Decentralized authorization and access control decision tree classification model and construction method thereof

Abstract

The application provides a decision tree classification model of decentralized authorization and access control and a construction method thereof, relates to the technical field of decision trees, and decouples data encryption and data calculation logic, realizes separation of data storage and calculation, and allows users of different authorized parties to jointly participate in calculation. Meanwhile, a data access control strategy and an access authorization decentralized storage service scheme not relying on a trusted intermediary are designed, and the security requirements of data privacy in an outsourcing environment are met.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of decision tree, in particular to a decentralized authorization and access control decision tree classification model and a construction method thereof. BACKGROUND

[0002] Outsourcing decision tree classification services to the cloud is beneficial, but it also brings serious privacy problems, such as the privacy leakage of models, input data and output results, which limits the development of outsourced classification services. The data analyzed by decision trees often contains privacy and sensitive data, and illegal access to these resources can have serious consequences. Access control is needed to prevent unauthorized access to resources while protecting sensitive private data. Therefore, how to build a secure decision tree classification model has become a new challenge. The simplest method is to encrypt personal data by encrypting data that involves user privacy or contains sensitive information before uploading it to ensure data security. In this case, the user needs to keep the decryption key locally. However, there is a huge demand for data sharing applications in cloud computing services. Since encrypted data can only be decrypted by the user, it is impossible to share it with anyone else through the cloud. Therefore, it is of great practical significance to conduct in-depth research and solve the information security problem in the outsourcing of decision tree classification services.

[0003] Many existing encryption schemes do not have the ability to re-encrypt ciphertext data, while proxy re-encryption (PRE) is a secure encryption method that can convert data encrypted by user A to data encrypted by a different key, allowing user B to decrypt it using their own key without revealing any plaintext messages during the entire conversion process. Access control is an important means of protecting data security, managing user permissions, and authorizing users to access corresponding data in the system according to their own permissions, preventing unauthorized access to data by users, and ensuring data security and normal operation of business systems. However, traditional access control methods use centralized design, which has the disadvantages of single point of failure, difficulty in expansion, low reliability, low throughput, etc. In fact, devices may belong to different organizations or users and have mobility and limited performance, making it difficult for centralized access control to meet the requirements of access control. In addition, during the interaction process between the user and the third-party authorization server, sensitive information such as user identity and access address may be leaked to untrusted servers, causing serious losses to the user. Blockchain has received widespread attention due to its decentralization and immutability. Therefore, the combination of blockchain and PRE can provide a secure and reliable data sharing method.

[0004] Most existing video image compression schemes have the following problems:

[0005] (1)Ciphertext computation problem: Traditional IBE methods cannot support ciphertext decision tree classification computation due to the limitations of existing cryptographic algorithms. At the same time, user data frequently exchanges across applications, systems, and ecosystems have become the norm, and traditional ciphertext computation schemes tightly couple data encryption logic and data computation logic, resulting in poor system flexibility and scalability.

[0006] (2) Decentralized authorization problem: In the current authorization scheme, most authorization management mechanisms rely on trusted third parties to complete, which not only has the problem of "single point failure", but also has the risk of directly obtaining important privacy information by the third party. In addition, the interaction process between the user and the third-party authorization server also leaks the user's identity, access habits and other privacy information to the third-party server, which may cause statistical inference attacks and cause serious losses.

[0007] (3) Access control problem: In the current IBE and blockchain scheme, although the non-tamperability of access control can be guaranteed, the one-to-many access control and data privacy protection problem is not considered. At the same time, the access control strategy in most ciphertext access control schemes is relatively extensive, either can access the entire ciphertext data set or has no access rights. In actual application, different users need different authorization, and the same user also needs different authorization in different working scenarios. Therefore, the data owner needs to develop a fine-grained access control strategy for the data. SUMMARY

[0008] In view of the deficiencies of the prior art, the present application provides a decision tree classification model for decentralized authorization and access control and a construction method thereof, which combines a proxy re-encryption instantiation Paillier encryption method to realize the access control process and is integrated with a blockchain to realize a method of decentralized authorization and on-chain sharing of key information ciphertext.

[0009] In one aspect, a decision tree classification model for decentralized authorization and access control includes a data owner DO, a data producer DP, a user U i , an access authorization center AAC, a decision tree classification server DTCS, and a data storage server DSS.

[0010] The data producer DP and the data storage server DSS jointly constitute an encrypted data storage plane, and the decision tree classification server DTCS and the access authorization center AAC constitute an encrypted data computation plane; the encrypted data storage plane is used for data storage, and the encrypted data computation plane is used for authorization management and ciphertext decision tree classification computation on encrypted data.

[0011] The data owner DO generates a master private key MSK and sends it to the data producer DP. The data producer DP then generates a data set D = {d1, d2, ..., d...}. n}, d n The data represents the data producer (DP) encrypting the data, the data owner (DO) setting access control policies for the generated data, and storing it in the Access Authorization Center (AAC). The AAC provides decentralized authorization services, allowing multiple users (U) to access the data. i Authorized access to data is granted; the data producer (DP) encrypts the data and transmits it to the data storage server (DSS) for storage; the user sends a data query request encrypted with the Paillier algorithm to the decision tree classification server (DTCS). The DTCS first performs attribute authentication to confirm that the user has been granted the appropriate access rights. Then, the data storage server (DSS) uploads the encrypted data from the data producer (DP) to the DTCS for decision tree classification calculation. Finally, the generated ciphertext query result is returned to the user, who decrypts it to obtain the plaintext classification result. When access control permissions change, a transaction is generated, and the access authorization center (AAC) stores the transaction in the centralized authorization log. Whenever access authorization is updated, the transaction is recorded in the decentralized authorization log.

