SM9-based ciphertext policy attribute-based encryption method

Abstract

The invention provides an SM9-based ciphertext policy attribute-based encryption method, which comprises the following steps of: S1, generating a public parameter mpk and a master key msk of a system according to an SM9 identification encryption algorithm; s2, generating a decryption key SK corresponding to the attribute set S of the user; s3, generating a ciphertext CT corresponding to the data m; and S4, the receiver decrypts the data by using a decryption key SK of the receiver and a system public parameter # imgabs0 #. The data is flexibly accessed through the matching relationship between the attribute and the access strategy, so that the problem of processing overhead of the network bandwidth and the sending node caused by data sharing fine-grained access control is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a ciphertext policy attribute-based encryption method based on SM9. Background Art

[0002] With the booming digital economy, data has shown explosive growth and high aggregation, and its value has become increasingly significant. At the same time, the risks faced by data security are also rising, and data leakage, tampering and abuse are common. In particular, in recent years, emerging digital technologies such as cloud computing have been widely infiltrated and applied to various fields of society, giving rise to huge amounts of data and diverse processing needs. In this context, more and more users and enterprises tend to entrust their own data to third-party cloud servers for storage, management and processing. However, most of these servers are controlled by cloud service providers. Although they provide services in good faith, they also have curiosity. This means that although they will faithfully perform their service duties, they may still snoop on the data of users and enterprises, and may even leak sensitive data for commercial interests or share it with unauthorized users. This undoubtedly poses a more severe challenge to the technology of ensuring data confidentiality and achieving flexible access control in cloud servers.

[0003] Attribute-Based Encryption (ABE) is a public key encryption technology that uses attributes to encrypt data. It can provide data confidentiality protection and fine-grained access control for cloud computing. Attribute-Based Encryption is divided into Ciphertext-Policy ABE (CP-ABE) and Key-Policy ABE (KP-ABE). Please refer to Figure 1 In ciphertext policy attribute-based encryption, the authority sets the decryption key through the attribute set corresponding to the user, and the encryptor encrypts the data through the data access policy. When the attribute set corresponding to the user's decryption key meets the access policy corresponding to the encrypted data, the user can decrypt the ciphertext to obtain the plaintext data. Key policy attribute-based encryption is just the opposite. The ciphertext policy attribute-based encryption system is more similar to the traditional role-based access control in concept. Each encryptor determines the access structure of the shared encrypted data. Therefore, confidentiality and more flexible access control of shared encrypted data can be achieved.

[0004] In order to achieve independent control of cryptographic technology and ensure network and information security, my country has independently designed the SM9 identification encryption algorithm, which has gradually become a national standard and an international standard. However, due to the particularity of the SM9 identification encryption structure, the algorithm does not support flexible access control of data, which seriously hinders the application of the SM9 identification encryption algorithm in distributed computing systems such as cloud computing, blockchain, and the Internet of Things. Summary of the invention

[0005] In view of this, the object of the present invention is to provide a ciphertext policy attribute-based encryption method based on SM9. The method achieves flexible access to data by cleverly matching attributes with access policies. This method significantly reduces the network bandwidth burden and processing cost of the sending node caused by fine-grained access control of data sharing, while ensuring seamless integration and efficient collaboration with the current information system using SM9.

[0006] To achieve the above object, the present invention adopts the following technical solution: a ciphertext policy attribute-based encryption method based on SM9, comprising the steps of:

[0007] S1. Generate the system's public parameter mpk and master key msk according to the SM9 identification encryption algorithm, make the generated public parameter mpk public to users in the system, and save the system master key msk;

[0008] S2. Generate a decryption key SK corresponding to the user's attribute set S according to the user's attribute set S, the system's public parameter mpk and the master key msk;

[0009] S3, the encryptor uses the access policy (M, ρ) of the data m and the public parameter mpk of the system ， Generate the ciphertext CT corresponding to the data m;

[0010] S4. After the receiver obtains the ciphertext CT, he uses his own decryption key SK and the system public parameter mpk to decrypt the data. When the attribute set S corresponding to the decryption key SK satisfies the access policy (M, ρ) corresponding to the ciphertext CT, the message can be decrypted and restored, otherwise the decryption fails.

