submodules.

[0216] The present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the traceable encryption method based on file hierarchical attribute-based encryption and key delegation described in any embodiment of the present application.

[0217] The present application also provides a computer program product, including a computer program / instruction, which, when executed by one or more processors, implements the steps of the traceable encryption method based on file hierarchical attribute-based encryption and key delegation described in any embodiment of the present application.

[0218] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments of the present application can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments of the method. The aforementioned storage medium can be a computer-readable storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0219] The above description is only part of the implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A traceable encryption method based on file hierarchical attribute-based encryption and key delegation, characterized in that: include: Select the bilinear pair e∶G0×G0→G T , the key generation center randomly selects parameters α, β to generate the public key PK and the master key MSK. The key generation center uses a k-1 degree polynomial to initialize Shamir's (k, n) threshold scheme; The key generation center calculates and determines the intermediate value based on the public key PK, the master key MSK, the user attribute set and the user identity information and generates the corresponding encrypted ciphertext. The key generation center selects a random number for the data user and calculates and determines the key K and the first part key D. i,1 and the second part of the key D i,2 , according to the key K, the first part of the key D i,1 and the second part of the key D i,2 Construct the key SK; Trustee user u1 sends a key delegation request to delegator user u0. Delegator user u0 checks the access structure of the ciphertext in the key delegation request and records the minimum attribute set S′. The key generation center selects a random number for trustee user u1 and generates a key SK′. The relevant intermediate value is saved to establish a key delegation relationship between trustee user u1 and delegator user u0. The data owner selects attributes and constructs polynomials to encrypt the data, calculates the encrypted ciphertext of each node, and calculates the encrypted ciphertext of the threshold node in the child node of the transmission node; The data user randomly selects a symmetric key and encrypts the corresponding message, and performs hierarchical encryption on the symmetric key, associating each symmetric key with a level node to calculate a determined level ciphertext; The data user decrypts the data using the key SK and checks whether the attributes match. For non-leaf nodes, the child nodes are recursively decrypted. If the user's attributes match, the information of the node at a specific level is recovered and decrypted. Recursively calculate the decryption information of nodes at other levels to recover the symmetric key; Data users call the preset key tracking algorithm to track the identity of malicious users to complete the traceable encryption method based on file hierarchical attribute-based encryption and key delegation.

2. The traceable encryption method based on file hierarchical attribute-based encryption and key delegation according to claim 1 is characterized in that: Select the bilinear pair e∶G0×G0→G T The key generation center randomly selects parameters α and β to generate the public key PK and the master key MSK. The key generation center uses a k-1 degree polynomial to initialize the steps of Shamir's (k, n) threshold scheme, including: Select the bilinear pair e∶G0×G0→G T , where G0 and G T is a p-order multiplicative cyclic group, g and h are generators of the group G0, and the Lagrange coefficient is defined as: △ ξ,S =∏ τ≠ξ,τ∈S (x-τ) / (ξ-τ), Where S is a set, ξ is an element in the set; Select hash function H1:G T →{0,1} l 、,H2∶Z p →G0 and H3: And determine the first symmetric key k1 and the second symmetric key k2; Key generation center is randomly selected To generate a public key PK and a master key MSK, wherein the expression of the public key PK is: The expression of the master key MSK is: MSK={β,g α ,k1,k2}; The key generation center uses the k-1 degree polynomial v = f(u) to initialize Shamir's (k,n) threshold scheme INS (k,n) .