[0012] The decentralized authorization and encrypted decision tree classification calculation process is as follows:

[0013] The decentralized authorization process involves an authorization agent granting corresponding access control permissions to each piece of data based on the user's different data processing needs, and recording modifications to these permissions in the decentralized authorization log. First, the DO (Delegated Authorization Provider) initiates a transaction to initialize the corresponding data access permissions, which includes the authorized user's ID. If access control permissions need to be adjusted, the DO publishes a subsequent transaction containing: the storage address of the ciphertext x (Add), access control policy A, user ID, public parameters (Params), and an access token for accessing the data. Any subsequent modifications to the access control policy require the publication of a new transaction, which is then recorded in the decentralized authorization log. The specific steps include:

[0014] Step S1: The DO first verifies its identity by signing and has access to set or edit data; the DO forms an authorization log by modifying data access permissions, and records the authorization log on the existing blockchain, which realizes the decentralization of the authorization service by utilizing the publicly verifiable and tamper-proof characteristics of the blockchain without relying on a trusted third party; without breaking the consensus, the blockchain has the access permission to record data settings, and when modifying the access permission, the global access control state is modified through a virtual chain; the authorization agent scans the authorization information on the blockchain, stores the relevant information in the database, and provides query services;

[0015] Step S2: After receiving the request, the DTCS directly queries the authorization agent to confirm the user's permission; if the request is legal, the request is executed; without the authorization of the DO and the U i direct communication;

[0016] Step S2.1: Public key cryptography is used to identify and authenticate the subjects in the classification model, and the data owner is paired with the data producer, and the hash value of the data owner's public key is the unique identifier of the subject; in the initialization process of the data producer, the data owner creates a pair of public and private keys (PK owner , SK owner ) locally, PK owner and SK owner are the public key and private key created by the data owner, and the private key SK owner is securely stored locally, and in the initialization phase, a two-way multi-signature registration transaction is published on the blockchain, the public and private keys (PK owner , SK owner ) created by the data owner are signed and bound to the public and private keys (PK devicei , SK devicei ) created by the data producer, PK devicei and SK devicei are the public key and private key created by the data producer;

[0017] Step S2.2: The data owner sets access permissions for the conversion token and key data through the private key SK owner , and realizes secure data storage through the private key SK devicei ; if the data producer exits the system, the data owner must republish a new multi-signature binding transaction to obtain ownership of future data generated by new paired data producers; the data owner obtains the signature of the data producer through an out-of-band channel, and broadcasts the registration transaction to the network after completing the addition of the signature;

[0018] Step S2.3: After generating a private and public ECDSA key pair for each data producer, the UCACM-ESD signs and generates a signature for the encrypted message;

[0019] Step S3: The authorization agent grants corresponding access control permissions according to different users, and records the modification operation of the access control permission in the decentralized authorization log; first, the DO initiates a transaction and initializes the corresponding data access permission, which includes the id for creating the initial state; if it is necessary to adjust the access control permission, the DO will issue a subsequent transaction to update the access permission, and any subsequent modification of the access control policy needs to issue a new transaction and record the transaction in the decentralized authorization log;

[0020] Step S3.1: The DO sends a request and provides the user id, start timestamp and interval time; i Add the corresponding network identification code, and integrate the above information into the byte stream, issue an OP_RETURN transaction, and use this byte stream as the data part of the transaction;

[0021] Step S3.2: The AAC scans the underlying blockchain to search for the corresponding transaction containing access permissions, and maintains the authorization state, queries the access control policy of U i ; When the storage node receives a request to store or retrieve data, it verifies the identity of the request U i based on the signature, and then searches for the access control policy in the AAC;

[0022] Step S3.3: When the DO receives the calculation request request sent by U i , query the access permission from the AAC, and verify the identity of U i based on the signature-based identity verification method to realize access control; the DO does not directly interact with U i , but dynamically adjusts and issues access control permissions by interacting with the decentralized authorization log; the DO verifies the data access request of U i according to the access permission embedded in the authorization log, and terminates the malicious session after checking the access permission;

[0023] Step S3.3.1: The DO calculates the ciphertext digital digest CTcheck = H(x), where H(x) is a hash calculation function, and also calculates the digital digest MD = H(id, Add, CTcheck) of the request transaction;

[0024] Step S3.3.2: The DO performs digital signature sign = Sign(MD), where Sign() is a signature function and MD is a digital digest;

[0025] Step S3.3.3: The DO generates a query request transaction T request = {id, Add, CTcheck, sign}, and the DO will request the transaction T requestThe broadcast is verified by other nodes in the blockchain network; each node calculates the digital digest MD' of the request transaction and compares it with the digital digest MD signed by DO; if MD' = MD, it indicates that the request transaction T request Verification is successful.

[0026] The ciphertext decision tree classification calculation is:

[0027] The secure ciphertext decision tree classification algorithm TreeEval is designed: in the classification process, the server is responsible for providing classification services for users, and before entering the classification process, the data calculation server DCS has the data encrypted by Paillier transmitted by the data storage server Where E(W) represents the encryption model, E(w i ) represents the encryption threshold node, represents the leaf node, represents the encrypted linear function. The user is the requester of the classification service, and can request calculation after verification, and has the data to be classified x;

[0028] The specific steps are as follows:

[0029] Step D1: U i sends a classification request to DTCS;

[0030] Step D2: After receiving the authorization result of AAC, DTCS reads the encrypted classification model;

[0031] Step D3: DTCS and U i exchange through a communication protocol, jointly complete the classification process of the ciphertext data, and return the encrypted classification result to U i ;

[0032] Step D3.1: DTCS and U i execute the PvtCmp protocol, and DTCS obtains the threshold comparison result;

[0033] Step D3.2: DTCS executes the path cost and linear cost function, obtains the encrypted path cost and linear function cost result, and provides U i after adding an interference value;

[0034] Step D4: U i obtains the encrypted path cost and linear function cost returned by DTCS, and obtains the classification result through key decryption and path cost judgment;

