An access control method based on attribute relationship evaluation and data encryption

Abstract

The application discloses an access control method based on attribute relation evaluation and data encryption, comprising the following steps: for object data with different attributes in a data access control scene, comparing the relations between the attributes to filter out an attribute set used for access control; determining an access strategy matrix according to the attribute set; encrypting the plaintext data by using an SM9 encryption algorithm to obtain a secret value; constructing a secret sharing matrix based on the secret value; calculating the access strategy matrix by using the secret sharing matrix to obtain an encrypted attribute value; and using the encrypted attribute value as an access control condition to limit the users with the attribute matching the access control condition to have the qualification to calculate the plaintext data to achieve the access purpose. The application combines the attribute relation evaluation and the encryption protection based on the SM9 algorithm, ensures that only the users meeting the specific conditions can access the data, greatly improves the efficiency of the access control, improves the security, and saves the computing resources and the storage space.

Description

Technical Field

[0001] This invention belongs to the field of data access control, specifically relating to an access control method based on attribute relationship evaluation and data encryption. Background Technology

[0002] With the rapid development of information technology and the arrival of the big data era, data security and privacy protection have become a major concern. Data is widely used in various fields, such as healthcare, finance, e-commerce, and government services, and these fields are increasingly reliant on data. However, with the exponential growth of data volume, security issues such as data leakage, tampering, theft, and unauthorized access are emerging one after another. Especially in the context of emerging technologies such as cloud computing and the Internet of Things, the openness and sharing of data are constantly increasing. Data is no longer confined to traditional enterprise intranets but is distributed across the vast Internet. While the openness and sharing of data improves the efficiency of information utilization, it also brings new security challenges and increases the risk of data leakage and unauthorized access. Therefore, how to effectively control data access permissions and ensure data security in open environments has become an important issue that urgently needs to be addressed.

[0003] In cloud computing environments, data storage and processing have shifted from traditional on-premises systems to the cloud. While cloud computing offers businesses and users flexible resource usage and management capabilities, reducing IT costs, the openness and multi-tenancy of the cloud environment also increase the risk of data breaches and unauthorized access. With data stored on third-party cloud service provider servers, users have less control over their data, and without effective security mechanisms, data may be accessed by malicious attackers or unauthorized users. Furthermore, data transmission in the cloud is also at risk of interception or tampering.

[0004] The widespread application of Internet of Things (IoT) technology has further exacerbated data security issues. IoT devices are typically distributed across various environments, including homes, factories, and cities, generating and transmitting massive amounts of real-time data. Due to the sheer number and wide distribution of these devices, this data easily becomes a target for cyberattacks. The limited computing power and security mechanisms of IoT devices themselves often fail to effectively defend against complex cyberattacks, leading to a higher risk of data leakage. Therefore, how to protect data security in open and distributed IoT environments has become a pressing issue.

[0005] The demand for data sharing and access is growing, but so are the risks of data breaches and unauthorized access. In this context, effectively controlling data access permissions and ensuring data security in open environments has become a critical issue that urgently needs to be addressed. Traditional access control mechanisms, despite their widespread use over the past few decades, are proving inadequate for today's complex and ever-changing environment. For example, traditional methods often require complex certificate management and are inefficient in dealing with dynamically changing access policies. Most existing access control schemes suffer from the following problems:

[0006] 1. Attribute Selection Issues: Traditional attribute selection methods rely on manual or simple statistical methods, which are difficult to handle complex access requirements and are inefficient in big data environments. Furthermore, when selecting attributes, it is easy to overlook the correlations between attributes, affecting the selection process.

[0007] 2. Insufficient access control flexibility: Existing access control models struggle to adapt to rapidly changing environments and needs, lacking flexibility and dynamism. Furthermore, access control systems are vulnerable to security breaches after being attacked. Summary of the Invention

[0008] To address the aforementioned problems in the existing technology, this invention provides an access control method based on attribute relationship evaluation and data encryption. The technical problem to be solved by this invention is achieved through the following technical solution:

[0009] An access control method based on attribute relationship evaluation and data encryption includes:

[0010] For object data with different attributes in a data access control scenario, the set of attributes used for access control is selected by comparing the relationships between the attributes.