3. The traceable encryption method based on file hierarchical attribute-based encryption and key delegation according to claim 2 is characterized in that: The key generation center calculates and determines the intermediate value based on the public key PK, the master key MSK, the user attribute set and the user identity information and generates the corresponding encrypted ciphertext. The key generation center selects a random number for the data user and calculates and determines the key K and the first part key D. i,1 and the second part of the key D i,2 , according to the key K, the first part of the key D i,1 and the second part of the key D i,2 The steps to construct the key SK include: The key generation center uses the KeyGen algorithm to calculate and determine based on the public key PK, the master key MSK, the user attribute set S and the user identity information id: Wherein, k1 is the first symmetric key; v = f(u), where f(u) is a value calculated based on the encrypted value u; Where k2 is the second symmetric key, u||v means concatenating u and v to form a composite message for encryption, and t is the encrypted value; The key generation center provides a random number to the data user For each element j∈S in the user attribute set S, the key generation center randomly selects a value in, Is a finite field, the key generation center calculates and determines: The key generation center generates the key K and the first part of the key D. i,1 and the second part of the key D i,2 Construct a key SK, wherein the expression of the key SK is:

4. The traceable encryption method based on file hierarchical attribute-based encryption and key delegation according to claim 3 is characterized in that: The trustee user u1 sends a key delegation request to the delegator user u0. The delegator user u0 checks the access structure of the ciphertext in the key delegation request and records the minimum attribute set S′. The key generation center selects a random number for the trustee user u1 and generates a key SK′, and saves the relevant intermediate value to establish a key delegation relationship between the trustee user u1 and the delegator user u0. include: The trustee user u1 sends a request with its identity identifier request||id′ to the delegator user u0. The delegator user u0 receives the request and sends a new key SK′ to the trustee u1. The key SK′ can only be used to decrypt the ciphertext set Decrypt the ciphertext in ; The delegator user u0 checks the access structure of the ciphertext in CT′, finds the minimal attribute set that satisfies the access structure of the ciphertext in CT′, and records it as S′, where The delegator user u0 sends a delegation request request||S′||id′||K′ to the key generation center. Based on the delegation request request||S′||id′||K′, the key generation center calculates and determines: Among them, u′ is the encrypted identity; v′=f(u′), where v′ is the result of processing u′ by function f; Among them, c′ is the encryption result of u′||v′; The key generation center saves u′||v′ and selects a random number for the trustee user u1 The key generation center sends c′||r′ to the client user u0, and the client user u0 selects a random number To generate a delegation key, the expression of the delegation key is: A key delegation relationship is established between the delegator user u0 and the trustee user u1. The key delegation relationship is expressed as: <(u0,S,SK),(u1,S′,SK′)>∈DK.

5. The traceable encryption method based on file hierarchical attribute-based encryption and key delegation according to claim 4 is characterized in that: The steps of selecting an attribute and constructing a polynomial to encrypt data, calculating and determining the encrypted ciphertext of each node, and calculating and determining the encrypted ciphertext of a threshold node in a child node of a transmission node include: The data owner accesses the tree based on the public key PK and multiple keys s1,s2,...,s k , for each node x of the visited tree, construct a polynomial F x , where the polynomial structure of each node is constructed from top to bottom, and the order of the polynomial is d x , d x =k x -1,k x is the threshold value of x; If node x is a level node in the visited tree, then: F x (0)=s i ; If node x is not a level node in the visited tree, then: F x (0) = F parent(x) (index(x)), where att(x) represents the attribute of node x, which is used to identify the attribute or permission of the node; For each node x, the data owner calculates and determines its ciphertext pair, which is expressed as: Determine the transmission node Y′ and TN-CT(x,y), where Y′ represents the access tree A transmission node in , the TN-CT (x, y) represents the set of threshold nodes in the child nodes of the transmission node, for node y and its corresponding child node ch y,k , which is calculated and determined by the data owner and is expressed as: Among them, αF y (0) and Represents node y and its corresponding child node ch respectively y,k weighting of the calculated polynomial values; For each child node ch y,k , the data owner calculates and determines the corresponding encrypted ciphertext, which is expressed as: Among them, W y,k Is the key for node encryption.

