Symmetric function encryption method capable of resisting dynamic collusion

Abstract

The invention discloses an anti-dynamic collusion symmetric function encryption method, and belongs to the technical field of information security and encryption. In order to solve the security problem of an existing symmetric function encryption scheme under dynamic collusion attacks, an original message privacy symmetric function encryption algorithm is improved, technologies such as a pseudo-random function and label accumulation are introduced, and the algorithm is gradually improved into a full-security static collusion-resistant symmetric function encryption algorithm, so that the security of the symmetric function encryption scheme under the dynamic collusion attacks is improved. And expanding the algorithm into a full-security label symmetric function encryption algorithm through a label generation mechanism, introducing a weak optimization technology in combination with collusion upper bound security parameters to form a full-security weak optimization symmetric function encryption algorithm, and finally improving the algorithm into a dynamic collusion-resistant symmetric function encryption algorithm. According to the method, the dynamic collusion resistance of an encryption scheme can be effectively enhanced, the privacy of messages and functions is ensured, meanwhile, the dependence on complex hypotheses is avoided, the encryption efficiency and security are improved, and the method has relatively high adaptability and practicability.

Description

Technical Field

[0001] The invention belongs to the field of information security and encryption technology, and in particular relates to a symmetric function encryption method that resists dynamic collusion. Background Art

[0002] Functional encryption (FE) is a recognized fine-grained access control method with wide applications in cloud computing and other fields. Unlike conventional encryption schemes, in functional encryption, the decryption algorithm does not obtain the complete message, but the function operation result with the message as input. Depending on whether the encryption algorithm requires a private key, functional encryption is divided into asymmetric functional encryption and symmetric functional encryption. In practical applications, not only the privacy of encrypted data needs to be protected, but also the privacy of the function itself needs to be protected (Emily Shen, Elaine Shi, Brent Waters: Predicate Privacy in Encryption Systems. TCC 2009: 457-473). In asymmetric functional encryption, after obtaining the function key, the attacker can arbitrarily select a message to encrypt, and then obtain the calculation result of the function at the message point through decryption, thereby obtaining partial information about the function. Therefore, the function privacy property of asymmetric functional encryption is more complicated to characterize; while in symmetric functional encryption, the attacker cannot encrypt the message by himself. It is reasonable to require that after obtaining the function key and the message ciphertext, the attacker cannot obtain any additional information about the function and the message except the calculation result of the function at the message point. The present invention mainly focuses on symmetric key functional encryption (SKFE) that satisfies both message privacy and function privacy.

[0003] The SKFE algorithm consists of four stages: parameter establishment, key generation, encryption, and decryption. Figure 1 As shown. The parameter establishment takes the security parameter as input and outputs the master private key msk; the key generation takes the master private key msk and the function description f as input and outputs the function private key sk f ; Encryption uses the master private key msk, message x as input, and outputs the ciphertext ct; decryption uses the function private key sk f , ciphertext ct as input, and output the calculation result f(x) of the function at the message point. From the perspective of security, SKFE needs to resist collusion, that is, even if the attacker obtains multiple functions f 1 ,…,f s The function private key and the ciphertext of the message x still cannot help it get the value of f 1 (x),…,f s (x) other than information.

[0004] Although SKFE is powerful, it is difficult to construct a completely anti-collusion solution for a general class of functions. Under the assumption that learning with error is difficult (LWE, learning with error), there is even an impossible conclusion (Akin Impossibility Results for Lattice-Based Functional Encryption Schemes. EUROCRYPT (1) 2020: 169-199). The SKFE that resists static collusion for general circuits can be constructed by extremely small primitives such as monotonic functions (Sergey Gorbunov, Vinod Vaikuntanathan, Hoeteck Wee: Functional Encryption with Bounded Collusions via Multi-party Computation. CRYPTO 2012:). In the SKFE that resists static collusion, the attacker needs to give an upper limit q of the number of colluders at the beginning of the scheme, and it can only ask for the function private key q times during the entire game. Once the attacker's function private key inquiries exceed q times, the security of the scheme can no longer be guaranteed. In the specific scheme construction, the size of its ciphertext and function private key often increases linearly with the increase of q.

