Dynamic hierarchical data access control method based on recoverable puncture encryption

Abstract

The invention discloses a dynamic hierarchical data access control method based on recoverable puncture encryption. A user key is composed of an attribute key and a puncture key; the hierarchical users revoke access authority of subordinate part data according to requirements; the hierarchical user recovers the previously revoked data access authority of the subordinate part of the hierarchical user when necessary; the edge node updates the attribute conversion key stored in the edge node by using the key updating material; the data owner encrypts the data by using puncturable attribute-based encryption according to the defined access structure and the data label set; after the malicious user is revoked, the third-party cloud server is responsible for public ciphertext updating; the edge node of the Internet of Things uses the conversion key part to decrypt the ciphertext; the user only can access the ciphertext of which the attribute meets the ciphertext access structure and does not contain the key punctured tag; in the user revocation stage, the malicious user is revoked, and the key of the user which is not revoked is updated; according to the method, fine-grained hierarchical dynamic access control can be realized, and a feasible method is provided for dynamic authority control among hierarchical organizations.

Description

Technical Field

[0001] The present invention relates to the Internet of Things and pierceable encryption technology, and in particular to a dynamic hierarchical data access control method based on recoverable piercing encryption. Background Art

[0002] Cloud computing has attracted increasing attention because it can provide on-demand computing and storage and services for resource-constrained users. Many Internet of Things devices and enterprises tend to utilize cloud services for data storage, freeing them from the burden of maintaining local data. However, since the cloud is semi-trusted, outsourced data must be encrypted before uploading. Outsourced data uploaded to cloud servers is not physically controlled by users. Therefore, access control and security issues of outsourced data remain the main challenges for the widespread application of cloud computing.

[0003] Attribute-based encryption (ABE) is often used to share outsourced data in the cloud. This is because it can provide one-to-many data encryption and fine-grained access control for outsourced data uploaded to a semi-trusted cloud server. However, in the Industrial Internet of Things, there are many organizations and enterprises with hierarchical structures, such as hospitals, smart device factories, and medical data organizations. In the hierarchy, users are divided into different levels by position, have different access rights, and their permissions to outsourced data are dynamically controlled by their managers. It is difficult to hierarchically define user permission requirements using ABE alone.

[0004] Pierceable encryption (PE) is a technique that supports selective key puncturing. In PE, data is encrypted by using descriptive labels of the data (e.g., collection time, file size, and data type). A user punctures his key with a set of labels, thereby restricting the key's partial decryption capabilities. Subsequently, the user can only access data whose label set does not contain the punctured labels. Prior literature has used PE to implement data sharing in a hierarchical structure. However, it cannot effectively restore the privileges of restricted access users. A high-level user can restrict the access rights of low-level users under his management. However, if many restricted privileges need to be restored, a high-level user should puncture the key with unrevoked labels. This is time-consuming if the number of unrevoked labels is large. Therefore, we let the high-level user efficiently restore the corresponding restricted privileges of his subordinates using the secret value saved during the key puncturing process. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to solve the deficiencies in the prior art and to provide a dynamic hierarchical data access control method based on recoverable puncture encryption. The present invention optimizes puncture encryption to achieve efficient, dynamic, and hierarchical access control. By recording the secret value of the corresponding puncture tag during the key puncture process, the present invention helps users to efficiently restore some of the data access rights of their subordinates that were previously revoked. The present invention also supports coarse-grained user revocation operations. The security of the cryptographic protocol is evaluated through formal security analysis and can resist multiple types of attacks. Compared with other related schemes, it has stronger security.

[0006] Technical solution: A dynamic hierarchical data access control method based on recoverable puncture encryption of the present invention comprises the following steps:

[0007] Step (1), the key distribution center KGC runs the group generator Gen to initialize the system, obtain the system master public key MPK and the system master private key MSK; and initialize the key distribution center KGC, cloud service provider CSP, data owner DO, data user DU, and edge node ENs respectively;

[0008] Among them, the public key of the data user DU is pk id , the private key is sk id ; The cloud service provider CSP, data owner DO and edge nodes ENs all store the system master public key MPK and the system master private key MSK;

[0009] Step (2), in the key generation phase, the key distribution center KGC and its managers generate user keys for data users; that is, when the data user initiates an access request to the system, the key distribution center KGC generates an attribute conversion key tk according to the user attribute R id and pierceable keys And send it to the highest-level data users and edge nodes ENs through secure channels;

[0010] Step (3), in the permission revocation stage, the data users of each hierarchical user revoke the access rights of their subordinate data according to their needs. The specific method is as follows:

[0011] High-level users first use their own puncture key and the id of its subordinates k+1 Distribute puncturable keys to its subordinates and revoke permissions, then k+1 Perform key delegation, then the high-level user punctures the key according to the tag set, and merges the puncture keys of the high-level user's subordinates Subordinates who possess this key cannot access the ciphertext containing the labels of the corresponding label set;

