An access control method based on outsourced computing and attribute-based searchable encryption on blockchain

Abstract

The present invention relates to the field of data sharing and specifically discloses an access control method based on outsourced computing and attribute-based searchable encryption on a blockchain. The method comprises the following steps: S1: an attribute authority initializes and generates a system public key and a master key, and generates a user's attribute private key; S2: a data owner formulates an access control policy and assists an outsourced encryption service provider in partial encryption. The data user and the outsourced encryption service provider encrypt keywords, data ciphertext storage addresses, and symmetric keys, and upload the encrypted ciphertext to the blockchain for storage; S3: the data user generates a search trapdoor and sends it to the blockchain to verify the user's attributes; S4: the data user assists an outsourced decryption service provider in partially decrypting the ciphertext, locally decrypting to obtain the data storage address and symmetric key, downloading the data ciphertext, and decrypting it using the symmetric key to obtain the data plaintext. The present invention reduces the computational burden of encryption and decryption for local users and improves the efficiency and security of data sharing.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security data sharing, and in particular to an access control method based on outsourced computing and attribute-based searchable encryption on a blockchain. Background Art

[0002] With the rapid development of cloud computing, data has become the most critical resource in the internet age. In this context, cross-domain data exchange and sharing are becoming increasingly important, and the role of access control mechanisms is becoming increasingly prominent. The primary purpose of access control is to protect the security of data resources and ensure that confidentiality, integrity, and availability are effectively maintained under various security requirements. By formulating appropriate access control policies, access control restricts the access rights of subjects (such as users) to resources, ensuring that only legitimate users can access and operate relevant data. Existing access control mechanisms can effectively manage and control access rights within a single administrative domain, ensuring data security. However, with the rapid growth in data sharing needs and the increase in collaboration and business transactions between enterprises and organizations, the secure exchange of cross-domain data has become particularly important.

[0003] Outsourced encryption and decryption technology refers to the process of transferring encryption and decryption operations from traditional local systems or devices to a third party, such as a cloud service provider. When processing data, it allows users to outsource computationally intensive encryption and decryption operations to cloud services, thereby reducing the consumption of local computing resources and improving system efficiency and flexibility. When outsourcing encryption, users delegate encryption operations to a cloud service provider or third party. In this scenario, data is encrypted before storage or transmission, ensuring that it cannot be read or tampered with, even if accessed externally. When outsourcing decryption, in addition to outsourced encryption, it allows a third party to decrypt encrypted data if certain conditions are met. Through effective encryption and decryption control and permission management, it can be ensured that only qualified users or services can decrypt data, and decryption operations can be performed by a third party.

[0004] Blockchain is a distributed ledger that connects multiple data blocks in chronological order. It is decentralized, tamper-proof, collectively maintained, and fully traceable. It utilizes encryption algorithms to ensure data security, transparency, and immutability. When sharing data between multiple institutions or businesses, blockchain provides a trusted, neutral platform, eliminating the trust issues inherent in traditional data sharing. Through a consensus mechanism, blockchain ensures data consistency and coordination among all parties.

[0005] Attribute-based searchable encryption (ABE) is a cryptographic technique that combines attribute-based encryption (ABE) and searchable encryption (SE). When data is encrypted, it is not only bound to access control policies (for example, data can only be decrypted by users with certain attributes), but also enables encrypted queries based on keywords or attributes. During searches, query requests are matched against the attributes of the encrypted data. Only users who meet the access control policies can perform searches, and the actual content of the data is not exposed during searches. This allows secure queries of specific attributes within encrypted data. With the increasing demand for cloud computing, data sharing, and privacy protection, this technology is gaining increasing attention. It is particularly suitable for scenarios requiring fine-grained access control and efficient data retrieval. Summary of the Invention

[0006] In order to solve the problems of high local computing overhead and low data sharing efficiency in existing attribute-based encryption, the present invention provides an access control method based on outsourced computing and attribute-based searchable encryption on the blockchain, which can reduce local user computing overhead while improving data sharing efficiency and security.

