Data encryption circulation and access authorization method
By introducing encrypted circulation and access authorization methods in data authorization and access control, the problem of insufficient hierarchical data access control and user authentication is solved, and the refined access authorization and user authentication of hierarchical data is realized, which improves data security and management flexibility.
Patent Information
- Application Number
- CN202411699435.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-26
- Publication Date
- 2025-03-14
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
In the era of big data, the existing data authorization and access control mechanisms face the problems of missing hierarchical data access control, insufficient authentication of user access requests, and difficulty in adapting to complex and changing data access environments.
A method of encrypted circulation and access authorization for data is proposed. By setting parameters by the data owner, performing data user access authorization and data encryption and release, combined with the coordinated operation of data users and data platform, it realizes refined access authorization and user authentication of hierarchical data.
It realizes refined access authorization for hierarchical data, ensures that data at different levels are circulated and shared strictly in accordance with preset permission rules, improves the flexibility and security of data management, and prevents unauthorized data access through a complete user authentication mechanism.
Smart Images
Figure CN119622772A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of data processing and access authorization, and in particular to a method for data encryption circulation and access authorization. Background Art
[0002] With the advent of the big data era, data has become an indispensable core resource in modern society, profoundly promoting the pace of social progress and economic development. However, in the process of widespread data circulation and sharing, how to ensure the efficient use of data while ensuring its security, privacy and compliance has become a major technical problem that needs to be overcome. Especially in the context of the increasingly complex and changing network environment, the access authorization and access control technology of data circulation faces unprecedented challenges.
[0003] First, traditional access control mechanisms are unable to cope with the massive, diverse, and highly sensitive data in the big data era. Since data is diverse and large in scale under the big data background, and different data carries different sensitivities and values, the traditional "one-size-fits-all" access control strategy can no longer accurately match the diverse data security needs. Specifically, the existing access control methods lack the ability to provide refined access authorization for hierarchical data, and it is difficult to implement differentiated access control strategies based on the security levels of different data. This not only limits the reasonable circulation of data, but also greatly increases the risk of data leakage and abuse.
[0004] Secondly, the authentication mechanism for user access requests also has significant shortcomings in ensuring data security. In the process of data circulation, confirming the legitimacy of user identities and the legitimacy of access requests is the basis for building a secure data circulation environment. However, many current systems have failed to build a complete authentication system and are unable to effectively verify the true identity of users and the access rights they have. This vulnerability provides an opportunity for malicious users to illegally obtain and access sensitive data by forging identities or bypassing the authentication process, thereby causing serious damage to data security and user privacy.
[0005] In addition, with the rapid development of advanced technologies such as cloud computing and the Internet of Things, the boundaries of data circulation have become increasingly blurred, and the data access environment has also shown a complex cross-platform and cross-network situation. This change has put forward new requirements for traditional access control technology, but unfortunately, existing technologies are often difficult to adapt to this changing environment and it is difficult to achieve comprehensive and effective control of cross-platform and cross-network data access. This limitation further exacerbates the security risks in the process of data circulation, making data security protection face more severe challenges. Summary of the invention
[0006] In view of this, the present invention proposes a method for data encryption circulation and access authorization to solve the problems existing in the existing data authorization and access control mechanisms, such as lack of hierarchical data access control, insufficient authentication of user access requests, and difficulty in adapting to complex and changing data access environments.
[0007] The specific technical solutions of the present invention are as follows:
[0008] A data encryption circulation and access authorization method, comprising:
[0009] Step 1: The data owner performs parameter setting, where the data owner, as the producer of the data, owns the data property rights;
[0010] Step 2: The data owner performs data user access authorization;
[0011] Step 3: The data owner executes data encryption and release;
[0012] Step 4: Data users and data platforms collaborate to perform data requests and user authentication. The data platform is used by data owners to upload and trade data, and data users purchase and obtain data access rights from the data platform.
[0013] Step 5: The data platform performs data authorization;
[0014] Step 6: Data users perform data access.
[0015] Furthermore, step 1 includes: first defining the hierarchical structure of the data and selecting two prime-order multiplicative cyclic groups as the mathematical basis; then, defining a bilinear map for establishing a mapping relationship between different group elements and specifying a generator in the group; defining an order integer group and three hash functions, which are respectively used to map bit strings of different lengths to group elements.