[0011] Determine the access strategy matrix based on the attribute set;

[0012] The plaintext data is encrypted using the SM9 encryption algorithm to obtain the secret value;

[0013] Construct a secret sharing matrix based on the secret value;

[0014] The access policy matrix is ​​calculated using the secret sharing matrix to obtain encrypted attribute values. These encrypted attribute values ​​serve as access control conditions, limiting users whose attributes match the access control conditions to be eligible to calculate plaintext data, thereby achieving the access purpose.

[0015] In one embodiment of the present invention, the step of filtering out a set of attributes for access control by comparing the relationships between attributes of object data with different attributes in a data access control scenario includes:

[0016] In a data access control scenario, multiple data groups are acquired, each consisting of two object data with different attributes.

[0017] For each data group, determine the pairwise attribute relationships between the data objects in that data group to obtain the attribute relationship matrix;

[0018] The weight matrix corresponding to the attribute relationship matrix is ​​determined based on the pre-set weights for different attribute relationships;

[0019] Calculate the length of each row vector in the weight matrix, sort all row vectors from largest to smallest according to their length, select the top row vectors, and use the attributes corresponding to the selected row vectors as candidate attributes.

[0020] Calculate the length of each column vector in the weight matrix, sort all column vectors in descending order of length, select the top column vectors, and use the attributes corresponding to the selected column vectors as candidate attributes.

[0021] The set of attributes used for access control consists of all the alternative attributes.

[0022] In one embodiment of the present invention, different attribute relationships include: equivalence relationships, hierarchical relationships, and unknown relationships;

[0023] The relationships between pre-set weights of different attribute relationships include:

[0024] The weight of equivalence relations > the weight of hierarchical relations > the weight of unknown relations.

[0025] In one embodiment of the present invention, calculating the length of each row vector in the weight matrix, or calculating the length of each column vector in the weight matrix, includes:

[0026] Squaring each value in the corresponding vector and summing them together, then calculating the square root of the summation result.

[0027] In one embodiment of the present invention, determining the access strategy matrix based on the attribute set includes:

[0028] Based on the relationships between attributes in the attribute set and the actual access control requirements, an access policy expression is determined; wherein, the access policy expression is a logical expression of different access policies, and each access policy is determined according to the logical relationship between the corresponding attributes.

[0029] The access strategy matrix is ​​determined based on the preset matrix construction rules and the logical relationships between attributes and access strategies in the access strategy expression.

[0030] The preset matrix construction rules include: all attributes in the attribute set are represented by single-entry matrices;

[0031] If the logical relationship between access strategies is an OR relationship, the access strategy matrix corresponding to the access strategy expression is represented as follows:

[0032]

[0033] If the logical relationship between access strategies is an AND relationship, the access strategy matrix corresponding to the access strategy expression is represented as follows:

[0034]

[0035] Among them, C a and R a C represents the first column and the remaining columns of the matrix corresponding to an access strategy in the access strategy expression. b and R b The first column and the remaining columns of the matrix corresponding to another access strategy in the access strategy expression are represented.

[0036] In one embodiment of the present invention, constructing a secret sharing matrix based on the secret value includes:

[0037] The secret value and a set of random numbers are combined to form a one-dimensional column vector, which serves as the secret sharing matrix.

[0038] In one embodiment of the present invention, the access policy matrix is ​​calculated using the secret sharing matrix to obtain encrypted attribute values, including:

[0039] Multiply the access policy matrix and the secret sharing matrix to obtain the encrypted attribute value.

[0040] In one embodiment of the present invention, the process of calculating plaintext data for a user whose attributes match the access control conditions includes:

[0041] Users whose attributes match the access control conditions obtain the corresponding access matrix M using their attribute values. A ;

[0042] Using access matrix M A Access coefficient λ A And the relationship between the target vector ε and the access coefficient λ can be solved. A ;

[0043] Based on the encrypted attribute value and the calculated access coefficient λ A And the formula for calculating the secret value, to solve for the secret value;

[0044] The secret value is decrypted using the SM9 decryption algorithm to obtain the plaintext data.