[0035] On the other hand, a construction method of a decentralized authorization and access control decision tree classification model includes the following steps:

[0036] Step 1: Parameter generation Setup(λ, N)→(Params, MSK);

[0037] Assume that the security parameter is λ, N is the maximum number of authorized users for decision tree classification calculation, select a prime number q of λ bits long, G is a subgroup of integer set , g is the generator of G; the order of the bilinear cyclic group G is a large prime number p, where the unit element e: G × G→G T , G T represents a bilinear group; select a random number α∈Z p , μ, Q∈G, Z p represents an integer. Then calculate g1=g α , The generator g is composed of g1, g2,..., g N . The generator μ is composed of μ1, μ2,..., μ N . And the signature parameter v=e(g, μ), e() represents the signature generation function; then select a collision-resistant hash function H i , i∈{1,2}, where H1:{0,1} * →Z p , H2:G→G T ; instantiate a Paillier encryption object paillier; finally, output the system public parameter as the master public key Params={p, g, v, G, G T , e, H1, H2, paillier} and the master secret key MSK={α, μ}, and upload the public parameter Params to the blockchain for parameter sharing, and the nodes on the blockchain call the public parameter;

[0038] Step 2: Key generation KeyGen(Params, MSK, id)→(pk id , sk id ).

[0039] Input the master public key Params, the master secret key MSK and the user identifier id∈{0,1}, generate a pair of paillier encryption public and private key pairs (pk id , sk id ) for each user, where the public key is pk id , and the private key is

[0040] Step 3: Data encryption Encrypt(M, id, A)→C;

[0041] Encrypt the message M of the user U id belonging to id, select a random number r∈Zp , respectively, and the message C M = M · v r , C1= Q r where v r denotes a signature parameter, Q r denotes a random number; the ciphertext message obtained at this time is C = (C M , C0, C1); only the user U id satisfying the access control policy A can decrypt the ciphertext message C;

[0042] Step 4: Linear function calculation Linear(id, D, MPK, sk id )→(L, token);

[0043] DO generates a linear function L for decision tree reasoning, and at the same time, the id of the authorized user is included in the linear function to generate an authorized token token; first, a message C' containing authorization information is calculated C' = Encrypt(M, sk id ) = (C M , C0, C1), and random numbers t, m, e ∈ Z p and σ ∈ Z p are selected; key material k1 = sk id · Q m , k2 = g αm , k4 = e(g, μ) s · σ, where S denotes an identity parameter; the re-encryption key k = k1, k2, k3, k4, k5 is obtained, and the re-encrypted key is sent to the blockchain for re-encryption use;

[0044] The decision tree model is converted into a linear function, and the path from the root node to each leaf node corresponds to a linear function; first, the threshold value is converted into a Boolean type value, and the attribute value and the decision node threshold value are compared where x i denotes a ciphertext node, w i denotes a threshold vector, and m denotes the length of the ciphertext. The path cost from the root node to each leaf node is calculated where b i denotes a decision node threshold value of a tree structure, b i = 1 denotes a left subtree, and b i = 0 denotes a right subtree; finally, an interference term is added to the polynomial to convert it into another polynomial where v M denotes a leaf node value;

[0045] At this time, the output authorization token token=(C', k) and polynomial L(x) are sent to the DTCs;

[0046] Step 5: Pseudo-random encryption UserEncrypt(Params, id, sk id → D user ′; user

[0047] The user U id encrypts the data D user before uploading the data; the private key k0=PRF(j) is calculated using the pseudo-random function PRF(), where j=id, and the message is encrypted

[0048] Step 6: Polynomial generation TreeRequest(L, token, id, sk id , Params)→(L', k U );

[0049] The user sends a decision tree query request to the computing server DTCS, and the user receives the polynomial L encrypted by DO and the authorization token token from the DTCS side; at this time, the user uses the Paillier encryption algorithm to encrypt the polynomial L to generate L'(x)=E(L(x))v M , where the function E() represents the Paillier encryption function.

[0050] A random number τ j ∈Z p is randomly selected, and the key material avk j =sk id ·τ j is calculated, where avk j represents the evaluation key, and at this time, the key material k U ={evk j , avk j , τ j}, the encrypted polynomial L'(x) and the key material k U are sent to the DTCS;

[0051] Step 7: Data re-encryption ReEncrypt(D user ′, k U )→RD user ;

[0052] The DTCS re-encrypts the user data D U using the key material k user , and the encrypted data is At this time, the key is s j =evk​j + avk j modp, the re-encrypted user data is RD user ;

[0053] Step 8: Decision tree classification calculation TreeEval(L'(x), RD user )→R;

[0054] The DTCS performs a decision tree classification calculation on the encrypted data set, and the user obtains the returned encrypted path cost value R;

[0055] Step 9: Path cost decryption Decrypt(sk id ,R)→r;

[0056] The user decrypts the encrypted path cost value R, and calculates the parameter Calculation Finally The value of the plaintext r represents the classification result;

[0057] The beneficial effects produced by the above technical solutions are as follows:

[0058] The present application provides a decision tree classification model for decentralized authorization and access control and a construction method thereof. The present application proposes a new scheme, which makes the data storage logic independent of the data calculation logic in function, thereby avoiding the tightly coupled layer and the encrypted data calculation layer, and can effectively protect the data storage and calculation, thereby realizing the cross-system compatibility requirement.

[0059] In addition, the present application designs an end-to-end encryption access control structure, which is based on the Paillier encryption scheme of IB-PRE, and simultaneously provides secure decision tree classification calculation from different authorized parties, and re-encrypts the ciphertext of one party as the data on the ciphertext field of another party.