[0011] In a preferred embodiment, the step S1 specifically includes: according to the SM9 identification encryption algorithm, firstly selecting an additive group G1, G2 of order N, a multiplicative group G of order N T , asymmetric bilinear mapping e:G1×G2→G T , hash function H1: Select the private key generation function identifier hid represented by one byte; secondly, randomly select the generator P1∈G1,P2∈G2, and select the random number Calculate the element P in group G1 pub =aP1, group G T The element g=e(P pub ,P2); define the system's master public key as: mpk = {P1,P2,P pub ,g}, the master private key is msk=a;

[0012] in,

[0013] N: Cyclic group G1, G2, G T The order of , and N>2 191 prime number of ;

[0014] G1: additive cyclic group of order prime number N;

[0015] G2: additive cyclic group of order prime number N;

[0016] G T : A multiplicative cyclic group of order prime number N;

[0017] e: From G1×G2 to G T Bilinear mapping of ;

[0018] The set of integers in the set {1,2,…,N} that are relatively prime to N;

[0019] {0,1} * : a bit string of finite length;

[0020] H1: Derived from the cryptographic hash function from {0,1} * arrive The cryptographic function of

[0021] hid: The encryption key generation function identifier represented by one byte, selected and made public by the key generation center;

[0022] P1: Generator of group G1;

[0023] P2: Generator of group G2;

[0024] System master key;

[0025] P pub : elements in group G1;

[0026] g: Group G T The elements in .

[0027] In a preferred embodiment, step S2 specifically includes: assuming that the attribute set corresponding to the user is S, the authority selects a random number The private key is calculated as:

[0028]

[0029] in:

[0030] S: the attribute set corresponding to the user;

[0031] Random elements in

[0032] SK: decryption key;

[0033] K: partial decryption key; an element in group G2;

[0034] L: partial decryption key; an element in group G1;

[0035] x: an attribute in the attribute set S, and x∈{0,1} *

[0036] K x : Partial decryption key, corresponding to attribute x in attribute set S, belonging to the element in group G2;

[0037] "N"||hid: The concatenation of N and hid, where N and hid are bit strings or byte strings.

[0038] In a preferred embodiment, step S3 specifically includes: inputting the access strategy (M, ρ) corresponding to the data m, where M is a secret generation matrix with l rows and n columns, and mapping ρ(i) maps the i-th row in the matrix to the attribute ρ(i); constructing a vector in is the shared secret value, is a random number randomly selected to hide s. For i = 1 to l, the encryptor calculates Among them, M i is the i-th row in the matrix M; secondly, the encryptor randomly selects The ciphertext CT is calculated as follows:

[0039] C=mg s , C'=s(H1(N||hid)P1+P pub )

[0040]

[0041] in:

[0042] m: plaintext message to be encrypted, and m∈G T ;

[0043] M: secret generator matrix;

[0044] l: the number of rows of the secret generator matrix;

[0045] n: the number of columns of the secret generator matrix;

[0046] ρ(i): a mapping that maps the i-th row in the secret generator matrix to the attribute ρ(i);

[0047] The random number used in encryption;

[0048] Randomly select a random number used to hide s;

[0049] λ i : The secret share of s corresponding to the i-th row in the secret generation matrix;

[0050] M i : the i-th row in the matrix M;

[0051] The random number selected during encryption;

[0052] C: Part of the ciphertext, belonging to G T Elements in

[0053] C': partial ciphertext, an element in G1;

[0054] C i ,D i : Part of the ciphertext, corresponding to the i-th row in the secret generator matrix, where i = 1 to l, and C i Elements in G2, D i Belongs to the elements in G1.

[0055] In a preferred embodiment, step S4 specifically includes: Assuming that S satisfies the access policy (M, ρ), the decryptor first defines And I = {i∈[l]∧ρ(i)∈S}; if is the effective secret share of s, then the decryptor can calculate a constant set in polynomial time So that∑ i∈I ω i ·λ i =s; Secondly, the decryptor calculates

[0056]

[0057] in,

[0058] K ρ(i) : The partial decryption key corresponding to attribute ρ(i), which belongs to the element of group G2;

[0059] I: the set of rows in the secret sharing matrix corresponding to the attribute set S;

