Multi-client intersection function encryption method with non-monotonic access control structure, storage medium and equipment

Abstract

The invention discloses a multi-client intersection function encryption method with a non-monotonic access control structure, a storage medium and equipment. A user key is embedded into the non-monotonic access structure, multiple clients are independently encrypted without interaction, and decryption is successful when and only when attributes in a ciphertext meet an access strategy in a private key; wherein the authorized user only obtains the intersection of any two set elements and cannot obtain any other information. The method is safe and reliable and better meets actual requirements.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer security, and in particular relates to a multi-client intersection function encryption method, storage medium and device with a non-monotonic access control structure. Background Art

[0002] Federated learning based on cloud servers is a distributed machine learning framework. Multiple clients participate in model training and collaborate with aggregators to train the optimal model without exchanging data. However, federated learning faces serious security issues, especially speculation attacks and sensitive data leakage. To address these issues, a federated learning framework based on multi-client function encryption is proposed. Multi-client function encryption is a new type of public key encryption technology. In this encryption scheme, a trusted authorization center generates a private key sk for a specified function f. f Each client independently encrypts data and generates ciphertext The key holder uses the private key sk f Decrypting ciphertext Get the function value f(x1,x2,…,x n ), but no other information can be obtained. Therefore, multi-client function encryption can not only protect the confidentiality of data, but also realize the secret state calculation of data. In addition, before model training, it is usually necessary to align the training data samples so that different samples of the same entity are associated. Therefore, finding the intersection of samples is one of the important operations in federated learning. In order to solve the privacy intersection problem, a multi-client set intersection function encryption scheme is proposed, which allows a third party to calculate the plaintext intersection of any two clients in a non-interactive form without obtaining other information.

[0003] Existing multi-client function encryption schemes can only implement monotonic access policy structures and cannot express more complex access control policies. However, in some special cases, non-monotonic access control policies are very necessary. For example, when the files of the history department are encrypted, the attributes usually embedded are: "Year: 2024", "Department: History". When only the data of the history department is authorized to be used and access to the data of the biology department is prohibited, the private key of the aggregator can be associated with the access policy: "Year: 2024" AND "Department: History" NOT "Department: Biology". Therefore, it is very practical to implement a non-monotonic access control structure with richer policy expression in the multi-client intersection function encryption scheme. Summary of the invention

[0004] The present invention is aimed at the problems existing in the prior art, and provides a multi-client intersection function encryption method, storage medium and device with a non-monotonic access control structure, in which the user key is embedded in the non-monotonic access structure, and multiple clients encrypt independently without interaction, and decryption is successful when and only when the attributes in the ciphertext meet the access policy in the private key; wherein the authorized user only obtains the intersection of any two set elements, and cannot obtain any information other than this. The method of the present invention is safe and reliable, and better meets actual needs.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is: a multi-client intersection function encryption method with a non-monotonic access control structure, comprising the following steps:

[0006] S1, system initialization phase: the trusted authorization center TA inputs a security parameter 1 λ , a preset number of attributes d and number of clients N, output system public parameters pp, a private key sk and N encryption keys csk1,csk2,…,csk N , set the master key msk = {sk, csk1, csk2, ..., csk N},Right now

[0007] Setup(1 λ ,d,N)→(pp,sk,csk1,csk2,…,csk N );

[0008] S2, key generation phase: the trusted authorization center TA inputs the system public parameters pp, the master key msk, a function f and the access policy Generate a private key for the data user DU Right now:

[0009]

[0010] S3, encryption phase: client CL k Input system common parameters pp, an attribute set S, a tag Tag, and a message set M k and the corresponding encryption key csk k , output the corresponding ciphertext CT k , where k∈[N], that is:

[0011] Enc(pp,S,Tag,M k ,csk k )→CT k ;

[0012] S4, decryption phase: data user DU inputs system public parameters pp, private key Any two ciphertexts CT_w and CTv , where w≠v; if the attributes in the ciphertext satisfy the access policy in the private key, the data user DU decrypts and obtains the set intersection M w ∩M v , otherwise output ⊥, that is:

[0013]

[0014] As an improvement of the present invention, in step S1, Generate an algorithm for an asymmetric bilinear group, which takes as input a security parameter 1 λ , output prime number p-order cyclic group in The trusted authority TA enters a security parameter 1 λ ,run Select generators at the same time and the hash function H:G T →G; Trusted Authorization Center TA randomly selects As the master key, calculate in is a non-zero cyclic group modulo p.

[0015] As another improvement of the present invention, the encryption phase of step S3 is performed independently by each client. k The plaintext set is M k ={M k,1 ,M k,2 ,…,M k,l}, the plaintext size held by each client is set to |M k |=l,client CL k Randomly select calculate For each η∈[1,l], the client CL k Select a tag Tag∈G T , perform the following calculation

[0016]

[0017] Therefore, M k ={M k,η} η∈[1,l] The ciphertext is:

[0018]

[0019] As another improvement of the present invention, in step S4, the data user DU calculates the intersection ciphertext:

[0020]

[0021] When the ciphertext CT w The plaintext element M in w,η and ciphertext CT v The plaintext element M v,η When the data user DU equation is the same as:

[0022]

[0023] The data user DU converts the plaintext element M w,η Put it into an initialized empty set Y, and finally output the intersection set Y.

