Key strategy attribute encryption method and system based on switchable attributes

Abstract

The invention discloses a key strategy attribute encryption method and system based on switchable attributes, and the method comprises the steps: obtaining a secret key of a user through a public key / main key of the system and an access strategy function of the user, and obtaining a conversion key through the secret key of the user, the public key of the user and a selected attribute set in an attribute set; exchanging the original ciphertext through the conversion key to obtain a switching ciphertext; meanwhile, if the cloud server receives the switching ciphertext, the switching ciphertext is returned to the user; and if not, decrypting the original ciphertext to obtain the plaintext. According to the invention, each ciphertext is associated with one attribute set, so that the problem of user addition is solved, the purpose that the user meeting the attribute set can decrypt the ciphertext is achieved, and the flexibility of the system is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of cyberspace security and relates to a key policy attribute encryption method and system based on switchable attributes. Background Art

[0002] With the exponential growth of data and the rapid development of cloud computing, a large amount of information is now placed in cloud infrastructure. By outsourcing data to a cloud server and paying for related services, data owners can significantly reduce the capital expenditure associated with local storage management and maintenance. At the same time, both data owners and users can seamlessly access the outsourced data while on the move. In addition, to protect the security and privacy of the outsourced data, data owners usually encrypt the data and then send the corresponding ciphertext to the cloud server.

[0003] However, traditional encryption schemes (such as AES or public key encryption) only grant the decryption right to users with the corresponding key and cannot effectively solve the scenario where data needs to be shared among a large number of users. The proposed attribute-based encryption (ABE) solves the "one-to-many scenario" and allows data owners to define a set of access policies based on users' attributes rather than specific keys. Users with matching attributes can decrypt the data, while those without these attributes cannot. In this way, data owners can more flexibly control who can access their data without having to know the keys of all legitimate users in advance. However, existing solutions cannot add users, that is, grant the decryption permission to others, reducing the flexibility of the system. Summary of the Invention

[0004] The purpose of the present invention is to solve the problem in the prior art that attribute encryption cannot add users and cannot grant the decryption permission to others, reducing the flexibility of the system, and to provide a key policy attribute encryption method and system based on switchable attributes.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] A key policy attribute encryption technology based on switchable attributes, comprising:

[0007] Step 1: Define the policy function, attribute set, and message space of the system, and generate the public key / master key of the system to complete the initialization of the system;

[0008] Step 2: Construct the user's own secret key based on the master key and the user's access policy function;

[0009] Step 3: Obtain the transformation key based on the user's own secret key, public key, and the selected attribute set from the attribute set;

[0010] Step 4: Select another attribute set from the attribute set, and encrypt the data associated with the attribute set based on the public key of the system to obtain the original ciphertext;

[0011] Step 5: Exchange all the original ciphertexts based on the transformation key to obtain the switched ciphertext;

[0012] Step 6: Determine whether the cloud server has received the switched ciphertext. If so, return the exchanged ciphertext to the user; if not, decrypt the original ciphertext to obtain the plaintext.

[0013] A further improvement of the present invention lies in:

[0014] Further, Steps 1, 2, and 3 are the work of the key generation center, Step 4 is the work of the data owner; Step 5 is the work of the cloud server; Step 6 is the work of the data user.

[0015] Further, after exchanging all the original ciphertexts based on the transformation key to obtain the switched ciphertext, it further includes determining whether the access policy function f(x)=0 holds. If it holds, output the transformed ciphertext and a corresponding attribute set. If it does not hold, output the error symbol ⊥, indicating that the original ciphertext is invalid.

[0016] Further, define the policy function, attribute set, and message space of the system, and generate the public key / master key of the system. Specifically: Run the Setup algorithm with λ as the input to generate the public key pk and the master key msk. Here, λ is the security parameter, which determines the security level of the system and is usually used to determine the size of the key and other encryption parameters. pk is the public key, which is used to encrypt messages and generate the transformation key; msk is the master key, which is used to generate the secret key related to the access policy.