[0007] To achieve the above objectives, the present invention proposes an access control method based on outsourced computing and attribute-based searchable encryption on the blockchain. The method comprises the following steps:

[0008] S1. The trusted authority AA initializes and generates the system public key PK and master key MSK, and generates the user attribute private key based on the attribute set of the data user;

[0009] S2. The data owner formulates an access control policy and assists the outsourced encryption service provider in performing partial encryption. The data user and the outsourced encryption service provider encrypt the keywords, data ciphertext storage address, and symmetric key and upload the encrypted ciphertext to the blockchain for storage.

[0010] S3: The data user generates a search trapdoor and sends it to the blockchain. The search trapdoor contract is called to verify the user's attributes. If the user's attributes meet the access control policy, the relevant ciphertext corresponding to the keyword is returned to the data user.

[0011] S4. The data user first assists the outsourced decryption service provider to decrypt the ciphertext, then decrypts it locally to obtain the data storage address and symmetric key. The data ciphertext is downloaded from IPFS according to the storage address, and finally the symmetric key is used to decrypt the data ciphertext to obtain the data plaintext.

[0012] Preferably, in S1, the specific steps for the trusted authority to initialize and generate the system public key PK and the master key MSK are:

[0013] The trusted authority AA executes the initialization algorithm Setup(1 λ )→(PK,MSK), input security parameter λ, generate a multiplication cyclic group G1 and G with prime order p T , given a bilinear mapping pair e:G1×G1→G T , define two random anti-collision Hash functions, for each attribute i∈U, randomly select parameters t1, t2, t3, and calculate e(g, g) respectively α 、g β , generate the system public key PK and master key MSK:

[0014]

[0015] MSK={t1,t2,t3,α,β};

[0016] Where, e(g,g) α and g β All of them are mathematical formulas about double mapping pairs in cryptography, and are calculation results. They are components of the system public key PK. g is the generator of G1, and the mapping relationship H1:{0,1} * →G1, represents the finite field of 1, 2, ..., p-1, {0,1} * represents a set of bit strings of arbitrary length, U is a set of system properties, and two integers are randomly selected from the finite field

[0017] Preferably, in S1, the specific steps for the trusted authority to generate the user attribute private key based on the attribute set of the data user are:

[0018] S11. The trusted authority AA executes the key generation algorithm KeyGenblind(PK,MSK,S)→(SK), inputs the system public key PK, the master key MSK and the user attribute set S, and the trusted authority AA uses the Schnorr protocol to blind each user attribute i, i∈S, calculates Q, L, and calculates the challenge σ i ,calculate Challenges i The response is calculated as:

[0019] Q = z·G;

[0020] L = m·G;

[0021] σ i =H2(G‖Q‖P‖j);

[0022]

[0023] Where Q represents the blinded public key, L represents the calculated value of the signature bound to the message content, and σ i Indicates that the verifier sends a randomly generated challenge to the prover. The prover generates a response based on his secret and challenge and sends it to the verifier. G is a point on the elliptic curve, and the data user DU randomly selects two integers in the finite field.

[0024] S12, order The data user DU sends info to the smart contract. For each attribute i∈U, the trusted authority AA generates an attribute private key based on the blinded user attribute set and randomly selects an integer in the finite field. The calculated attribute private key SK is:

[0025]

[0026] Where info is the defined four-tuple, D1 and D2 are the parameters that make up the attribute private key.

[0027] Preferably, in S2, the data user and the outsourced encryption service provider encrypt the keyword, the data ciphertext storage address and the symmetric key and upload the encrypted ciphertext to the blockchain for storage. The specific steps include:

[0028] S21, the encryption service provider ESP partially encrypts to form an intermediate ciphertext;

[0029] S22. The data owner DO first encrypts the data plaintext based on the intermediate ciphertext, then encrypts the data ciphertext storage address, and finally encrypts the keyword set and the symmetric key.

[0030] Preferably, in S21, the specific steps of partially encrypting the intermediate ciphertext by the outsourced encryption service provider are as follows:

[0031] S211. The encryption service provider ESP executes the EncryptESP(PK,T) algorithm, inputs the access control policy specified by the user, and converts it into an access structure tree T.