[0024] In order to achieve the above-mentioned purpose, the present invention also adopts a technical solution: a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a multi-client intersection function encryption method with a non-monotonic access control structure as described above.

[0025] In order to achieve the above object, the present invention also adopts a technical solution: a computer device, comprising:

[0026] A memory for storing instructions;

[0027] The processor is used to execute the instructions so that the computer device performs any of the operations of the multi-client intersection function encryption method with a non-monotonic access control structure described above.

[0028] Compared with the prior art, the present invention has the following technical effects and advantages:

[0029] (1) In the method of the present invention, the authorized user can only obtain the intersection of two set elements, but cannot obtain other plaintext information.

[0030] (2) In the method of the present invention, multiple clients can run independently without interaction and can resist "mix-and-match" attacks.

[0031] (3) The non-monotonic access policy structure in the method of the present invention can implement attribute-based fine-grained access control and can express any access control structure. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a flow chart of the steps of the multi-client intersection function encryption method with a non-monotonic access control structure of the present invention. DETAILED DESCRIPTION

[0033] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0034] Example 1

[0035] A multi-client intersection function encryption method with a non-monotonic access control structure, the steps of which are as follows Figure 1 As shown, the following steps are included:

[0036] Step S1, system initialization phase: the trusted authorization center TA inputs a security parameter 1 λ , a preset number of attributes d and number of clients N, output system public parameters pp, a private key sk and N encryption keys csk1,csk2,…,csk N , set the master key msk = {sk, csk1, csk2, ..., csk N},Right now

[0037] Setup(1 λ ,d,N)→(pp,sk,csk1,csk2,…,csk N );

[0038] Assumptions Generate an algorithm for an asymmetric bilinear group, which takes as input a security parameter 1 λ , output prime number p-order cyclic group in The trusted authority TA enters a security parameter 1 λ ,run The trusted authorization center TA selects the generator and the hash function H:G T →G, set the attribute set size in the ciphertext to The number of clients is in Represented as a set of positive integers. The trusted authorization center TA selects two vectors For each i∈[1,d], calculate and Define two vectors Trusted Authorization Center TA randomly selects As the master key, calculate in It is a non-zero cyclic group formed by modulo p. The trusted authorization center TA selects Define the encryption key as csk k =(a k ,b k ), where k∈[1,N]. Send the encryption key csk k Give the corresponding client CLk The public parameters of the system are The master key is:

[0039]

[0040] Step S2, Key Generation Phase: The Trusted Authorization Center TA inputs the system public parameters pp, the master key msk, a function f, and an access policy Generate a private key for the data user DU That is:

[0041]

[0042] Given an index function f = (w, v) that satisfies w, v ∈ [1, N] and w < v, the authorization center TA selects two random numbers Using the corresponding encryption key csk w =(a w , b w ), csk v =(a v , b v ) to calculate and And publicly disclose Let be represented as the sharing matrix of a linear secret sharing scheme Π, which has o rows and c columns. P is represented as a set of attributes. ρ: {1,..., o} → P is a mapping that maps the rows of the matrix to a set of attributes. The Trusted Authorization Center TA selects a random number Let the vector Output as the o shares of the master key , and the share is bound to the attribute ρ(i). Let be represented as a monotone access policy and associated with a linear secret sharing scheme Π on the set of attributes P, be a non-monotone access policy that satisfies By applying the scheme Π, output the share of the master key Suppose for the share λ i it is where is an attribute and can be represented as a non-negative state and a negative state. For each i ∈ {1, 2,..., o}, the Trusted Authorization Center TA selects and defines a vector That is The Trusted Authorization Center TA calculates:

[0043]

[0044] For the sake of brief representation, represents the non - negative attribute, represents the negative attribute,

[0045]

[0046]

[0047] and

[0048] the decryption key is

[0049] Step S3, Encryption Phase: Client CL k inputs the system public parameter pp, an attribute set S, a tag Tag, a message set M k and the corresponding encryption key csk k , and outputs the corresponding ciphertext CT k , where k ∈ [N], that is:

[0050] Enc(pp, S, Tag, M k , csk k ) → CT k ;

[0051] This phase is independently executed by each client. The plaintext set of the k - th client CL k is M k = {M k,1 , M k,2 , …, M k,l}, and the size of the plaintext held by each client is set to |M k | = l. Assume that each client encrypts under the same attribute set S, and the set size satisfies |S| = q < d. Client CL k defines a polynomial whose coefficients form the first q + 1 coordinates of the vector . If q + 1 < d, set y j = 0 for q + 2 ≤ j ≤ d. Client CL k randomly selects and calculates For each η ∈ [1, l], client CL k selects a tag Tag ∈ G T , and calculates

[0052] and

[0053]

[0054] Therefore, M k ={M k,η} η∈[1,l] The ciphertext is:

[0055]

[0056] Upload the ciphertext to the cloud server.