[0012] Step (4), in the permission recovery phase, the hierarchical user, when necessary, recovers the previously revoked data access rights of its subordinates. The specific method is as follows:

[0013] Data user DU according to the identity vector Request its manager to restore the included tag t i After receiving the ciphertext, the manager first restores part of the data rights of the data owner DO; the data user DU re-randomizes part of the puncturable key; the final user deletes the tag t i The relevant key of

[0014] Step (5), in the key update phase, the edge node ENs uses the key update material to update the attribute conversion key stored therein, the specific method is:

[0015] The key distribution center KGC resolves the current time period t into For all nodes, record the indices where all bits in the timestamp are 0 to calculate the key update material ku θ , and calculate the key update material ku at period t t And broadcast it to the edge nodes ENs, and the edge nodes ENs update the attribute conversion keys stored in themselves after receiving them;

[0016] Step (6), ciphertext generation phase, the data owner DO runs the encryption algorithm to encrypt the corresponding plaintext information m and obtains the ciphertext CT;

[0017] Step (7), ciphertext update phase: after the data user revokes the permission, the cloud service provider CSP updates the ciphertext within the new time period t and obtains the updated ciphertext CT t ;

[0018] When the system reaches a new time period t, CSP calculates the index set V where all bits of timestamp t are 0; then updates the ciphertext CT stored in it according to the index set V and calculates Get the ciphertext under time period t

[0019] Step (8), ciphertext outsourcing decryption phase, edge node ENs uses the conversion key of the attribute key to decrypt part of the ciphertext and obtains the converted ciphertext

[0020] Step (9), ciphertext decryption phase, the data user DU that meets the access policy initiates an access request to the edge node ENs through the system public key MPK and obtains the ciphertext CT t2 After that, when the ciphertext does not contain the tag whose key of the data user DU is punctured, the data user DU runs the decryption algorithm to obtain the plaintext m

[0021] Step (10), user revocation phase, KGC adds the malicious user's ID to the revocation list rl, and the edge node ENs updates the key of the unrevoked user, and obtains the updated revocation list as follows:

[0022] rl←rl∪(id,t).

[0023] Furthermore, the detailed process of step (1) is as follows:

[0024] The key distribution center KGC runs the group generator Gen(1 λ )Get parameters parms=(p,G,G T ,e,g), where g is the generator of the group G and e is a bilinear map e:G×G→G T ;

[0025] Then KGC selects the bounded time T of the system and calculates l1=log2T, the random values ​​w,w0,w1,…,w n ,u0,u1,…,u l ,h1,…,h U ,v0,v1,…,v l1 ∈G and a,α,β,t0∈Z p ; Where t0 is a distinguishing mark that will not be used in encryption;

[0026] Then KGC chooses the hash function H1: {0,1} * →G, H2: {0,1} * →Z p ; Label space and identity space And a binary tree BT with at least N leaf nodes, finally generating the system master public key MPK = {parms, e(g, g) α ,g β ,g a ,w,w0,w1,…,w n ,u0,u1,…,u l ,h1,…,h U ,v0,v1,…,v l1 ,H1,H2} and system master private key MSK={β,α};

[0027] Data user DU uses random value γ id ∈Z p Calculate the key: sk id =γ id .

[0028] Furthermore, the process of generating the key in step (2) is as follows:

[0029] Step (2.1), after the data user initiates an access request to the system, KGC generates an attribute key based on the user attribute R;

[0030] First, input the user attribute set R, and calculate the attribute key components for each attribute in R;

[0031] Then for each attribute in R, KGC selects a leaf node of an undefined BT and stores the id in the node;

[0032] Then, according to the id selected in step (3-1-2), the path Path(id) from the root node of the tree BT to id is calculated. For each node θ on the path Path(id), if g in node θ θ has been defined for direct use (where g θ is the corresponding value stored in node θ), otherwise a random value g is selected θ ∈G, and update st to st∪(θ,g θ ) to update the value of node θ (st is the key-value pair of the node in the tree and the value stored in the node);

[0033] Choose t′∈Z p And calculate Calculation: tk1 = g θ 'g at′ ,tk2=g t′ , tk θ =(tk1,tk2,{tk 3,τ} τ∈[k] );

[0034] where tk1, tk2, tk 3,τ All are intermediate variables; finally the conversion key tk is obtained id ={(id,R),{tk θ} θ∈Path(id)};

[0035] Step (2.2), KGC selects a random value r, r id ∈Z p , then calculate the pierceable key

[0036]

[0037] Output conversion key tk id And pierceable keys And sent to the highest-level users and edge nodes ENs through a secure channel.