[0005] Functional encryption that resists static collusion needs to ensure that the function encryption does not exceed the upper bound of the collusion determined in advance throughout the entire life cycle, which is not flexible enough in practical applications. To solve this problem, Agrawal et al. (Shweta Agrawal, Monosij Maitra, Narasimha Sai Vempati, Shota Yamada: Functional Encryption for Turing Machines with Dynamic Bounded Collusion from LWE. CRYPTO (4) 2021: 239-269) and Garg et al. (Rachit Garg, Rishab Goyal, George Lu, Brent Waters: Dynamic Collusion Bounded Functional Encryption from Identity-Based Encryption. EUROCRYPT (2) 2022: 736-763) proposed dynamic functional encryption at the same time. In dynamic functional encryption, it is no longer necessary to determine the upper bound of collusion at the beginning of the system establishment, but the encryptor can flexibly determine the upper bound of collusion that the ciphertext can resist. In this way, the size of the function private key no longer depends on the upper bound of collusion. The above authors used identity based encryption (IBE) to upgrade asymmetric function encryption that is resistant to static collusion to asymmetric function encryption that is resistant to dynamic collusion, and proved the necessity of IBE. Summary of the invention

[0006] The purpose of the present invention is to propose a symmetric function encryption method that is resistant to dynamic collusion, which uses the symmetric primitive with the minimum assumption to upgrade the symmetric function encryption that is resistant to static collusion to symmetric function encryption that is resistant to dynamic collusion, thereby achieving function privacy.

[0007] The technical solution adopted by the present invention to achieve the above-mentioned purpose is as follows:

[0008] A symmetric function encryption method for resisting dynamic collusion comprises the following steps:

[0009] 1) Modify the message privacy symmetric function encryption algorithm mpFE to a fully secure symmetric function encryption algorithm stFE that is resistant to static collusion: improve the master private key in mpFE to a master private key containing two symmetric keys, and expand the structure of the master private key; all subsequent function key generation and encryption and decryption processes are based on the expanded master private key;

[0010] 2) Modify the fully secure anti-static collusion symmetric function encryption algorithm stFE into a fully secure label symmetric function encryption algorithm tgFE: Add a label generation mechanism based on stFE, generate labels through a pseudo-random function, and use the labels as additional input to generate a new master private key, and then generate function keys and ciphertexts based on the labels;

[0011] 3) Modify the fully secure label symmetric function encryption algorithm tgFE into a fully secure weakly optimized symmetric function encryption algorithm woFE: By modifying the master private key generation method of tgFE, the label space is combined with the collusion upper bound security parameter to generate a new master private key; then generate the corresponding ciphertext under each label, and generate the function key based on the label and the new master private key;

[0012] 4) Modify the fully secure weakly optimized symmetric function encryption algorithm woFE into a fully secure symmetric function encryption algorithm dyFE that is resistant to dynamic collusion: Based on woFE, multiple master private keys are generated for different collusion upper bounds, and these master private keys are combined into a new master private key; during the encryption and decryption process, the master private key that matches the collusion upper bound is selected for encryption and decryption operations.

[0013] Furthermore, the step of modifying mpFE to stFE in step 1) includes:

[0014] Modify the master private key generation method: During the parameter establishment phase, the master private key in mpFE is improved to include two symmetric keys and expanded to a new master private key;

[0015] Modify the function key generation method: use the extended master private key and function f to generate the function key;

[0016] Modify the encryption method: During the encryption process, use the extended master private key and a message with a specific structure for encryption;

[0017] Modify the decryption method: During the decryption process, use the improved function key and ciphertext for decryption.

