Decision tree classification model for decentralized authorization and access control and construction method thereof

Abstract

The invention provides a decision tree classification model for decentralized authorization and access control and a construction method thereof, relates to the technical field of decision trees, and aims to decouple data encryption and data calculation logic, realize separation of data storage and calculation and allow users of different authorization parties to participate in calculation together. Meanwhile, a decentralized storage service scheme of a data access control strategy and access authorization which are not affected by a trust intermediary is designed, and the security requirement of data privacy in an outsourcing environment is met.

Description

Technical Field

[0001] The present invention relates to the technical field of decision trees, and in particular to a decision tree classification model for decentralized authorization and access control and a construction method thereof. Background Art

[0002] Outsourcing decision tree classification services to the cloud is beneficial, but it also brings serious privacy issues, such as privacy leakage of models, input data, and output results, which limits the development of outsourced classification services. The data analyzed by decision trees often contain privacy and sensitive data, and illegal access to these resources has serious consequences. Access control is required to prevent unauthorized access to resources while protecting sensitive private data. Therefore, how to build a secure decision tree classification model becomes a new challenge. The simplest way is to encrypt personal data and ensure data security by encrypting and uploading data involving user privacy or containing sensitive information. In this case, the user needs to save the decryption key locally. However, there is a huge demand for the use of data sharing applications in cloud computing services. Since encrypted data can only be decrypted by users, it is impossible to share it with anyone else through the cloud. Therefore, it is of great practical significance to conduct in-depth research and solve the information security issues in the outsourcing of decision tree classification services.

[0003] Many existing encryption schemes do not have the ability to re-encrypt ciphertext data, while proxy re-encryption (PRE) is a secure encryption method that can convert data encrypted by user A into data encrypted by a different key, which allows user B to decrypt using his own key and does not leak any plaintext messages during the entire conversion process. Access control is an important means of protecting data security. It manages user permissions, and authorized users can only access the corresponding data in the system according to their own permissions, preventing users from unauthorized access to data, thereby ensuring data security and the normal operation of business systems. However, traditional access control methods adopt a centralized design, which has disadvantages such as single point failure, difficulty in scalability, low reliability, and low throughput. In fact, devices may belong to different organizations or users and have mobility and limited performance, which makes it difficult for centralized access control to meet access control requirements. In addition, during the interaction between users and third-party authorization servers, sensitive content such as user identity and access address may also be leaked to untrusted servers, causing serious losses to users. Blockchain has received widespread attention due to its decentralization and immutability. Therefore, the combination of blockchain and PRE can provide a secure and reliable data sharing method.

[0004] Most existing video image compression schemes have the following problems:

[0005] (1) Ciphertext calculation problem: Traditional IBE methods cannot support ciphertext decision tree classification calculations due to the limitations of existing cryptographic algorithms. At the same time, frequent cross-application, cross-system, and cross-ecosystem exchanges of user data have become the norm, and traditional ciphertext calculation solutions tightly couple data encryption logic with data calculation logic, resulting in poor system flexibility and scalability.

[0006] (2) Decentralized authorization problem: In current authorization schemes, most authorization management mechanisms rely on trusted third parties. This not only poses a "single point failure" problem, but also poses a risk that the authorization content may be directly obtained by a third party, thereby obtaining important privacy information. In addition, the interaction process between the user and the third-party authorization server may also leak user identity, access habits and other privacy information to the third-party server, which may cause statistical inference attacks and result in serious losses.

[0007] (3) Access control issues: In the current IBE and blockchain solutions, although the tamper-proof nature of access control can be guaranteed, one-to-many access control and data privacy protection issues are not considered. At the same time, the access control policies in most ciphertext access control schemes are relatively rough, either access to the entire ciphertext data set or no access rights. In practical applications, different users require different authorizations, and the same user also requires different authorizations in different work scenarios. Therefore, data owners need to formulate fine-grained access control policies for their data. Summary of the invention

[0008] In view of the shortcomings of the prior art, the present invention provides a decision tree classification model for decentralized authorization and access control and a construction method thereof, combines a Paillier encryption method instantiated based on proxy re-encryption to implement the access control process, and integrates it with the blockchain to realize a method for decentralized authorization and sharing of key information ciphertext on the chain.

[0009] On the one hand, a decision tree classification model for decentralized authorization and access control includes: data owner DO, data producer DP, user U i , access authorization center AAC, decision tree classification server DTCS, and data storage server DSS;

[0010] The data producer DP and the data storage server DSS together constitute an encrypted data storage plane, and the decision tree classification server DTCS and the access authorization center AAC constitute an encrypted data calculation plane; the encrypted data storage plane is used for data storage, and the encrypted data calculation plane is used for authorization management and ciphertext decision tree classification calculation on encrypted data.

[0011] The data owner DO generates a master private key MSK and sends the master private key MSK to the data producer DP. The data producer DP generates a data set D = {d1, d2, ..., d n}, d n Represents data, the data producer DP encrypts the data, the data owner DO sets the access control policy for the generated data, and stores it in the access authorization center AAC. The access authorization center AAC provides decentralized authorization services. i Authorized to access data; the data producer DP encrypts the data and transmits it to the data storage server DSS for storage; the user sends a data query request encrypted by the Paillier algorithm to the decision tree classification server DTCS, which first performs attribute identity authentication and needs to confirm that the user is granted the corresponding access rights. Then the data storage server DSS uploads the encrypted data producer DP data to the decision tree classification server DTCS for decision tree classification calculation. Finally, the generated ciphertext query result is returned to the user, who decrypts it to obtain the plaintext classification result; when the access control authority is changed, a transaction is generated, and the access authorization center AAC stores the transaction in the centralized authorization log; whenever the access authorization is updated, the transaction is recorded in the decentralized authorization log.