[0038] Furthermore, the specific method of revoking the authority in step (3) is:

[0039] Step (3.1) The high-level user uses his own puncture key and the id of its subordinates k+1 Distribute pierceable keys and revoke permissions for its subordinates, where k represents the depth of the hierarchical organization where the top level is located;

[0040] Step (3.2), select a random number r′ id ∈Z p , and according to id k+1 To delegate the key:

[0041]

[0042] Step (3.3), high-level users puncture the key according to the tag set, for the newly added (t i ,...,t j ) selects a random value r for each label in i ′,λ i , r i ∈Z p , and calculate:

[0043]

[0044] Step (3.4), the high-level user saves the corresponding secret value λ of each tag i , such as: ({t i :λ i},…,{t k :λ k}) and merge to get the puncture key of the subordinates of the high-level user Subordinates with this key cannot access the set containing the tag Tag∪t i ...∪t j The ciphertext of the label.

[0045] Furthermore, the specific process of restoring permissions in step (4) is as follows:

[0046] Data user DU first uses the identity vector Request its manager to restore the included tag t i The ciphertext of t i Find the {t saved during puncture i :λ i} to restore some data permissions of the data owner DO;

[0047] Next, the data user manager receives the sk from the data user DU. 0,1 , choose a random value r i′∈Z p ,calculate And sk′ 0,1 Sent to data user DU;

[0048] The data user DU receives the processed sk 0,1 Then, use the random value r i 'Complete (sk 0,2 ,sk 0,3 ) re-randomization;

[0049]

[0050] Then the user deletes the tag t i The relevant key (sk i,1 ,sk i ,sk i,3 ), then the puncture label is completed i of revocation.

[0051] Furthermore, the specific method for updating the key in step (5) is:

[0052] The key distribution center KGC resolves the current time period t into Let t[i] be the i-th bit of timestamp t;

[0053] For all nodes θ∈KUNodes(st,rl,t), randomly select And define a set V∈[l] to record the indices of all bits in the timestamp that are 0 to calculate the key update material ku θ =(ku1,ku2):

[0054]

[0055] Calculate the key update material ku at period t t =(t,{ku θ} θ∈KUNodes(st,rl,t) ), and broadcast it to the edge nodes ENs;

[0056] The edge nodes ENs receive the ku t Update the attribute conversion key stored in itself. If Path(id)∩KUNodes(st,rl,t)=(), then terminate. Otherwise, there exists a θ∈Path(id)∩KUNodes(st,rl,t);

[0057] Let V be the index set of all 0 bits of timestamp t, and the edge node ENs updates the attribute conversion key utk stored in itself id,t =((id,R,t),utk1,utk2,{utk3,τ} τ∈[k] ,utk4);

[0058] utk1=tk1;

[0059]

[0060] utk2=tk2=g t′ ,

[0061] Furthermore, the specific process of generating the ciphertext in step (6) is as follows:

[0062] Data owner DO input (MPK, m, S, id k ,AS,t), m is the encrypted plaintext, and the identity vector is id k =(I1,…,I k ), AS = (M, ρ);

[0063] Then use a univariate polynomial Define a constant vector z=(z0,z1,...,z n ), for each i∈[1,k], calculate id i =H(I i );

[0064] Next, the data owner DO selects a random vector And calculate For i∈[1,l], randomly select t i ∈Z p , calculate the ciphertext C = me(g β ,w),C1=g s ,

[0065] Then, assuming For timestamp The set of indices of all 0 bits of is the output of the algorithm TEncode(t,T), and then calculates the time ciphertext component Final ciphertext

[0066] Furthermore, the specific process of outsourcing the ciphertext decryption in step (8) is as follows:

[0067] First, the edge nodes ENs parse the information in the ciphertext: the attribute set R is parsed into (R1,...,R k), the access structure AS is (M,ρ),;

[0068] in is a matrix, ρ is a mapping ρ: [l] → Z p ;

[0069] Then, assume I = {i:ρ(i)∈S} and a constant set {ω i ∈Z p} i∈I , when there is a set of attributes that satisfies the access structure, there is ∑ i∈I ω i λ i =s, ENs uses the attribute conversion key to partially decrypt the ciphertext. The decryption process is:

[0070]

[0071] The edge node ENs finally obtains the converted ciphertext as And store waiting DU request.

[0072] Furthermore, the specific process of decrypting the ciphertext in step (9) is as follows:

[0073] First obtain the system public key MPK and update the ciphertext Private Key And DU's sk id ;

[0074] in

[0075] The data user then chooses a random number z=sk id ∈Z p To blind the key And send the blinded decryption key to the ENs that help it outsource decryption;

[0076] The edge nodes ENs calculate the constant vector z=(z0,z1,...,z n ), calculate the following ciphertext components:

[0077]

[0078]

[0079] Calculate the partial decrypted ciphertext Afterwards Send to DU;

[0080] Data user DU decrypts the received partial ciphertext Decrypt and get the plaintext

[0081] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0082] (1) The present invention uses identity-based hierarchical encryption to delegate the keys of senior users to subordinates. In the key delegation process, puncturable keys are introduced to restrict access rights, and the revocation of punctured tags enables effective restoration of restricted privileges to previous tags.