[0045] In one embodiment of the present invention, the access matrix M is... A Access coefficient λ A The relationship between the target vector ε and the target vector ε is expressed as:

[0046]

[0047] Where T denotes matrix transpose; ε = (1,0,…,0) T .

[0048] In one embodiment of the present invention, the formula for calculating the secret value is expressed as:

[0049]

[0050] in, ρ represents the request matrix; M represents the secret sharing matrix; A ·ρ represents the product of the access matrix and the secret sharing matrix; S represents the secret value.

[0051] The solution provided in this invention first selects a set of attributes for access control by comparing the relationships between object data with different attributes in a data access control scenario. Second, an access policy matrix is ​​determined based on the attribute set. Next, plaintext data is encrypted using the SM9 encryption algorithm to obtain a secret value. Then, a secret sharing matrix is ​​constructed based on the secret value. Finally, the access policy matrix is ​​calculated using the secret sharing matrix to obtain encrypted attribute values. These encrypted attribute values ​​serve as access control conditions, limiting users whose attributes match the access control conditions to the ability to calculate plaintext data, thus achieving the access purpose. This invention combines attribute relationship evaluation with SM9-based encryption protection. By scientifically evaluating and selecting attributes, a linear secret sharing matrix is ​​constructed for access control, and the SM9 algorithm is used for data encryption. This ensures that only users meeting specific conditions can access the data, significantly improving access control efficiency, enhancing security, and saving computing resources and storage space. Attached Figure Description

[0052] Figure 1 This is a flowchart illustrating an access control method based on attribute relationship evaluation and data encryption, provided in an embodiment of the present invention. Detailed Implementation

[0053] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0054] Attribute-based access control and identity-based encryption technologies, as emerging access control and encryption techniques, have gradually attracted widespread attention from academia and industry. Attribute-based access control makes access decisions based on user and resource attribute information, offering greater flexibility and fine-grained control capabilities, and adapting to complex and ever-changing access scenarios. Identity-based encryption technologies, especially the SM9 algorithm, greatly simplify the complexity of key management and distribution by directly using identifiers (such as usernames, email addresses, etc.) as public keys, avoiding the complex certificate management required by traditional Public Key Infrastructure (PKI). The SM9 algorithm not only improves the flexibility and scalability of encryption systems but also enhances data security, especially in distributed and open environments.

[0055] Therefore, this invention proposes a novel access control scheme. This scheme combines attribute relationship evaluation with SM9-based encryption protection, aiming to achieve efficient, flexible, and secure access control.

[0056] Specifically, embodiments of the present invention provide an access control method based on attribute relationship evaluation and data encryption, such as... Figure 1 As shown, the method may include the following steps:

[0057] S1, for object data with different attributes in the data access control scenario, filter out the attribute set used for access control by comparing the relationship between the attributes;

[0058] Ranking attributes are a more core concept than computational length. In the process of big data protection, the importance of security-related attributes within each piece of big data can be assessed to rank data attributes for security purposes. This embodiment of the invention provides an attribute relationship evaluation method for filtering out high-priority attributes in data access control scenarios.

[0059] Specifically, the main process of the attribute relationship evaluation method in this embodiment of the invention is as follows: First, all attributes of the data are extracted, and then the attributes are generalized. Next, the correlation between attributes is compared and the relationship is evaluated. Finally, the selected attributes that require security measures are evaluated based on the correlation.

[0060] To facilitate understanding of this process, let's first assume the following modeling environment:

[0061] (1) The goal is to target multiple large datasets with different attributes;

[0062] (2) Each big data is considered a single object, and big data with multiple attributes can be called object data.

[0063] (3) The relationship between a specific value and an attribute is unknown.

[0064] (4) All attributes are related to each other.

[0065] Therefore, let:

[0066] OBD i This represents the i-th big data item, which can be of any object type;

[0067] Attr_x represents the "x" attribute of big data;

[0068] OBD i (Attr) indicates Big Data OBD i The set of attributes;

[0069] OBD i [Attr_x] represents the length of attribute "x" of the i-th big data;

[0070] In one optional implementation, S1 may include the following steps:

[0071] S11, acquire multiple data groups in the data access control scenario, each data group consisting of two object data with different attributes;

[0072] The data access control scenario is determined based on the actual situation. For example, it could be for a company where different data can be accessed. Each data object in this scenario can have different attributes, such as belonging to department A, office B, or financial data, etc.