[0032] S212, the system public key PK starts from the root node of the access structure T, and randomly selects a node of order d for each non-leaf node x of the access structure from top to bottom. x The polynomial q x , randomly select a positive integer in the finite field As the node value of the root node R of the access structure T, set qR(0) = s, let Y be the attribute set of the leaf nodes in the access structure T, calculate and output the intermediate ciphertext as: CT ESP ={D x ,D' x}, where h x =H1(att(x));

[0033] Where h x Represents the result of the hash function H1, the input att(x) is the attribute of the leaf node, D x is the power term of the generator of group G1, D' x is the power term result of a hash function H1, q x (0) is the polynomial q corresponding to the leaf node x The value at point 0, d x =k x -1,k x Indicates the threshold of the node. For other non-leaf nodes x, set q x (0)=qparent(x)(index(x)), x∈Y.

[0034] Preferably, in S22, the data owner DO first encrypts the data plaintext based on the intermediate ciphertext, then encrypts the data ciphertext storage address, and finally encrypts the keyword set and the symmetric key. The specific steps are:

[0035] S221. The data owner DO extracts the keyword set W from the data plaintext m, encrypts the data plaintext m with the symmetric key, generates data ciphertext = Enc(m, key) and uploads it to the IPFS interplanetary file system. The returned data ciphertext storage address is encrypted with the same symmetric key key to generate the storage address ciphertext CT addr =Enc(addr,key);

[0036] S222. The data owner DO defines a keyword set W = {ω} and a symmetric key, performs attribute-based encryption, and executes the encryption algorithm Encrypt DO (PK, CT ESP , key, W)→CT, the data owner DO randomly selects a set of user attributes Calculation yields C0 = key·e(g,g) αs , C1=g βs , the output symmetric key ciphertext is CT key ={C0,C1};

[0037] Where C0 and C1 both represent the symmetric key ciphertext, and together they constitute the symmetric key ciphertext. C0 is related to the symmetric key, and C1 is related to the attribute set S.

[0038] S223, randomly select a positive integer field Calculate keyword ciphertext Storage address ciphertext CT addr =Enc(addr,key), the final ciphertext CT = (CT key ,CT ω ,CT addr ,CT ESP ) and uploaded to the blockchain for storage. The blockchain uses the index generation contract to create an index for the keyword ciphertext, where C2 and C3 both represent partial ciphertexts of the keyword ciphertext.

[0039] Preferably, in S3, the specific steps for a data user to generate a search trapdoor and call a smart contract in the blockchain to perform keyword matching and obtain ciphertext are:

[0040] S31, data user DU executes the trapdoor generation algorithm Trapdoor(PK,SK,S,τ)→T τ , input the system public key PK, attribute private key SK, data user DU attribute set S and search keyword τ, data user DU randomly selects an element Calculate search gate parameters y3=D1 v , generate search gate trap T τ ={y1,y2,y3,{B i =(D i ) v ,B' i =(D' i ) v} i∈S} and sent to the blockchain for search verification;

[0041] S32. The blockchain calls the smart contract to verify the legitimacy of the DU attribute first. When the verification is successful, the ciphertext corresponding to the matching keyword is searched. The smart contract calculation formula is:

[0042] S33. When L′=L, the attribute verification is successful, and the relevant ciphertext set is returned and sent to DU, which then sends it to the outsourced decryption service provider. Otherwise, the attribute verification fails and the entire algorithm process is terminated.

[0043] Preferably, the search trapdoor smart contract in the blockchain is used to verify whether the DU attribute set satisfies the access control policy, and the attribute legitimacy is checked by a non-interactive Schnoor protocol verification.

[0044] Preferably, in S4, the data user first assists the outsourced decryption service provider in partially decrypting the ciphertext. The specific steps are as follows:

[0045] S411, return the decryption result to DU, use the execution algorithm Decrypt DSP (PK,CT ESP,T τ ,S)→F Δ , and divide it into two cases:

[0046] S4111, x (x∈S) is a leaf node, then the calculated value F of the leaf node x used for decryption x for:

[0047]

[0048] Among them, when When F x =⊥;

[0049] S4112, x is a non-leaf node, let ρ x For the set of child nodes of any threshold, then for each child node π of x, ρ is used for decryption x The value F obtained by weighted cumulative calculation of each non-leaf node x in the set π for:

[0050]

[0051] S412, determine whether the attribute set of DU meets the access control policy. If it meets the access control policy, perform partial decryption to obtain the converted ciphertext F Δ =e(g,g) uvs Return to DU.