[0083] (2) The present invention takes into account the need to directly restrict all access rights of users and the server-assisted user revocation. The present invention ensures the forward security revocation of outsourced data after user use through trusted institutions and edge nodes and efficient public ciphertext updates. In addition, the edge node can assist the data user in partially decrypting the ciphertext to reduce the user's decryption burden. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 It is a system model diagram of the present invention;

[0085] Figure 2 This is a comparison chart of the permission revocation cost in the embodiment;

[0086] Figure 3 This is a comparison chart of permission recovery overhead in the embodiment. DETAILED DESCRIPTION

[0087] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0088] The present invention realizes coarse-grained user revocation while supporting hierarchical organization of dynamic hierarchical access control. The data owner (DO) formulates access policies and a set of descriptive labels for the data. The data user (DU) can correctly decrypt the ciphertext only when the attribute set of the data user (DU) satisfies the access structure of the ciphertext and the ciphertext does not contain a label whose key is pierced; the puncture key of the data user is distributed by its manager, and the attribute key is uniformly distributed by the KGC; the system supports two types of access control operations, and supports fine-grained revocation and restoration of user access rights to some data for dynamic access control between fine-grained levels. For coarse-grained access control, server-assisted user revocation is supported. After the KGC revokes the user, ENs generates key update materials by the KGC to update the user attribute conversion key stored therein to realize user revocation; at the same time, the CSP will publicly update the ciphertext according to the time period to ensure the forward security of user revocation.

[0089] In order to facilitate understanding of the technical solution of this embodiment, the meaning of the relevant variables is first explained, and the specific content is shown in Table 1.

[0090] Table 1

[0091]

[0092] like Figure 1 As shown, the present invention mainly involves the following entities, namely, a key distribution center (KGC), edge nodes (ENs), a data owner (DO), a data user (DU), and a cloud server provider (CSP), and specifically includes the following steps:

[0093] Step (1), the key distribution center KGC runs the group generator Gen to initialize the system, obtain the system master public key MPK and the system master private key MSK; and initialize the key distribution center KGC, cloud service provider CSP, data owner DO, data user DU, and edge node ENs respectively;

[0094] Among them, the public key of the data user DU is pk id , the private key is sk id ; The cloud service provider CSP, data owner DO and edge nodes ENs all store the system master public key MPK and the system master private key MSK;

[0095] Step (2), in the key generation phase, the key distribution center KGC and its managers generate user keys for data users; that is, when the data user initiates an access request to the system, the key distribution center KGC generates an attribute conversion key tk according to the user attribute R id and pierceable keys And send it to the highest-level data users and edge nodes ENs through secure channels;

[0096] Step (3), in the permission revocation stage, each layer of data users revokes the access rights of their subordinate data according to their needs. The specific method is as follows:

[0097] High-level users first use their own puncture key and the id of its subordinates k+1 Distribute puncturable keys to its subordinates and revoke permissions, then k+1 Perform key delegation, then the high-level user punctures the key according to the tag set, and merges the puncture keys of the high-level user's subordinates Subordinates who possess this key cannot access the ciphertext containing the labels of the corresponding label set;

[0098] Step (4), in the permission recovery phase, the hierarchical user, when necessary, recovers the previously revoked data access rights of its subordinates. The specific method is as follows:

[0099] Data user DU according to the identity vector Request its manager to restore the included tag t iAfter receiving the ciphertext, the manager first restores part of the data rights of the data owner DO; the data user DU re-randomizes part of the puncturable key; the final user deletes the tag t i The relevant key of

[0100] Step (5), in the key update phase, the edge node ENs uses the key update material to update the attribute conversion key stored therein, the specific method is:

[0101] The key distribution center KGC resolves the current time period t into For all nodes, record the indices where all bits in the timestamp are 0 to calculate the key update material ku θ , and calculate the key update material ku at period t t And broadcast it to the edge nodes ENs, and the edge nodes ENs update the attribute conversion keys stored in themselves after receiving them;

[0102] Step (6), ciphertext generation phase, the data owner DO runs the encryption algorithm to encrypt the corresponding plaintext information m and obtains the ciphertext CT;

[0103] Step (7), ciphertext update phase: after the data user revokes the permission, the cloud service provider CSP updates the ciphertext within the new time period t and obtains the updated ciphertext CT t ;

[0104] When the system reaches a new time period t, CSP calculates the index set V where all bits of timestamp t are 0; then updates the ciphertext CT stored in it according to the index set V and calculates Get the ciphertext under time period t

