An edge device traceable data flow transfer method based on identity-based proxy re-encryption

Abstract

The application discloses an edge device traceable data flow conversion method based on identity proxy re-encryption, which fuses a digital signature technology into an identity proxy re-encryption method, takes a traditional identity proxy re-encryption technology as a framework, and innovates a new key generation method without participation of a key generation center in key generation by fusing a key generation technology including distributed key generation and weakening influence of the key generation center; and combines a method of fusion encryption and decryption and tracing including certificateless signature to bind a data tracing function with the identity proxy re-encryption technology, so that encryption and decryption and tracing are integrated in a data flow conversion process; wherein the tracing method is realized by the digital signature technology to realize the data tracing function. The application binds identity information of participants in the data flow conversion process, and data is converted in a cipher text form in an entire process, and a user side can also perform a tracing operation on the data after receiving the data to verify whether the data is tampered in the conversion process.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of data security and information hiding, and relates to a method for eliminating the influence of key generation center and realizing efficient data traceable circulation by coupling identity proxy re-encryption technology and digital signature technology. BACKGROUND

[0002] Data circulation refers to the process of data flowing from one node to other nodes through a series of processing and transmission steps in a data system.

[0003] This process usually involves data collection, processing, storage, analysis, etc., with the purpose of ensuring the effective flow of data from generation to use. With the development of data element market, as a key technical solution for data security circulation, how to improve the efficiency and security of data circulation is the future research direction.

[0004] In the past, data circulation mainly relied on plaintext mode, for example, the government directly provided plaintext information to commercial banks. However, with the introduction of security laws and personal information protection laws, governments and enterprises pay more and more attention to the ownership and security of data. Therefore, the introduction of proxy re-encryption technology into the circulation process is just around the corner, which can ensure the ownership of data in the calculation process, maximize the value of data, and provide security for data providers and demanders, reducing concerns.

[0005] The goal of data circulation is to realize the safe circulation of data through various privacy computing technologies, while protecting the privacy and ownership of data, thereby promoting the development of data element market and releasing greater data value. It plays a crucial role in enterprise operations.

[0006] Data protection methods refer to technologies and strategies used to protect data from unauthorized access, disclosure, tampering and destruction. These methods ensure the confidentiality, integrity and availability of data.

[0007] Since traditional proxy re-encryption cannot eliminate the high dependence on key generation center, for specific business scenarios of data circulation, combined with digital signature traceability algorithm, and combined with security demand scenarios under big data application and data transaction, the present application chooses to couple digital signature and identity proxy re-encryption to realize the functions of no key generation center and data traceability, and complete the data security demand operation. SUMMARY

[0008] The purpose of the present application is to provide an edge device traceable data circulation method based on identity proxy re-encryption to overcome the shortcomings of the prior art.

[0009] Based on the first main aspect of the application, an edge device traceable data flow transfer method based on identity proxy re-encryption is provided, which integrates digital signature technology into the identity proxy re-encryption method, takes the traditional identity proxy re-encryption technology as a framework, and innovates a new key generation method without the participation of a key generation center in key generation by integrating key generation technologies that weaken the influence of the key generation center, including distributed key generation;

[0010] In addition, by combining the fusion encryption and decryption and tracing method including the certificateless signature, the data tracing function is bound with the identity proxy re-encryption technology, and the encryption and decryption tracing integration in the data flow transfer process is realized.

[0011] The tracing method is realized by the digital signature technology.

[0012] In some embodiments, as a further preferred solution, the method comprises the following steps:

[0013] S100: design the public parameters required for calculation, and design the key generation method of the system participants;

[0014] S200: After the data source selects a random number, the auxiliary ciphertext and auxiliary parameters are calculated, the shared key, verification key and re-encryption key are calculated and distributed, and finally the plaintext is signed, the plaintext is encrypted and distributed;

[0015] S300: After the proxy receives all the parameters and ciphertexts, the ciphertexts are re-encrypted and distributed;

[0016] S400: After the user receives the ciphertexts and required parameters, the integrity of the re-encrypted ciphertexts is verified, and if the verification is successful, the plaintext is decrypted, the integrity of the plaintext is verified, and the data flow transfer is completed.

[0017] As a further preferred solution, in the above solution, the S100 comprises the following steps:

[0018] S110: There are two participants, namely the data source and the user, wherein the user is the data receiver;

[0019] S120: The key generation is combined with the identity encryption to generate the identity information, which weakens the influence of the KGC;

[0020] S130: Based on the identity information generated key, the key generation method of the certificateless encryption is combined, the private key is split into two parts, one part is a random number, and the other part is a key calculated based on the identity information and public parameters, and the two parts together form the private key;

[0021] S140: On this basis, combined with the method of distributed key, a new public key calculation formula is adopted, which is convenient for subsequent shared key generation calculation.