[0018] Furthermore, the step of step 1) modifying mpFE to stFE includes:

[0019] Modify the master private key generation method: In the parameter establishment phase, first use the mpFE parameter establishment algorithm to set the collusion upper bound to q to generate the master private key mp.msk, and at the same time generate two symmetric keys k and k′, and then combine k and k′ with mp.msk to form a new extended master private key st.msk;

[0020] Modify the function key generation method: Use the SKE encryption algorithm to encrypt the function f twice using two symmetric keys k and k′ to obtain two encrypted ciphertexts c and c′; based on these two ciphertexts, use the mpFE function key generation algorithm to generate a new function key st.sk f ;

[0021] Modify the encryption method: During the encryption process, use the mpFE encryption algorithm to encrypt the input x and the symmetric key k together as a message to generate the encrypted ciphertext st.ct x ;

[0022] Modify the decryption method: During the decryption process, use the function key st.sk f And the encrypted ciphertext st.ct x , use the mpFE decryption algorithm to calculate the function value f(x).

[0023] Furthermore, the step 2) of modifying stFE to tgFE includes:

[0024] Modify the master private key generation method: use a pseudo-random function to generate a tag in tgFE, and generate a new master private key based on the tag;

[0025] Modify the function key generation method: After generating a new master private key through the label, use this master private key to generate a new function key for the function;

[0026] Modify the encryption method: During the encryption process, the input data is encrypted using the master private key generated based on the tag;

[0027] Modify the decryption method: During the decryption process, use the function key corresponding to the label to perform decryption.

[0028] Furthermore, the step 2) of modifying stFE to tgFE includes:

[0029] Modify the master private key generation method: In the parameter establishment phase, a pseudo-random function key K is randomly selected from the input space T, and the algorithm is established using the parameters of tgFE to generate the master private key tg.msk of the label space;

[0030] Modify the function key generation method: Use tg.msk and label tg to generate the master private key st.msk of stFE through a pseudo-random function; then use the master private key st.msk to generate the corresponding function private key tg.sk for function f f ;

[0031] Modify the encryption method: During the encryption process, first use a pseudo-random function to generate the master private key st.msk of stFE according to the label tg, and then use the master private key st.msk to encrypt the input x to obtain the encrypted ciphertext tg.ct x ;

[0032] Modify the decryption method: During the decryption process, use the function private key tg.sk f And the encrypted ciphertext tg.ct x , use the stFE decryption algorithm to calculate the function value f(x).

[0033] Furthermore, step 3) of modifying tgFE to woFE includes:

[0034] Modify the master private key generation method: In the parameter establishment phase, use the tgFE parameter establishment algorithm to generate a new master private key in the label space, collusion bound, and security parameters;

[0035] Modify the function key generation method: randomly select a label, use the new master private key and the label to generate a function key, and use the function key and the label as the new function private key;

[0036] Modify the encryption method: During the encryption process, for each tag, use the new master private key to generate the corresponding ciphertext;

[0037] Modify the decryption method: During the decryption process, use the function key corresponding to the label to recover the function value from the ciphertext.

[0038] Furthermore, step 3) of modifying tgFE to woFE includes:

[0039] Modify the master private key generation method: In the parameter establishment phase, the label space T is used, the collusion upper bound is used as the security parameter λ, and the algorithm is established using the parameters of tgFE to obtain the new master private key wo.msk;

[0040] Modify the function key generation method: randomly extract the label tg, use the key generation algorithm of tgFE to generate the function private key sk using the label tg, function f and master private key wo.msk f,tg , composed of label tg and function private key sk f,tg Composition function key wo.sk f ;

[0041] Modify the encryption method: For each label u, use the master private key wo.msk to generate the ciphertext ct with u as the label u , and the ciphertexts of all labels are combined into the ciphertext wo.ct x ;

[0042] Modify the decryption method: During the decryption process, use the label tg and the corresponding function private key sk f,tg , from the ciphertext wo.ct x Select the tgth ciphertext ct tg , and use the decryption algorithm of tgFE to calculate the function value f(x).

