Multi-client intersection function encryption method with non-monotonic access control structure, storage medium and device

Abstract

The application discloses a multi-client intersection function encryption method with a non-monotonic access control structure, a storage medium and equipment, wherein a user key is embedded in a non-monotonic access structure, and multiple clients are independently encrypted without interaction, and decryption is successful only when and if attributes in ciphertext meet an access strategy in a private key; wherein, an authorized user only obtains an intersection of any two set elements and cannot obtain any information other than this. The method is safe and reliable and more conforms to actual demands.

Description

Technical Field

[0001] The present invention belongs to the field of computer security technology, and in particular relates to a multi-client intersection function encryption method, storage medium and device with a non-monotonic access control structure. Background Art

[0002] Federated learning based on cloud servers is a distributed machine learning framework. Multiple clients participate in model training and collaborate with aggregators to train the optimal model without exchanging data. However, federated learning faces serious security issues, especially speculation attacks and sensitive data leakage. To address these issues, a federated learning framework based on multi-client function encryption was proposed. Multi-client function encryption is a new type of public key encryption technology. In this encryption scheme, a trusted authorization center generates a private key sk for a specified function f. f Each client independently encrypts data and generates ciphertext The key holder uses the private key sk f Decrypting ciphertext Get the function value f(x1,x2,…,x n ), but no other information can be obtained. Therefore, multi-client function encryption not only protects data confidentiality but also enables data-encrypted computation. Furthermore, before model training, sample alignment is often required to associate different samples of the same entity. Therefore, finding sample intersection is a key operation in federated learning. To address the privacy intersection problem, a multi-client set intersection function encryption scheme has been proposed. This scheme allows a third party to non-interactively compute the plaintext intersection of any two clients without obtaining any other information.

[0003] Existing multi-client function encryption schemes can only implement monotonic access policy structures and cannot express more complex access control policies. However, in some special cases, non-monotonic access control policies are very necessary. For example, when files in the history department are encrypted, the attributes usually embedded are: "Year: 2024" and "Department: History". When only the data of the history department is authorized to be used and the data of the biology department is prohibited from being accessed, the aggregator's private key can be associated with the access policy: "Year: 2024" AND "Department: History" NOT "Department: Biology". Therefore, it is very practical to implement a non-monotonic access control structure with richer policy expression in the multi-client intersection function encryption scheme. Summary of the Invention

[0004] The present application is just for the problems existing in the prior art, providing a multi-client intersection function encryption method with non-monotonic access control structure, storage medium and equipment, the user key is embedded in the non-monotonic access structure, and multiple clients are independently encrypted without interaction, and the decryption is successful only when the attributes in the ciphertext meet the access policy in the private key;Among them, the authorized user only obtains the intersection of any two set elements, and cannot obtain any information other than this.The method of the present application is safe and reliable, and more in line with actual demand.

[0005] In order to achieve the above-mentioned purpose, the technical scheme adopted by the present application is: a multi-client intersection function encryption method with non-monotonic access control structure, comprising the following steps:

[0006] S1, system initialization stage: the trusted authority center TA inputs a security parameter 1 λ , a preset attribute number d and a client number N, outputs system public parameters pp, a private key sk and N encryption keys csk1, csk2, …, csk N , set the master key msk={sk, csk1, csk2, …, csk N}, that is

[0007] Setup(1 λ ,d,N)→(pp,sk,csk1,csk2,…,csk N );

[0008] S2, key generation stage: the trusted authority center TA inputs the system public parameters pp, the master key msk, a function f and an access policy for the data user DU to generate a private key , that is

[0009]

[0010] S3, encryption stage: the client CL k inputs the system public parameters pp, an attribute set S, a label Tag, a message set M k and the corresponding encryption key csk k , outputs the corresponding ciphertext CT k , wherein k∈[N], that is

[0011] Enc(pp,S,Tag,M k ,csk k )→CT k ;

[0012] S4, decryption stage: the data user DU inputs the system public parameters pp, the private key , any two ciphertexts CT_w and CTv , where w≠v; if the attributes in the ciphertext satisfy the access policy in the private key, the data user DU decrypts and obtains the set intersection M w ∩M v , otherwise output ⊥, that is:

[0013]

[0014] As an improvement of the present invention, in step S1, Generate an algorithm for an asymmetric bilinear group, which takes as input a security parameter 1 λ , output prime number p-order cyclic group in The trusted authority TA enters a security parameter 1 λ ,run Select generators at the same time and the hash function H:G T →G; Trusted Authorization Center TA randomly selects As the master key, calculate in is a non-zero cyclic group modulo p.