[0060] Finally, the present application realizes a decentralized authorization service, which combines access control and authorization to realize secure calculation of encrypted data and access authorization without trusted intermediaries. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 Fig. 1 is a structure diagram of a decision tree classification model in an embodiment of the present application;

[0062] Figure 2 Fig. 3 is a distributed authorization process in an embodiment of the present application. DETAILED DESCRIPTION

[0063] The specific embodiments of the present application will be further described in detail below in combination with the drawings and examples. The following examples are used to illustrate the present application, but are not used to limit the scope of the present application.

[0064] In one aspect, a decision tree classification model for decentralized authorization and access control comprises a data owner DO, a data producer DP, a user U Figure 1 i (User), an access authorization center AAC, a decision tree classification server DTCS, and a data storage server DSS, as shown in the figure.

[0065] The data producer DP and the data storage server DSS jointly constitute an encrypted data storage plane, and the decision tree classification server DTCS and the access authorization center AAC constitute an encrypted data calculation plane. In existing majority ciphertext access control mechanisms, the encrypted data storage plane and the encrypted data calculation plane are tightly coupled, resulting in poor flexibility and scalability of the system. The idea of decoupling the encrypted data storage plane and the encrypted data calculation plane is studied, and the model is divided into functionally independent encrypted data storage planes and encrypted data calculation planes. The encrypted data storage plane is used for data storage, and the encrypted data calculation plane is used for authorization management and ciphertext decision tree classification calculation on encrypted data.

[0066] The data owner DO generates a master secret key MSK and sends the master secret key MSK to the data producer DP. The data producer DP generates a data set D = {d1, d2,..., d n} and d n represents data. The data producer DP encrypts the data, and the data owner DO sets an access control policy for the generated data and stores it in the access authorization center AAC. The access authorization center AAC provides decentralized authorization services, and multiple users U i are authorized to access the data. The data producer DP encrypts the data and transmits it to the data storage server DSS for storage. The user sends a data query request encrypted by the Paillier algorithm to the decision tree classification server DTCS. The decision tree classification server DTCS first performs attribute identity verification to confirm that the user is granted the corresponding access rights. Then, the data storage server DSS uploads the encrypted data producer DP data to the decision tree classification server DTCS for decision tree classification calculation. Finally, the generated ciphertext query result is returned to the user, and the user decrypts it to obtain the plaintext classification result. When the access control rights are changed (for example, granting or revoking rights to the user), a transaction is generated, and the access authorization center AAC stores the transaction in the centralized authorization log. Whenever the access authorization is updated, the transaction is recorded in the decentralized authorization log.​

[0067] The decentralized authorization and ciphertext decision tree classification calculation process is as follows:

[0068] The decentralized authorization: the authorization agent grants corresponding access control permissions to each piece of data according to different processing needs of the user for the data, and records the modification operation on the access control permission to the decentralized authorization log; first, a transaction is initiated by the DO to initialize the corresponding data access permission, which contains the ID of the authorized user; if it is necessary to adjust the access control permission, the DO issues a subsequent transaction to update the access permission of the data. The transaction includes: the storage address Add of the ciphertext x, the access control policy A, the user id, the public parameter Params and the access token token used to access the data; any modification of the access control policy needs to issue a new transaction again, and the transaction is recorded on the decentralized authorization log; specific steps include the following:

[0069] Step S1: the DO first verifies its identity by signature and has the access permission to set or edit the data; the DO forms the authorization log by modifying the data access permission, and records the authorization log on the existing blockchain, which realizes the decentralization of the authorization service by using the publicly verifiable and tamper-proof characteristics of the blockchain without relying on a trusted third party; without breaking the consensus, the blockchain has the record of the data setting access permission, including authorization, revocation, modification, etc. When modifying the access permission, the global access control state is modified through a virtual chain; the authorization agent scans the authorization information on the blockchain, stores the relevant information in the database, and provides query services;

[0070] Step S2: after receiving the request, the DTCS directly queries the authorization agent to confirm the user's permission; if the request is legal, the request is executed; without the authorization of the DO and the U i direct communication;

[0071] Step S2.1: public key cryptography is used to identify and authenticate the subjects in the classification model, and the data owner is paired with the data producer. The hash value of the data owner's public key is the unique identifier of the subject; the user's identity is verified and authorized by using public key signature, so that the data producer can securely and autonomously encrypt the generated streaming data and securely interact with the data storage server; in the initialization process of the data producer, the data owner creates a pair of public and private keys (PK owner , SK owner ) locally, PK owner and SK owner are the public key and private key created by the data owner, and the private key SK owner is securely stored locally. In the initialization phase, a two-way multi-signature registration transaction is published on the blockchain, and the data owner creates a pair of public and private keys (PKowner ,SK owner ) created by the data producer, and the public key PK devicei and the private key SK devicei are respectively the public key and the private key created by the data producer; devicei devicei

[0072] Step S2.2: The data owner sets access permissions for the conversion token and key data through the private key SK owner , and realizes secure data storage through the private key SK devicei ; if the data producer exits the system, the data owner must republish a new multi-signature binding transaction to obtain the ownership of future new paired data producers generated data; the data owner obtains the signature of the data producer through an out-of-band channel, and broadcasts the registration transaction to the network after completing the addition of the signature;

[0073] Step S2.3: After generating the private and public ECDSA key pair of each data producer, the UCACM-ESD signs and generates a signature for the encrypted message; the signature can be verified given the public key and the ciphertext. As long as the enemy does not destroy the private key, the enemy cannot forge the signature.

[0074] Step S3: The authorized agent grants corresponding access control permissions according to different users, and records the modification operation of the access control permission in the decentralized authorization log, as shown in FIG. 8; first, the DO initiates a transaction and initializes the corresponding data access permissions, which include the id used to create the initial state; if the access control permission needs to be adjusted, the DO will publish a subsequent transaction to update the access permission, and any subsequent modification of the access control policy needs to publish a new transaction, and the transaction is recorded in the decentralized authorization log; Figure 2

[0075] Step S3.1: The DO sends a request and provides the user id, the start timestamp and the interval time; the U i adds the corresponding network identification code, and integrates the above information into a byte stream, issues an OP_RETURN transaction, and uses this byte stream as the data part of the transaction;

[0076] The OP_RETURN transaction is a transaction type for storing data on the blockchain, and does not require Bitcoin; the related access control data will be written into the decentralized authorization log, and can be queried on the blockchain through the corresponding transaction hash value. After the transaction is published, it will be broadcasted on the Bitcoin network. In order to determine the validity of the transaction and improve real-time authorization, mining confirmation is performed after the transaction is broadcasted.