[0016] Furthermore, step 1 also includes: extracting a set of random numbers, and calculating the public key component, the re-encryption key and the cumulative value based on these parameters, which involve the data category, the parent category, the authorized data user identity set and the private key component.
[0017] Furthermore, step 1 also includes: generating system public parameters and publishing them publicly, while secretly storing the system master key.
[0018] Further, step 2 includes: issuing access authorization to the data user, first extracting a random number as the user's private key component, then calculating the user's private key and the user's public key components according to a preset algorithm, and updating the accumulated value to record the authorization operation.
[0019] Furthermore, step 2 also includes: the generated data user private key is secretly sent to the user, and the user's public key is generated and made public for subsequent verification.
[0020] Furthermore, step 3 includes: for the data to be released, first generate a random number as a symmetric key, and select a corresponding symmetric encryption algorithm to encrypt the data; then, extract the random number and calculate the ciphertext components, which will be used to construct the encrypted data; finally, integrate all the ciphertext components and upload them to the data platform for user access.
[0021] Furthermore, step 4 includes: when a data user submits a data access request, a signature containing information such as a timestamp and a data tag is first generated; after receiving the request, the data platform records the signature timestamp and verifies the validity of the signature, including verifying the timestamp in the signature, calculating the verification factor and checking whether the equation holds; if the verification passes, the user's data access request is confirmed to be valid.
[0022] Furthermore, step 5 includes: after the user passes the verification, the data platform determines the authorization conditions based on the user's permissions and data categories; if the user directly has access rights, the ciphertext is directly returned to the user; if the user needs to access through authorization, the authorization ciphertext components are calculated and replaced with corresponding components in the original ciphertext to form a new authorization ciphertext and then forwarded to the user.
[0023] Furthermore, step 6 includes: the user calculates the intermediate ciphertext and extracts the symmetric key according to the received ciphertext type; and uses the extracted symmetric key to decrypt the encrypted data, thereby accessing the required data.
[0024] The beneficial effects of the present invention are:
[0025] 1. Refined hierarchical access authorization: The present invention implements refined access authorization for hierarchical data by designing a re-encryption mechanism. This mechanism can ensure that data of different levels are circulated and shared strictly in accordance with the preset permission rules, thereby meeting the complex requirements of hierarchical data access authorization. This not only improves the flexibility of data management, but also greatly enhances data security.
[0026] 2. Improvement of user authentication mechanism: Based on hierarchical access authorization, the present invention further implements a signature mechanism. This mechanism is used to effectively verify the access request of data users, ensuring that only legally authenticated users can access sensitive data. This improvement significantly improves the security of the system and prevents unauthorized data access. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0028] Figure 1 The figure is a flow chart of the encrypted circulation and access authorization method of data of the present invention. DETAILED DESCRIPTION
[0029] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.
[0030] This paper proposes a data encryption circulation and access authorization method, which aims to ensure the secure circulation, fine authorization and strict access control of data in general scenarios. This method cleverly integrates the roles and functions of data owners, data platforms and data users, and builds a safe, reliable and flexible data circulation ecosystem.
[0031] In this system, the data owner is the original producer and legal owner of the data, and owns and manages the property rights of the data. The data owner will strictly encrypt the sensitive data it produces, using advanced encryption algorithms (such as AES or RSA, etc.) to generate encrypted data (ciphertext) to ensure the security of the data during transmission and storage. During the encryption process, the data owner will properly keep the encryption key so that the data can be decrypted or the integrity of the data can be verified when needed in the future.
[0032] As an intermediary, the data platform builds a bridge between data owners and data users. The platform not only provides interfaces and tools for data upload, allowing data owners to easily upload encrypted data to the cloud or a designated storage location, but also has the functions of data trading and access authorization. By implementing a complete permission management mechanism, the data platform can flexibly assign corresponding access rights to users based on the settings of data owners and the purchasing behavior of data users, ensuring that only authorized users can access specific data resources.