[0060] So that∑ i∈I ω i ·λ i =s is the set of constants for which

[0061] Compared with the prior art, the present invention has the following beneficial effects: As a commercial encryption algorithm in my country, the SM9 identification encryption algorithm has strong security and high efficiency and is often used to implement data privacy protection. However, when we need to perform fine-grained access control on messages, the SM9 identification encryption does not work, and the ciphertext policy attribute-based encryption method based on SM9 can solve this problem. It is specifically reflected in the following three points:

[0062] The present invention, without changing the basic architecture of the SM9 identification encryption algorithm, flexibly accesses data through the matching relationship between attributes and access policies, greatly reducing the network bandwidth and processing overhead of the sending node caused by the fine-grained access control of data sharing. Secondly, the present invention supports large attribute sets, and the system does not need to consider the attribute set during initial settings, thereby avoiding the system from resetting the system due to the size of the attribute set during operation. Finally, the present invention can be effectively integrated with the existing information system using SM9, promoting the further application of the SM9 identification encryption algorithm in distributed computing systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 is the ciphertext policy attribute-based encryption system diagram;

[0064] Figure 2 A ciphertext policy attribute-based encryption flow chart based on SM9 according to a preferred embodiment of the present invention;

[0065] Figure 3 The figure is a flowchart of the encryption / decryption algorithm of the preferred embodiment of the present invention. DETAILED DESCRIPTION

[0066] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0067] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0068] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0069] The most critical concept of the present invention is that, without changing the basic structure of SM9 identification encryption, a ciphertext policy attribute-based encryption method is constructed that can realize flexible data access control.

[0070] Please refer to Figure 2 , a ciphertext policy attribute-based encryption method based on SM9, characterized in that it includes the steps of:

[0071] S1. Generate the system's public parameter mpk and master key msk according to the SM9 identification encryption algorithm, make the generated public parameter mpk public to users in the system, and save the system master key msk;

[0072] S2. Generate a decryption key SK corresponding to the user's attribute set S according to the user's attribute set S, the system's public parameter mpk and the master key msk;

[0073] S3, the encryptor generates the ciphertext CT corresponding to the data m according to the access policy (M, ρ) of the data m and the public parameter mpk of the system;

[0074] S4, after the receiver obtains the ciphertext CT, it uses its own decryption key SK and the system public parameter mpk to decrypt the data; when the attribute set S corresponding to the decryption key SK satisfies the access policy (M, ρ) corresponding to the ciphertext CT, the message can be decrypted and restored, otherwise the decryption fails. Further, the step S1 specifically includes:

[0075] According to the SM9 signature encryption algorithm, we first select the additive groups G1 and G2 of order N and the multiplicative group G of order N. T , asymmetric bilinear mapping e:G1×G2→G T , hash function Select the private key generation function identifier hid represented by one byte; secondly, randomly select the generator P1∈G1,P2∈G2, and select the random number Calculate the element P in group G1 pub =aP1, group G T The element g=e(P pub ,P2); define the system's master public key as: mpk = {P1,P2,P pub ,g}, the master private key is msk=a;

[0076] in,

[0077] N: Cyclic group G1, G2, G T The order of , and N>2 191 prime number of ;

[0078] G1: additive cyclic group of order prime number N;

[0079] G2: additive cyclic group of order prime number N;

[0080] G T: A multiplicative cyclic group of order prime number N;

[0081] e: From G1×G2 to G T Bilinear mapping of ;

[0082] The set of integers in the set {1,2,…,N} that are relatively prime to N;

[0083] {0,1} * : a bit string of finite length;

[0084] Derived from the cryptographic hash function from {0,1} * arrive The cryptographic function of

[0085] hid: The encryption key generation function identifier represented by one byte, selected and made public by the key generation center;

[0086] P1: Generator of group G1;

[0087] P2: Generator of group G2;

[0088] System master key;

[0089] P pub : elements in group G1;

[0090] g: Group G T The elements in .

[0091] In step S2, the authority generates a decryption key SK corresponding to the user's attribute set S according to the user's attribute set S, the system's public parameter mpk and the master key msk; specifically, the authority selects a random number The private key is calculated as:

[0092]

[0093] in:

[0094] S: the attribute set corresponding to the user;

[0095] Random elements in

[0096] SK: decryption key;

[0097] K: partial decryption key; an element in group G2;

[0098] L: partial decryption key; an element in group G1;

[0099] x: an attribute in the attribute set S, and x∈{0,1}*

[0100] K x : Partial decryption key, corresponding to attribute x in attribute set S, belonging to the element in group G2;

[0101] "N"||hid: The concatenation of N and hid, where N and hid are bit strings or byte strings.