[0052] Preferably, in S4, after DU obtains the converted ciphertext, it decrypts it locally to obtain the symmetric key. The specific steps of accessing IPFS to finally decrypt and obtain the data plaintext are as follows:

[0053] S421, using Decrypt DSP (PK,CT,F Δ ,SK,S)→m executes the algorithm to decrypt DU, which is calculated by the following formula:

[0054]

[0055] Where θ represents the partial decryption result of the symmetric key ciphertext, which is used to decrypt the data ciphertext key;

[0056] S422, DU decrypts the data ciphertext key Decrypted data ciphertext storage address addr=Dec(key,CT addr ), access IPFS from addr to get the data ciphertext CT m , and finally decrypted to get the data plaintext m=Dec(key, CT m ).

[0057] Therefore, the present invention proposes an access control method based on outsourced computing and attribute-based searchable encryption on the blockchain, which has the following beneficial effects:

[0058] The present invention solves the problems of high local computing overhead and low data sharing efficiency in existing attribute-based encryption. While improving data sharing efficiency and security, it can reduce local user computing overhead, effectively reduce the computational burden of encryption and decryption for local users, and significantly improve data sharing efficiency and security.

[0059] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is an access control model diagram based on outsourced computing and attribute-based searchable encryption on the blockchain. DETAILED DESCRIPTION

[0061] To make the technical solutions, advantages, and purposes of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below. The described embodiments are part of the embodiments of the present invention, not all of them. Based on the described embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0062] Unless otherwise defined, technical or scientific terms used in the present invention shall have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs.

[0063] like Figure 1 As shown, the present invention proposes an access control method based on outsourced computing and attribute-based searchable encryption on a blockchain, the method comprising:

[0064] S1. The trusted authority AA initializes and generates the system public key PK and master key MSK, and generates the user attribute private key based on the attribute set of the data user;

[0065] In S1, the specific steps for the trusted authority to initialize and generate the system public key PK and master key MSK are as follows:

[0066] The trusted authority AA executes the initialization algorithm Setup(1 λ )→(PK,MSK), input security parameter λ, generate a multiplication cyclic group G1 and G with prime order p T , given a bilinear mapping pair e:G1×G1→G T , define two random anti-collision Hash functions, for each attribute i∈U, randomly select parameters t1, t2, t3, and calculate e(g, g) respectivelyα 、g β , generate the system public key PK and master key MSK:

[0067]

[0068] MSK={t1,t2,t3,α,β};

[0069] Where, e(g,g) α and g β All of them are mathematical formulas about double mapping pairs in cryptography, and are calculation results. They are components of the system public key PK. g is the generator of G1, and the mapping relationship H1:{0,1} * →G1, represents the finite field of 1, 2, ..., p-1, {0,1} * represents a set of bit strings of arbitrary length, U is a set of system properties, and two integers are randomly selected from the finite field

[0070] In S1, the specific steps for the trusted authority to generate the user attribute private key based on the attribute set of the data user are as follows:

[0071] S11. The trusted authority AA executes the key generation algorithm KeyGenblind(PK,MSK,S)→(SK), inputs the system public key PK, the master key MSK and the user attribute set S, and the trusted authority AA uses the Schnorr protocol to blind each user attribute i, i∈S, calculates Q, L, and calculates the challenge σ i ,calculate Challenges i The response is calculated as:

[0072] Q = z·G;

[0073] L = m·G;

[0074] σ i =H2(G‖Q‖P‖j);

[0075]

[0076] Where Q represents the blinded public key, L represents the calculated value of the signature bound to the message content, and σ i Indicates that the verifier sends a randomly generated challenge to the prover. The prover generates a response based on his secret and challenge and sends it to the verifier. G is a point on the elliptic curve, and the data user DU randomly selects two integers in the finite field.