[0017] Further, construct the user's own secret key based on the master key and the user's access policy function. Specifically: Run the KeyGen algorithm with the master key msk and the access policy Generate the key sk f 。

[0018] Further, obtain the transformation key based on the user's own secret key, public key, and the selected attribute set from the attribute set. Specifically: Run the SwitchKeyGen algorithm with the public key pk, the key skf 和 Attribute set as the input to generate the transformation key swk associated with the function f and the attribute set y y 。

[0019] Further, select another attribute set from the attribute set, and encrypt the data associated with the attribute set based on the public key of the system to obtain the original ciphertext. Specifically: Run the Enc algorithm with the public key pk, the plaintext and the attribute set as the input, and outputs the original ciphertext CT and the corresponding attribute set x.

[0020] Furthermore, based on the transformation key, all the original ciphertexts are exchanged to obtain the switched ciphertext, specifically: running the Switch algorithm with the transformation key swk y and the original ciphertext CT and a corresponding attribute set as the input, when f(x) = 0, the output is the transformed ciphertext CT' and the corresponding attribute set y, otherwise the error symbol ⊥ is output indicating that the original ciphertext CT is invalid.

[0021] Furthermore, the original ciphertext is decrypted to obtain the plaintext, specifically: the user with the key sk f runs the Dec algorithm with the transformation key swk y and the original ciphertext CT as the input, and the output is the plaintext or the error symbol ⊥.

[0022] A key-policy attribute encryption system based on switchable attributes, comprising:

[0023] A generation module that defines the policy function, attribute set, and message space of the system, and generates the public key / master key of the system to complete the initialization of the system;

[0024] A construction module that constructs the user's own secret key based on the master key and the user's access policy function;

[0025] A first acquisition module that obtains the transformation key based on the user's own secret key, public key, and the selected attribute set from the attribute set;

[0026] A second acquisition module that selects another attribute set from the attribute set, and encrypts the data associated with the attribute set based on the public key of the system to obtain the original ciphertext;

[0027] An exchange module that exchanges all the original ciphertexts based on the transformation key to obtain the switched ciphertext;

[0028] A judgment module that judges whether the cloud server has received the switched ciphertext. If so, it returns the exchanged ciphertext to the user; if not, it decrypts the original ciphertext to obtain the plaintext.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] Through the system's public key / master secret key and the user's access policy function, the present invention obtains the user's own secret key, and through the user's own secret key, public key, and the selected attribute set from the set of attributes, obtains the conversion key; exchanges the original ciphertext through the conversion key to obtain the switched ciphertext; at the same time, if the cloud server receives the switched ciphertext, it returns the exchanged ciphertext to the user; if not, it decrypts the original ciphertext to obtain the plaintext. Each ciphertext in the present invention is associated with an attribute set, solves the user addition problem, realizes the purpose that users satisfying the attribute set can decrypt the ciphertext, and improves the flexibility of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the drawings required for use in the embodiments. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, without creative efforts, other relevant drawings can also be obtained based on these drawings.

[0032] Figure 1 It is a flowchart of the key-policy attribute encryption method based on switchable attributes of the present invention;

[0033] Figure 2 It is a structural diagram of the key-policy attribute encryption system based on switchable attributes of the present invention;

[0034] Figure 3 It is an architecture diagram of the key-policy attribute encryption technology based on switchable attributes of the present invention for cloud data sharing. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0035] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Usually, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0036] Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed present invention, but merely represents the selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

[0037] It should be noted that like reference numerals and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined or explained in subsequent figures.

[0038] In the description of the embodiments of the present invention, it should be noted that if terms such as "upper", "lower", "horizontal", "inner", etc. indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the inventive product is customarily placed during use, it is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus cannot be construed as a limitation on the present invention. In addition, terms such as "first", "second", etc. are only used for distinguishing descriptions and cannot be construed as indicating or implying relative importance.

[0039] In addition, if the term "horizontal" appears, it does not mean that the component is required to be absolutely horizontal, but it can be slightly inclined. For example, "horizontal" only means that its direction is more horizontal relative to "vertical", and does not mean that the structure must be completely horizontal, but it can be slightly inclined.

[0040] In the description of the embodiments of the present invention, it should also be noted that unless otherwise clearly specified and limited, if terms such as "set", "install", "connect", "couple" are understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium, and it can be the communication inside two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific situations.