[0012] The decentralized authorization and ciphertext decision tree classification calculation process is as follows:

[0013] The decentralized authorization: the authorization agent grants corresponding access control permissions to each piece of data in combination with the different processing requirements of the user for the data, and records the modification operation of the access control permissions in the decentralized authorization log; first, DO initiates a transaction to initialize the corresponding data access permission, which includes the ID of the authorized user; if the access control permission needs to be adjusted, DO publishes a subsequent transaction, which includes: the storage address Add of the ciphertext x, the access control policy A, the user id, the public parameters Params, and the access token token used to access the data; any subsequent modification of the access control policy requires the publication of a new transaction, and the transaction is recorded in the decentralized authorization log; specifically, the following steps are included:

[0014] Step S1: DO first verifies its identity through signature and has access rights to set or edit data; DO forms an authorization log by modifying data access rights and records the authorization log on the existing blockchain. By utilizing the public verifiable and tamper-proof characteristics of blockchain, it does not need to rely on a trusted third party to achieve decentralization of authorization services; without breaking the consensus, the blockchain has the access rights to record data settings. When modifying access rights, the global access control status is modified through the virtual chain; the authorization agent scans the authorization information on the blockchain, stores the relevant information in the database, and provides query services;

[0015] Step S2: After receiving the request, DTCS directly inquires with the authorized agent to confirm the user's authority; if the request is legitimate, it executes the request without the authorization of DO and U i Empowerment through direct communication;

[0016] Step S2.1: Use public key cryptography to identify and authenticate the subject in the classification model, pair the data owner with the data producer, and the hash value of the data owner's public key is the unique identifier of the subject; during the initialization process of the data producer, the data owner creates a pair of public and private keys (PK owner ,SK owner ), PK owner With SK owner The public key and private key created for the data owner are respectively owner Stored securely locally, during the initialization phase, the public-private key (PK) created by the data owner is published on the blockchain through a two-way multi-signature registration transaction. owner ,SK owner ) creates a public-private key (PK) for the data producer devicei ,SK devicei ) for signature binding, PK devicei With SK devicei Public and private keys created for data producers respectively;

[0017] Step S2.2: The data owner uses the private key SK owner Set access permissions for conversion tokens and key data, and pass the private key SK devicei Realize secure data storage; if the data producer exits the system, the data owner must reissue a new multi-signature binding transaction to obtain ownership of the data generated by the new paired data producer in the future; the data owner obtains the signature of the data producer through an out-of-band channel and broadcasts the registration transaction to the network after completing the signature addition;

[0018] Step S2.3: After generating the private and public ECDSA key pairs of each data producer, UCACM-ESD signs the encrypted message and generates a signature;

[0019] Step S3: The authorization agent grants corresponding access control permissions according to different users, and records the modification operation of access control permissions in the decentralized authorization log; First, DO starts a transaction and initializes the corresponding data access permissions, including the id used to create the initial state; If the access control permissions need to be adjusted, DO will issue a subsequent transaction to update the access permissions. Any subsequent modification of the access control policy requires issuing a new transaction and recording the transaction in the decentralized authorization log;

[0020] Step S3.1: DO sends a request and provides user id, start timestamp and interval time; i Add the corresponding network identification code and integrate the above information into the byte stream, issue an OP_RETURN transaction, and use this byte stream as the data part of the transaction;

[0021] Step S3.2: AAC scans the underlying blockchain, searches for the corresponding transaction containing access rights, maintains the authorization status, and queries U i When a storage node receives a request to store or retrieve data, it uses the signature to verify the request U i The identity is then searched for access control policies in AAC;

[0022] Step S3.3: When DO receives U i When a computing request is issued, the AAC is queried for access rights and the query is used to verify the U i The identity of the user is based on the signature authentication method to achieve access control; DO does not directly communicate with U i Interaction, dynamically adjusts and issues access control permissions only by interacting with decentralized authorization logs; DO grants permissions to U based on the access permissions embedded in the authorization log. i Verify data access requests, check access permissions, and terminate malicious sessions;

[0023] Step S3.3.1: DO calculates the ciphertext digital summary CTcheck=H(x), where H(x) is a hash calculation function, and simultaneously calculates the digital summary of the request transaction MD=H(id,Add,CTcheck);

[0024] Step S3.3.2: DO performs digital signature sign=Sign(MD), where Sign() is a signature function and MD is a digital summary;

[0025] Step S3.3.3: DO generates a query request transaction T request ={id,Add,CTcheck,sign}, DO will request transaction T requestBroadcast to other nodes in the blockchain network for verification; each node calculates the digital summary MD′ of the request transaction and compares it with the digital summary MD of the DO signature; if MD′=MD, it means that the request transaction T request Verification successful.

[0026] The ciphertext decision tree classification calculation:

[0027] Design of secure ciphertext decision tree classification algorithm TreeEval: During the classification process, the server is responsible for providing classification services to users. Before entering the classification process, the data computing server DCS has the data encrypted by Paillier transmitted by the data storage server. Where E(W) represents the encryption model, E(w i ) represents the encryption threshold node, represents a leaf node, Represents an encrypted linear function. The user is the requester of the classification service. After verification, he can perform the requested calculation and has the data x to be classified;

[0028] The specific steps are as follows:

[0029] Step D1: U i Send a classification request to DTCS;

[0030] Step D2: After receiving the authorization result from AAC, DTCS reads the encrypted classification model;

[0031] Step D3: DTCS and U i Through communication protocol interaction, the classification process of ciphertext data is completed together, and the encrypted classification results are returned to U i ;

[0032] Step D3.1: DTCS and U i After executing the PvtCmp protocol, DTCS obtains the threshold comparison result;