[0077] S12, order The data user DU sends info to the smart contract. For each attribute i∈U, the trusted authority AA generates an attribute private key based on the blinded user attribute set and randomly selects an integer in the finite field. The calculated attribute private key SK is:

[0078]

[0079] Where info is the defined four-tuple, D1 and D2 are the parameters that make up the attribute private key.

[0080] S2. The data owner formulates an access control policy and assists the outsourced encryption service provider in performing partial encryption. The data user and the outsourced encryption service provider encrypt the keyword, data ciphertext storage address, and symmetric key and upload the encrypted ciphertext to the blockchain for storage. The specific steps include:

[0081] S21, the encryption service provider ESP partially encrypts to form an intermediate ciphertext;

[0082] S22. The data owner DO first encrypts the data plaintext based on the intermediate ciphertext, then encrypts the data ciphertext storage address, and finally encrypts the keyword set and the symmetric key.

[0083] In S21, the specific steps for the outsourced encryption service provider to partially encrypt and form the intermediate ciphertext are as follows:

[0084] S211. The encryption service provider ESP executes the EncryptESP(PK,T) algorithm, inputs the access control policy specified by the user, and converts it into an access structure tree T.

[0085] S212, the system public key PK starts from the root node of the access structure T, and randomly selects a node of order d for each non-leaf node x of the access structure from top to bottom. x Polynomial qx, randomly select a positive integer in the finite field As the node value of the root node R of the access structure T, set qR(0) = s, let Y be the attribute set of the leaf nodes in the access structure T, calculate and output the intermediate ciphertext as: CT ESP ={D x ,D' x}, where h x =H1(att(x));

[0086] Where h x Represents the result of the hash function H1, the input att(x) is the attribute of the leaf node, D x is the power term of the generator of group G1, D' x is the power term result of a hash function H1, qx (0) is the polynomial q corresponding to the leaf node x The value at point 0, d x =k x -1,k x Indicates the threshold of the node. For other non-leaf nodes x, set q x (0)=qparent(x)(index(x)), x∈Y.

[0087] In S22, the data owner DO first encrypts the data plaintext based on the intermediate ciphertext, then encrypts the data ciphertext storage address, and finally encrypts the keyword set and symmetric key. The specific steps are:

[0088] S221. The data owner DO extracts the keyword set W from the data plaintext m, encrypts the data plaintext m with the symmetric key, generates data ciphertext = Enc(m, key) and uploads it to the IPFS interplanetary file system. The returned data ciphertext storage address is encrypted with the same symmetric key key to generate the storage address ciphertext CT addr =Enc(addr,key);

[0089] S222. The data owner DO defines a keyword set W = {ω} and a symmetric key, performs attribute-based encryption, and executes the encryption algorithm Encrypt DO (PK, CTESP, key, W) → CT, the data owner DO randomly selects a set of user attributes Calculation yields C0 = key·e(g,g) αs , C1=g βs , the output symmetric key ciphertext is CT key ={C0,C1};

[0090] Where C0 and C1 both represent the symmetric key ciphertext, and together they constitute the symmetric key ciphertext. C0 is related to the symmetric key, and C1 is related to the attribute set S.

[0091] S223, randomly select a positive integer field Calculate keyword ciphertext Storage address ciphertext CT addr =Enc(addr,key), the final ciphertext CT = (CT key ,CT ω ,CT addr ,CT ESP ) and uploaded to the blockchain for storage. The blockchain uses the index generation contract to create an index for the keyword ciphertext, where C2 and C3 both represent partial ciphertexts of the keyword ciphertext.

[0092] S3: The data user generates a search trapdoor and sends it to the blockchain. The search trapdoor contract is called to verify the user's attributes. If the user's attributes meet the access control policy, the relevant ciphertext corresponding to the keyword is returned to the data user.