[0022] As a further preferred scheme, in the above scheme, the S200 comprises the following steps:

[0023] S210: Select a random number from the above to participate in subsequent encryption process parameter calculation;

[0024] S220: Use the public and private keys of the participants and the random number to calculate the shared key, auxiliary ciphertext, and combine the public parameters to perform encryption operation on the plaintext mainly by XOR operation, reduce the encryption process calculation overhead;

[0025] S230: Use the public and private keys of the participants and the random number to calculate the auxiliary parameters and combine the public parameters to perform signature operation on the plaintext, realize the data traceability function;

[0026] S240: Use the public and private keys of the participants, auxiliary ciphertext and encrypted ciphertext to calculate verification key and send to user side, realize the function of verifying the integrity of ciphertext;

[0027] S250: Use the public and private keys of the participants and the random number, combine the bilinear mapping and the public parameters to calculate the re-encryption key and send it to the proxy side, according to the different decryption objects, modify the re-encryption key calculation formula, complete the dynamic decryption permission control.

[0028] As a further preferred scheme, in the above scheme, the S400 comprises the following steps:

[0029] S410: After obtaining the re-encrypted re-ciphertext, according to the received data; Calculate the verification key and compare it with the received verification key, if they are consistent, it proves that the proxy has not tampered with, and the integrity of the ciphertext is verified;

[0030] S420: After verifying the integrity of the ciphertext, decrypt the re-ciphertext to get the plaintext information;

[0031] S430: After decrypting the plaintext, according to the received signature information, recalculate the auxiliary parameters, and participate in the calculation of signature with the decrypted plaintext, if the calculated signature information is consistent with the received signature, it proves that the plaintext has not been tampered with, the integrity of the plaintext is verified, and the plaintext is also traced.

[0032] In some embodiments, as a further preferred scheme, the new public key calculation formula comprises:

[0033] The data source party generates public key as:

[0034]

[0035] The public key generated by the user side is:

[0036]

[0037] wherein, is a random number selected by the data source side, g is a generator, g [e] G1, G1 is a defined cyclic group, H1 is a hash function, H1: {0, 1} * → G1; is a random number selected by the user side; p pub is a public key.

[0038] Based on the second main aspect of the application, an identity-based proxy re-encryption edge device traceable data flow transfer device for the foregoing method is provided, comprising:

[0039] A key design module is used for designing key generation of participants, establishing a more secure decentralized key generation method not affected by the KGC;

[0040] A data encryption signature module is used for calculating parameters including auxiliary ciphertext and signing and encrypting plaintext, completing the protection and traceability functions of data;

[0041] A re-encryption module is used for twice encryption of ciphertext, including dynamically setting decryption permissions, so that only specific users can decrypt the ciphertext;

[0042] A data decryption verification module is used for obtaining plaintext information after decrypting the re-encrypted ciphertext, and performing integrity verification on the ciphertext and the decrypted plaintext.

[0043] Based on the third main aspect of the application, an electronic device is provided, comprising: at least one processor; a memory in communication connection with the at least one processor; the memory stores a computer program, when executed by the at least one processor, enables the at least one processor to implement the identity-based proxy re-encryption edge device traceable data flow transfer method as described above.

[0044] Based on the fourth main aspect of the application, a computer readable storage medium is provided, which stores a computer program, and the program is executed to implement the identity-based proxy re-encryption edge device traceable data flow transfer method as described above.

[0045] Advantages and beneficial effects of the present application:

[0046] The present application is directed to the data storage, transmission and calculation of data flow conversion in edge computing network data transaction, and the privacy protection and security guarantee problem, and the data reseller acts as a data transaction agent when reselling the data source, so that a traceable data flow conversion (LTP-CLE) scheme based on identity proxy re-encryption can be realized, the identity information of the participants in the data flow conversion process is bound, the data flows in the form of ciphertext throughout the process, and the user can also perform traceability operation on the data, and check whether tampering has occurred in the flow conversion process.

[0047] The basic idea of such operation is to integrate digital signature technology into identity proxy re-encryption method. Specifically, the present application takes the traditional identity proxy re-encryption technology as the framework, and innovates a new key generation method without key generation center participating in key generation by integrating several key generation technologies such as distributed key generation to weaken the influence of key generation center, solves the single point failure and key management difficulty problem caused by key generation center. And combined with the technology idea of integrating encryption and decryption and traceability such as certificateless signcryption, the data traceability function is bound with the identity proxy re-encryption technology, and the integration of encryption and decryption traceability in the data flow conversion process is realized.

[0048] The traceability method of the present application selects digital signature technology to realize the data traceability function. In this way, the calculation overhead in the data flow conversion process can be effectively reduced, and the flow conversion efficiency and security are not affected.