[0043] Furthermore, the step of modifying woFE to dyFE in step 4) includes:

[0044] Modify the master private key generation method: In the parameter establishment phase, use the woFE parameter establishment algorithm to generate a master private key for each collusion upper bound; for each different collusion upper bound, generate a corresponding master private key, and combine all the master private keys into a new master private key;

[0045] Modify the function key generation method: for each collusion upper bound, use the corresponding master private key to generate the function key;

[0046] Modify the encryption method: During the encryption process, a master private key is selected to generate the ciphertext according to the set collusion upper bound;

[0047] Modify the decryption method: During the decryption process, use the function key and ciphertext corresponding to the encryption to perform the decryption operation and restore the original data.

[0048] Furthermore, the step of modifying woFE to dyFE in step 4) includes:

[0049] Modify the master private key generation method: In the parameter establishment phase, for each collusion upper bound q i , use the parameters of woFE to establish the algorithm multiple times to generate a set of master private keys wo.msk i , combine all generated master private keys into a new master private key dy.msk;

[0050] Modify the function key generation method: for each collusion upper bound q i , use the corresponding master private key wo.msk i Use woFE's function key generation algorithm multiple times to generate the corresponding function private key sk i,f , combine all generated function private keys into a new function private key dy.sk f ;

[0051] Modify the encryption method: During the encryption process, select the corresponding master private key according to the given collusion upper bound q Encrypt the input x and generate the ciphertext dy.ct x ;

[0052] Modify the decryption method: During the decryption process, use the function private key and the ciphertext dy.ctx , use woFE’s decryption algorithm to calculate the function value f(x).

[0053] Compared with the prior art, the present invention has the following advantages:

[0054] 1) The present invention provides a general method that can upgrade any symmetric function encryption that is resistant to static collusion to SKFE that is resistant to dynamic collusion. There is no need to design a new method for each specific scheme, and the method has strong adaptability and flexibility.

[0055] 2) The present invention can not only maintain the privacy of messages but also the privacy of functions during the editing process, thereby effectively preventing information leakage.

[0056] 3) The editing process of the present invention only relies on basic primitives such as symmetric encryption (SKE) and pseudo-random function (PRF), avoiding reliance on complex or additional difficult assumptions, making the method more efficient and highly secure.

[0057] 4) The present invention improves the ability to resist dynamic collusion and enhances the applicability and security of the encryption scheme by introducing linearization technology and power of 2 technology while ensuring security.

[0058] 5) The method proposed in the present invention has good computational efficiency, reduces the complexity of key management and encryption and decryption processes, and has strong practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is the overall flow chart of the symmetric function encryption algorithm.

[0060] Figure 2 It is an overall flow chart of a symmetric function encryption method for resisting dynamic collusion of the present invention. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical method and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings.

[0062] The present invention discloses a symmetric function encryption method that resists dynamic collusion, which is suitable for application scenarios that require protection of both message and function privacy. The method specifically includes three steps: increasing function privacy, label accumulation, and combination method. The process is as follows: Figure 2 As shown, the step of increasing the privacy of the function can be exchanged with the other two steps.

[0063] First, this embodiment provides an explanation of the symbols used in the construction of this method, as shown in Table 1.

[0064] Table 1 Explanation of symbols in the method

[0065]

[0066]

[0067]

[0068] The three steps of increasing function privacy, label accumulation, and combination method of this method are described in detail as follows.

[0069] Step 1: Increase the privacy of the function (upgrade mpFE to stFE)

[0070] The message privacy-resistant SKFE is edited into the fully secure SKFE resistant to static collusion. In the SKFE resistant to static collusion, the collusion upper bound is used as input when the parameters are established. During the security data interaction, when the adversary inquires about the function private key less than the upper bound, the attack advantage is negligible. The fully secure SKFE not only protects the message privacy, but also the function privacy.