[0033] Step D3.2: DTCS executes the path cost and linear cost function to obtain the encrypted path cost and linear function cost results, and adds the interference value to them to provide U i ;

[0034] Step D4: U i Get the encrypted path cost and linear function cost returned by DTCS, and get the classification result through key decryption and path cost judgment;

[0035] On the other hand, a method for constructing a decision tree classification model for decentralized authorization and access control includes the following steps:

[0036] Step 1: Parameter generation Setup(λ,N)→(Params,MSK);

[0037] Assume that the security parameter is λ, N is the maximum number of authorized users for decision tree classification calculation, select a prime number q with a length of λ bits, and G is an integer set A subgroup of G, where g is a generator of G; a bilinear cyclic group G of order p, where the identity element e:G×G→G T , G T represents a bilinear group; select a random number α∈Z p ,μ,Q∈G,Z p represents an integer. Then calculate g1=g α , The generator g is composed of g1,g2,...,g N composition. The generator μ is μ1,μ2,...,μ N And the signature parameter v = e(g,μ), e() represents the signature generation function; then select the collision-resistant hash function H i , i∈{1,2}, where H1:{0,1} * →Z p ,H2:G→G T ; Instantiate a Paillier encryption object paillier; Finally, output the system public parameters as the master public key Params = {p, g, v, G, G T ,e,H1,H2,paillier} and master key MSK={α,μ}, and upload the public parameters Params to the blockchain for parameter sharing, and the nodes on the blockchain call the public parameters;

[0038] Step 2: Key generation KeyGen(Params,MSK,id)→(pk id ,sk id );

[0039] Input the master public key Params, master key MSK and user identifier id∈{0,1}, and generate a pair of paillier-encrypted public-private key pairs (pk id ,sk id ), where the public key is pk id , and construct the private key

[0040] Step 3: Data encryption Encrypt(M,id,A)→C;

[0041] Encrypt user U belonging to id id message M, select a random number r∈Zp , respectively calculate the message C M =M·v r , C1=Q r , where v r Indicates the signature parameter, Q r represents a random number; the ciphertext message obtained at this time is C=(C M ,C0,C1); only users U that meet access control policy A id Can decrypt the ciphertext message C;

[0042] Step 4: Linear function calculation Linear(id,D,MPK,sk id )→(L,token);

[0043] DO generates a linear function L for calculating decision tree reasoning, and includes the ID of the authorized user in the linear function to generate an authorization token token; first, calculate the message C′=Encrypt(M,sk id )=(C M ,C0,C1), select a random number t,m,e∈Z p With σ∈Z p Calculate the key material k1 = sk id Q m , k2=g αm , k4=e(g,μ) s σ, Where S represents the identity parameter; the re-encrypted key is k=k1, k2, k3, k4, k5, and the re-encrypted key is sent to the blockchain for re-encryption;

[0044] The decision tree model is converted into a linear function. The path from the root node to each leaf node corresponds to a linear function. First, the threshold is converted into a Boolean value, and the attribute value is compared with the threshold value of the decision node. where x i represents the ciphertext node, w i represents the threshold vector, and m represents the length of the ciphertext. Then calculate the path cost from the root node to each leaf node where b i Represents the decision node threshold of the tree structure, b i =1 indicates the left subtree, b i = 0 represents the right subtree, and finally the interference term is added to the polynomial and converted into another polynomial where v M Indicates the value of a leaf node;

[0045] At this time, the authorization token token = (C′, k) and the polynomial L(x) are output and sent to DTCS;

[0046] Step 5: Pseudo-random encryption UserEncrypt(Params,id,sk id ,D user ) → D user ′;

[0047] UserU id Before uploading data, user Encryption; use the pseudo-random function PRF() to calculate the private key k0=PRF(j), where j=id, and encrypt the message

[0048] Step 6: Generate TreeRequest(L,token,id,sk id ,Params)→(L′,k U );

[0049] The user sends a decision tree query request to the computing server DTCS, and receives the polynomial L and authorization token encrypted by DO from DTCS. At this time, the user uses the Paillier encryption algorithm to encrypt the polynomial L to generate L′(x)=E(L(x))v M , function E() represents the Paillier encryption function.

[0050] Randomly select a random number τ j ∈Z p , while computing the key material avk j =sk id ·τ j , where avk j Indicates the evaluation key, and the key material k U ={evk j ,avk j ,τ j}, the encryption polynomial L′(x) and the key material k U Send to DTCS;

[0051] Step 7: Data Re-encryption ReEncrypt (D user ′,k U )→RD user ;

[0052] DTCS uses key material k U For user data D user 'Re-encrypt, the encrypted data is At this time, the key is s j =evkj +avk j modp, the re-encrypted user data is RD user ;

[0053] Step 8: Decision tree classification calculation TreeEval(L′(x),RD user )→R;

[0054] DTCS performs decision tree classification calculations on the encrypted data set, and the user obtains the returned encrypted path cost value R;

[0055] Step 9: Path cost decryption Decrypt(sk id ,R)→r;

[0056] The user decrypts the encrypted path cost value R and calculates the parameter calculate at last The value of the plaintext r represents the classification result;

[0057] The beneficial effects of adopting the above technical solution are:

[0058] The present invention provides a decision tree classification model for decentralized authorization and access control and a construction method thereof. The present invention proposes a new solution that makes the data storage logic functionally independent of the data computing logic, thereby avoiding a tightly coupled layer and an encrypted data computing layer, and can flexibly and effectively protect data storage and computing, thereby achieving cross-system compatibility requirements.

[0059] In addition, the present invention designs an end-to-end encrypted access control structure, which is based on the Paillier encryption scheme of IB-PRE and provides security decision tree classification calculations from different authorized parties to re-encrypt the ciphertext of one party into data on the ciphertext field of the other party.