[0049] The present application can be used for efficient data flow conversion on edge devices with limited computing power, verifying the data integrity in data flow conversion, and increasing security and autonomy while ensuring data integrity. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 An introduction diagram of KGC key generation mode in an embodiment of the present application is shown;

[0051] Figure 2 An introduction diagram of identity proxy re-encryption process in an embodiment of the present application is shown;

[0052] Figure 3 An introduction diagram of data traceability process in an embodiment of the present application is shown;

[0053] Figure 4 A total flow chart after the scheme is realized in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0054] The preferred embodiments of the present application will be described in detail below, so that the purpose, characteristics and advantages of the present application can be more clearly understood. It should be understood that the following embodiments are not a limitation on the scope of the present application, but only to illustrate the essential spirit of the technical scheme of the present application.

[0055] In the following description, for purposes of explanation, specific details are set forth to provide a thorough understanding of various disclosed embodiments. However, one of ordinary skill in the relevant arts will appreciate that the embodiments can be practiced without one or more of the specific details, or with other methods, components, materials, and so forth. In other instances, well-known structures and functions are not shown or described in order to avoid obscuring the description.

[0056] Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearances of the phrase "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0057] First step, parameter preparation.

[0058] (1) Public parameter pre-architecture.

[0059] Define two order as large prime number p cyclic group G1 group and G T , select g e G1 defined as the generator, defined a bilinear mapping e: G1 x G1→ G T . Define hash function H1: {0, 1} * → G1 and H2: G T → {0, 1} * , H1 identity code mapping to G1 group, H2 G T group element into a binary bit string, select a random number as the system master key, calculate the public key P pub = sg, the public parameters of the system end here.

[0060] (2) Key generation and distribution.

[0061] The data source party and the user party participating in the data flow transfer independently select their own identity information as the key generation base, the identity information of the data source party is defined as ID1, and the identity information of the user party is defined as ID u . Then, the public parameters are used to generate their own partial private key and public key, and finally a random number is selected to form their own complete private key. The key generation calculation formula of the data source party and the user party is as follows:

[0062] Data source party partial private key:

[0063]

[0064] The data source party selects a random number to generate a complete private key:

[0065]

[0066] The data source generates a public key as follows:

[0067]

[0068] The user generates a partial private key as follows:

[0069]

[0070] The user selects a random number The complete private key is generated as follows:

[0071]

[0072] The public key generated by the user is as follows:

[0073]

[0074] Step 2: Data encryption and signature process

[0075] The data encryption and signature process is mainly implemented and explained through the following steps:

[0076] First, the data source selects a random number Calculate the auxiliary ciphertext c1 and send it to the user and the agent:

[0077] c1 = g r

[0078] Then, the data source uses the selected random number The user's public key and the data source's partial private key to calculate the shared key K:

[0079]

[0080] After that, the data source uses the shared key K and the generator to encrypt the data plaintext M to get the ciphertext c2:

[0081]

[0082] The data source selects another random number Calculate the auxiliary parameter x, and then use the auxiliary parameter to sign the plaintext information v:

[0083]

[0084] Calculate the second signature auxiliary parameter U, and send the signature sign(U, v) to the data side:

[0085]

[0086] Data source calculates verification key R1, and assists in verifying the integrity of the encrypted ciphertext:

[0087]

[0088] Finally, the data source calculates a re-encryption key and sends it to the agent:

[0089]

[0090] Third step, re-encryption process

[0091] After receiving the re-encryption key sent by the data source, the agent side starts re-encryption operation: After receiving the re-encryption key sent by the data source, the agent side starts re-encryption operation:

[0092]

[0093] After the re-encryption is completed, the re-encrypted ciphertext c'2 is sent to the user, and the re-encryption process is completed.

[0094] Fourth step, data decryption verification process

[0095] After receiving the re-encrypted ciphertext of the agent, the user calculates R1 using the public key of the data source and the auxiliary ciphertext, and verifies whether the ciphertext is tampered with.

[0096]

[0097] If R1'=R1, the ciphertext has not been tampered with in the process of transmission

[0098] Then the user decrypts the re-encrypted ciphertext c2 according to the public key of the user, the system master key, the auxiliary ciphertext c1, and finally decrypts the plaintext M by combining the shared key and the generator:

[0099]

[0100] After obtaining the plaintext M, the auxiliary parameter x' is calculated according to the public key and the auxiliary ciphertext c1, and the signature information sign(U, v) sent by the data source is combined to verify the signature information v, if v'=v, the plaintext is not tampered with.

[0101] x'=e(U,g)e(c1,-P pub ) v

[0102]

[0103] The details of the present application are well known to those skilled in the art.