[0093] In S3, the specific steps for data users to generate a search trapdoor and call the smart contract in the blockchain to perform keyword matching and obtain ciphertext are as follows:

[0094] S31, data user DU executes the trapdoor generation algorithm Trapdoor(PK,SK,S,τ)→T τ , input the system public key PK, attribute private key SK, data user DU attribute set S and search keyword τ, data user DU randomly selects an element Calculate search gate parameters y3=D1 v , generate search gate trap T τ ={y1,y2,y3,{B i =(D i ) v ,B' i =(D' i ) v} i∈S} and sent to the blockchain for search verification;

[0095] S32. The blockchain calls the smart contract to verify the legitimacy of the DU attribute first. The search trapdoor smart contract in the blockchain is used to verify whether the DU attribute set meets the access control policy, and the attribute legitimacy is verified through the non-interactive Schnoor protocol. When the verification is successful, the ciphertext corresponding to the matching keyword is searched. The smart contract calculation formula is:

[0096] S33. When L′=L, the attribute verification is successful, and the relevant ciphertext set is returned and sent to DU, which then sends it to the outsourced decryption service provider. Otherwise, the attribute verification fails and the entire algorithm process is terminated.

[0097] S4. The data user first assists the outsourced decryption service provider to decrypt the ciphertext, then decrypts it locally to obtain the data storage address and symmetric key. The data ciphertext is downloaded from IPFS according to the storage address, and finally the symmetric key is used to decrypt the data ciphertext to obtain the data plaintext.

[0098] In S4, the data user first assists the outsourced decryption service provider to decrypt the ciphertext. The specific steps are as follows:

[0099] S411, return the decryption result to DU, use the execution algorithm Decrypt DSP (PK,CT ESP ,T τ,S)→F Δ , and divide it into two cases:

[0100] S4111, x (x∈S) is a leaf node, then the calculated value F of the leaf node x used for decryption x for:

[0101]

[0102] Among them, when When F x =⊥;

[0103] S4112, x is a non-leaf node, let ρ x For the set of child nodes of any threshold, then for each child node π of x, ρ is used for decryption x The value F obtained by weighted cumulative calculation of each non-leaf node x in the set π for:

[0104]

[0105] S412, determine whether the attribute set of DU meets the access control policy. If it meets the access control policy, perform partial decryption to obtain the converted ciphertext F Δ =e(g,g) uvs Return to DU.

[0106] In S4, DU obtains the converted ciphertext and then decrypts it locally to obtain the symmetric key. The specific steps for accessing IPFS and finally decrypting the data plaintext are as follows:

[0107] S421, using Decrypt DSP (PK,CT,F Δ ,SK,S)→m executes the algorithm to decrypt DU, which is calculated by the following formula:

[0108]

[0109] Where θ represents the partial decryption result of the symmetric key ciphertext, which is used to decrypt the data ciphertext key;

[0110] S422, DU decrypts the data ciphertext key Decrypted data ciphertext storage address addr=Dec(key,CT addr ), access IPFS from addr to get the data ciphertext CT m , and finally decrypted to get the data plaintext m=Dec(key, CT m ).