[0060] Finally, the present invention implements a decentralized authorization service that combines access control and authorization to achieve secure computation of encrypted data and access authorization without the need for a trusted intermediary. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 A structural diagram of a decision tree classification model in an embodiment of the present invention;

[0062] Figure 2 This is the distributed authorization process in the embodiment of the present invention. DETAILED DESCRIPTION

[0063] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0064] On the one hand, a decision tree classification model for decentralized authorization and access control, e.g. Figure 1 As shown, it includes: data owner DO (Data Owner), data producer DP (Data Producer), user U i (User), Access Authorization Center AAC (Access Authorization Center), Decision Tree Classification Server DTCS (Decision Tree Classification Server), and Data Storage Server DSS (Data Storage Server);

[0065] The data producer DP and the data storage server DSS together constitute the encrypted data storage plane, and the decision tree classification server DTCS and the access authorization center AAC constitute the encrypted data computing plane; in most existing ciphertext access control mechanisms, the encrypted data storage plane and the encrypted data computing plane are tightly coupled, resulting in poor system flexibility and scalability. The idea of ​​decoupling the encrypted data storage plane and the encrypted data computing plane is studied, and the model is divided into functionally independent encrypted data storage plane and encrypted data computing plane. The encrypted data storage plane is used for data storage, and the encrypted data computing plane is used for authorization management and ciphertext decision tree classification calculation of encrypted data.

[0066] The data owner DO generates a master private key MSK and sends the master private key MSK to the data producer DP. The data producer DP generates a data set D = {d1, d2, ..., d n}, d n Represents data, the data producer DP encrypts the data, the data owner DO sets the access control policy for the generated data, and stores it in the access authorization center AAC. The access authorization center AAC provides decentralized authorization services. i Authorized to access data; the data producer DP encrypts the data and transmits it to the data storage server DSS for storage; the user sends a data query request encrypted by the Paillier algorithm to the decision tree classification server DTCS, which first performs attribute identity authentication and needs to confirm that the user is granted the corresponding access rights. Then the data storage server DSS uploads the encrypted data producer DP data to the decision tree classification server DTCS for decision tree classification calculation. Finally, the generated ciphertext query result is returned to the user, who decrypts it to obtain the plaintext classification result; when the access control authority is changed (for example, granting or revoking authority to the user), a transaction is generated, and the access authorization center AAC stores the transaction in the centralized authorization log; whenever the access authorization is updated, the transaction is recorded in the decentralized authorization log.

[0067] The decentralized authorization and ciphertext decision tree classification calculation process is as follows:

[0068] Decentralized authorization: The authorization agent grants corresponding access control permissions to each piece of data based on the different processing requirements of users for data, and records the modification of access control permissions in the decentralized authorization log; first, DO initiates a transaction to initialize the corresponding data access permissions, which includes the ID of the authorized user; if the access control permissions need to be adjusted, DO publishes a subsequent transaction to update the data access permissions. The transaction includes: the storage address Add of the ciphertext x, the access control policy A, the user id, the public parameters Params, and the access token token used to access the data; any subsequent modification of the access control policy requires the publication of a new transaction, and the transaction is recorded in the decentralized authorization log; specifically, the following steps are included:

[0069] Step S1: DO first verifies its identity through signature and has access rights to set or edit data; DO forms an authorization log by modifying data access rights and records the authorization log on the existing blockchain. By utilizing the public verifiable and tamper-proof characteristics of blockchain, it does not need to rely on a trusted third party to achieve decentralization of authorization services; without breaking the consensus, the blockchain has the access rights to record data settings, including authorization, revocation, modification, etc. When modifying access rights, the global access control status is modified through the virtual chain; the authorization agent scans the authorization information on the blockchain, stores the relevant information in the database, and provides query services;

[0070] Step S2: After receiving the request, DTCS directly inquires with the authorized agent to confirm the user's authority; if the request is legitimate, it executes the request without the authorization of DO and U i Empowerment through direct communication;

[0071] Step S2.1: Use public key cryptography to identify and authenticate the subject in the classification model, pair the data owner with the data producer, and the hash value of the data owner's public key is the unique identifier of the subject; use public key signatures to verify and authorize user identities, so that data producers can safely and autonomously encrypt the generated stream data and interact securely with the data storage server; during the initialization process of the data producer, the data owner creates a pair of public and private keys (PK owner ,SK owner ), PK owner With SK owner The public key and private key created for the data owner are respectively owner Stored securely locally, during the initialization phase, the public-private key (PK) created by the data owner is published on the blockchain through a two-way multi-signature registration transaction.owner ,SK owner ) creates a public-private key (PK) for the data producer devicei ,SK devicei ) for signature binding, PK devicei With SK devicei Public and private keys created for data producers respectively;

[0072] Step S2.2: The data owner uses the private key SK owner Set access permissions for conversion tokens and key data, and pass the private key SK devicei Realize secure data storage; if the data producer exits the system, the data owner must reissue a new multi-signature binding transaction to obtain ownership of the data generated by the new paired data producer in the future; the data owner obtains the signature of the data producer through an out-of-band channel and broadcasts the registration transaction to the network after completing the signature addition;

[0073] Step S2.3: After generating the private and public ECDSA key pairs of each data producer, UCACM-ESD signs the encrypted message and generates a signature; this signature can be verified given the public key and ciphertext. As long as the adversary does not compromise the private key, the adversary cannot forge the signature.