[0104] The foregoing is considered as illustrative only of the principles of the application and the forms thereof shown and described by way of example. Further, those skilled in the art will realize that the mechanism of the present application is capable of other modes of practice and still be within the spirit and scope of the application. For example, the application can be used in other types of systems and / or methods. The disclosure should be understood, therefore, as not being so limited, but rather directed primarily to the principal of the application and the major features thereof. Further, changes and modifications can be obvious to those skilled in the art, and are intended to be included within the spirit and scope of the application as defined by the following claims.

Claims

1. An edge device traceable data flow transfer method based on identity-based proxy re-encryption, characterized in that, It comprises the following steps: S100: design the public parameters required for calculation, and design the key generation method of the system participants; S200: After the data source party selects a random number, calculate the auxiliary ciphertext and auxiliary parameters, calculate the shared key, verification key and re-encryption key and distribute them, and finally sign the plaintext, encrypt the plaintext and distribute it; S300: After the agent party receives all the parameters and ciphertexts, re-encrypt the ciphertexts and distribute them; S400: After the user party receives the ciphertexts and required parameters, perform integrity verification on the re-encrypted ciphertexts, and if the verification is successful, decrypt the plaintext to obtain the plaintext, and perform integrity verification on the plaintext, and the data flow is completed; S100 comprises the following steps: S110: There are two participants, namely the data source party and the user party, wherein the user party is the data receiving party; S120: The key generation is based on identity encryption, which uses identity information as the basis to generate, and weakens the influence of KGC; S130: Based on the identity information generated key, combined with the key generation method of certificateless encryption, the private key is split into two parts, one part is a random number, and the other part is a key calculated based on the identity information combined with the public parameter, and the two parts together form the private key; S140: On this basis, combined with the method of distributed key, a new public key calculation formula is adopted, which is convenient for subsequent shared key generation calculation; S200 comprises the following steps: S210: Select a random number from the above, participate in subsequent encryption process parameter calculation; S220: Use the public and private keys of the participants and the random number to calculate the shared key, auxiliary ciphertext and combine the public parameters to perform encryption operation on the plaintext mainly by using XOR operation, to reduce the encryption process calculation overhead; S230: Use the public and private keys of the participants and the random number to calculate the auxiliary parameters and combine the public parameters to perform signature operation on the plaintext, to realize the data traceability function; S240: Use the public and private keys of the participants, auxiliary ciphertext and encrypted ciphertext to calculate the verification key and send it to the user party, to realize the function of verifying the integrity of the ciphertext; S250: Use the public and private keys of the participants and the random number, combined with the bilinear mapping and the public parameters, to calculate the re-encryption key and send it to the agent party, according to the different decryption objects, modify the re-encryption key calculation formula, and complete the dynamic decryption permission control; The new public key calculation formula comprises: The public key generated by the data source party is: The public key generated by the user party is: wherein, is a random number selected by the data source party, g is a generator, g ∈ G1, G1 is a defined cyclic group, H1 is a hash function, is a random number selected by the user party; p pub is a public key.

2. The edge device traceable data flow transfer method based on identity-based proxy re-encryption according to claim 1, characterized in that: S400 comprises the following steps: S410: After obtaining the re-encrypted ciphertext, compare the received data with the received verification key to prove that the agent party has not tampered with it, and verify the integrity of the ciphertext; S420: After verifying the integrity of the ciphertext, decrypt the re-encrypted ciphertext to obtain the plaintext information; S430: After decrypting the plaintext, calculate the auxiliary parameters again according to the received signature information, and participate in the calculation of the signature with the decrypted plaintext, if the calculated signature information is consistent with the received signature, it proves that the plaintext has not been tampered with, and the integrity of the plaintext is verified, and the plaintext is also traced.

3. An edge device traceable data flow transfer apparatus for implementing the method of claim 1 or 2 based on identity-based proxy re-encryption, characterized in that, It comprises: A key design module for designing the key generation of participants to establish a more secure decentralized key generation method that is not affected by KGC; A data encryption signature module is configured to calculate parameters including auxiliary ciphertext and sign the encrypted plaintext, thereby completing the protection and traceability of data; A re-encryption module is configured to perform secondary encryption on the ciphertext, including dynamically setting decryption permissions, so that only specific users can decrypt the ciphertext; A data decryption verification module is configured to obtain the plaintext information by decrypting the re-encrypted ciphertext, and perform integrity verification on the ciphertext and the decrypted plaintext.

4. An electronic device, comprising: Comprise: at least one processor; a memory connected in communication with the at least one processor; The memory stores a computer program which, when executed by the at least one processor, enables the at least one processor to implement the identity-based proxy re-encryption-based edge device traceable data flow transfer method of claim 1 or 2.

5. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed to implement the identity-based proxy re-encryption-based edge device traceable data flow transfer method of claim 1 or 2.

Images