[0041] The present invention will be further described in detail below with reference to the drawings:

[0042] See Figure 1 , the present invention discloses a key policy attribute encryption technology based on switchable attributes, including:

[0043] S101: Define the policy function, attribute set and message space of the system, and generate the public key / master key of the system to complete the initialization of the system;

[0044] Run the Setup algorithm with λ as the input to generate the public key pk and the master key msk. Here, λ is the security parameter that determines the security level of the system and is usually used to determine the size of the key and other encryption parameters. The pk is the public key used to encrypt messages and generate transformation keys; the msk is the master key used to generate the secret key related to the access policy.

[0045] S102: Construct the user's own secret key based on the master key and the user's access policy function;

[0046] Run the KeyGen algorithm with the master key msk and the access policy to generate the key sk f .

[0047] S103: Obtain the transformation key based on the user's own secret key, the public key, and the selected attribute set from the attribute set;

[0048] Run the SwitchKeyGen algorithm with the public key pk, the key sk f and the attribute set as inputs to generate the transformation key swk associated with the function f and the attribute set y y .

[0049] S104: Select another attribute set from the attribute set, encrypt the data associated with the attribute set based on the public key of the system to obtain the original ciphertext;

[0050] Run the Enc algorithm with the public key pk, the plaintext and the attribute set as inputs to output the original ciphertext CT and the corresponding attribute set x.

[0051] S105: Exchange all the original ciphertexts based on the transformation key to obtain the switched ciphertext;

[0052] Run the Switch algorithm with the transformation key swk y and the original ciphertext CT and a corresponding attribute set as inputs. After exchanging all the original ciphertexts based on the transformation key to obtain the switched ciphertext, it also includes determining whether the access policy function f(x)=0 holds. If it holds, output the transformed ciphertext CT' and the corresponding attribute set y. If it does not hold, output the error symbol ⊥, indicating that the original ciphertext is invalid.

[0053] S106: Determine whether the cloud server has received the switched ciphertext. If so, return the exchanged ciphertext to the user; if not, decrypt the original ciphertext to obtain the plaintext.

[0054] Decrypt the original ciphertext to obtain the plaintext. Specifically: The user with the key sk f runs the Dec algorithm with the transformation key swk y and the original ciphertext CT as inputs to output the plaintext or the error symbol ⊥.

[0055] Among them, S101, S102, and S103 are the operations of the key generation center, S104 is the operation of the data owner; S105 is the operation of the cloud server; S106 is the operation of the data user.

[0056] See Figure 2 , the present invention discloses a key-policy attribute-based encryption system with switchable attributes, including:

[0057] A generation module, which defines the policy function, attribute set, and message space of the system, and generates the public key / master key of the system to complete the initialization of the system;

[0058] A construction module, which constructs the user's own secret key based on the master key and the user's access policy function;

[0059] A first acquisition module, which obtains the conversion key based on the user's own secret key, public key, and the selected attribute set from the attribute set;

[0060] A second acquisition module, which selects another attribute set from the attribute set and encrypts the data associated with the attribute set based on the public key of the system to obtain the original ciphertext;

[0061] A swapping module, which swaps all the original ciphertexts based on the conversion key to obtain the switched ciphertext;

[0062] A judgment module, which judges whether the cloud server has received the switched ciphertext. If so, it returns the swapped ciphertext to the user; if not, it decrypts the original ciphertext to obtain the plaintext.

[0063] Embodiment:

[0064] Such as Figure 3As shown, a key policy attribute encryption method based on switchable attributes of the present invention is used for cloud data sharing, which can solve the problem of fine-grained access control for encrypted data in the cloud computing environment. It involves four entities: system administrator, data owner, data user, and cloud server. The system administrator initializes the system by defining policy functions, attribute sets, message spaces, and generating the public key / master key of the system. The data owner receives a key linked to certain policy functions from the system administrator. After receiving the exchange key from the data owner, the cloud server performs an exchange operation on all data ciphertexts to generate switched ciphertexts. After receiving the request from the data user, the cloud server returns the original ciphertext to the data user or exchanges the ciphertext with the data user. The data user receives a key linked to the policy function from the system administrator. The data user requests the ciphertext from the cloud server. If the cloud server has received the exchange key from the data owner, the cloud server returns the switched ciphertext to the data user; otherwise, the cloud server returns the original ciphertext.