[0077] ​​​Step S3.2: AAC scans the underlying blockchain, searches for corresponding transactions containing access permissions, maintains the authorization status, and queries U. i The permissions; when a storage node receives a request to store or retrieve data, it uses a signature to verify the request U. i The identity is determined, and then access control policies are searched in AAC;

[0078] Step S3.3: When DO receives U i When issuing a computation request, the system queries the AAC for access permissions and verifies U through the query. i Access control is implemented using a signature-based authentication method; DO does not directly interact with U. i Interaction is achieved by dynamically adjusting and publishing access control permissions solely through interaction with distributed authorization logs; DO, based on the access permissions embedded in the authorization logs, controls U... i The data access request is verified, and after checking the access permissions, the malicious session is terminated.

[0079] Calculate request transaction T request The verification process is as follows: Figure 2 As shown.

[0080] Step S3.3.1: DO calculates the ciphertext digital digest CTcheck = H(x), where H(x) is the hash calculation function, and at the same time calculates the digital digest of the requesting transaction MD = H(id,Add,CTcheck);

[0081] Step S3.3.2: DO performs a digital signature sign = Sign(MD), where Sign() is the signature function and MD is the digital digest;

[0082] Step S3.3.3: DO generates query request transaction T request ={id,Add,CTcheck,sign}, DO will request transaction T request The request is broadcast to other nodes in the blockchain network for verification; each node calculates the digital digest MD′ of the request transaction and compares it with the digital digest MD of the DO signature; if MD′ = MD, it means that the request transaction T... request Verification successful.

[0083] The encrypted decision tree classification calculation:

[0084] Design a secure encrypted decision tree classification algorithm, TreeEval: During the classification process, the server is responsible for providing classification services to users. Before entering the classification process, the data computing server (DCS) possesses data encrypted by Paillier transmitted from the data storage server. Where E(W) represents the encryption model, E(w) i) represents an encryption threshold node, represents a leaf node, represents an encryption linear function. The user is the requester of the classification service, and can make a request calculation after being verified, and has data x to be classified;

[0085] The secure ciphertext decision tree classification process is shown in Algorithm 1.

[0086]

[0087]

[0088] The specific steps are as follows:

[0089] Step D1: U i sends a classification request to the DTCS;

[0090] Step D2: After the DTCS receives the authorization result of the AAC, the encrypted classification model is read;

[0091] Step D3: The DTCS and U i complete the classification process of the ciphertext data through communication protocol interaction, and return the encrypted classification result to the U i ;

[0092] Step D3.1: The DTCS and U i execute the PvtCmp protocol, and the DTCS obtains the threshold comparison result;

[0093] Step D3.2: The DTCS executes the path cost and linear cost function, obtains the encrypted path cost and linear function cost result, and provides the U i after adding an interference value;

[0094] Step D4: U i obtains the encrypted path cost and linear function cost returned by the DTCS, and obtains the classification result through key decryption and path cost judgment;

[0095] The embodiments of the application are described by the following 9 polynomial time algorithms Setup, KeyGen, Encrypt, Linear, UserEncrypt, TreeRequest, ReEncrypt, TreeEval, and Decrypt:

[0096] (1) Setup (lambda, N) -> (Params, MSK): input a security parameter lambda, and input the maximum number of authorized users N. Output parameters Params and master secret key MSK.

[0097] (2) KeyGen (Params, MSK, id) -> (pkid ,sk id ): Upon input of Params, MSK and user id, outputs the paillier key pair pk i ,sk id for the requester. id .

[0098] (3) Encrypt(M, id, A) → C: Encrypts a message for a user or data owner, inputting the message M, the user identifier id and the access policy A generated by the DO, outputting the encrypted message C.

[0099] (4) Linear(id, D, MPK, sk id ) → (L, token): Run by the DO, inputting the parameters Params, the identity id, the data set D and the key sk id , outputs an authorization token token and a decision tree linear function polynomial L.

[0100] (5) UserEncrypt(Params, id, sk id , D user ) → D user ': Input the user data D user to encrypt, encrypt the message to obtain D user '.

[0101] (6) TreeRequest(L, token, id, sk id , Params) → (L', k U ): Input the decision tree linear function polynomial L, the identity id, the key sk id and the parameters Params, and the authorization token token generated by the DO, generate a set of key feature parameters - label triplets k U .

[0102] (7) ReEncrypt(D user ', k U ) → RD user : The algorithm is run by the CS, which takes the ciphertext-signature pair set D user ' and the triplet set k U as input, and outputs a set of re-encrypted ciphertext-processed signature-label triplets RD user .

[0103] (8) TreeEval(L'(x), RD user ) → R: The algorithm performs decision tree ciphertext calculation by the DCS, and the output R is the result set of the decision tree classification calculation.

[0104] (9) Decrypt(sk id , R) → r: decrypt the encrypted result set, the value of plaintext r represents the classification result.