[0073] For all object data in this data access control scenario, two objects can be grouped together to facilitate subsequent attribute set filtering in the form of data groups.

[0074] S12, For each data group, determine the pairwise attribute relationships between data objects in that data group to obtain the attribute relationship matrix;

[0075] The following steps, S12 to S16, illustrate using a data group as an example. For instance, Table 1 shows a data group that includes large data (object data) OBD1 and OBD2, each with multiple attributes.

[0076] Table 1 Examples of Data Sets

[0077]

[0078]

[0079] This invention assumes that all attributes are related to each other. This means that some attribute relationships have unknown values. The relationships between attributes can be decomposed into three cases.

[0080] Specifically, different attribute relationships include: equivalence relations, hierarchical relations, and unknown relations;

[0081] ① Equivalence relation: Two attributes are equivalent if attributes 'x' and 'y' are the same. That is:

[0082] Attr_x≡Attr_y;

[0083] ② Hierarchical relationship: Two attributes have a hierarchical relationship. That is:

[0084]

[0085] ③ Unknown relationship: Neither equivalence nor hierarchical relationship. That is:

[0086]

[0087] Here, it can be understood that ∧ represents AND logic; ∨ represents OR logic; and ≡ is the identity sign. This is an inequality sign.

[0088] For Table 1, OBD1(Attr) = {Attr_a, Attr_b, Attr_c, Attr_d} has four attributes; OBD2(Attr) = {Attr_a', Attr_b, Attr_e} has three attributes.

[0089] Based on Table 1, the relationship between each attribute in OBD1 and each attribute in OBD2 can be determined, thus obtaining an attribute relationship matrix, which can be seen in Table 2.

[0090] Table 2 Example of Attribute Relationship Matrix

[0091]

[0092] S13, determine the weight matrix corresponding to the attribute relationship matrix according to the weights preset for different attribute relationships;

[0093] In this embodiment of the invention, different weights are pre-set for evaluating attribute relationships. The weights are represented as scores for quantitative comparison, with "equivalent" relationships receiving the highest score, "unknown" relationships receiving the lowest score, and hierarchical relationships receiving an intermediate score.

[0094] In other words, the relationships between the pre-set weights of different attribute relationships include:

[0095] The weight of equivalence relations > the weight of hierarchical relations > the weight of unknown relations.

[0096] In one optional implementation, the weight of the equivalence relation can be 5, the weight of the hierarchical relation can be 3, and the weight of the unknown relation can be 1.

[0097] Based on the example above, the attribute relationship matrix shown in Table 2 can be transformed into a weight matrix, as shown below:

[0098]

[0099] Of course, the weights of the remaining values ​​can also be set according to the actual application requirements.

[0100] S14, calculate the length of each row vector in the weight matrix, sort all row vectors from largest to smallest according to their length, select the first few row vectors in the sorting, and use the attributes corresponding to the selected row vectors as candidate attributes.

[0101] Assume that the length of each row and column vector is proportional to the importance of the association. In this case, attribute relationships can be evaluated based on scores. Calculating the length of each row vector in the weight matrix, or calculating the length of each column vector in the weight matrix, includes:

[0102] Squaring each value in the corresponding vector and summing them together, then calculating the square root of the summation result.

[0103] Specifically, for big data OBD2, the length of each attribute (row vector) is as follows:

[0104]

[0105] Therefore, all row vectors are sorted in descending order of length, that is, the corresponding attribute lengths are sorted in descending order as follows:

[0106] Attr_b>Attr_a'>Attr_e

[0107] In this example, Attr_b can be selected as an alternative attribute, indicating that for the security association between Big Data OBD2 and Big Data OBD1, the Attr_b attribute needs to be protected with the highest level of security.

[0108] Of course, it is not necessary to simply select the attribute that ranks first as the candidate attribute.

[0109] S15, calculate the length of each column vector in the weight matrix, sort all column vectors according to their length from largest to smallest, select the first few column vectors in the sorting, and use the attributes corresponding to the selected column vectors as candidate attributes.