[0033] Data users are the ultimate beneficiaries of this system. They purchase and obtain access rights to the required data through the data platform. When accessing data, data users need to comply with the platform's security regulations and access agreements. They may need to provide authentication information, access tokens, or other forms of authorization credentials to prove the legitimacy of their access rights. For encrypted data, the data platform may provide decryption services or allow users to use the correct key to decrypt the data themselves so that users can view and use the original content of the data.
[0034] The specific steps of the present invention are as follows:
[0035] Step 1: Parameter setting.
[0036] This step is performed by the data owner. First, the data owner defines the data level as ψ, which provides a basis for subsequent data classification and access control. Then, the data owner defines two prime number p factorial cyclic groups and As the mathematical basis of the encryption system, the choice of these two groups ensures the complexity and security of the encryption algorithm. Next, the bilinear map e is defined: This mechanism can combine the two groups The elements in are mapped to a group The elements in provide powerful tools for the subsequent encryption and decryption process.
[0037] Define g as a group A generator in which the group All elements in are important elements for subsequent key generation and encryption operations. At the same time, the p-order integer group is defined Serves as the basis for random number extraction and encryption parameter calculation.
[0038] In order to enhance the data's anti-collision properties and the security of the verification process, the data owner defines three hash functions H0: H1: H2: Among them, H0: Indicates mapping a bit string of arbitrary length to a group On an element of; H1: Indicates mapping a bit string of arbitrary length to a group On an element of; H2: Indicates that An element in is mapped to the group These hash functions play an important role in subsequent data encryption, user authentication and permission control.
[0039] In the random number extraction phase, the data owner A set of random numbers are drawn from Among them, r i These random numbers will serve as the basis for key generation and encryption parameter calculation. Based on these random numbers, the data owner calculates the key parameter P = e(g, g) σ and Q = e(g,g) δ , and also calculates the public key component Among them, r r is the rth data category, r j is the jth data category, t r is a random number associated with data category r, t rj For data category r j The associated random number. For data category r i The parent category of The public key is a parameter used publicly in the subsequent data encryption and verification process, ensuring the secure flow and access control of data.
[0040] In addition, in order to support flexible authorization and access control of data, the data owner also calculates the re-encryption key And the accumulated value Among them, r w is the w-th data category, For all classes r i A collection of identities of data users who have access rights to the data, is a randomly selected user ID u The associated private key components. These keys allow changing the access rights to data while leaving the data content unchanged, so that data originally encrypted for one user can be re-encrypted into a form that another user can decrypt.
[0041] Finally, the data owner generates the system public parameters And publicly released for all users and data platforms to use. At the same time, the data owner secretly saves the system master key Includes all undisclosed random numbers and private key components to ensure the security of the system.
[0042] Step 2: Data user access authorization.
[0043] Step 2 is the key step to ensure secure access to data. This step is carefully performed by the data owner, who authorizes data users to access the data by issuing keys.
[0044] The data owner first uses a secure random number generation mechanism to draw a unique random number for each data user. This random number will be used as the user ID u The private key component greatly enhances the complexity and security of the private key.
[0045] The user's private key component is then calculated as well as This process ensures the uniqueness and unpredictability of the private key. x For the xth file category, tr x is the random number corresponding to the x-th file category, Ar x It is the parent category corresponding to the x-th file category.
[0046] At the same time, in order to realize the public verification function of the public key, the data owner will also calculate the user's public key component based on the private key component through another set of algorithms:
[0047]
[0048] Among them, ID j is the ID number of the jth user, The generation of the public key component not only depends on the private key component, but may also include dynamic information such as the current timestamp (current timestamp) to ensure the timeliness and uniqueness of the public key.
[0049] After generating the public and private key components, the data owner performs an update operation that accumulates the value: Among them, ver v The current version number of the accumulated value. By updating this accumulated value, the data owner can ensure the orderliness and traceability of the key generation process.
[0050] Based on the above private key components and public key components, the data owner finally generates a complete data user private key and the public key As highly sensitive information, the private key will be encrypted and sent to the data user secretly through a secure channel (such as encrypted email, dedicated transmission protocol, etc.). The public key will be stored publicly so that other entities can verify or encrypt communications when needed.