[0074] Step S3: The authorization agent grants corresponding access control permissions to different users and records the modification operation of the access control permissions in the decentralized authorization log, as shown in the attached Figure 2 As shown in the figure, first, DO starts a transaction and initializes the corresponding data access rights, including the id used to create the initial state; if the access control permissions need to be adjusted, DO will issue a subsequent transaction to update the access rights. Any subsequent modification of the access control policy requires issuing a new transaction and recording the transaction in the decentralized authorization log;

[0075] Step S3.1: DO sends a request and provides user id, start timestamp and interval time; i Add the corresponding network identification code and integrate the above information into the byte stream, issue an OP_RETURN transaction, and use this byte stream as the data part of the transaction;

[0076] The OP_RETURN transaction is a type of transaction used to store data on the blockchain, which does not require Bitcoin; the relevant access control data will be written to the decentralized authorization log and can be queried on the blockchain through the corresponding transaction hash value. After the transaction is published, it will be broadcast on the Bitcoin network. In order to determine the validity of the transaction and improve real-time authorization, mining confirmation is performed after the broadcast transaction.

[0077] Step S3.2: AAC scans the underlying blockchain, searches for the corresponding transaction containing access rights, maintains the authorization status, and queries U i When a storage node receives a request to store or retrieve data, it uses the signature to verify the request U i The identity is then searched for access control policies in AAC;

[0078] Step S3.3: When DO receives U i When a computing request is issued, the AAC is queried for access rights and the query is used to verify the U i The identity of the user is based on the signature authentication method to achieve access control; DO does not directly communicate with U i Interaction, dynamically adjusts and issues access control permissions only by interacting with decentralized authorization logs; DO grants permissions to U based on the access permissions embedded in the authorization log. i Verify data access requests, check access permissions, and terminate malicious sessions;

[0079] Compute request transaction T request The verification process is as follows Figure 2 shown.

[0080] Step S3.3.1: DO calculates the ciphertext digital summary CTcheck=H(x), where H(x) is a hash calculation function, and simultaneously calculates the digital summary of the request transaction MD=H(id,Add,CTcheck);

[0081] Step S3.3.2: DO performs digital signature sign=Sign(MD), where Sign() is a signature function and MD is a digital summary;

[0082] Step S3.3.3: DO generates a query request transaction T request ={id,Add,CTcheck,sign}, DO will request transaction T request Broadcast to other nodes in the blockchain network for verification; each node calculates the digital summary MD′ of the request transaction and compares it with the digital summary MD of the DO signature; if MD′=MD, it means that the request transaction T request Verification successful.

[0083] The ciphertext decision tree classification calculation:

[0084] Design of secure ciphertext decision tree classification algorithm TreeEval: During the classification process, the server is responsible for providing classification services to users. Before entering the classification process, the data computing server DCS has the data encrypted by Paillier transmitted by the data storage server. Where E(W) represents the encryption model, E(w i) represents the encryption threshold node, represents a leaf node, Represents an encrypted linear function. The user is the requester of the classification service. After verification, he can perform the requested calculation and has the data x to be classified;

[0085] The secure ciphertext decision tree classification process is shown in Algorithm 1.

[0086]

[0087]

[0088] The specific steps are as follows:

[0089] Step D1: U i Send a classification request to DTCS;

[0090] Step D2: After receiving the authorization result from AAC, DTCS reads the encrypted classification model;

[0091] Step D3: DTCS and U i Through communication protocol interaction, the classification process of ciphertext data is completed together, and the encrypted classification results are returned to U i ;

[0092] Step D3.1: DTCS and U i After executing the PvtCmp protocol, DTCS obtains the threshold comparison result;

[0093] Step D3.2: DTCS executes the path cost and linear cost function to obtain the encrypted path cost and linear function cost results, and adds the interference value to them to provide U i ;

[0094] Step D4: U i Get the encrypted path cost and linear function cost returned by DTCS, and get the classification result through key decryption and path cost judgment;

[0095] The embodiment of the present invention is described by the following nine polynomial time algorithm groups: Setup, KeyGen, Encrypt, Linear, UserEncrypt, TreeRequest, ReEncrypt, TreeEval, Decrypt:

[0096] (1) Setup(λ,N)→(Params,MSK): Takes a security parameter λ as input and the maximum number of authorized users N as input. Outputs the parameters Params and the master private key MSK.

[0097] (2)KeyGen(Params,MSK,id)→(pkid ,sk id ):When inputting DO or U i When the Params, MSK and user ID are output, the paillier key pair pk is output to the requester. id ,sk id .

[0098] (3) Encrypt(M, id, A) → C: Encrypt a message for a user or data owner. Input message M, user identifier id, and access policy A generated by DO. Output encrypted message C.

[0099] (4)Linear(id,D,MPK,sk id )→(L, token): Run by DO, input parameters Params, identity id, data set D and key sk id , output an authorization token and a decision tree linear function polynomial L.

[0100] (5)UserEncrypt(Params,id,sk id ,D user ) → D user ′: Input user data D user Encrypt the message to get D user ′.

[0101] (6)TreeRequest(L,token,id,sk id ,Params)→(L′,k U ): Input decision tree linear function polynomial L, identity id, key sk id and parameters Params, as well as the authorization token token generated by DO, to generate a set of key feature parameters - label triples k U .

[0102] (7)ReEncrypt(D user ′,k U )→RD user : The algorithm is run by CS, which takes a set of ciphertext-signature pairs D user ′ and triple set k U As input, output a set of re-encrypted ciphertext-processed signature-tag triples RD user .

[0103] (8)TreeEval(L′(x),RD user )→R: The algorithm is executed by DCS to perform decision tree ciphertext calculation, and the output R is the result set of decision tree classification calculation.

[0104] (9)Decrypt(sk id ,R)→r: Decrypt the encrypted result set, and the value of the plaintext r represents the classification result.