[0105] On the other hand, a method for constructing a decision tree classification model of decentralized authorization and access control comprises the following steps:

[0106] Step 1: parameter generation Setup(λ, N) → (Params, MSK);

[0107] Assume that the security parameter is λ, and N is the maximum number of authorized users for decision tree classification calculation, select a prime number q with a length of λ bits, G is a subgroup of the integer set , and g is the generator of G; the order of the bilinear cyclic group G is a large prime number p, wherein the unit element e: G × G → G T , G T represents a bilinear group; select random numbers α∈Z p , μ, Q∈G, and Z p represents an integer. Then calculate g1=g α , The generator g is composed of g1, g2,..., g N . The generator μ is composed of μ1, μ2,..., μ N . And the signature parameter v=e(g, μ), e() represents a signature generation function; then select an anti-collision hash function H i , i∈{1,2}, wherein H1:{0,1} * → Z p , H2: G → G T ; instantiate a Paillier encryption object paillier; finally, output the system public parameter as the master public key Params={p, g, v, G, G T , e, H1, H2, paillier} and the master secret key MSK={α, μ}, and upload the public parameter Params to the blockchain for parameter sharing, and the nodes on the blockchain call the public parameter;

[0108] Step 2: key generation KeyGen(Params, MSK, id) → (pk id , sk id );

[0109] Input the master public key Params, the master secret key MSK, and the user identifier id∈{0,1}, generate a pair of paillier encryption public and private key pairs (pk id , sk id ) for each user, wherein the public key is pk idSimultaneously construct a private key

[0110] Step 3: data encryption Encrypt(M, id, A)→C;

[0111] Encrypt the message M of the user U belonging to id id , select a random number r∈Z p , respectively calculate the message C M = M·v r , C1= Q r , wherein v r represents a signature parameter, and Q r represents a random number; at this time, the obtained ciphertext message is C=(C M , C0, C1); only the user U id satisfying the access control policy A can decrypt the ciphertext message C;

[0112] Step 4: linear function calculation Linear(id, D, MPK, sk id )→(L, token);

[0113] DO generate a linear function L for decision tree reasoning, and include the id of the authorized user in the linear function to generate an authorized token token; first, calculate the message C' containing the authorization information C'=Encrypt(M, sk id )=(C M , C0, C1), select random numbers t, m, e∈Z p and σ∈Z p , calculate the key material k1=sk id ·Q m , k2=g αm , k4=e(g, μ) s ·σ, wherein S represents an identity parameter; the obtained re-encryption key is k=k1, k2, k3, k4, k5, and the re-encrypted key is sent to the blockchain for re-encryption use;

[0114] Convert the decision tree model into a linear function, and the path from the root node to each leaf node corresponds to a linear function; first, convert the threshold value into a Boolean type value, and compare the attribute value and the threshold value of the judgment node wherein x i represents a ciphertext node, w i represents a threshold value vector, and m represents the length of the ciphertext. Then, calculate the path cost from the root node to each leaf node wherein b i represents the threshold value of the judgment node of the tree structure, and b i= 1 indicates left child, b i = 0 indicates right child, finally add the interference term to the polynomial, convert to another polynomial where v M represents the value of the leaf node;

[0115] At this time, the output authorization token token = (C', k) and the polynomial L(x) are sent to the DTCs;

[0116] Step 5: Pseudo-random encryption UserEncrypt(Params, id, sk id , D user ) → D user ';

[0117] The user U id encrypts the data D user before uploading the data; uses the pseudo-random function PRF() to calculate the private key k0 = PRF(j), where j = id, and encrypts the message

[0118] Step 6: Polynomial generation TreeRequest(L, token, id, sk id , Params) → (L', k U );

[0119] The user sends a decision tree query request to the computing server DTCS, and the user receives the polynomial L encrypted by DO and the authorization token token from the DTCS side; At this time, the user uses the Paillier encryption algorithm to encrypt the polynomial L to generate L'(x) = E(L(x))v M , where the function E() represents the Paillier encryption function.

[0120] Randomly select a random number τ j ∈ Z p , and calculate the key material avk j = sk id · τ j , where avk j represents the evaluation key, and at this time the key material k U = {evk j , avk j , τ j}, the encrypted polynomial L'(x) and the key material k U are sent to the DTCS;

[0121] Step 7: Data re-encryption ReEncrypt(D user ', k U ) → RD user ;

[0122] DTCS uses key material k U On user data D user ′ re-encrypt, encrypt data as This time the key is s j = evk j + avk j mod p, then the re-encrypted user data is RD user ;

[0123] Step 8: Decision tree classification calculation TreeEval(L′(x), RD user )→R;

[0124] DTCS performs decision tree classification calculation on the encrypted data set, and the user obtains the returned encrypted path cost value R;

[0125] Step 9: Path cost decryption Decrypt(sk id ,R)→r;

[0126] The user decrypts the encrypted path cost value R, and calculates the parameter Calculate σ=C j ′·T -1 , Finally The value of the plaintext r represents the classification result;

[0127] The above description is only the preferred embodiment of the present disclosure and the explanation of the applied technical principles. Those skilled in the art should understand that the scope of the application involved in the embodiments of the present disclosure is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or equivalent features without departing from the above inventive concept. For example, the above features and the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) are replaced with each other to form a technical solution.

Claims

1. A decision tree classification model for decentralized authorization and access control, characterized in that, include: Data owner DO, data producer DP, user U i , access authorization center AAC, decision tree classification server DTCS, and data storage server DSS; The data producer (DP) and the data storage server (DSS) together constitute an encrypted data storage plane, and the decision tree classification server (DTCS) and the access authorization center (AAC) constitute an encrypted data computation plane. The encrypted data storage plane is used for data storage, and the encrypted data computation plane is used for authorization management and encrypted decision tree classification computation of encrypted data. The data owner DO generates a master private key MSK and sends it to the data producer DP. The data producer DP then generates a data set D = {d1, d2, ..., d...}. n }, d n The data represents the data producer (DP) encrypting the data, the data owner (DO) setting access control policies for the generated data, and storing it in the Access Authorization Center (AAC). The AAC provides decentralized authorization services, allowing multiple users (U) to access the data. i Authorized access to data; Data producer (DP) encrypts the data and transmits it to data storage server (DSS) for storage; User sends a data query request encrypted with the Paillier algorithm to decision tree classification server (DTCS). DTCS first performs attribute authentication to confirm that the user has been granted the appropriate access rights. Then, data storage server (DSS) uploads the encrypted data producer (DP) data to DTCS for decision tree classification calculation; Finally, the generated ciphertext query result is returned to the user, who decrypts it to obtain the plaintext classification result; When access control permissions change, a transaction is generated, and access authorization center (AAC) stores the transaction in a centralized authorization log; Whenever an access authorization is updated, the transaction is recorded in the decentralized authorization log.