[0051] In summary, step two provides a secure and reliable access authorization mechanism for data users, ensuring the security and controllability of data during sharing and use.
[0052] Step 3: Data encryption and release.
[0053] Step 3 is entirely the responsibility of the data owner. For the data Msg that has been determined to be released, the data owner will first carefully generate a high-strength random number As a symmetric key, this key will be used in the subsequent encryption process, and its corresponding symmetric encryption algorithm is Enc.
[0054] After obtaining the symmetric key, the data owner will further extract a random number These random numbers are used to enhance the complexity and security of the encryption process. Then, using the symmetric encryption algorithm and these random numbers, the data owner calculates the components of the ciphertext:
[0055] C0=Enc K (Msg),
[0056]
[0057] After completing the calculation of the ciphertext components, the data owner will combine these components into a complete ciphertext data packet Once uploaded successfully, only authorized users can download and decrypt the data package from the data platform to access the original, unencrypted data content.
[0058] In summary, step three (encrypted data release) ensures the confidentiality, integrity, and availability of data during the release process through a series of operations such as generating symmetric keys, selecting encryption algorithms, calculating ciphertext components, integrating ciphertext data packets, and securely uploading them to the data platform.
[0059] Step 4: Data request and user authentication.
[0060] Step 4 is the key link to ensure data access security and authorization control, which is completed by close cooperation between data users and data platforms. In this process, a specific access category r is first set up. x The identity of the data user is ID u , and the data category r that the user wants to access i .
[0061] In order to initiate a data access request, the data user first performs a series of security operations to generate a valid signature. Specifically, the user draws a random number As part of the signature, to ensure the uniqueness of the signature; at the same time, the current timestamp ts is recorded as the time proof of the signature to prevent replay attacks; in addition, the data tag Name requested for access is included in the signature calculation to clarify the access intention. Based on these components, the user uses his own private key (or the private key part of the key pair) and the predetermined encryption algorithm to calculate the signature components:
[0062]
[0063] S3=g v .
[0064] Then generate the signature Sig = (S1, S2, S3).
[0065] After the signature is generated, the data user ID u The signature is sent to the data platform along with the data access request. After receiving the request and signature, the data platform will immediately record the exact timestamp ts′ of the received signature for subsequent verification. Subsequently, the platform will perform a series of strict verification steps:
[0066] First, check whether the signature exists ts′-ts<Δt and Wherein, Δt is a preset time threshold for determining the timeliness of the signature.
[0067] If it exists, further calculate three verification factors V1, V2, V3:
[0068]
[0069] V2=e(H0(r x ),S3)=e(H0(r x ),g) v ,
[0070]
[0071] Then, it is verified whether the equation V1=V2·V3 holds. If so, it means that the data user has passed the verification and its data access request is valid.
[0072] In summary, step four ensures that only authorized and authentic data users can successfully access data resources on the platform through a series of complex verification mechanisms and processes, thereby maintaining the security and privacy of the data.
[0073] Step 5: Data authorization.
[0074] This step is performed by the data platform. After the user passes the verification, if r x =r i , the ciphertext is returned directly to the user ID u Otherwise, if r x ≠r i but Calculate the authorization ciphertext component:
[0075]
[0076] Then, the authorization ciphertext component Replace ciphertext Components in Forming authorization ciphertext And forwarded to the data users.
[0077] Through such a data authorization process, the data platform can ensure that only authorized users who meet the permission requirements can access the data, thereby protecting the security and privacy of the data. At the same time, this process also meets the legitimate needs of different users, allowing users to obtain corresponding data according to their permission level and request content.
[0078] Step 6: Data access.
[0079] This step is performed by the data user if r x =r i , calculate the intermediate ciphertext:
[0080]
[0081] if Calculate the intermediate ciphertext:
[0082]
[0083] Then, calculate the remaining intermediate ciphertext:
[0084]
[0085] On this basis, the symmetric key is calculated
[0086]
[0087] The data user uses the symmetric key to decrypt and access the data Msg = Dec K (C0).