[0110] Specifically, for big data OBD1, the length of each attribute (column vector) is as follows:

[0111]

[0112] Therefore, all column vectors are sorted in descending order of length, that is, the corresponding attribute lengths are sorted in descending order as follows:

[0113] Attr_b>Attr_a>Attr_c=Attr_d

[0114] In this example, Attr_b can be selected as an alternative attribute, indicating that for the security association between Big Data OBD1 and Big Data OBD2, the attribute Attr_b needs to be protected with the highest level of security.

[0115] S16 is a set of attributes used for access control, consisting of all alternative attributes.

[0116] Understandably, the alternative attributes of all data groups constitute the attribute set used for access control.

[0117] S2, determine the access strategy matrix based on the attribute set;

[0118] In one optional implementation, S2 may include the following steps:

[0119] S21, Determine the access policy expression based on the relationship between the attributes in the attribute set and the actual access control requirements;

[0120] The access strategy expression is a logical expression of different access strategies, and each access strategy is determined according to the logical relationship between the corresponding attributes.

[0121] To facilitate understanding, the following example illustrates the concept. Assume the access strategy expression is: p = (a1∧a2)∨(a1∧a3∧a4), where a1, a2, a3, and a4 are attributes in the attribute set, which can also represent the corresponding access strategy. In this case, p... a Representing (a1∧a2), p b Each of (a1∧a3∧a4) represents an access strategy, and the access strategy expression can be represented as p = p a ∨p b .

[0122] S22, Determine the access strategy matrix according to the preset matrix construction rules and the logical relationships between attributes and access strategies in the access strategy expression;

[0123] The preset matrix construction rules include: all attributes in the attribute set are represented by single-entry matrices;

[0124] If the logical relationship between access strategies is an OR relationship, the access strategy matrix corresponding to the access strategy expression is represented as follows:

[0125]

[0126] If the logical relationship between access strategies is an AND relationship, the access strategy matrix corresponding to the access strategy expression is represented as follows:

[0127]

[0128] Among them, C a and R a C represents the first column and the remaining columns of the matrix corresponding to an access strategy in the access strategy expression. b and R b This represents the first column and the remaining columns of the matrix corresponding to another access strategy in the access strategy expression. Each row of the matrix formed by the access strategies corresponds to an attribute value, that is, the row vectors and attribute values ​​form a one-to-one mapping relationship.

[0129] Specifically, the above example will be used as an illustration.

[0130] Attributes a1, a2, a3, and a4 are each represented using a single-entry matrix, i.e., M. U =[1].

[0131] Matrix M a Indicates access policy p a C a Indicates access policy p a The corresponding matrix M a The first column, R a Indicates access policy p a The corresponding matrix M a The remaining columns of matrix M, excluding the first column. b Indicates access policy p b C b Indicates access policy p b The corresponding matrix M b The first column, R b Indicates access policy p b The corresponding matrix M b The remaining columns other than the first column.

[0132] For access strategy p a p a =(a1∧a2)=[1]∧[1], by available:

[0133]

[0134] Similarly, for p b =(a1∧a3∧a4), we can get:

[0135]

[0136] For the access strategy p = pa ∨p b ,according to The access strategy matrix can be obtained as follows:

[0137]

[0138] In this matrix, each row of the access strategy matrix is ​​represented in sequence as a1, a2, a1, a3, a4.

[0139] S3, encrypt the plaintext data using the SM9 encryption algorithm to obtain the secret value;

[0140] In practical applications, most encrypted files have an attribute policy when shared or accessed. The secret value can only be obtained when this attribute policy (conditions) are met. For example, for a secret value file that only manager C of office B under department A can access, the access conditions can be decomposed into an attribute set: [Department A, Office B, Manager C]. Only when all conditions in this attribute set are met can the secret value file be obtained. If we let p1 represent department A, p2 represent office B, p3 represent manager C, and p represent the access conditions (access policy), then p can be represented as:

[0141] p = p1∧p2∧p3;

[0142] There are many encryption methods for protecting secret value files. Among them, attribute-based encryption is an encryption technique that binds user identity to a series of attributes. This invention mainly uses the SM9 encryption algorithm to encrypt and protect plaintext values ​​to obtain secret value files.