[0102] In step S3, the encryptor generates the ciphertext CT corresponding to the data m according to the access strategy (M, ρ) of the data m and the public parameter mpk of the system; specifically, the following steps are performed:

[0103] The data encryptor inputs the access strategy (M, ρ) corresponding to the data m, where M is the secret generation matrix with l rows and n columns, and the mapping ρ(i) maps the i-th row in the matrix to the attribute ρ(i); construct the vector in is the shared secret value, is a random number randomly selected to hide s. For i = 1 to l, the encryptor calculates Among them, M i is the i-th row in the matrix M; secondly, the encryptor randomly selects The ciphertext CT is calculated as follows:

[0104] C=mg s , C'=s(H1(N||hid)P1+P pub )

[0105]

[0106] in:

[0107] m: plaintext message to be encrypted, and m∈G T ;

[0108] M: secret generator matrix;

[0109] l: the number of rows of the secret generator matrix;

[0110] n: the number of columns of the secret generator matrix;

[0111] ρ(i): a mapping that maps the i-th row in the secret generator matrix to the attribute ρ(i);

[0112] The random number used in encryption;

[0113] Randomly select a random number used to hide s;

[0114] λ i: The secret share of s corresponding to the i-th row in the secret generation matrix;

[0115] M i : the i-th row in the matrix M;

[0116] The random number selected during encryption;

[0117] C: Part of the ciphertext, belonging to G T Elements in

[0118] C': partial ciphertext, an element in G1;

[0119] C i ,D i : Part of the ciphertext, corresponding to the i-th row in the secret generator matrix, where i = 1 to l, and C i Elements in G2, D i Belongs to the elements in G1.

[0120] After the receiver obtains the ciphertext CT in step S4, he uses his own decryption key SK and the system public parameter mpk to decrypt the data. When the attribute set S corresponding to the decryption key SK satisfies the access policy (M, ρ) corresponding to the ciphertext CT, the message can be decrypted and restored, otherwise the decryption fails. Specifically, it includes:

[0121] Assuming S satisfies the access policy (M,ρ), the decryptor first defines And I = {i∈[l]∧ρ(i)∈S}; if is the effective secret share of s, then the decryptor can calculate a constant set in polynomial time So that Σ i∈I ω i ·λ i =s; Secondly, the decryptor calculates

[0122]

[0123] in,

[0124] K ρ(i) : The partial decryption key corresponding to attribute ρ(i), which belongs to the element of group G2;

[0125] I: the set of rows in the secret sharing matrix corresponding to the attribute set S;

[0126] So that∑ i∈I ω i ·λ i =s is the set of constants for which

[0127] Here are some things to note about the calculation formula:

[0128] (1) The decryption calculation in step S4 is correct

[0129]

[0130] (2) The additive groups G1, G2 and the multiplicative group G selected in step S1 T 、Bilinear mapping e:G1×G2→G T , hash function and the private key generation function identifier hid are consistent with the selection in the SM9 identification encryption algorithm.

[0131] From the above description, it can be seen that, without changing the basic architecture of the SM9 identification encryption algorithm, data can be flexibly accessed through the matching relationship between attributes and access policies, which greatly reduces the network bandwidth and processing overhead of the sending node caused by fine-grained access control of data sharing. Moreover, the SM9-based ciphertext policy attribute-based encryption method supports large attribute sets, and the system does not need to consider the attribute set during initial settings, thereby avoiding the system being reset due to the size of the attribute set during operation. Finally, this method can be effectively integrated with existing information systems using SM9, promoting the further application of the SM9 identification encryption algorithm in distributed computing systems.

[0132] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A ciphertext policy attribute-based encryption method based on SM9, characterized in that: Includes steps: S1. Generate the system's public parameter mpk and master key msk according to the SM9 identification encryption algorithm, make the generated public parameter mpk public to users in the system, and save the system master key msk; S2. Generate a decryption key SK corresponding to the user's attribute set S according to the user's attribute set S, the system's public parameter mpk and the master key msk; S3, the encryptor generates the ciphertext CT corresponding to the data m according to the access policy (M, ρ) of the data m and the public parameter mpk of the system; S4. After the receiver obtains the ciphertext CT, it decrypts the data using its own decryption key SK and the system public parameter mpk; When the attribute set S corresponding to the decryption key SK satisfies the access policy (M, ρ) corresponding to the ciphertext CT, the message can be decrypted and restored, otherwise the decryption fails.