[0057] Step S4, decryption phase: data user DU inputs system public parameters pp, private key Two ciphertext CT w and CT v If the attributes in the ciphertext satisfy the access policy in the private key, the data user DU decrypts and obtains the set intersection M w ∩M v , otherwise output ⊥, that is:

[0058]

[0059] This stage is completed by the data user DU, who requests data access from the cloud server, and the cloud server returns the corresponding ciphertext CT w and CT v Assume that the attribute set S in the ciphertext satisfies the nonmonotonic access strategy in the decryption key Then the decryption can succeed, otherwise, the algorithm returns ⊥. is a non-monotonic access strategy. is a monotonic access strategy associated with a linear secret sharing scheme π. Set and make Represents non-negative attributes (i.e. x i ∈S), Indicates negative attributes (Right now ).because Then there exists a series of constants {π i} i∈I satisfy The data user DU sets a polynomial Its coefficients form the vector Data user DU performs decryption calculation:

[0060] For non-negative attributes calculate

[0061]

[0062] For negative attributes calculate

[0063]

[0064] Then, the data user DU calculates the intersection ciphertext:

[0065]

[0066] When the ciphertext CT w The plaintext element M in w,η and ciphertext CT v The plaintext element M v,η When the data user DU equation is the same as:

[0067]

[0068] The data user DU converts the plaintext element M w,η Put it into an initialized empty set Y, and finally output the intersection set Y.

[0069] In summary, the multi-client intersection function encryption method and system with a non-monotonic access control structure proposed in the present invention includes a system initialization phase, a key generation phase, an encryption phase, and a decryption phase. The method can realize a non-monotonic fine-grained access control structure, allowing multiple clients to encrypt independently without interaction; authorized users can only obtain the intersection of any two client set elements, but cannot obtain any information other than this. The method of the present invention is safe and reliable, and better meets actual needs.

[0070] It should be noted that the above content only illustrates the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications all fall within the protection scope of the claims of the present invention.

Claims

1. A multi-client intersection function encryption method with a non-monotonic access control structure, characterized in that: The user key is embedded in a non-monotonic access structure and encrypted independently by multiple clients. Decryption is successful if and only if the attributes in the ciphertext satisfy the access policy in the private key; the authorized user only obtains the intersection of any two set elements.

2. The multi-client intersection function encryption method with a non-monotonic access control structure as claimed in claim 1, characterized in that: The following steps are involved: S1, system initialization phase: the trusted authorization center TA inputs a security parameter 1 λ , a preset number of attributes d and number of clients N, output system public parameters pp, a private key sk and N encryption keys csk1,csk2,…,csk N , set the master key msk = {sk, csk1, csk2, ..., csk N },Right now Setup(1 λ ,d,N)→(pp,sk,csk1,csk2,…,csk N ); S2, key generation phase: the trusted authorization center TA inputs the system public parameters pp, the master key msk, a function f and the access policy Generate a private key for the data user DU Right now: S3, encryption phase: client CL k Input system common parameters pp, an attribute set S, a tag Tag, and a message set M k and the corresponding encryption key csk k , output the corresponding ciphertext CT k , where k∈[N], that is: Enc(pp,S,Tag,M k ,csk k )→CT k ; S4, decryption phase: data user DU inputs system public parameters pp, private key Any two ciphertexts CT_w and CT v , where w≠v; if the attributes in the ciphertext satisfy the access policy in the private key, the data user DU decrypts and obtains the set intersection M w ∩M v , otherwise output ⊥, that is:

3. The multi-client intersection function encryption method with a non-monotonic access control structure as claimed in claim 2, characterized in that: In the step S1, Generate an algorithm for an asymmetric bilinear group, which takes as input a security parameter 1 λ , output prime number p-order cyclic group in The trusted authority TA enters a security parameter 1 λ ,run Select generators at the same time and the hash function H:G T →G; Trusted Authorization Center TA randomly selects As the master key, calculate in is a non-zero cyclic group modulo p.

4. The multi-client intersection function encryption method with a non-monotonic access control structure as claimed in claim 3, characterized in that: The encryption phase of step S3 is performed independently by each client. The kth client CL k The plaintext set is M k ={M k,1 ,M k,2 ,…,M k,l }, the plaintext size held by each client is set to |M k |=l, client CL k Randomly select calculate For each η∈[1,l], the client CL k Select a tag Tag∈G T , perform the following calculation Therefore, M k ={M k,η } η∈[1,l] The ciphertext is:

5. The multi-client intersection function encryption method with a non-monotonic access control structure as claimed in claim 4, characterized in that: In step S4, the data user DU calculates the intersection ciphertext: When the ciphertext CT w The plaintext element M in w,η and ciphertext CT v The plaintext element M v,η When the data user DU equation is the same as: The data user DU converts the plaintext element M w,η Put it into an initialized empty set Y, and finally output the intersection set Y.

6. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the multi-client intersection function encryption method with a non-monotonic access control structure as claimed in any one of claims 1 to 5 is implemented.

7. A computer device, characterized in that: include: A memory for storing instructions; The processor is used to execute the instructions so that the computer device performs the operations of the multi-client intersection function encryption method with a non-monotonic access control structure as described in any one of claims 1-5.

Images