[0143] The SM9 encryption algorithm is an identity-based public-key cryptography algorithm. Unlike the common RSA public-key cryptography algorithm, the public key of an identity-based cryptography algorithm is a user's identity identifier, such as an email address or ID card number, and the user's private key is generated using the user's identity identifier and the system master key.

[0144] The SM9 encryption algorithm is based on the finite field elliptic curve group and consists of four phases: initialization phase, key generation phase, encryption phase, and decryption phase.

[0145] 1) Setup(λ): The initialization phase of the algorithm. Given the safety parameter λ; the bilinear group BP = (G1, G2, G... T G(e,N), where N is a large prime number related to the safety parameter, G1 and G2 are additive groups of order N, and G... T It is an N-order multiplicative group, e: G1×G2→G T Satisfies bilinearity and nondegeneracy; H1: Let H1 represent a hash function that transforms a binary string of arbitrary length into a multiplicative group modulo N, where H1 denotes the hash function, {0,1}. * Let H1 be the domain of function H1, representing the set of all possible binary strings, and → denote a mapping. The range of function H1 represents the multiplicative group modulo N; specifically, it represents the set of all integers coprime to N. The private key generation function identifier `hid` is represented by one byte, and the algorithm randomly selects P1∈G1, P2∈G2, and a random number a∈Z. N Calculate P pub =aP1 and set g=e(P pub (P2).

[0146] Public parameters (master public key) mpk = {BP, P1, P2, P...} pub ,g,H1,hid},Master private key msk=a.

[0147] 2) KeyGen(mpk,msk,ID): The key generation phase of the algorithm. Given an identifier ID, the algorithm first calculates t1 = H1(ID||hid,N) + a(mod N). If t1 = 0, the key generation center KGC reselects the master key a∈Z. N Calculate and publish the corresponding master public key P pub And g, recalculate the existing user's decryption key sk. Otherwise, KGC calculates... and

[0148] 3) Encrypt(mpk, X, ID): The encryption phase of the algorithm. Given an identifier ID, the algorithm first selects a random number s ∈ Z. N And calculate Q ID =H1(ID||hid,N)P1+P pub Then, calculate the ciphertext S = (C1 = Xg) s C2 = sQ ID In this context, the plaintext data X is the message value. Using the Encrypt algorithm, the message value X can be encrypted based on identity to obtain the encrypted value (secret value, also known as ciphertext) S.

[0149] 4) Decrypt(mpk,S,sk) ID ): The decryption phase of the algorithm. If it is necessary to decrypt the secret value S, the Decrypt algorithm can be used to decrypt S. Once a secret value S and a decryption key sk are received... ID The algorithm first calculates w = e(C2, sk ID Then output plaintext data.

[0150] In this embodiment of the invention, this step involves encrypting the plaintext data using the SM9 algorithm to obtain a secret value S. Access to this secret value S can then be controlled through an access policy matrix, allowing access only when the access conditions are met. Finally, the secret value S is decrypted to obtain the final plaintext data X.

[0151] S4, Construct a secret sharing matrix based on the secret value;

[0152] This step includes:

[0153] The secret value and a set of random numbers are combined to form a one-dimensional column vector, which serves as the secret sharing matrix.

[0154] Specifically, the secret sharing matrix can be represented as:

[0155] ρ=(S,ρ2,…,ρ e );

[0156] Where S represents the secret value; ρ2,…,ρ e Represents a set of random numbers.

[0157] S5, the access policy matrix is ​​calculated using the secret sharing matrix to obtain encrypted attribute values. The encrypted attribute values ​​are used as access control conditions to limit the eligibility of users whose attributes match the access control conditions to calculate plaintext data in order to achieve the access purpose.

[0158] The access policy matrix is ​​calculated using the secret sharing matrix to obtain encrypted attribute values, including:

[0159] Multiplying the access policy matrix and the secret sharing matrix yields the encrypted attribute value. The encrypted attribute value can be represented as:

[0160] M·ρ=(s1,…,s d ) T ;

[0161] Where s1,…,s d This represents the individual values ​​in the encrypted attribute values, and T represents the matrix transpose.