[0105] Step (8), ciphertext outsourcing decryption phase, edge node ENs uses the conversion key of the attribute key to decrypt part of the ciphertext and obtains the converted ciphertext

[0106] Step (9), ciphertext decryption phase, the data user DU that meets the access policy initiates an access request to the edge node ENs through the system public key MPK and obtains the ciphertext CT t2 After that, when the ciphertext does not contain the tag whose key of the data user DU is punctured, the data user DU runs the decryption algorithm to obtain the plaintext m

[0107] Step (10), user revocation phase, KGC adds the malicious user's ID to the revocation list rl, and the edge node ENs updates the key of the unrevoked user, and obtains the updated revocation list as follows:

[0108] rl←rl∪(id,t).

[0109] The detailed process of step (1) is as follows:

[0110] The key distribution center KGC runs the group generator Gen(1 λ )Get parameters parms=(p,G,G T ,e,g), where g is the generator of the group G and e is a bilinear map e:G×G→G T ;

[0111] Then KGC selects the bounded time T of the system and calculates l1=log2T, the random values ​​w,w0,w1,…,w n ,u0,u1,…,u l ,h1,…,h U ,v0,v1,…,v l1 ∈G and a,α,β,t0∈Z p ; Where t0 is a distinguishing mark that will not be used in encryption;

[0112] Then KGC chooses the hash function H1: {0,1} * →G, H2: {0,1} * →Z p ; Label space and identity space And a binary tree BT with at least N leaf nodes, finally generating the system master public key MPK = {parms, e(g, g) α ,g β ,g a ,w,w0,w1,…,w n ,u0,u1,…,u l ,h1,…,h U ,v0,v1,…,v l1 ,H1,H2} and system master private key MSK={β,α};

[0113] Data user DU uses random value γ id ∈Z p Calculate the key: sk id =γ id .

[0114] Furthermore, the process of generating the key in step (2) is as follows:

[0115] Step (2.1), after the data user initiates an access request to the system, KGC generates an attribute key based on the user attribute R;

[0116] First, input the user attribute set R, and calculate the attribute key components for each attribute in R;

[0117] Then for each attribute in R, KGC selects a leaf node of an undefined BT and stores the id in the node;

[0118] Then, according to the id selected in step (3-1-2), the path Path(id) from the root node of the tree BT to id is calculated. For each node θ on the path Path(id), if g in node θ θ has been defined for direct use (where g θ is the corresponding value stored in node θ), otherwise a random value g is selected θ ∈G, and update st to st∪(θ,g θ ) to update the value of node θ (st is the key-value pair of the node in the tree and the value stored in the node);

[0119] Choose t′∈Z p And calculate Calculation: tk1 = g θ 'g at′ ,tk2=g t′ , tk θ =(tk1,tk2,{tk 3,τ} τ∈[k] );

[0120] where tk1, tk2, tk 3,τ All are intermediate variables; finally the conversion key tk is obtained id ={(id,R),{tk θ} θ∈Path(id)};

[0121] Step (2.2), KGC selects a random value r, r id ∈Z p , then calculate the pierceable key

[0122]

[0123] Output conversion key tk id And pierceable keys And sent to the highest-level users and edge nodes ENs through a secure channel.

[0124] The specific method of revoking the permission in step (3) is as follows:

[0125] Step (3.1) The high-level user uses his own puncture key and the id of its subordinates k+1Distribute pierceable keys and revoke permissions for its subordinates, where k represents the depth of the hierarchical organization where the top level is located;

[0126] Step (3.2), select a random number r′ id ∈Z p , and according to id k+1 To delegate the key:

[0127]

[0128] Step (3.3), high-level users puncture the key according to the tag set, for the newly added (t i ,...,t j ) selects a random value r for each label in i ′,λ i , r i ∈Z p , and calculate:

[0129]

[0130]

[0131] Step (3.4), the high-level user saves the corresponding secret value λ of each tag i , such as: ({t i :λ i},…,{t k :λ k}) and merge to get the puncture key of the subordinates of the high-level user Subordinates with this key cannot access the set containing the tag Tag∪t i ...∪t j The ciphertext of the label.

[0132] Step (4) Specific process of restoring permissions:

[0133] Data user DU first uses the identity vector Request its manager to restore the included tag t i The ciphertext of t i Find the {t saved during puncture i :λ i} to restore some data permissions of the data owner DO;

[0134] Next, the data user manager receives the sk from the data user DU. 0,1 , choose a random value r i ′∈Z p ,calculate And sk′ 0,1 Sent to data user DU;

[0135] The data user DU receives the processed sk 0,1 Then, use the random value r i 'Complete (sk 0,2 ,sk 0,3 ) re-randomization;

[0136]

[0137] Then the user deletes the tag t i The relevant key (sk i,1 ,sk i ,sk i,3 ), then the puncture label is completed i of revocation.