2. The decision tree classification model for decentralized authorization and access control according to claim 1, characterized in that, The decentralized authorization specifically involves: the authorization agent granting corresponding access control permissions to each piece of data based on the user's different data processing needs, and recording the modification operations of access control permissions in the decentralized authorization log; first, the DO initiates a transaction to initialize the corresponding data access permissions, which includes the authorized user's ID; if access control permissions need to be adjusted, the DO publishes a subsequent transaction, which includes: the storage address Add of the ciphertext x, access control policy A, user ID, public parameter Params, and access token for accessing the data; any subsequent modifications to the access control policy require the publication of a new transaction, and the transaction is recorded in the decentralized authorization log.

3. The decision tree classification model for decentralized authorization and access control according to claim 2, characterized in that, The decentralized authorization specifically includes the following steps: Step S1: The DO first verifies its identity through signature and has access to set or edit data; the DO modifies data access permissions to form an authorization log and records the authorization log on the existing blockchain. By leveraging the blockchain's publicly verifiable and tamper-proof characteristics, the authorization service is decentralized without relying on a trusted third party; without breaking consensus, the blockchain has access to record data settings, and when modifying access permissions, the global access control state is modified through a virtual chain; the authorization agent scans the authorization information on the blockchain, stores the relevant information in the database, and provides query services. Step S2: After receiving the request, the DTCS directly inquires the authorized agent, confirming the user's authority; if the request is legal, the request is executed; without the DO and U i direct communication and authorization; Step S3: The authorization agent grants corresponding access control permissions to different users and records the modification of access control permissions in the distributed authorization log. First, the DO starts a transaction and initializes the corresponding data access permissions, including the id used to create the initial state. If access control permissions need to be adjusted, the DO will publish a subsequent transaction to update the access permissions. Any subsequent modification to the access control policy requires publishing a new transaction and recording the transaction in the distributed authorization log.

4. The decision tree classification model for decentralized authorization and access control according to claim 3, characterized in that, Step S2 specifically includes the following steps: Step S2.1: using public key cryptography to identify and authenticate the principal in the classification model, pairing the data owner with the data producer, the hash value of the data owner's public key is the unique mark of the principal; in the initialization process of the data producer, the data owner creates a pair of public and private keys (PK owner , SK owner ) locally, PK owner and SK owner are the public key and private key created by the data owner, and the private key SK owner is securely stored locally. In the initialization phase, a two-way multi-signature registration transaction is published on the blockchain, and the public and private keys (PK owner , SK owner ) created by the data owner are signed and bound to the public and private keys (PK devicei , SK devicei ) created by the data producer, PK devicei and SK devicei are the public key and private key created by the data producer; Step S2.2: The data owner sets access permissions for the converted token and key data through the private key SK owner The data owner sets access permissions for the converted token and key data through the private key SK devicei Realize data security storage; if the data producer exits the system, the data owner must republish a new multi-signature binding transaction to obtain the ownership of future new paired data producers to generate data; the data owner obtains the signature of the data producer through an out-of-band channel, and broadcasts the registration transaction to the network after completing the addition of the signature; Step S2.3: After generating private and public ECDSA key pairs for each data producer, UCACM-ESD signs the encrypted message and generates a signature.

5. The decision tree classification model for decentralized authorization and access control according to claim 3, characterized in that, Step S3 specifically includes the following steps: Step S3.1: DO sends a request and provides user id, start timestamp and interval time; U i Add the corresponding network identification code, and integrate the above information into the byte stream, send OP_RETURN transaction, and use this byte stream as the data part of the transaction; Step S3.2: The AAC scans the underlying blockchain for the corresponding transaction containing access rights and maintains the authorization state, querying U i ; when a storage node receives a request to store or retrieve data, it verifies the identity of the requestor U i using the signature and then searches the AAC for the access control policy; Step S3.3: When the DO receives the calculation request request from the U i , it queries the access right from the AAC and verifies the identity of the U i based on the signed identity verification method; the DO does not directly interact with the U i , but dynamically adjusts and issues access control rights by interacting with the decentralized authorization log; the DO verifies the data access request of the U i according to the access rights embedded in the authorization log, and terminates malicious sessions after checking the access rights; Step S3.3.1: DO calculates the ciphertext digital digest CTcheck = H(x), where H(x) is the hash calculation function, and at the same time calculates the digital digest of the requesting transaction MD = H(id,Add,CTcheck); Step S3.3.2: DO performs a digital signature sign = Sign(MD), where Sign() is the signature function and MD is the digital digest; Step S3.3.3: The DO generates a query request transaction T request = {id, Add, CTcheck, sign}, and broadcasts the request transaction T request to the blockchain network for verification by other nodes; each node compares the digital digest MD' of the request transaction T request calculated by the node with the digital digest MD signed by the DO; if MD' = MD, the request transaction T request is verified successfully.

6. The decision tree classification model for decentralized authorization and access control according to claim 1, characterized in that, The specific calculation of the encrypted decision tree classification is as follows: Design a secure encrypted decision tree classification algorithm, TreeEval: During the classification process, the server is responsible for providing classification services to users. Before entering the classification process, the data computing server (DCS) possesses data encrypted by Paillier transmitted from the data storage server. Where E(W) represents the encryption model, E(w) i ) represents the encryption threshold node. Represents a leaf node. represents the encryption linear function, and m represents the length of the ciphertext; The user is the requester of the classification service. After verification, the user can request calculations and possesses the data x to be classified.