[0162] Using the example above, assume that the plaintext data is encrypted using the SM9 encryption algorithm, resulting in a secret value S = 2, and that the secret sharing matrix is ​​ρ = (2, 3, 1, 4). T The encrypted attribute value M·ρ is then represented as:

[0163]

[0164] That is, the encrypted attribute value is (5,3,7,4,1).T .

[0165] In this embodiment of the invention, the encrypted attribute value serves as an access control condition, used to limit the eligibility of users whose attributes match the access control condition to calculate plaintext data in order to achieve the access purpose.

[0166] Specifically, the process of calculating plaintext data for users whose attributes match the access control conditions includes:

[0167] (1) Users whose attributes match the access control conditions obtain the corresponding access matrix M using the attribute values ​​they possess. A ;

[0168] Users whose attributes match the access control conditions possess attribute values ​​that correspond to the known partial attributes, specifically the value of M·ρ, denoted as M. A ·ρ. Where M A This is the access matrix.

[0169] (2) Using the access matrix M A Access coefficient λ A And the relationship between the target vector ε and the access coefficient λ can be solved. A ;

[0170] In this embodiment of the invention, there exists a target vector ε = (1, 0, ..., 0). T It can make This formula is for the access matrix M A Access coefficient λ A And the relationship between the target vector ε and the equation, through which the corresponding access coefficient λ can be obtained. A .

[0171] For the example above, assume that the requesting user already possesses the secret values ​​corresponding to attributes a1 and a2, that is, the requesting user satisfies the access policy condition (a1∧a2), and the value M of M·ρ corresponding to attributes a1 and a2 is known. A ·ρ. Then, at this point, the user can first solve for λ. A The values. Specifically, take the row vectors corresponding to the attribute values ​​of matrices a1 and a2, transpose them, and form a new matrix:

[0172]

[0173] Then use The calculation yielded:

[0174]

[0175] λ can be solved A = (1, -1).

[0176] (3) Based on the encrypted attribute value and the calculated access coefficient λ A And the formula for calculating the secret value, to solve for the secret value;

[0177] The formula for calculating the secret value is expressed as follows:

[0178]

[0179] The above formula is based on M·ρ=(s1,…,s d ) T Received. S A T ρ represents the request matrix; M represents the secret sharing matrix; A ·ρ represents the product of the access matrix and the secret sharing matrix; S represents the secret value.

[0180] For the example above, since M·ρ=(5,3) T , λ A = (1, -1), substituting into the formula for calculating the secret value, we can obtain the secret value as:

[0181] S=(M·ρ)·λ A =2;

[0182] (4) The secret value is decrypted using the SM9 decryption algorithm to obtain the plaintext data.

[0183] The requesting user can decrypt the secret value S using the SM9 algorithm to obtain the final plaintext data, thus the access is successful. For details on the encryption and decryption process of the SM9 algorithm, please refer to the relevant technical explanations, which will not be explained in detail here.

[0184] The solution provided in this invention first selects a set of attributes for access control by comparing the relationships between object data with different attributes in a data access control scenario. Second, an access policy matrix is ​​determined based on the attribute set. Next, plaintext data is encrypted using the SM9 encryption algorithm to obtain a secret value. Then, a secret sharing matrix is ​​constructed based on the secret value. Finally, the access policy matrix is ​​calculated using the secret sharing matrix to obtain encrypted attribute values. These encrypted attribute values ​​serve as access control conditions, limiting users whose attributes match the access control conditions to the ability to calculate plaintext data, thus achieving the access purpose. This invention combines attribute relationship evaluation with SM9-based encryption protection. By scientifically evaluating and selecting attributes, a linear secret sharing matrix is ​​constructed for access control, and the SM9 algorithm is used for data encryption. This ensures that only users meeting specific conditions can access the data, significantly improving access control efficiency, enhancing security, and saving computing resources and storage space.