[0065] The specific steps of the present invention are as follows:

[0066] System initialization Setup(1 λ ):This step is executed by the system administrator (KGC). The input of the algorithm is the security parameter 1 λ , and the output is the public key pk and the master key msk;

[0067] Among them, λ is the security parameter, which determines the security level of the system and is usually used to determine the size of keys and other encryption parameters; pk is the public key, which is used to encrypt messages and generate transformation keys; msk is the master key, which is used to generate secret keys related to access policies.

[0068] Security setting: This step sets the encryption parameters required for the encryption scheme to ensure the required security level based on the input parameter λ.

[0069] Key generation preparation: Generate the public key pk for encryption and switch key generation, and the master key msk for generating user-specific keys.

[0070] Key generation KeyGen(msk,f): This step is executed by the system administrator (KGC). The input of the algorithm is the master key msk and the function (access policy) The output is the secret key sk f ;

[0071] Among them, f is the access policy function, belonging to the function family Attribute-based encryption function family with switchable attributes.

[0072] Access control: Generate the secret key sk embedding the access policy f fThis key can be used to decrypt the ciphertext that conforms to policy f.

[0073] User-specific key: Ensure that only users with the corresponding secret key sk f can access the data encrypted according to the corresponding access policy.

[0074] Generation of the attribute conversion key SwitchKeyGen(pk, sk f , y): This step can be executed by both the system administrator (KGC) and the data user. The inputs to the algorithm are the public key pk, the secret key sk f and the attribute set The output is the conversion key swk associated with the function f and the attribute set y y ;

[0075] Attribute switching: Generate the switching key swk that allows the ciphertext to be re-encrypted when the attribute set switches from x to y y .

[0076] Flexibility: Provide the ability to update the ciphertext to reflect new attributes without decrypting and re-encrypting from scratch.

[0077] Generation of the ciphertext Enc(pk, μ, x): This step can be executed by any party. Such a user is called a content distributor. The inputs to the algorithm are the public key pk, the plaintext and the attribute set Output an original ciphertext CT and a corresponding attribute set x;

[0078] where, is the message space; is the attribute space.

[0079] Data encryption: Encrypt the message μ using the attribute set x. The generated ciphertext CT can only be decrypted by users with the appropriate secret key that satisfies the access policy related to x.

[0080] Access control enforcement: Ensure that only users with matching attributes can decrypt the ciphertext.

[0081] Conversion of attributes Switch(swk y , CT): This step is executed by the cloud server. The inputs to the algorithm are the conversion key swk y and the original ciphertext CT and a corresponding attribute set If f(x) = 0, the output is a converted ciphertext CT' and a corresponding attribute set y, otherwise the output is an error symbol ⊥ indicating that the original ciphertext CT is invalid;

[0082] Re-encryption: Use the switching key swk y to allow the ciphertext to be updated to the new attribute set y for convenient attribute update.

[0083] Safety check: Ensure that the switch operation is only performed when the current attribute set x does not satisfy the function f (i.e. f(x) ≠ 1).

[0084] Decryption of ciphertext Dec(sk f ,CT): This step is performed by having the key sk f The user executes the algorithm, and the input of the algorithm is the conversion key swk y and the original ciphertext CT, the output is the plaintext Or the error symbol ⊥;

[0085] Decryption: Allows the user to decrypt the ciphertext CT and retrieve the original message μ if their secret key sk f Satisfy the access policy embedded in CT.

[0086] Computation offloading: Users can offload part of the decryption computation to the cloud server, reducing the computational burden on their local devices.

[0087] Correctness analysis: For the key policy attribute-based encryption (ABE) scheme with switchable attributes, its correctness can be discussed from the following two cases: the original ciphertext and the switched ciphertext.

[0088] (1) Original ciphertext: For any ciphertext generated by Setup(1 λ ) generated by the public key pk and master key msk, any secret key sk generated by KeyGen(msk,f) f (in is an arbitrary function), any message and any set of attributes If f(x) = 0, then: Pr[Dec(sk f ,Enc(pk,μ,x))=μ]=1-negl(λ).

[0089] Correct decryption: If the attribute set x satisfies the access policy f, that is, f(x) = 0, then use sk f Decrypting the ciphertext encrypted by x should correctly restore the message μ.

[0090] High probability correct: The probability of successful decryption is almost certain, with only a very small probability error that gradually disappears as the security parameter λ increases.