6. The traceable encryption method based on file hierarchical attribute-based encryption and key delegation according to claim 5 is characterized in that: The data user randomly selects a symmetric key and encrypts the corresponding message, and performs hierarchical encryption on the symmetric key, and associates each symmetric key with a level node to calculate and determine the level ciphertext, including: The data user calls the OnlineEnc algorithm and randomly selects k symmetric keys ck to encrypt the corresponding k messages E ck (M), and hierarchically encrypt the symmetric key ck, wherein ck={ck1, ck2, ..., ck k }, Data users will each symmetric key ck i With a level node L1, L2, ..., L k Associated, calculate the determined level ciphertext, which includes:

7. The traceable encryption method based on file hierarchical attribute-based encryption and key delegation according to claim 6 is characterized in that: The data user decrypts the data using the key SK and checks whether the attributes match. For non-leaf nodes, the child nodes are recursively decrypted. If the user's attributes match, the information of the node at a specific level is recovered and decrypted. The steps of recursively calculating the decryption information of nodes at other levels to recover the symmetric key include: If the attribute set S associated with the key SK and the access structure of the ciphertext CT If the key SK matches, the data user uses the key SK to perform a decryption algorithm, which includes: For a leaf node (x, y), let i = att(x). If i∈S, then: If x is a non-leaf node, then: DecryptNode(SK,CT,x), perform the decryption operation on node x, which includes: Calculate F for each child node z of node x z =DecryptNode(SK,CT,x), where S x By any k x The set of child nodes z, such that F z ≠⊥, its expression is: If the attributes of the data user meet all or part of Through the above decryption operation, the data user can obtain For level node L i , calculate and determine: If the data user can decrypt the level node L i of And can decrypt Node L in the subtree i The root level node L j of CS through ciphertext These level nodes are recursively evaluated, which include: Data user recovery ck i , calculate and determine:

8. A traceable encryption device based on file hierarchical attribute-based encryption and key delegation, characterized in that: include: The system initialization module is set to select the bilinear pair e∶G0×G0→G T , the key generation center randomly selects parameters α, β to generate the public key PK and the master key MSK. The key generation center uses a k-1 degree polynomial to initialize Shamir's (k, n) threshold scheme; The key generation module is set as the key generation center, which calculates and determines the intermediate value and generates the corresponding encrypted ciphertext based on the public key PK, the master key MSK, the user attribute set and the user identity information. The key generation center selects a random number for the data user, calculates and determines the key K, the first part key D i,1 and the second part of the key D i,2 , according to the key K, the first part of the key D i,1 and the second part of the key D i,2 Construct the key SK; The delegation key generation module is configured such that the trustee user u1 sends a key delegation request to the delegator user u0. The delegator user u0 checks the access structure of the ciphertext in the key delegation request and records the minimum attribute set S′. The key generation center selects a random number for the trustee user u1 and generates a key SK′, and saves the relevant intermediate value to establish a key delegation relationship between the trustee user u1 and the delegator user u0. The data offline encryption module is set to select attributes of the data owner and construct a polynomial to encrypt the data, calculate the encrypted ciphertext of each node, and calculate the encrypted ciphertext of the threshold node in the child node of the transmission node; The data online encryption module is configured to randomly select a symmetric key for the data user and encrypt the corresponding message, and perform hierarchical encryption on the symmetric key, associating each symmetric key with a level node to calculate a determined level ciphertext; The data decryption module is set to use the key SK for the data user to decrypt the data and check whether the attributes match. For non-leaf nodes, the child nodes are decrypted recursively. If the user's attributes match, the information of the node at a specific level is recovered and decrypted. The decrypted information of nodes at other levels is recursively calculated to recover the symmetric key. The malicious user tracking module is configured to call a preset key tracking algorithm for data users to track the identity of malicious users, so as to complete a traceable encryption method based on file hierarchical attribute-based encryption and key delegation.

9. An electronic device comprising a central processing unit and a memory, characterized in that: The central processing unit is configured to call and run a computer program stored in the memory to execute the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that It stores a computer program implemented according to the method described in any one of claims 1 to 7 in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

Images