[0185] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. An access control method based on attribute relationship evaluation and data encryption, characterized in that, include: For object data with different attributes in a data access control scenario, the set of attributes used for access control is selected by comparing the relationships between the attributes. Determine the access strategy matrix based on the attribute set; The plaintext data is encrypted using the SM9 encryption algorithm to obtain the secret value; Construct a secret sharing matrix based on the secret value; The access policy matrix is ​​calculated using the secret sharing matrix to obtain encrypted attribute values. These encrypted attribute values ​​serve as access control conditions, which are used to limit the eligibility of users whose attributes match the access control conditions to calculate plaintext data in order to achieve the access purpose. Specifically, in the data access control scenario, for object data with different attributes, the set of attributes used for access control is selected by comparing the relationships between attributes, including: In a data access control scenario, multiple data groups are acquired, each consisting of two object data with different attributes. For each data group, determine the pairwise attribute relationships between the data objects in that data group to obtain the attribute relationship matrix; The weight matrix corresponding to the attribute relationship matrix is ​​determined based on the pre-set weights for different attribute relationships; Calculate the length of each row vector in the weight matrix, sort all row vectors from largest to smallest according to their length, select the top row vectors, and use the attributes corresponding to the selected row vectors as candidate attributes. Calculate the length of each column vector in the weight matrix, sort all column vectors in descending order of length, select the top column vectors, and use the attributes corresponding to the selected column vectors as candidate attributes. The set of attributes used for access control consists of all the alternative attributes.

2. The access control method based on attribute relationship evaluation and data encryption according to claim 1, characterized in that, Different attribute relationships include: equivalence relations, hierarchical relations, and unknown relations; The relationships between pre-set weights of different attribute relationships include: The weight of equivalence relations > the weight of hierarchical relations > the weight of unknown relations.

3. The access control method based on attribute relationship evaluation and data encryption according to claim 1, characterized in that, Calculating the length of each row vector in the weight matrix, or calculating the length of each column vector in the weight matrix, includes: Squaring each value in the corresponding vector and summing them together, then calculating the square root of the summation result.

4. The access control method based on attribute relationship evaluation and data encryption according to claim 1, characterized in that, Determine the access strategy matrix based on the attribute set, including: Based on the relationships between attributes in the attribute set and the actual access control requirements, an access policy expression is determined; wherein, the access policy expression is a logical expression of different access policies, and each access policy is determined according to the logical relationship between the corresponding attributes. The access strategy matrix is ​​determined based on the preset matrix construction rules and the logical relationships between attributes and access strategies in the access strategy expression. The preset matrix construction rules include: all attributes in the attribute set are represented by single-entry matrices; If the logical relationship between access strategies is an OR relationship, the access strategy matrix corresponding to the access strategy expression is represented as follows: ； If the logical relationship between access strategies is an AND relationship, the access strategy matrix corresponding to the access strategy expression is represented as follows: ； in, and This represents the first column and the remaining columns of the matrix corresponding to an access strategy in the access strategy expression. and The first column and the remaining columns of the matrix corresponding to another access strategy in the access strategy expression are represented.

5. The access control method based on attribute relationship evaluation and data encryption according to claim 1, characterized in that, Constructing a secret sharing matrix based on the secret value includes: The secret value and a set of random numbers are combined to form a one-dimensional column vector, which serves as the secret sharing matrix.

6. The access control method based on attribute relationship evaluation and data encryption according to claim 5, characterized in that, The access policy matrix is ​​calculated using the secret sharing matrix to obtain encrypted attribute values, including: Multiply the access policy matrix and the secret sharing matrix to obtain the encrypted attribute value.

7. The access control method based on attribute relationship evaluation and data encryption according to claim 6, characterized in that, The process of calculating plaintext data for users whose attributes match the access control conditions includes: Users whose attributes match the access control conditions can obtain the corresponding access matrix using their attribute values. ; Using access matrix Access coefficient and target vector The relationship is used to solve for the access coefficient. ; Based on the encrypted attribute value and the calculated access coefficient And the formula for calculating the secret value, to solve for the secret value; The secret value is decrypted using the SM9 decryption algorithm to obtain the plaintext data.

8. The access control method based on attribute relationship evaluation and data encryption according to claim 7, characterized in that, The access matrix Access coefficient and target vector The relation is expressed as: ； in, Indicates matrix transpose; .

9. The access control method based on attribute relationship evaluation and data encryption according to claim 8, characterized in that, The formula for calculating the secret value is expressed as follows: ； in, Represents the request matrix; Represents a secret sharing matrix; This represents the product of the access matrix and the secret sharing matrix; This represents the secret value.

Images