[0071] 1) stFE.Setup(q): Call the mpFE collusion bound with the parameter q to establish the algorithm to generate mp.msk←mpFE.Setup(q), generate two symmetric keys k, k′←SKE.Kgen, and set st.msk:=(mp.msk,k,k′).

[0072] 2) stFE.Kgen(st.msk,f): Call the SKE encryption algorithm to encapsulate f twice, calculate c←SKE.E(k,f),c′←SKE.E(k′,f), and call the mpFE function key generation algorithm for circuit U c,c′ Generate function key Circuit U c,c′ An example description is as follows:

[0073]

[0074] 3) stFE.Enc(st.msk,x): Use (x,⊥,k,⊥) as the message to call the encryption algorithm of mpFE to calculate st.ct x ←mpFE.Enc(mp.msk,(x,⊥,k,⊥)).

[0075] 4) stFE.Dec(st.sk f ,st.ct x ): Call the decryption algorithm of mpFE to calculate f(x)←mpFE.Dec(st.sk f ,st.ct x ).

[0076] This step mainly introduces two symmetric keys by expanding the master private key of mpFE, and uses encryption and decryption algorithms to encapsulate and restore functions and messages. This not only ensures message privacy, but also enhances security during function key generation and encryption and decryption.

[0077] Step 2: Label accumulation (promoting stFE to tgFE)

[0078] The fully secure anti-static collusion SKFE is edited into a fully secure tag SKFE. The running time of the parameter establishment phase of the tag SKFE is logarithmically related to the size of the tag space. Its function key generation and encryption phase requires the tag as an additional input. The correctness of decryption can be guaranteed if and only if the ciphertext and the tag corresponding to the function key are the same.

[0079] 1) tgFE.Setup(T,q): Randomly select the key K of the PRF with input space T and set tg.msk:=K.

[0080] 2) tgFE.Kgen(tg.msk,tg,f): First, PRF(K,tg) is used as a random number to generate the master private key st.msk←stFE.Setup(q;PRF(K,tg)) of stFE for tg, and then this master private key is used to generate the function private key tg.sk for function f. f ←stFE.Keygen(st.msk,f).

[0081] 3) tgFE.Enc(tg.msk,tg,x): First, PRF(K,tg) is used as a random number to generate the master private key st.msk←stFE.Setup(q;PRF(K,tg)) of stFE for tg, and then this master private key is used to generate the ciphertext tg.ct for the input x x ←stFE.Enc(st.msk,x).

[0082] 4)tgFE.Dec(tg.sk f ,tg.ct x ): Call the decryption algorithm of stFE to calculate f(x)←stFE.Dec(tg.sk f ,tg.ct x ).

[0083] This step mainly generates a master private key by using a pseudo-random function, and generates and encrypts / decrypts function keys and data based on the master private key, thereby ensuring that the label matches the ciphertext and ensuring the correctness of the decryption.

[0084] Step 3: Combination method (promote tgFE to woFE first, and then to dyFE)

[0085] The fully secure label SKFE is first edited into a fully secure weakly optimized SKFE, and then the fully secure weakly optimized SKFE is edited into a fully secure SKFE that is resistant to dynamic collusion. In the SKFE that is resistant to dynamic collusion, the collusion upper bound is no longer used as input when the parameters are established, and the encryption algorithm inputs the collusion upper bound. In the security data interaction, when the number of times the adversary inquires about the function private key is less than the upper bound, its attack advantage is negligible.

[0086] 1. First, upgrade tgFE to woFE:

[0087] 1)woFE.Setup(q): call tag space T: = [2 logq ], the collusion community generates the master private key wo.msk←tgFE.Setup(T,λ) for tgFE with security parameter λ.

[0088] 2)woFE.Kgen(wo.msk,f): uniformly randomly extract tg from [q] and generate sk with tg as label f,tg ←tgFE.Kgen(wo.msk,tg,f), set wo.sk f :=(tg,sk f,tg ).