[0015] As another improvement of the present invention, the encryption phase of step S3 is performed independently by each client. The kth client CL k The plaintext set is M k ={M k,1 ,M k,2 ,…,M k,l}, the plaintext size held by each client is set to |M k |=l,client CL k Randomly selected calculate For each η∈[1,l], the client CL k Select a tag Tag∈G T , perform the following calculation

[0016]

[0017] Therefore, M k ={M k,η} η∈[1,l] The ciphertext is:

[0018]

[0019] As another improvement of the present invention, in step S4, the data user DU calculates the intersection ciphertext:

[0020]

[0021] When the ciphertext CT w The plaintext element M in w,η and ciphertext CT v The plaintext element M v,η When the data user DU equation is the same as:

[0022]

[0023] The data user DU converts the plaintext element M w,η Put it into an initialized empty set Y, and finally output the intersection set Y.

[0024] In order to achieve the above-mentioned purpose, the present invention also adopts the following technical solution: a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a multi-client intersection function encryption method with a non-monotonic access control structure as described above.

[0025] In order to achieve the above object, the present invention also adopts a technical solution: a computer device comprising:

[0026] a memory for storing instructions;

[0027] The processor is configured to execute the instructions so that the computer device performs any of the operations of the multi-client intersection function encryption method with a non-monotonic access control structure described above.

[0028] Compared with the prior art, the present invention has the following technical effects and advantages:

[0029] (1) In the method of the present invention, the authorized user can only obtain the intersection of two set elements, but cannot obtain other plaintext information.

[0030] (2) In the method of the present invention, multiple clients can run independently without interaction and can resist "mix-and-match" attacks.

[0031] (3) The non-monotonic access policy structure in the method of the present invention can implement fine-grained access control based on attributes and can express any access control structure. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a flowchart of the steps of the multi-client intersection function encryption method with a non-monotonic access control structure of the present invention. DETAILED DESCRIPTION

[0033] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0034] Example 1

[0035] A multi-client intersection function encryption method with a non-monotonic access control structure, the steps of which are as follows Figure 1 As shown, the following steps are included:

[0036] Step S1, system initialization phase: the trusted authorization center TA inputs a security parameter 1 λ , a preset number of attributes d and number of clients N, output system public parameters pp, a private key sk and N encryption keys csk1,csk2,…,csk N , set the master key msk={sk,csk1,csk2,…,csk N},Right now

[0037] Setup(1 λ ,d,N)→(pp,sk,csk1,csk2,…,csk N );

[0038] Assumptions Generate an algorithm for an asymmetric bilinear group, which takes as input a security parameter 1 λ , output prime number p-order cyclic group in The trusted authority TA enters a security parameter 1 λ ,run The trusted authorization center TA selects the generator and the hash function H:G T →G, set the attribute set size in the ciphertext to The number of clients is in Represented as a set of positive integers. The trusted authorization center TA selects two vectors For each i∈[1,d], calculate and Define two vectors Trusted Authorization Center TA randomly selects As the master key, calculate in It is a non-zero cyclic group composed of modules p. The trusted authorization center TA selects Define the encryption key as csk k =(a k ,b k ), where k∈[1,N]. Send encryption key csk k Give the corresponding client CLk The common parameters of the system are The master key is:

[0039]

[0040] Step S2, key generation phase: the trusted authorization center TA inputs the system public parameters pp, the master key msk, a function f and the access policy Generate a private key for the data user DU Right now:

[0041]

[0042] Given an index function f = (w, v), which satisfies w, v ∈ [1, N] and w <v,授权中心TA选取两个随机数 Using the corresponding encryption key csk w =(a w ,b w ),csk v =(a v ,b v )calculate and and make it public make Expressed as a shared matrix of a linear secret sharing scheme π, There are o rows and c columns. P is represented as a set of attributes. ρ:{1,…,o}→P is a matrix The trusted authorization center TA selects a random number Let vector Output As the master key o shares, shares is bound to the attribute ρ(i). Let Denote a monotonic access policy associated with a linear secret sharing scheme π on the set of attributes P, is a non-monotonic access strategy that satisfies By applying the scheme Π, the output of the master key share Assume that for the share λ i Yes in is an attribute and can be expressed as a non-negative state and a negative state. For each i∈{1,2,…,o}, the trusted authority TA selects And define a vector Right now Trusted Authorization Center TA calculates:

[0043]

[0044] wherein for simplicity of representation, denotes a non-negative attribute, denotes a negative attribute,

[0045]

[0046]

[0047] and

[0048] The decryption key is

[0049] Step S3, encryption phase: client CL k Input system public parameters pp, a set of attributes S, a tag Tag, a set of messages M k and the corresponding encryption key csk k , output the corresponding ciphertext CT k , where k ∈ [N], i.e.:

[0050] Enc (pp, S, Tag, M k , csk k ) → CT k ;

[0051] This phase is executed independently by each client. The plaintext set of the kth client CL k is M k = {M k,1 , M k,2 , …, M k,l}, and the plaintext size held by each client is set to |M k | = l. It is assumed that each client encrypts under the same set of attributes S, and the set size satisfies |S| = q < d. The client CL k defines a polynomial whose coefficients form the vector The first q + 1 coordinates of the vector. If q + 1 < d, set y j = 0 for q + 2 ≤ j ≤ d. The client CL k randomly selects and calculates For each η ∈ [1, l], the client CL k selects a tag Tag ∈ G T , calculates

[0052] and

[0053]

[0054] Therefore, M k ={M k,η} η∈[1,l] The ciphertext is:

[0055]

[0056] Upload the ciphertext to the cloud server.