[0088] The beneficial effects of the present invention are:
[0089] 1. Refined hierarchical access authorization: The present invention implements refined access authorization for hierarchical data by designing a re-encryption mechanism. This mechanism can ensure that data of different levels are circulated and shared strictly in accordance with the preset permission rules, thereby meeting the complex requirements of hierarchical data access authorization. This not only improves the flexibility of data management, but also greatly enhances data security.
[0090] 2. Improvement of user authentication mechanism: Based on hierarchical access authorization, the present invention further implements a signature mechanism. This mechanism is used to effectively verify the access request of data users, ensuring that only legally authenticated users can access sensitive data. This improvement significantly improves the security of the system and prevents unauthorized data access.
[0091] In summary, by combining refined hierarchical access authorization and user authentication mechanisms, the present invention provides comprehensive security protection for data access in complex environments. Whether in internal networks or external networks, whether in static data storage or in dynamic data circulation, this method can provide continuous and effective security protection.
[0092] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.
Claims
1. A data encryption circulation and access authorization method, characterized in that: include: Step 1: The data owner performs parameter setting, where the data owner, as the producer of the data, owns the data property rights; Step 2: The data owner performs data user access authorization; Step 3: The data owner executes data encryption and release; Step 4: Data users and data platforms collaborate to perform data requests and user authentication. The data platform is used by data owners to upload and trade data, and data users purchase and obtain data access rights from the data platform. Step 5: The data platform performs data authorization; Step 6: Data users perform data access.
2. The data encryption circulation and access authorization method as claimed in claim 1, characterized in that: The step 1 includes: firstly defining the hierarchical structure of the data and selecting two prime-order multiplicative cyclic groups as the mathematical basis; then, defining a bilinear map for establishing a mapping relationship between different group elements and specifying a generator in the group; defining an order integer group and three hash functions, which are respectively used to map bit strings of different lengths to group elements.
3. The data encryption circulation and access authorization method as claimed in claim 2, characterized in that: The step 1 also includes: extracting a set of random numbers, and calculating the public key component, the re-encryption key and the accumulated value based on these parameters, which involve the data category, the parent category, the authorized data user identity set and the private key component.
4. The data encryption circulation and access authorization method as claimed in claim 3, characterized in that: The step 1 also includes: generating system public parameters and publishing them publicly, while secretly storing the system master key.
5. The data encryption circulation and access authorization method as claimed in claim 1, characterized in that: The step 2 includes: issuing access authorization to the data user, first extracting a random number as the user's private key component, then calculating the user's private key and the user's public key components according to a preset algorithm, and updating the accumulated value to record the authorization operation.
6. The data encryption circulation and access authorization method as claimed in claim 5, characterized in that: The step 2 also includes: the generated data user private key is secretly sent to the user, and the user's public key is generated and made public for subsequent verification.
7. The data encryption circulation and access authorization method as claimed in claim 1, characterized in that: The step 3 includes: for the data to be released, first generate a random number as a symmetric key, and select a corresponding symmetric encryption algorithm to encrypt the data; then, extract the random number and calculate the ciphertext components, which will be used to construct the encrypted data; finally, integrate all the ciphertext components and upload them to the data platform for user access.
8. The data encryption circulation and access authorization method as claimed in claim 1, characterized in that: The step 4 includes: when a data user submits a data access request, a signature including timestamp, data tag and other information is first generated; after receiving the request, the data platform records the signature timestamp and verifies the validity of the signature, including verifying the timestamp in the signature, calculating the verification factor and checking whether the equation holds; if the verification passes, the user's data access request is confirmed to be valid.
9. The data encryption circulation and access authorization method as claimed in claim 1, characterized in that: The step 5 includes: after the user passes the verification, the data platform determines the authorization conditions according to the user's authority and data category; if the user directly has access rights, the ciphertext is directly returned to the user; if the user needs to access through authorization, the authorization ciphertext component is calculated and replaced with the corresponding component in the original ciphertext to form a new authorization ciphertext and then forwarded to the user.
10. The data encryption circulation and access authorization method as claimed in claim 1, characterized in that: The step 6 includes: the user calculates the intermediate ciphertext and extracts the symmetric key according to the received ciphertext type; and uses the extracted symmetric key to decrypt the encrypted data, thereby accessing the required data.