[0089] 3)woFE.Enc(st.msk,x): For each u∈[q], generate the ciphertext with u as the label, that is, ct u ←tgFE.Enc(wo.msk,u,x). setwo.ct x :=(ct 1 ,…,ct q ).

[0090] 4)woFE.Dec(wo.sk f ,wo.ct x ): Use the function private key and the tgth ciphertext to call the decryption algorithm of tgFE to calculate f(x)←tgFE.Dec(sk f,tg ,ct tg ).

[0091] This step mainly generates a master private key through the collusion upper bound and the label space, uses the master private key and the label to generate a function key, then generates ciphertext for each label, and finally decrypts it through the corresponding function key. This process enhances the tgFE algorithm and improves the algorithm's anti-collusion ability.

[0092] 2. Finally, upgrade woFE to dyFE:

[0093] 1)dyFE.Setup: for i=1,…,λ, with q i :=2i Call woFE with the parameters for the collusion upper bound to establish the algorithm λ times and generate wo.msk i ←woFE.Setup(q i ). Set dy.msk: = (wo.msk 1 ,…,wo.msk λ ).

[0094] 2) dyFE.Kgen(wo.msk,f): For i=1,...,λ, use wo.msk i Call the function key generation algorithm of woFE for the master private key λ times to generate sk i,f ←woFE.Kgen(wo.msk i ,f).Set dy.sk f :=(sk 1,f ,…,sk λ,f ).

[0095] 3)dyFE.Enc(st.msk,x,q): Call the The master private key generates the ciphertext, that is

[0096] 4)dyFE.Dec(dy.sk f ,dy.ct x ): Use The function private key and ciphertext call woFE's decryption algorithm to calculate

[0097] This step is mainly based on the collusion upper bound q i Generate multiple sets of master private keys, and generate function keys based on these master private keys. During the encryption process, select the master private key corresponding to the collusion upper bound for encryption; and during decryption, use the corresponding function private key to restore the original data f(x). This process upgrades woFE to dyFE, further enhancing the algorithm's ability to resist dynamic collusion.

[0098] Analysis and evaluation:

[0099] 1. Correctness analysis:

[0100] The decryption correctness of each step of the present invention is guaranteed by the decryption correctness of the called SKFE, so the final decryption correctness can be guaranteed.

[0101] 2. Security analysis:

[0102] In order to achieve the complete anti-dynamic collusion security of the final SKFE, the present invention re-characterizes the security definition of the intermediate primitives stFE, tgFE, and woFE in an indistinguishable (IND) way. In the secure interaction between stFE and woFE, when the adversary does not perform a ciphertext query, the number of function key extraction queries it performs is not limited; when the adversary performs a ciphertext query, the number of function key extraction queries it performs is required to be within a limited range. In the secure interaction of tgFE, for tags that have not been encrypted, the number of function key extraction queries the adversary performs on this tag is not limited; for tags that have been encrypted, the number of function key extraction queries the adversary performs on this tag must be within a limited range.

[0103] According to these newly described security definitions, the present invention can perform security reduction for each step. Combining Theorems 1-4 can obtain security conclusions. The proofs of these theorems can refer to the paper Dynamic Collusion Function-PrivateFunctional Encryption.

[0104] Theorem 1: If the symmetric encryption scheme SKE is indistinguishably secure, and mpFE is a static collusion-resistant SKFE that satisfies message privacy, then stFE with the “increased function privacy” function is a completely secure static collusion-resistant SKFE.

[0105] Theorem 2: If stFE is a completely secure static collusion-resistant SKFE, and the pseudo-random function PRF satisfies pseudo-randomness, then tgFE after "label accumulation" is a completely secure static collusion-resistant label SKFE.

[0106] Theorem 3: If tgFE is a completely secure tag SKFE against static collusion, then dyFE obtained by the “combination method” is a completely secure tag SKFE against dynamic collusion.

[0107] 3. Efficiency analysis:

[0108] The only means of improvement used in the present invention are pseudo-random functions and symmetric encryption, both of which can be constructed by one-way functions, and all steps can be implemented by calling the underlying primitives in a black box, with at most polynomial calls. Therefore, the present invention can be implemented efficiently in general.