[0138] The specific method for updating the key in step (5) is:

[0139] The key distribution center KGC resolves the current time period t into (l1 is log2T), let t[i] be the i-th bit of timestamp t;

[0140] For all nodes θ∈KUNodes(st,rl,t), randomly select And define a set V∈[l] to record the indices of all bits in the timestamp that are 0 to calculate the key update material ku θ =(ku1,ku2):

[0141]

[0142] Calculate the key update material ku at period t t =(t,{ku θ} θ∈KUNodes(st,rl,t) ), and broadcast it to the edge nodes ENs;

[0143] The edge nodes ENs receive the ku t Update the attribute conversion key stored in itself. If Path(id)∩KUNodes(st,rl,t)=(), then terminate. Otherwise, there exists a θ∈Path(id)∩KUNodes(st,rl,t);

[0144] Let V be the index set of all 0 bits of timestamp t, and the edge node ENs updates the attribute conversion key utk stored in itself id,t =((id,R,t),utk1,utk2,{utk 3,τ} τ∈[k] ,utk4);

[0145] utk1=tk1;

[0146]

[0147] utk2=tk2=g t′ ,

[0148] The specific process of generating ciphertext in step (6) is as follows:

[0149] Data owner DO input (MPK, m, S, id k ,AS,t), m is the encrypted plaintext, and the identity vector is id k =(I1,…,I k ), AS = (M, ρ);

[0150] Then use a univariate polynomial Define a constant vector z=(z0,z1,...,z n ), for each i∈[1,k], calculate id i =H(I i );

[0151] Next, the data owner DO selects a random vector And calculate For i∈[1,l], randomly select t i ∈Z p , calculate the ciphertext C =

[0152] me(g β ,w),C1=g s ,

[0153] Then, assuming For timestamp The set of indices of all 0 bits of is the output of the algorithm TEncode(t,T), and then calculates the time ciphertext component Final ciphertext

[0154] The specific process of step (8) ciphertext outsourcing decryption is as follows:

[0155] First, the edge nodes ENs parse the information in the ciphertext: the attribute set R is parsed into (R1,...,R k ), the access structure AS is (M,ρ),;

[0156] in is a matrix, ρ is a mapping ρ: [l] → Z p ;

[0157] Then, assume I = {i:ρ(i)∈S} and a constant set {ω i ∈Z p} i∈I , when there is a set of attributes that satisfies the access structure, there is ∑ i∈I ω i λ i =s, ENs uses the attribute conversion key to partially decrypt the ciphertext. The decryption process is:

[0158]

[0159]

[0160] The edge node ENs finally obtains the converted ciphertext as And store waiting DU request.

[0161] The specific process of decrypting the ciphertext in step (9) is as follows:

[0162] First obtain the system public key MPK and update the ciphertext Private Key And DU's sk id ;

[0163] in

[0164] The data user then chooses a random number z=sk id ∈Z p To blind the key And send the blinded decryption key to the ENs that help it outsource decryption;

[0165] The edge nodes ENs calculate the constant vector z=(z0,z1,...,z n ), calculate the following ciphertext components:

[0166]

[0167] Calculate the partial decrypted ciphertext Afterwards Sent to data user DU; data user DU decrypts the received part of the ciphertext Decrypt and get the plaintext

[0168] To further verify the effect of the present invention, this example is run on a virtual machine with Ubuntu 20.04.4 LTS operating system and 4GB RAM, and the CPU of the host machine is the 11th generation Core TM i7-11700@3.40GHz.

[0169] The functional implementation of the technical solution of the present invention is compared, and the results are shown in Table 2. The technical solution of the present invention supports more suitable hierarchical authority control functions.

[0170] Table 2

[0171]

[0172] Comparing the revocation and restoration of the rights in the technical solution of the present invention, the results are as follows: Figure 2 and Figure 3 As shown, under general circumstances, the technical solution of the present invention still has a higher dynamic permission control efficiency under relatively secure privacy protection.