[0105] On the other hand, a method for constructing a decision tree classification model for decentralized authorization and access control includes the following steps:

[0106] Step 1: Parameter generation Setup(λ,N)→(Params,MSK);

[0107] Assume that the security parameter is λ, N is the maximum number of authorized users for decision tree classification calculation, select a prime number q with a length of λ bits, and G is an integer set A subgroup of G, where g is a generator of G; a bilinear cyclic group G of order p, where the identity element e:G×G→G T , G T represents a bilinear group; select a random number α∈Z p ,μ,Q∈G,Z p represents an integer. Then calculate g1=g α , The generator g is composed of g1,g2,...,g N composition. The generator μ is μ1,μ2,...,μ N And the signature parameter v = e(g,μ), e() represents the signature generation function; then select the collision-resistant hash function H i , i∈{1,2}, where H1:{0,1} * →Z p ,H2:G→G T ; Instantiate a Paillier encryption object paillier; Finally, output the system public parameters as the master public key Params = {p, g, v, G, G T ,e,H1,H2,paillier} and master key MSK={α,μ}, and upload the public parameters Params to the blockchain for parameter sharing, and the nodes on the blockchain call the public parameters;

[0108] Step 2: Key generation KeyGen(Params,MSK,id)→(pk id ,sk id );

[0109] Input the master public key Params, master key MSK and user identifier id∈{0,1}, and generate a pair of paillier-encrypted public-private key pairs (pk id ,sk id ), where the public key is pk id, and construct the private key

[0110] Step 3: Data encryption Encrypt(M,id,A)→C;

[0111] Encrypt user U belonging to id id message M, select a random number r∈Z p , respectively calculate the message C M =M·v r , C1=Q r , where v r Indicates the signature parameter, Q r represents a random number; the ciphertext message obtained at this time is C=(C M ,C0,C1); only users U that meet access control policy A id Can decrypt the ciphertext message C;

[0112] Step 4: Linear function calculation Linear(id,D,MPK,sk id )→(L,token);

[0113] DO generates a linear function L for calculating decision tree reasoning, and includes the ID of the authorized user in the linear function to generate an authorization token token; first, calculate the message C′=Encrypt(M,sk id )=(C M ,C0,C1), select a random number t,m,e∈Z p With σ∈Z p Calculate the key material k1 = sk id Q m , k2=g αm , k4=e(g,μ) s σ, Where S represents the identity parameter; the re-encrypted key is k=k1, k2, k3, k4, k5, and the re-encrypted key is sent to the blockchain for re-encryption;

[0114] The decision tree model is converted into a linear function. The path from the root node to each leaf node corresponds to a linear function. First, the threshold is converted into a Boolean value, and the attribute value is compared with the threshold value of the decision node. where x i represents the ciphertext node, w i represents the threshold vector, and m represents the length of the ciphertext. Then calculate the path cost from the root node to each leaf node where b i Represents the decision node threshold of the tree structure, b i=1 indicates the left subtree, b i = 0 represents the right subtree, and finally the interference term is added to the polynomial and converted into another polynomial where v M Indicates the value of a leaf node;

[0115] At this time, the authorization token token = (C′, k) and the polynomial L(x) are output and sent to DTCS;

[0116] Step 5: Pseudo-random encryption UserEncrypt(Params,id,sk id ,D user ) → D user ′;

[0117] UserU id Before uploading data, user Encryption; use the pseudo-random function PRF() to calculate the private key k0=PRF(j), where j=id, and encrypt the message

[0118] Step 6: Generate TreeRequest(L,token,id,sk id ,Params)→(L′,k U );

[0119] The user sends a decision tree query request to the computing server DTCS, and receives the polynomial L and authorization token encrypted by DO from DTCS. At this time, the user uses the Paillier encryption algorithm to encrypt the polynomial L to generate L′(x)=E(L(x))v M , function E() represents the Paillier encryption function.

[0120] Randomly select a random number τ j ∈Z p , while computing the key material avk j =sk id ·τ j , where avk j Indicates the evaluation key, and the key material k U ={evk j ,avk j ,τ j}, the encryption polynomial L′(x) and the key material k U Send to DTCS;

[0121] Step 7: Data Re-encryption ReEncrypt (D user ′,k U )→RD user ;

[0122] DTCS uses key material k U For user data D user 'Re-encrypt, the encrypted data is At this time, the key is s j =evk j +avk j modp, the re-encrypted user data is RD user ;

[0123] Step 8: Decision tree classification calculation TreeEval(L′(x),RD user )→R;

[0124] DTCS performs decision tree classification calculations on the encrypted data set, and the user obtains the returned encrypted path cost value R;

[0125] Step 9: Path cost decryption Decrypt(sk id ,R)→r;

[0126] The user decrypts the encrypted path cost value R and calculates the parameter Calculate σ = C j ′·T -1 , at last The value of the plaintext r represents the classification result;

[0127] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) to form a technical solution.

Claims

1. A decision tree classification model for decentralized authorization and access control, characterized in that: include: Data owner DO, data producer DP, user U i , access authorization center AAC, decision tree classification server DTCS, and data storage server DSS; The data producer DP and the data storage server DSS together constitute an encrypted data storage plane, and the decision tree classification server DTCS and the access authorization center AAC constitute an encrypted data calculation plane; the encrypted data storage plane is used for data storage, and the encrypted data calculation plane is used for authorization management and ciphertext decision tree classification calculation on encrypted data; The data owner DO generates a master private key MSK and sends the master private key MSK to the data producer DP. The data producer DP generates a data set D = {d1, d2, ..., d n }, d n Represents data, the data producer DP encrypts the data, the data owner DO sets the access control policy for the generated data, and stores it in the access authorization center AAC. The access authorization center AAC provides decentralized authorization services. i Authorized to access data; the data producer DP encrypts the data and transmits it to the data storage server DSS for storage; the user sends a data query request encrypted by the Paillier algorithm to the decision tree classification server DTCS, and the decision tree classification server DTCS first performs attribute identity authentication and needs to confirm that the user is granted the corresponding access rights. Then the data storage server DSS uploads the encrypted data producer DP data to the decision tree classification server DTCS for decision tree classification calculation; finally, the generated ciphertext query result is returned to the user, and the user decrypts it to obtain the plaintext classification result; when the access control authority is changed, a transaction is generated, and the access authorization center AAC stores the transaction in the centralized authorization log; Whenever an access authorization is updated, the transaction is recorded in the decentralized authorization log.