[0109] In summary, the performance of the present invention is relatively excellent in terms of security, time overhead and access control strategy, has strong practical application value, and can provide users with better services.

[0110] Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions of the technical solutions of the present invention made by ordinary technicians in the field should all be included in the protection scope of the present invention. The protection scope of the present invention shall be based on what is defined in the claims.

Claims

1. A symmetric function encryption method against dynamic collusion, characterized in that: The following steps are involved: 1) Modify the message privacy symmetric function encryption algorithm mpFE to a fully secure symmetric function encryption algorithm stFE that is resistant to static collusion: improve the master private key in mpFE to a master private key containing two symmetric keys, and expand the structure of the master private key; all subsequent function key generation and encryption and decryption processes are based on the expanded master private key; 2) Modify the fully secure anti-static collusion symmetric function encryption algorithm stFE into a fully secure label symmetric function encryption algorithm tgFE: Add a label generation mechanism based on stFE, generate labels through a pseudo-random function, and use the labels as additional input to generate a new master private key, and then generate function keys and ciphertexts based on the labels; 3) Modify the fully secure label symmetric function encryption algorithm tgFE into a fully secure weakly optimized symmetric function encryption algorithm woFE: By modifying the master private key generation method of tgFE, the label space is combined with the collusion upper bound security parameter to generate a new master private key; then generate the corresponding ciphertext under each label, and generate the function key based on the label and the new master private key; 4) Modify the fully secure weakly optimized symmetric function encryption algorithm woFE into a fully secure symmetric function encryption algorithm dyFE that is resistant to dynamic collusion: Based on woFE, multiple master private keys are generated for different collusion upper bounds, and these master private keys are combined into a new master private key; during the encryption and decryption process, the master private key that matches the collusion upper bound is selected for encryption and decryption operations.

2. The method according to claim 1, characterized in that Step 1) The steps of modifying mpFE to stFE include: Modify the master private key generation method: During the parameter establishment phase, the master private key in mpFE is improved to include two symmetric keys and expanded to a new master private key; Modify the function key generation method: use the extended master private key and function f to generate the function key; Modify the encryption method: During the encryption process, use the extended master private key and a message with a specific structure for encryption; Modify the decryption method: During the decryption process, use the improved function key and ciphertext for decryption.

3. The method according to claim 2, characterized in that Step 1) The steps of modifying mpFE to stFE include: Modify the master private key generation method: In the parameter establishment phase, first use the mpFE parameter establishment algorithm to set the collusion upper bound to q to generate the master private key mp.msk, and at the same time generate two symmetric keys k, k ′ , and k,k ′ Together with mp.msk, it forms a new extended master private key st.msk; Modify the function key generation method: Use the SKE encryption algorithm to generate two symmetric keys k and k for function f. ′ Encrypt twice to get two encrypted ciphertexts c and c ′ ; Based on these two ciphertexts, use the mpFE function key generation algorithm to generate a new function key st.sk f ; Modify the encryption method: During the encryption process, use the mpFE encryption algorithm to encrypt the input x and the symmetric key k together as a message to generate the encrypted ciphertext st.ct x ; Modify the decryption method: During the decryption process, use the function key st.sk f And the encrypted ciphertext st.ct x , use the mpFE decryption algorithm to calculate the function value f(x).

4. The method according to claim 1, characterized in that Step 2) The steps of modifying stFE to tgFE include: Modify the master private key generation method: use a pseudo-random function to generate a tag in tgFE, and generate a new master private key based on the tag; Modify the function key generation method: After generating a new master private key through the label, use this master private key to generate a new function key for the function; Modify the encryption method: During the encryption process, the input data is encrypted using the master private key generated based on the tag; Modify the decryption method: During the decryption process, use the function key corresponding to the label to perform decryption.