[0111] Therefore, the present invention provides an access control method based on outsourced computing and attribute-based searchable encryption on the blockchain, which solves the problems of high local computing overhead and low data sharing efficiency in existing attribute-based encryption. While improving data sharing efficiency and security, it can reduce the computing overhead of local users, effectively reduce the computing burden of encryption and decryption for local users, and significantly improve data sharing efficiency and security.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solutions of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. An access control method based on outsourced computing and attribute-based searchable encryption on blockchain, characterized in that: The steps of this method are as follows: S1. The trusted authority AA initializes and generates the system public key PK and master key MSK, and generates the user attribute private key based on the attribute set of the data user; S2. The data owner formulates an access control policy and assists the outsourced encryption service provider in performing partial encryption. The data user and the outsourced encryption service provider encrypt the keywords, data ciphertext storage address, and symmetric key and upload the encrypted ciphertext to the blockchain for storage. S3: The data user generates a search trapdoor and sends it to the blockchain. The search trapdoor contract is called to verify the user's attributes. If the user's attributes meet the access control policy, the relevant ciphertext corresponding to the keyword is returned to the data user. S4. The data user first assists the outsourced decryption service provider to decrypt the ciphertext, then decrypts it locally to obtain the data storage address and symmetric key. The data ciphertext is downloaded from IPFS based on the storage address, and finally the symmetric key is used to decrypt the data ciphertext to obtain the data plaintext. In S1, the specific steps for the trusted authority to initialize and generate the system public key PK and master key MSK are as follows: The trusted authority AA executes the initialization algorithm Setup( ) , enter security parameters , generating a multiplicative cyclic group G1 of prime order p and , given a bilinear map pair , define two random anti-collision Hash functions, for each attribute i U, randomly select parameters t1, t2, t3, and calculate them separately , generate the system public key PK and master key MSK: PK={ ,H1,H2}; <h2 style=";text-align:left;direction:ltr">MSK={t1,t2,t3,<h2 style=";text-align:left;direction:ltr"> <h2 style=";text-align:left;direction:ltr">}; Where, All of them are mathematical formulas about double mapping pairs in cryptography, and are calculation results. They are components of the system public key PK. g is the generator of G1. The mapping relationship is represents a finite field of 1, 2, ..., p-1, Represents a set of bit strings of arbitrary length, U is a set of system properties, and two integers in the finite field are randomly selected ; In S1, the specific steps for the trusted authority to generate the user attribute private key based on the attribute set of the data user are as follows: S11, the trusted authority AA executes the key generation algorithm KeyGenblind ( , ,S) (SK), input system public key PK, master key MSK and user attribute set S, trusted authority AA uses Schnorr protocol to blind each user attribute i, i∈S, calculate Q, L, and calculate challenge ,calculate Challenges The response is calculated as: Q=z G; L=m G; =H2(G‖ Q ‖P‖j); =m+ with(modp); Where Q represents the blinded public key, L represents the calculated value bound to the signature and message content, Indicates that the verifier sends a randomly generated challenge to the prover. The prover generates a response based on his secret and challenge and sends it to the verifier. G is a point on the elliptic curve, and the data user DU randomly selects two integers z,m∈ in the finite field. ; S12, let info = {P, Q, }, data user DU sends info to the smart contract for each attribute i U, the trusted authority AA generates the attribute private key based on the blinded user attribute set, and randomly selects an integer u∈ in the finite field. , the calculated attribute private key SK is: SK={ = , = ,{ , ; Where info is the defined four-tuple, D1 and D2 are the parameters that make up the attribute private key.

2. The access control method based on outsourced computing and attribute-based searchable encryption on blockchain according to claim 1 is characterized in that: In S2, the data user and the outsourced encryption service provider encrypt the keyword, data ciphertext storage address, and symmetric key and upload the encrypted ciphertext to the blockchain for storage. The specific steps include: S21, the encryption service provider ESP partially encrypts to form an intermediate ciphertext; S22. The data owner DO first encrypts the data plaintext based on the intermediate ciphertext, then encrypts the data ciphertext storage address, and finally encrypts the keyword set and the symmetric key.

3. The access control method based on outsourced computing and attribute-based searchable encryption on the blockchain according to claim 2 is characterized in that: In S21, the specific steps for the outsourced encryption service provider to partially encrypt and form the intermediate ciphertext are as follows: S211. The encryption service provider ESP executes the EncryptESP(PK,T) algorithm, inputs the access control policy specified by the user, and converts it into an access structure tree T. S212, the system public key PK starts from the root node of the access structure T, and randomly selects a node of order d for each non-leaf node x of the access structure from top to bottom. x The polynomial q x , randomly select a positive integer s∈ in the finite field As the node value of the root node R of the access structure T, set qR(0) = s, let Y be the attribute set of the leaf nodes in the access structure T, and calculate and output the intermediate ciphertext as: ={ },in, =H1(att(x)); = = ; Where h x Represents the result of the hash function H1, the input att(x) is the attribute of the leaf node, D x is the power term of the generator of group G1, is the power term result of a hash function H1, q x (0) is the polynomial q corresponding to the leaf node x The value at point 0, d x =k x -1,k x Indicates the threshold of the node. For other non-leaf nodes x, set q x (0)=qparent(x)(index(x)),x∈ .