2. A decision tree classification model for decentralized authorization and access control according to claim 1, characterized in that: The decentralized authorization is specifically as follows: the authorization agent grants corresponding access control permissions for each piece of data based on the different data processing requirements of the user, and records the modification operations of the access control permissions in the decentralized authorization log; first, DO initiates a transaction to initialize the corresponding data access permissions, which includes the ID of the authorized user; if the access control permissions need to be adjusted, DO publishes a subsequent transaction, which includes: the storage address Add of the ciphertext x, the access control policy A, the user id, the public parameters Params, and the access token token used to access the data; any subsequent modifications to the access control policy require the publication of a new transaction, and the transaction is recorded in the decentralized authorization log.

3. A decision tree classification model for decentralized authorization and access control according to claim 2, characterized in that: The decentralized authorization specifically includes the following steps: Step S1: DO first verifies its identity through signature and has access rights to set or edit data; DO forms an authorization log by modifying data access rights and records the authorization log on the existing blockchain. By utilizing the public verifiable and tamper-proof characteristics of blockchain, it does not need to rely on a trusted third party to achieve decentralization of authorization services; without breaking the consensus, the blockchain has the access rights to record data settings. When modifying access rights, the global access control status is modified through the virtual chain; the authorization agent scans the authorization information on the blockchain, stores the relevant information in the database, and provides query services; Step S2: After receiving the request, DTCS directly inquires with the authorized agent to confirm the user's authority; if the request is legitimate, it executes the request without the authorization of DO and U i Empowerment through direct communication; Step S3: The authorization agent grants corresponding access control permissions according to different users, and records the modification operations of access control permissions in the decentralized authorization log; first, DO starts a transaction and initializes the corresponding data access permissions, including the id used to create the initial state; if the access control permissions need to be adjusted, DO will issue a subsequent transaction to update the access permissions. Any subsequent modifications to the access control policy require the issuance of a new transaction and the recording of the transaction in the decentralized authorization log.

4. A decision tree classification model for decentralized authorization and access control according to claim 3, characterized in that: The step S2 specifically includes the following steps: Step S2.1: Use public key cryptography to identify and authenticate the subject in the classification model, pair the data owner with the data producer, and the hash value of the data owner's public key is the unique identifier of the subject; during the initialization process of the data producer, the data owner creates a pair of public and private keys (PK owner ,SK owner ), PK owner With SK owner The public key and private key created for the data owner are respectively owner Stored securely locally, during the initialization phase, the public-private key (PK) created by the data owner is published on the blockchain through a two-way multi-signature registration transaction. owner ,SK owner ) creates a public-private key (PK) for the data producer devicei ,SK devicei ) for signature binding, PK devicei With SK devicei Public and private keys created for data producers respectively; Step S2.2: The data owner uses the private key SK owner Set access permissions for conversion tokens and key data, and pass the private key SK devicei Realize secure data storage; if the data producer exits the system, the data owner must reissue a new multi-signature binding transaction to obtain ownership of the data generated by the new paired data producer in the future; the data owner obtains the signature of the data producer through an out-of-band channel and broadcasts the registration transaction to the network after completing the signature addition; Step S2.3: After generating the private and public ECDSA key pairs of each data producer, UCACM-ESD signs the encrypted message and generates a signature.

5. A decision tree classification model for decentralized authorization and access control according to claim 3, characterized in that: The step S3 specifically comprises the following steps: Step S3.1: DO sends a request and provides user id, start timestamp and interval time; i Add the corresponding network identification code and integrate the above information into the byte stream, issue an OP_RETURN transaction, and use this byte stream as the data part of the transaction; Step S3.2: AAC scans the underlying blockchain, searches for the corresponding transaction containing access rights, maintains the authorization status, and queries U i When a storage node receives a request to store or retrieve data, it uses the signature to verify the request U i The identity is then searched for access control policies in AAC; Step S3.3: When DO receives U i When a computing request is issued, the AAC is queried for access rights and the query is used to verify the U i The identity of the user is based on the signature authentication method to achieve access control; DO does not directly communicate with U i Interaction, dynamically adjusts and issues access control permissions only by interacting with decentralized authorization logs; DO grants permissions to U based on the access permissions embedded in the authorization log. i Verify data access requests, check access permissions, and terminate malicious sessions; Step S3.3.1: DO calculates the ciphertext digital summary CTcheck=H(x), where H(x) is a hash calculation function, and simultaneously calculates the digital summary of the request transaction MD=H(id,Add,CTcheck); Step S3.3.2: DO performs digital signature sign=Sign(MD), where Sign() is a signature function and MD is a digital summary; Step S3.3.3: DO generates a query request transaction T request ={id,Add,CTcheck,sign}, DO will request transaction T request Broadcast to other nodes in the blockchain network for verification; each node calculates the digital summary MD′ of the request transaction and compares it with the digital summary MD of the DO signature; if MD′=MD, it means that the request transaction T request Verification successful.

6. A decision tree classification model for decentralized authorization and access control according to claim 1, characterized in that: The ciphertext decision tree classification calculation is specifically as follows: Design of secure ciphertext decision tree classification algorithm TreeEval: During the classification process, the server is responsible for providing classification services to users. Before entering the classification process, the data computing server DCS has the data encrypted by Paillier transmitted by the data storage server. Where E(W) represents the encryption model, E(w i ) represents the encryption threshold node, represents a leaf node, Represents an encrypted linear function; the user is the requester of the classification service, who can perform the requested calculation after verification and has the data x to be classified.