[0091] (2) Switching Ciphertext: For any λ ) generated by the public key pk and master key msk, any secret key sk generated by KeyGen(msk,f) f , and the secret key sk generated by KeyGen(msk,g) g (in (where \(f\) is an arbitrary function), for any message and any set of attributes we have \(\Pr[\text{Dec}(sk g , \text{Switch}(swk y , CT)) = \mu] = 1 - \text{negl}(\lambda)\). If \(f(x)=0\) and \(g(y)=0\), where \(CT \leftarrow \text{Enc}(pk, \mu, x)\) and \(swk y \leftarrow \text{SwitchKeyGen}(pk, sk f , y)\).

[0092] Correct switching and decryption: If the attribute set \(x\) satisfies the access policy \(f\) and the attribute set \(y\) satisfies the access policy \(g\), i.e., \(f(x) = 0\) and \(g(y) = 0\), then using \(sk g to decrypt the ciphertext switched by \(swk y should correctly recover the message \(\mu\).

[0093] High probability of correctness: The probability of successful decryption is almost certain, with only a negligible probability of error that vanishes as the security parameter \(\lambda\) grows.

[0094] Multi / single-switch attribute: If any original ciphertext can be switched multiple times, then the key-policy ABE scheme with the switchable attribute is multi-switchable. Otherwise, it is single-switch.

[0095] Selective HSA security: A new security concept is considered, called selective HSA (i.e., honest switch attack) security, which combines the selective security of ABE with the security requirements arising from the switch operations (i.e., \(\text{SwitchKeyGen}\) and \(\text{Switch}\) algorithms). Specifically, an experiment is defined that describes the interaction between the challenger and a PPT adversary .

[0096] (1) Setup: The challenger announces a set of attributes and computes \((pk, msk) \leftarrow \text{Setup}(1 λ ) and returns \(pk\) to The challenger also sets the counter \(numCt = 0\), key-value storage and set derivation

[0097] (2) Query Phase 1: The adversary makes polynomially many queries in an arbitrary order:

[0098] Key Generation : Whenever submits a function When \(f(x * )\neq0\), the challenger computes and returns \(sk f \leftarrow KeyGen(f, msk)\).

[0099] SwitchKey Generation : Whenever a pair such that \(f(x * )\neq0\) or such that \((f(x * ) = 0, y = x * )\) (to avoid trivial attacks) is submitted, the challenger computes and returns \(swk y \leftarrow SwitchKeyGen(pk, sk f , y)\) to

[0100] Encryption : Whenever a pair is submitted, the challenger computes and returns \(CT\leftarrow Enc(pk, \mu, x)\) to After that, the challenger increments \(numCt\) and adds \(CT\) to the set with key \((x, numCt)\).

[0101] Switch : Whenever a quadruple \((f, x, y, k)\) is submitted, where \(k\leq numCt\), if there is no key \((x, k)\) in otherwise set \(CT\) to the value in When \(f(x)\neq0\) indicates that \(CT\) is invalid, the algorithm y terminates. Otherwise, the challenger computes and returns \(CT'\leftarrow Switch(swk

[0102] Challenge Ciphertext: Two messages are submitted, the challenger randomly samples a bit \(b\leftarrow\{0, 1\}\), computes and returns the challenge ciphertext to Then, the challenger increments \(numCt\), adds \(numCt\) to the set Derive, and adds to the set with key \((x * , numCt)\). This query can only be executed once.

[0103] (3)Query Phase 2: Continue to access Just as in query phase 1, except for the following constraints on : If k ∈ Derive and there is a function f in (i.e., f(x * ) ≠ 0) such that f(y) = 0 (to avoid trivial attacks), then the challenger terminates.

[0104] Output: Return a bit b' ∈ {0, 1} to the challenger. If b = b', then win this experiment. In winning the experiment the advantage is defined as then the key-policy attribute-based encryption with switchable attributes is considered to be selectively HSA secure in the standard model.