4. The access control method based on outsourced computing and attribute-based searchable encryption on the blockchain according to claim 2 is characterized in that: In S22, the data owner DO first encrypts the data plaintext based on the intermediate ciphertext, then encrypts the data ciphertext storage address, and finally encrypts the keyword set and symmetric key. The specific steps are: S221. The data owner DO extracts the keyword set W from the data plaintext m, encrypts the data plaintext m with the symmetric key, generates the data ciphertext = Enc(m, key) and uploads it to the IPFS interstellar file system. The returned data ciphertext storage address is encrypted with the same symmetric key key to generate the storage address ciphertext =Enc(addr,key); S222. The data owner DO defines a keyword set W={ } and symmetric key, and perform attribute-based encryption and execute the encryption algorithm , the data owner DO randomly selects the user attribute set S∈ , calculated , = , the output symmetric key ciphertext is ={C0,C1}; Where C0 and C1 both represent the symmetric key ciphertext, and together they constitute the symmetric key ciphertext. C0 is related to the symmetric key, and C1 is related to the attribute set S. S223, randomly select a positive integer field ∈ , calculate the keyword ciphertext ={ , }, storage address ciphertext = , the final ciphertext CT=( , , , ) and uploaded to the blockchain for storage. The blockchain uses the index generation contract to create an index for the keyword ciphertext, where C2 and C3 both represent partial ciphertexts of the keyword ciphertext.

5. The access control method based on outsourced computing and attribute-based searchable encryption on blockchain according to claim 1 is characterized in that: In S3, the specific steps for data users to generate a search trapdoor and call the smart contract in the blockchain to perform keyword matching and obtain ciphertext are as follows: S31, data user DU executes the trapdoor generation algorithm Trapdoor (PK, SK, S, ) , input the system public key PK, attribute private key SK, data user DU attribute set S and search keyword , the data user DU randomly selects an element ∈ , calculate the search gate parameters = , , , generate search gate trap ={ , , , } and sent to the blockchain for search verification; S32. The blockchain calls the smart contract to verify the legitimacy of the DU attribute first. When the verification is successful, the ciphertext corresponding to the matching keyword is searched. The smart contract calculation formula is L′= ; S33. When L′=L, the attribute verification is successful, and the relevant ciphertext set is returned and sent to DU, which then sends it to the outsourced decryption service provider. Otherwise, the attribute verification fails and the entire algorithm process is terminated.

6. The access control method based on outsourced computing and attribute-based searchable encryption on the blockchain according to claim 5 is characterized in that: The search trapdoor smart contract in the blockchain is used to verify whether the DU attribute set satisfies the access control policy, and the legitimacy of the attributes is checked through the non-interactive Schnoor protocol.

7. The access control method based on outsourced computing and attribute-based searchable encryption on blockchain according to claim 1 is characterized in that: In S4, the data user first assists the outsourced decryption service provider to decrypt the ciphertext. The specific steps are as follows: S411, return the decryption result to DU, and use the execution algorithm , and divide it into two cases: S4111、x(x S) is a leaf node, then the calculated value of the leaf node x used for decryption for: ； Among them, when x When S ; S4112, x is a non-leaf node, let is a set of child nodes of any threshold, then for each child node of x For decryption The value obtained by weighted cumulative calculation of each non-leaf node x in the set for: ； S412: Determine whether the attribute set of the DU satisfies the access control policy. If so, perform partial decryption to obtain the converted ciphertext. Return to DU.

8. The access control method based on outsourced computing and attribute-based searchable encryption on blockchain according to claim 1 is characterized in that: In S4, DU obtains the converted ciphertext and then decrypts it locally to obtain the symmetric key. The specific steps for accessing IPFS and finally decrypting the data plaintext are as follows: S421, adopt Execute the algorithm to decrypt the DU, and calculate it using the following formula: ； Where, The partial decryption result of the symmetric key ciphertext is used to decrypt the data ciphertext key; S422, DU decrypts the data ciphertext key key, decrypted data ciphertext storage address =Dec(key, ),from Access IPFS to get data ciphertext , and finally decrypted to get the data plaintext m=Dec(key, ).

Images