7. The decision tree classification model for decentralized authorization and access control according to claim 6, characterized in that, The encrypted decision tree classification calculation specifically includes the following steps: Step D1 : U i sending a classification request to the DTCS; Step D2: After receiving the authorization result from AAC, DTCS reads the encrypted classification model; Step D3: DTCS and U i Through communication protocol interaction, they jointly complete the classification process of the encrypted data and return the encrypted classification results to U. i ; Step D3.1: DTCS and U i Execute the PvtCmp protocol, and DTCS obtains the threshold comparison results; Step D3.2: DTCS executes the path cost and linear cost function to obtain the encrypted path cost and linear function cost results, and then adds an interference value to provide U. i ; Step D4: U i The encrypted path cost and linear function cost returned by DTCS are obtained, and the classification result is obtained by decrypting the key and judging the path cost.

8. The decision tree classification model for decentralized authorization and access control according to claim 1, characterized in that, The method for constructing the decentralized authorization and access control decision tree classification model includes the following steps: Step 1: Parameter generation Setup(λ,N)→(Params,MSK); Assume the security parameter is λ, N is the maximum number of authorized users calculated by the decision tree classification, a prime number q with a length of λ bits is selected, and G is the set of integers. A subgroup of G, where g is a generator of G; a bilinear cyclic group G of order p, where the identity element e: G×G→G T G T Represent the bilinear group; select random numbers α∈Z p μ, Q∈G,Z p Represent an integer; then calculate g1 = g α , The generator g consists of g1, g2, ..., g N composition; The generator μ consists of μ1, μ2, ..., μ N The system consists of: a signature parameter v = e(g, μ), where e() represents the signature generation function; and a collision-resistant hash function H is selected. i , i∈{1,2}, where H1:{0,1} * →Z p H2:G→G T Instantiate a Paillier cryptographic object paillier; finally, output the system's public parameters as the master public key Params = {p, g, v, G, G}. T The public parameter Params is uploaded to the blockchain for parameter sharing, and nodes on the blockchain can call the public parameter. Step 2: Key generation KeyGen(Params,MSK,id) → (pk id ,sk id ); Input the master public key Params, the master private key MSK, and the user identifier id∈{0,1} to generate a Paillier encrypted public-private key pair (pk) for each user. id ,sk id ), where the public key is pk id At the same time, construct the private key. Step 3: Encrypt data Encrypt(M,id,A)→C; Encryption belongs to user U with ID id Message M selects a random number r∈Z p Calculate message C respectively M =M·v r , C1 = Q r , where v r Q represents the signature parameter. r This represents a random number; the ciphertext message obtained at this time is C = (C M (C0, C1); Only users U who satisfy access control policy A id It can decrypt the ciphertext message C; Step 4: Calculate the linear function Linear(id,D,MPK,sk) id → (L, token), where D is the data set generated by data producer DP; DO generates a linear function L for computational decision tree inference, and simultaneously includes the authorized user's ID within the linear function to generate an authorization token; first, it computes the message C′ = Encrypt(M, sk) containing authorization information. id )=(C M Choose random numbers t, m, e∈Z (C0, C1). p With σ∈Z p Calculate the key material k1 = sk id ·Q m k2 = g αm , k4 = e(g,μ) s ·σ, Where S represents the identity parameter; the re-encryption key is obtained as k = k1, k2, k3, k4, k5, and the re-encryption key is sent to the blockchain for re-encryption and use; The decision tree model is transformed into a linear function, where the path from the root node to each leaf node corresponds to a linear function. First, the threshold is converted to a Boolean value, and then the attribute values ​​are compared with the threshold values ​​of the decision nodes. Where x i w represents the ciphertext node. i This represents the threshold vector, where m represents the length of the ciphertext; then, the path cost from the root node to each leaf node is calculated. Where b i b represents the threshold value for determining the decision node in the tree structure. i =1 indicates the left subtree, b i =0 indicates the right subtree. Finally, the interference term is added to the polynomial, transforming it into another polynomial. Where v M Indicates the value of the leaf node; At this point, output the authorization token (C′, k) and the polynomial L(x) and send them to DTCS; Step 5: Pseudo-random encryption UserEncrypt(Params, id, sk) id D user → D user ′; User U id Data D before uploading user Encryption is performed to obtain encrypted data D. user The private key k0 = PRF(j) is calculated using the pseudo-random function PRF(), where j = id, and the encrypted message is encrypted. Step 6: Generate TreeRequest(L, token, id, sk) using polynomials id Params)→(L′,k U ); The user sends a decision tree query request to the computing server DTCS, and receives a polynomial L encrypted with DO and an authorization token from DTCS; at this time, the user uses the Paillier encryption algorithm to encrypt the polynomial L to generate L′(x)=E(L(x))v M The function E() represents the Paillier encryption function; Randomly select a random number τ j ∈Z p Simultaneously calculate key materials avk j =sk id ·τ j , among which avk j This represents the evaluation key, where the key material k is... U ={evk j ,avk j ,τ j }, the cryptographic polynomial L′(x) and the key material k U Send to DTCS; Step 7: ReEncrypt (D) user ′,k U →RD user ; DTCS uses key material k U For user data D user Re-encrypt, the encrypted data is The key is s at this time. j =evk j +avk j modp, then the re-encrypted user data is RD user ; Step 8: Calculate TreeEval(L′(x),RD) for decision tree classification. user → R; DTCS performs decision tree classification calculations on encrypted datasets, and the user obtains the returned encrypted path value R. Step 9: Path Cost Decryption (sk id ,R)→r; The user decrypts the encrypted path value R and calculates the parameters. Calculate σ = C j ′·T -1 , at last The value of plaintext r represents the classification result.

Images