Claims

1. A dynamic hierarchical data access control method based on recoverable puncture encryption, characterized in that: The following steps are involved: Step (1), the key distribution center KGC runs the group generator Gen to initialize the system, obtain the system master public key MPK and the system master private key MSK; and initialize the key distribution center KGC, cloud service provider CSP, data owner DO, data user DU, and edge node ENs respectively; Among them, the public key of the data user DU is pk id , the private key is sk id ; The cloud service provider CSP, data owner DO and edge nodes ENs all store the system master public key MPK and the system master private key MSK; Step (2), in the key generation phase, the key distribution center KGC and its managers generate user keys for data users; that is, when the data user initiates an access request to the system, the key distribution center KGC generates an attribute conversion key tk according to the user attribute R id and pierceable keys And send it to the highest-level data users and edge nodes ENs through secure channels; Step (3), in the permission revocation stage, the data users of each hierarchical user revoke the access rights of their subordinate data according to their needs. The specific method is as follows: High-level users first use their own puncture key and the id of its subordinates k+1 Distribute puncturable keys to its subordinates and revoke permissions, then k+1 Perform key delegation, then the high-level user punctures the key according to the tag set, and merges the puncture keys of the high-level user's subordinates Subordinates who possess this key cannot access the ciphertext containing the labels of the corresponding label set; Step (4), in the permission recovery phase, the hierarchical user, when necessary, recovers the previously revoked data access rights of its subordinates. The specific method is as follows: Data user DU according to the identity vector Request its manager to restore the included tag t i After receiving the ciphertext, the manager first restores part of the data rights of the data owner DO; the data user DU re-randomizes part of the puncturable key; the final user deletes the tag t i The relevant key of Step (5), in the key update phase, the edge node ENs uses the key update material to update the attribute conversion key stored therein, the specific method is: The key distribution center KGC resolves the current time period t into For all nodes, record the indices where all bits in the timestamp are 0 to calculate the key update material ku θ , and calculate the key update material ku at period t t And broadcast it to the edge nodes ENs, and the edge nodes ENs update the attribute conversion keys stored in themselves after receiving them; Step (6), ciphertext generation phase, the data owner DO runs the encryption algorithm to encrypt the corresponding plaintext information m and obtains the ciphertext CT: Step (7), ciphertext update phase: after the data user revokes the permission, the cloud service provider CSP updates the ciphertext within the new time period t and obtains the updated ciphertext CT t ; When the system reaches a new time period t, CSP calculates the index set V where all bits of timestamp t are 0; then updates the ciphertext CT stored in it according to the index set V and calculates Get the ciphertext under time period t Step (8), ciphertext outsourcing decryption phase, edge node ENs uses the conversion key of the attribute key to decrypt part of the ciphertext and obtains the converted ciphertext Step (9), ciphertext decryption phase, the data user DU that meets the access policy initiates an access request to the edge node ENs through the system public key MPK and obtains the ciphertext CT t2 After that, when the ciphertext does not contain the tag whose key of the data user DU is punctured, the data user DU runs the decryption algorithm to obtain the plaintext m Step (10), user revocation phase, KGC adds the malicious user's ID to the revocation list rl, and the edge node ENs updates the key of the unrevoked user, and obtains the updated revocation list as follows: rl←rl∪(id,t).

2. The dynamic hierarchical data access control method based on recoverable puncture encryption according to claim 1 is characterized in that: The detailed process of step (1) is as follows: The key distribution center KGC runs the group generator Gen(1 λ )Get parameters parms=(p, G, G T , e, g), where g is the generator of the group G, and e is a bilinear map e: G×G→G T ; Then KGC selects the system bounded time T and calculates l1=log2T, the random value and a,α,β,t0∈Z p ; Where t0 is a distinguishing mark that will not be used in encryption; Then KGC selects the hash function H1: {0, 1} * →G, H2: {0, 1} * →Z p ; Label space and identity space And a binary tree BT with at least N leaf nodes, which eventually generates the system master public key And system master private key MSK = {β, α}; Data user DU uses random value γ id ∈Z p Calculate the key: sk id =γ id .

3. The dynamic hierarchical data access control method based on recoverable puncture encryption according to claim 1 is characterized in that: The process of generating the key in step (2) is as follows: Step (2.1), after the data user initiates an access request to the system, KGC generates an attribute key based on the user attribute R; First, input the user attribute set R, and calculate the attribute key components for each attribute in R; Then for each attribute in R, KGC selects a leaf node of an undefined BT and stores the id in the node; Then, according to the selected id, the path Path(id) from the root node of the tree BT to id is calculated. For each node θ on the path Path(id), if g in node θ θ If defined, it is used directly, otherwise a random value g is chosen θ ∈G, and update st to stU(θ, g θ ) to update the value of node θ; Choose t′∈Z p And calculate Calculation: tk1 = g θ 'g at′ , tk2=g t′ , tk θ =(tk1, tk2, {tk 3，τ } τ∈[k] ); where tk1, tk2, tk 3，τ All are intermediate variables; finally the conversion key tk is obtained id ={(id, R),{tk θ } θ∈Path(id) }; Step (2.2), KGC selects a random value r, r id ∈Z p , then calculate the pierceable key Output conversion key tk id And pierceable keys And sent to the highest-level users and edge nodes ENs through a secure channel.