[0057] Step S4, decryption phase: data user DU inputs system public parameters pp, private key Two ciphertext CT w and CT v If the attributes in the ciphertext satisfy the access policy in the private key, the data user DU decrypts and obtains the set intersection M w ∩M v , otherwise output ⊥, that is:

[0058]

[0059] This stage is completed by the data user DU, who requests data access from the cloud server, and the cloud server returns the corresponding ciphertext CT w and CT v Assume that the attribute set S in the ciphertext satisfies the non-monotonic access policy in the decryption key Then the decryption can succeed, otherwise, the algorithm returns ⊥. is a non-monotonic access strategy, is a monotonic access strategy associated with a linear secret sharing scheme π. Set and make Represents non-negative attributes (i.e. x i ∈S), Indicates negative attributes (Right now ).because Then there exists a series of constants {π i} i∈I satisfy The data user DU sets a polynomial Its coefficients form the vector Data user DU performs decryption calculation:

[0060] For non-negative attributes calculate

[0061]

[0062] For negative attributes calculate

[0063]

[0064] Then, the data user DU calculates the intersection ciphertext:

[0065]

[0066] When the ciphertext CT w The plaintext element M in w,η and ciphertext CT v The plaintext element M v,η When the data user DU is the same as:

[0067]

[0068] The data user DU converts the plaintext element M w,η Put it into an initialized empty set Y, and finally output the intersection set Y.

[0069] In summary, the multi-client intersection function encryption method and system with a non-monotonic access control structure proposed in this invention includes a system initialization phase, a key generation phase, an encryption phase, and a decryption phase. This method can implement a non-monotonic, fine-grained access control structure, allowing multiple clients to independently encrypt without interaction. Authorized users can only obtain the intersection of any two client set elements and cannot obtain any other information. This method is secure and reliable, and better meets practical needs.

[0070] It should be noted that the above content merely illustrates the technical idea of ​​the present invention and cannot be used to limit the scope of protection of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications all fall within the scope of protection of the claims of the present invention.

Claims

1. A multi-client intersection function encryption method with a non-monotonic access control structure, characterized by: The user key is embedded in a non-monotonic access structure, and multiple clients independently encrypt it. Decryption is successful if and only if the attributes in the ciphertext satisfy the access policy in the private key. Authorized users only obtain the intersection of any two set elements. The following steps are included: S1, system initialization phase: trusted authorization center Enter a security parameter , a preset number of attributes and number of clients , output system common parameters , a private key and encryption keys , set the master key ,Right now ； S2, key generation phase: trusted authorization center Enter system common parameters , master key , a function and access policies , for data users Generate a private key ,Right now: ； S3, encryption phase: client Enter system common parameters , a set of attributes , a label , a message collection and the corresponding encryption key , output the corresponding ciphertext ,in ,Right now: ； The encryption phase is performed independently by each client. Clients The plaintext set is , the plaintext size held by each client is set to , client Randomly selected ,calculate , , , for each , client Select a tag , perform the following calculation ； ； therefore, The ciphertext is: ； S4, Decryption Phase: Data Users Enter system common parameters , private key , any two ciphertexts CT_w ,in ; If the attributes in the ciphertext satisfy the access policy in the private key, the data user Decrypt to obtain set intersection , otherwise output ,Right now: , ； Data Users Calculate the intersection ciphertext: ； When the ciphertext The plaintext elements in and ciphertext Plaintext elements When the data user is the same Equation: ； Data Users The plaintext element Put an initialized empty collection Finally, the intersection set is output .

2. The multi-client intersection function encryption method with a non-monotonic access control structure according to claim 1, wherein: In the step S1, Generate an algorithm for an asymmetric bilinear group that takes as input a security parameter , output prime numbers Cyclic group of order ,in , Trusted Authorization Center Enter a security parameter ,run , and select the generator and hash functions Trusted Authorization Center Random selection As the master key, calculate ,in It is a model The non-zero cyclic group.

3. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the multi-client intersection function encryption method with a non-monotonic access control structure as claimed in any one of claims 1 to 2 is implemented.

4. A computer device, characterized in that: include: a memory for storing instructions; The processor is configured to execute the instructions so that the computer device performs the operations of the multi-client intersection function encryption method with a non-monotonic access control structure as described in any one of claims 1-2.

Images