7. A decision tree classification model for decentralized authorization and access control according to claim 6, characterized in that: The ciphertext decision tree classification calculation specifically includes the following steps: Step D1: U i Send a classification request to DTCS; Step D2: After receiving the authorization result from AAC, DTCS reads the encrypted classification model; Step D3: DTCS and U i Through communication protocol interaction, the classification process of ciphertext data is completed together, and the encrypted classification results are returned to U i ; Step D3.1: DTCS and U i After executing the PvtCmp protocol, DTCS obtains the threshold comparison result; Step D3.2: DTCS executes the path cost and linear cost function to obtain the encrypted path cost and linear function cost results, and adds the interference value to them to provide U i ; Step D4: U i The encrypted path cost and linear function cost returned by DTCS are obtained, and the classification result is obtained through key decryption and path cost judgment.

8. A decision tree classification model for decentralized authorization and access control according to claim 1, characterized in that: The method for constructing the decision tree classification model for decentralized authorization and access control comprises the following steps: Step 1: Parameter generation Setup(λ,N)→(Params,MSK); Assume that the security parameter is λ, N is the maximum number of authorized users for decision tree classification calculation, select a prime number q with a length of λ bits, and G is an integer set A subgroup of G, where g is a generator of G; a bilinear cyclic group G of order p, where the identity element e:G×G→G T , G T represents a bilinear group; select a random number α∈Z p ,μ,Q∈G,Z p represents an integer; then calculate The generator g is composed of g1,g2,...,g N composition; The generator μ is μ1,μ2,...,μ N composition; and signature parameter v = e(g,μ), where e() represents the signature generation function; and then selects the collision-resistant hash function H i , i∈{1,2}, where H1:{0,1} * →Z p ,H2:G→G T ; Instantiate a Paillier encryption object paillier; Finally, output the system public parameters as the master public key Params = {p, g, v, G, G T ,e,H1,H2,paillier} and master key MSK={α,μ}, and upload the public parameters Params to the blockchain for parameter sharing, and the nodes on the blockchain call the public parameters; Step 2: Key generation KeyGen(Params,MSK,id)→(pk id ,sk id ); Input the master public key Params, master key MSK and user identifier id∈{0,1}, and generate a pair of paillier-encrypted public-private key pairs (pk id ,sk id ), where the public key is pk id , and construct the private key Step 3: Data encryption Encrypt(M,id,A)→C; Encrypt user U belonging to id id message M, select a random number r∈Z p , respectively calculate the message where v r Indicates the signature parameter, Q r represents a random number; the ciphertext message obtained at this time is C=(C M ,C0,C1); only users U that meet access control policy A id Can decrypt the ciphertext message C; Step 4: Linear function calculation Linear(id,D,MPK,sk id )→(L,token); DO generates a linear function L for calculating decision tree reasoning, and includes the ID of the authorized user in the linear function to generate an authorization token token; first, calculate the message C′=Encrypt(M,sk id )=(C M ,C0,C1), select a random number t,m,e∈Z p With σ∈Z p Calculate the key material k1 = sk id Q m , k2=g αm , k4=e(g,μ) s σ, Where S represents the identity parameter; the re-encrypted key is k=k1, k2, k3, k4, k5, and the re-encrypted key is sent to the blockchain for re-encryption; The decision tree model is converted into a linear function. The path from the root node to each leaf node corresponds to a linear function. First, the threshold is converted into a Boolean value, and the attribute value is compared with the threshold value of the decision node. where x i represents the ciphertext node, w i represents the threshold vector, m represents the length of the ciphertext; then calculate the path cost E from the root node to each leaf node id (b) v1 =(1-b1)+(1-b2)+(1-b4), where b i Represents the decision node threshold of the tree structure, b i =1 indicates the left subtree, b i = 0 represents the right subtree, and finally the interference term is added to the polynomial and converted into another polynomial where v M Indicates the value of a leaf node; At this time, the authorization token token = (C′, k) and the polynomial L(x) are output and sent to DTCS; Step 5: Pseudo-random encryption UserEncrypt(Params,id,sk id ,D user ) → D user ′; UserU id Before uploading data, user Encryption; use the pseudo-random function PRF() to calculate the private key k0=PRF(j), where j=id, and encrypt the message Step 6: Generate TreeRequest(L,token,id,sk id ,Params)→(L′,k U ); The user sends a decision tree query request to the computing server DTCS, and receives the polynomial L encrypted by DO and the authorization token token from DTCS. At this time, the user uses the Paillier encryption algorithm to encrypt the polynomial L to generate L′(x)=E(L(x))·v M , function E() represents the Paillier encryption function; Randomly select a random number τ j ∈Z p , while computing the key material avk j =sk id ·τ j , where avk j Indicates the evaluation key, and the key material k U ={evk j ,avk j ,τ j }, the encryption polynomial L′(x) and the key material k U Send to DTCS; Step 7: Data Re-encryption ReEncrypt (D user ′,k U )→RD user ; DTCS uses key material k U For user data D user 'Re-encrypt, the encrypted data is At this time, the key is s j =evk j +avk j modp, the re-encrypted user data is RD user ; Step 8: Decision tree classification calculation TreeEval(L′(x),RD user )→R; DTCS performs decision tree classification calculations on the encrypted data set, and the user obtains the returned encrypted path cost value R; Step 9: Path cost decryption Decrypt(sk id ,R)→r; The user decrypts the encrypted path cost value R and calculates the parameter Calculate σ = C j ′·T -1 , at last The value of the plaintext r represents the classification result.

Images