2. The SM9-based ciphertext policy attribute-based encryption method according to claim 1, characterized in that: The step S1 specifically includes: according to the SM9 identification encryption algorithm, firstly selecting an additive group G1, G2 of order N, and a multiplicative group G T , asymmetric bilinear mapping e:G1×G2→G T , hash function Select the private key generation function identifier hid represented by one byte; secondly, randomly select the generator P1∈G1,P2∈G2, and select the random number Calculate the element P in group G1 pub =aP1, group G T The element g=e(P pub ,P2); define the system's master public key as: mpk = {P1,P2,P pub ,g}, the master private key is msk=a; in, N: Cyclic group G1, G2, G T The order of , and N>2 191 prime number of ; G1: additive cyclic group of order prime number N; G2: additive cyclic group of order prime number N; G T : A multiplicative cyclic group of order prime number N; e: From G1×G2 to G T Bilinear mapping of ; The set of integers in the set {1,2,…,N} that are relatively prime to N; {0,1} * : a bit string of finite length; Derived from the cryptographic hash function {0,1} * arrive The cryptographic function of hid: The encryption key generation function identifier represented by one byte, selected and made public by the key generation center; P1: Generator of group G1; P2: Generator of group G2; System master key; P pub : elements in group G1; g: Group G T The elements in .

3. The ciphertext policy attribute-based encryption method based on SM9 according to claim 1, characterized in that: The step S2 specifically includes: assuming that the attribute set corresponding to the user is S, the authority selects a random number The private key is calculated as: in: S: the attribute set corresponding to the user; Random elements in SK: decryption key; K: partial decryption key; an element in group G2; L: partial decryption key; an element in group G1; x: an attribute in the attribute set S, and x∈{0,1} * K x : Partial decryption key, corresponding to attribute x in attribute set S, belonging to the element in group G2; "N"||hid: The concatenation of N and hid, where N and hid are bit strings or byte strings.

4. The SM9-based ciphertext policy attribute-based encryption method according to claim 1, characterized in that: The step S3 specifically includes: inputting the access strategy (M, ρ) corresponding to the data m, where M is a secret generation matrix with l rows and n columns, mapping ρ(i) to map the i-th row in the matrix to the attribute ρ(i); constructing a vector in is the shared secret value, is a random number randomly selected to hide s. For i = 1 to l, the encryptor calculates Among them, M i is the i-th row in the matrix M; secondly, the encryptor randomly selects The ciphertext CT is calculated as follows: C=mg s ,C'=s(H1(N||hid)P1+P pub ) in: m: plaintext message to be encrypted, and m∈G T ; M: secret generator matrix; l: the number of rows of the secret generator matrix; n: the number of columns of the secret generator matrix; ρ(i): a mapping that maps the i-th row in the secret generator matrix to the attribute ρ(i); The random number used in encryption; Randomly select a random number used to hide s; λ i : The secret share of s corresponding to the i-th row in the secret generation matrix; M i : the i-th row in the matrix M; The random number selected during encryption; C: Part of the ciphertext, belonging to G T Elements in C': partial ciphertext, an element in G1; C i ,D i : Part of the ciphertext, corresponding to the i-th row in the secret generator matrix, where i = 1 to l, and C i Elements in G2, D i Belongs to the elements in G1.

5. The SM9-based ciphertext policy attribute-based encryption method according to claim 1, characterized in that: The step S4 specifically includes: assuming that S satisfies the access policy (M, ρ), the decryptor first defines And I = {i∈[l]^ρ(i)∈S}; if is the effective secret share of s, then the decryptor can calculate a constant set in polynomial time So that Σ i∈I ω i ·λ i =s; Secondly, the decryptor calculates in, K ρ(i) : The partial decryption key corresponding to attribute ρ(i), which belongs to the element of group G2; I: the set of rows in the secret sharing matrix corresponding to the attribute set S; So that Σ i∈I ω i ·λ i =s is the set of constants for which

Images