5. The method according to claim 4, characterized in that Step 2) The steps of modifying stFE to tgFE include: Modify the master private key generation method: In the parameter establishment phase, a pseudo-random function key K is randomly selected from the input space T, and the algorithm is established using the parameters of tgFE to generate the master private key tg.msk of the label space; Modify the function key generation method: Use tg.msk and label tg to generate the master private key st.msk of stFE through a pseudo-random function; then use the master private key st.msk to generate the corresponding function private key tg.sk for function f f ; Modify the encryption method: During the encryption process, first use a pseudo-random function to generate the master private key st.msk of stFE according to the label tg, and then use the master private key st.msk to encrypt the input x to obtain the encrypted ciphertext tg.ct x ; Modify the decryption method: During the decryption process, use the function private key tg.sk f And the encrypted ciphertext tg.ct x , use the stFE decryption algorithm to calculate the function value f(x).

6. The method according to claim 1, characterized in that Step 3) The steps of modifying tgFE to woFE include: Modify the master private key generation method: In the parameter establishment phase, use the tgFE parameter establishment algorithm to generate a new master private key in the label space, collusion bound, and security parameters; Modify the function key generation method: randomly select a label, use the new master private key and the label to generate a function key, and use the function key and the label as the new function private key; Modify the encryption method: During the encryption process, for each tag, use the new master private key to generate the corresponding ciphertext; Modify the decryption method: During the decryption process, use the function key corresponding to the label to recover the function value from the ciphertext.

7. The method according to claim 6, characterized in that Step 3) The steps of modifying tgFE to woFE include: Modify the master private key generation method: In the parameter establishment phase, the label space T is used, the collusion upper bound is used as the security parameter λ, and the algorithm is established using the parameters of tgFE to obtain the new master private key wo.msk; Modify the function key generation method: randomly extract the label tg, use the key generation algorithm of tgFE to generate the function private key sk using the label tg, function f and master private key wo.msk f,tg , composed of label tg and function private key sk f,tg Composition function key wo.sk f ; Modify the encryption method: For each label u, use the master private key wo.msk to generate the ciphertext ct with u as the label u , and the ciphertexts of all labels are combined into the ciphertext wo.ct x ; Modify the decryption method: During the decryption process, use the label tg and the corresponding function private key sk f,tg , from the ciphertext wo.ct x Select the tgth ciphertext ct tg , and use the decryption algorithm of tgFE to calculate the function value f(x).

8. The method according to claim 1, characterized in that The steps of modifying woFE to dyFE in step 4) include: Modify the master private key generation method: In the parameter establishment phase, use the woFE parameter establishment algorithm to generate a master private key for each collusion upper bound; for each different collusion upper bound, generate a corresponding master private key, and combine all the master private keys into a new master private key; Modify the function key generation method: for each collusion upper bound, use the corresponding master private key to generate the function key; Modify the encryption method: During the encryption process, a master private key is selected to generate the ciphertext according to the set collusion upper bound; Modify the decryption method: During the decryption process, use the function key and ciphertext corresponding to the encryption to perform the decryption operation and restore the original data.

9. The method according to claim 8, characterized in that The steps of modifying woFE to dyFE in step 4) include: Modify the master private key generation method: In the parameter establishment phase, for each collusion upper bound q i , use the parameters of woFE to establish the algorithm multiple times to generate a set of master private keys wo.msk i , combine all generated master private keys into a new master private key dy.msk; Modify the function key generation method: for each collusion upper bound q i , use the corresponding master private key wo.msk i Use woFE's function key generation algorithm multiple times to generate the corresponding function private key sk i,f , combine all generated function private keys into a new function private key dy.sk f ; Modify the encryption method: During the encryption process, select the corresponding master private key according to the given collusion upper bound q Encrypt the input x and generate the ciphertext dy.ct x ; Modify the decryption method: During the decryption process, use the function private key and the ciphertext dy.ct x , use woFE’s decryption algorithm to calculate the function value f(x).

Images