[0105] The above are only the preferred embodiments of the present invention and are not used to limit the present invention. For those skilled in the art, the present invention can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A key policy attribute encryption technology based on switchable attributes, characterized in that: include: Step 1: Define the system's policy functions, attribute sets, and message space, and generate the system's public key / master key to complete system initialization; Step 2: Based on the master key and the user's access policy function, construct the user's own secret key; Step 3: Based on the user's own secret key, public key and the selected attribute set in the attribute set, a conversion key is obtained; Step 4: Select another attribute set from the attribute set, encrypt the data associated with the attribute set based on the public key of the system, and obtain the original ciphertext; Step 5: Exchange all original ciphertexts based on the conversion key to obtain the switching ciphertext; Step 6: Determine whether the cloud server has received the switching ciphertext. If so, return the switching ciphertext to the user; if not, decrypt the original ciphertext to obtain the plaintext.

2. The key policy attribute encryption technology based on switchable attributes according to claim 1 is characterized in that: Step 1, step 2 and step 3 are the work of the key generation center, step 4 is the work of the data owner; step 5 is the work of the cloud server; and step 6 is the work of the data user.

3. The key policy attribute encryption technology based on switchable attributes according to claim 2 is characterized in that: After all the original ciphertexts are exchanged based on the conversion key to obtain the switched ciphertext, it also includes judging whether the access policy function f(x)=0 holds. If so, the converted ciphertext and a corresponding attribute set are output. If not, an error symbol ⊥ is output, indicating that the original ciphertext is invalid.

4. The key policy attribute encryption technology based on switchable attributes according to claim 3 is characterized in that: The system's policy functions, attribute sets and message space are defined, and the system's public key / master key is generated. Specifically, the Setup algorithm is run with λ as input to generate a public key pk and a master key msk, where λ is a security parameter that determines the security level of the system and is usually used to determine the size of the key and other encryption parameters. pk is the public key used to encrypt messages and generate conversion keys; msk is the master key used to generate secret keys related to access policies.

5. The key policy attribute encryption technology based on switchable attributes according to claim 4 is characterized in that: The method based on the master key and the user's access policy function constructs the user's own secret key, specifically: running the KeyGen algorithm with the master key msk and the access policy Generate key sk f .

6. The key policy attribute encryption technology based on switchable attributes according to claim 5 is characterized in that: The method is based on the user's own secret key, public key and the selected attribute set in the attribute set to obtain the conversion key, specifically: running the SwitchKeyGen algorithm with the public key pk and the key sk f and attribute sets As input, generate the transformation key swk associated with the function f and the attribute set y y .

7. The key policy attribute encryption technology based on switchable attributes according to claim 6 is characterized in that: The method selects another attribute set from the attribute set, encrypts the data associated with the attribute set based on the public key of the system, and obtains the original ciphertext, specifically: running the Ennc algorithm with the public key pk, the plaintext and attribute set x∈χ as input, and output the original ciphertext CT and the corresponding attribute set x.

8. The key policy attribute encryption technology based on switchable attributes according to claim 7 is characterized in that: The method exchanges all original ciphertexts based on the conversion key to obtain the switching ciphertext, specifically: running the Switch algorithm to convert the key swk y and the original ciphertext CT and a corresponding attribute set As input, when f(x) = 0, the output is the converted ciphertext CT′ and the corresponding attribute set y, otherwise the output error symbol ⊥ indicates that the original ciphertext CT is invalid.

9. The key policy attribute encryption technology based on switchable attributes according to claim 8 is characterized in that: The decryption of the original ciphertext to obtain the plaintext is specifically as follows: the user with the key skf runs the Dec algorithm to convert the key swk y and the original ciphertext CT as input, and the output is the plaintext Or the error symbol ⊥.

10. A key policy attribute encryption system based on switchable attributes, characterized in that: include: A generation module, which defines the policy function, attribute set and message space of the system, generates the public key / master key of the system, and completes the initialization of the system; A construction module, wherein the construction module constructs a user's own secret key based on the master key and the user's access policy function; A first acquisition module, the first acquisition module obtains a conversion key based on the user's own secret key, public key and a selected attribute set in the attribute set; A second acquisition module, wherein the second acquisition module selects another attribute set from the attribute set, encrypts data associated with the attribute set based on a public key of the system, and obtains an original ciphertext; A switching module, wherein the switching module switches all original ciphertexts based on a conversion key to obtain a switching ciphertext; The judgment module judges whether the cloud server has received the switching ciphertext. If so, the switching ciphertext is returned to the user; if not, the original ciphertext is decrypted to obtain the plaintext.

Images