4. The dynamic hierarchical data access control method based on recoverable puncture encryption according to claim 1 is characterized in that: The specific method of revoking the authority in step (3) is: Step (3.1) The high-level user uses his own puncture key and the id of its subordinates k+1 Distribute pierceable keys and revoke permissions for its subordinates, where k represents the depth of the hierarchical organization where the top level is located; Step (3.2), select a random number r′ id ∈Z p , and according to id k+1 To delegate the key: Step (3.3), high-level users puncture the key according to the tag set, for the newly added (t i , ..., t j ) selects a random value r′ for each label in i ,λ i , r i ∈Z p , and calculate: Step (3.4), the high-level user saves the corresponding secret value λ of each tag i , ({t i :λ i }, ..., {t k :λ k }) and merge to get the puncture key of the subordinates of the high-level user Subordinates with this key cannot access the set containing the tag Tag∪t i …∪t j The ciphertext of the label.

5. The dynamic hierarchical data access control method based on recoverable puncture encryption according to claim 1 is characterized in that: Step (4) Specific process of restoring permissions: Data user DU first uses the identity vector Request its manager to restore the included tag t i The ciphertext of t i Find the {t saved during puncture i :λ i } to restore some data permissions of the data owner DO; Next, the data user manager receives the sk from the data user DU. 0，1 , choose a random value r′ i ∈Z p ,calculate And sk′ 0，1 Sent to data user DU; The data user DU receives the processed sk 0，1 Then, use the random value r′ i Complete (sk 0,2 ,sk 0，3 ) re-randomization; Then the user deletes the tag t i The relevant key (sk i,1 ,sk i ,sk i，3 ), then the puncture label is completed i of revocation.

6. The dynamic hierarchical data access control method based on recoverable puncture encryption according to claim 1 is characterized in that: The specific method for updating the key in step (5) is: The key distribution center KGC resolves the current time period t into Let t[i] be the i-th bit of timestamp t; For all nodes θ∈KUNodes(st, rl, t), randomly select And define a set V∈[l] to record the indices of all bits in the timestamp that are 0 to calculate the key update material ku θ =(ku1,ku2): Calculate the key update material ku at period t t =(t, {ku θ } θ∈KUNodes(st,rl，t) ), and broadcast it to the edge nodes ENs; The edge nodes ENs receive the ku t Update the attribute conversion key stored in itself. If Path(id)∩KUNodes(st, rl, t) = (), terminate. Otherwise, there exists a θ∈Path(id)∩KUNodes(st, rl, t); Let V be the index set of all 0 bits of timestamp t, and the edge node ENs updates the attribute conversion key utk stored in itself id,t =((id,R,t),utk1,utk2,{utk 3,τ } τ∈[k] ,utk4); utk1=tk1; utk2=tk2=g t′ , 7. The dynamic hierarchical data access control method based on recoverable puncture encryption according to claim 1 is characterized in that: The specific process of generating the ciphertext in step (6) is as follows: Data owner DO input (MPK, m, S, id k , AS, t), m is the encrypted plaintext, and the identity vector is idk=(I1,...,I k ), AS = (M, ρ); Then use a univariate polynomial Define a constant vector z = (z0, z1, ..., z n ), for each i∈[1,k], calculate id i =H(I i ); Next, the data owner DO selects a random vector And calculate For i∈[1,l], randomly select t i ∈Z p , calculate the ciphertext C = me(g β , w), C1=g s , Then, assuming Timestamp The set of indices of all 0 bits of is the output of the algorithm TEncode(t, T), and then calculates the time ciphertext component Final ciphertext 8. The dynamic hierarchical data access control method based on recoverable puncture encryption according to claim 1 is characterized in that: The specific process of outsourcing ciphertext decryption in step (8) is as follows: First, the edge nodes ENs parse the information in the ciphertext: the attribute set R is parsed into (R1, ..., R k ), the access structure AS is (M, ρ),; in is a matrix, ρ is a mapping ρ: [l] → Z p ; Then, assume I = {i: ρ(i)∈S} and a constant set {ω i ∈Z p } i∈I , when there is a set of attributes that satisfies the access structure, there is ∑ i∈I ω i λ i =s, ENs uses the attribute conversion key to partially decrypt the ciphertext. The decryption process is: The edge node ENs finally obtains the converted ciphertext as And store waiting DU request.

9. The dynamic hierarchical data access control method based on recoverable puncture encryption according to claim 1 is characterized in that: The specific process of decrypting the ciphertext in step (9) is as follows: First obtain the system public key MPK and update the ciphertext Private Key And DU's sk id ; in The data user then chooses a random number z=sk id ∈Z p To blind the key And send the blinded decryption key to the ENs that help it outsource decryption; The edge nodes ENs calculate the constant vector z=(z0, z1, ..., z n ), calculate the following ciphertext components: Calculate the partial decrypted ciphertext Afterwards Send to DU; Data user DU decrypts the received partial ciphertext Decrypt and get the plaintext

Images