Linkable post-quantum certificateless signcryption method and system

Abstract

According to the linkable post-quantum certificateless signcryption method and system, a new post-quantum CLSC scheme is provided, the linkable IoMT is realized, the design provided by the invention is convenient for safely transmitting medical data between a doctor and a patient, the legality of a user is effectively verified, and the user experience is improved. And the risk of private information leakage is reduced to the greatest extent. In order to achieve the purpose, a lattice sampling algorithm and a hash function are used for forming a secret key, then a signature encryption method is adopted, and a link label is designed at the same time.

Description

Technical Field

[0001] The present application belongs to the field of data security technology, and in particular relates to a linkable post-quantum certificateless signcryption method and system. Background Art

[0002] The Internet of Medical Things (IoMT) has gained significant research attention in both academia and healthcare institutions. However, the sensitive data involved in the IoMT raises concerns about user authentication and data privacy.

[0003] To address these issues, certificateless signature cryptography (CLSC) has emerged as a promising solution, providing authenticity, confidentiality, and unforgeability. Unfortunately, most existing CLSC schemes are impractical for IoMT due to heavy computational and storage requirements. Furthermore, these schemes are vulnerable to quantum computing attacks.

[0004] Therefore, current research on designing an efficient post-quantum CLSC scheme is still of far-reaching significance.

[0005] The above statements are only used to provide background technical information related to this application. Unless otherwise indicated herein, the contents described in this section are not prior art for the contents of other parts of this application. Summary of the Invention

[0006] This paper proposes a novel post-quantum CLSC scheme that implements a linkable IoMT. This proposed design facilitates the secure transmission of medical data between doctors and patients, effectively verifies the legitimacy of users, and minimizes the risk of private information leakage. To achieve this, this paper utilizes a lattice sampling algorithm and a hash function to form a key, followed by a signature encryption method and the design of link tags.

[0007] This application also demonstrates the security of the design, including indistinguishability against chosen-ciphertext attacks (IND-CCA2), existential unforgeability against chosen-message attacks (EU-CMA), and linkability. Finally, through a comprehensive performance evaluation, the computational overhead of this application is only 31% of that of other existing solutions. This evaluation demonstrates the practicality and efficiency of this solution.

[0008] According to a first aspect of an embodiment of the present application, a linkable post-quantum certificateless signcryption method is provided, comprising:

[0009] The Key Generation Center (KGC) executes the Setup algorithm to initialize and generate the public parameters pp and the master public key pair (mpk, msk);

[0010] The key generation center (KGC) uses the public parameter pp and the user identity ID i As input, the partial key psk is calculated by the partial key extraction algorithm i , and send part of the key psk i Give identity ID i users;

[0011] The user enters the public parameter pp and identity ID i As input, combined with the partial key psk i Execute the KeyGen algorithm to calculate the public key pair (PK i , SK i );

[0012] The signature encryption user IDs takes the public parameter pp, the medical message m, and the secret key SKs and public key Pku of the non-encrypted user IDu, and the encryption user IDs performs the ciphertext encryption algorithm to generate the ciphertext C and the link tag ls, and sends them to the non-encrypted user IDu;

[0013] The non-encrypted user ID Du takes the public parameter pp, ciphertext C, and the key SKu and public key PKs of the encrypted user IDs as input. The non-encrypted user ID Du executes the ciphertext decryption algorithm to decrypt the ciphertext C, thereby obtaining the medical message m.

[0014] In some embodiments of the present application, the method further comprises an encrypted text linkability checking stage;

[0015] The encrypted text linkability check stage includes: after the doctor user receives the two ciphertexts C1 and C2, he takes the corresponding two link tags L1 and L2 and the ciphertexts C1 and C2 as input, and executes the Link link algorithm to check whether the two ciphertexts C1 and C2 are generated by the same signing user.

[0016] In some embodiments of the present application, the key generation center (KGC) executes the Setup algorithm to initialize and generate the public parameters pp and the master public key pair (mpk, msk), including:

[0017] The system parameters n and security parameters X are input into the Setup algorithm to initialize the entire system. The Setup algorithm generates the public parameters pp and the master public key pair (mpk, msk) through the following steps, including:

[0018] The Key Generation Center (KGC) initially calls the q←poly(n) function, where q is a prime number; then Random selection;

[0019] The key generation center (KGC) defines Θ = 2·n([logq]); then, the error distribution parameter is calculated

[0020] Key Generation Center (KGC) Settings Widget Matrix: gT=[1,2,..,2 k-1 ], k = [logq];

[0021] The Key Generation Center (KGC) selects two common hash functions:

[0022]

[0023] Next, the Key Generation Center (KGC) executes the TrapGen(n,Θ,q) algorithm to calculate and its base

[0024] The Key Generation Center (KGC) calculates the discrete Gaussian distribution And define σ as the discrete highland distribution parameter;

[0025] Then, the key generation center (KGC) defines the master public key mpk:=A, the master secret key msk:=T, and P as the grid sampling parameter.

[0026] Finally, it returns a public parameter pp:={a,λ,d,P,H1,H2} and a master public-secret key pair (mpk,msk).

[0027] In some embodiments of the present application, the key generation center (KGC) uses the public parameter pp and the user identity ID i As input, the partial key psk is calculated by the partial key extraction algorithm i ,include:

[0028] Users include signature encryption user IDs and non-signature encryption user Idu; the signature encryption user IDs set is defined as in is the total number of signature encryption users, S i ∈{0,1}*;Define the set of non-signature encrypted users Idu as U:=(U1,U2,…U k ), where k is the total number of non-signing encryption users, i∈[1,k], U i ∈{0,1}*;

[0029] The Key Generation Center (KGC) calculates U i =H1(ID i ),in Indicates general users;

[0030] The Key Generation Center (KGC) calculates the formula Parsed Then call SamplePre(A, T, U i , p) algorithm obtains the partial key psk of user IDi i ,in

[0031] In some embodiments of the present application, the user will use the public parameter pp and the identity ID i As input, combined with the partial key psk i Execute the KeyGen algorithm to calculate the public key pair (PK i , SK i ),include:

[0032] User ID i Randomly choose a secret value The key is represented as SK i =(S i , psk i )∈Z n ×Z Θ ;

[0033] Then, the user ID i Selection Matrix and a random vector

[0034] 3) Calculate using the algorithm formula:

[0035] Among them, the vector and

[0036] Then, the algorithm calculates As user ID i The public key of

[0037] In some embodiments of the present application, the signature encryption user IDs performs a ciphertext encryption algorithm on the public parameter pp, the medical message m, and the key SKs and public key Pku of the non-encrypted user IDu, and the encryption user IDs to generate a ciphertext C and a link tag ls, and sends the ciphertext C and the link tag ls to the non-encrypted user IDu, including:

[0038] (1) First, the signature encrypted user IDs resolve SKs into psk s , Ss, and calculate the link label

[0039] (2) Signature encryption user IDs randomly select four vectors

[0040] (3) Then randomly select three values And define the vector

[0041] (4) Signature encrypted user IDs calculate the following two vectors:

[0042] in,

[0043] (5) Signature encryption user IDs calculate signature Where, sig't=t+g;

[0044] (6) Then, the signature and encryption user IDs are calculated into three ciphertext elements as follows:

[0045]

[0046] μ=(2v U +m+ <w,H1(ID S , ID U )>+ <m U , r>)mod q·;

[0047] (7) Finally, ID defines and transmits the final ciphertext C = (u1|u2|u) and the link label ls to the non-encrypted user IDu.

[0048] In some embodiments of the present application, the non-encrypted user ID Du takes the public parameter pp, the ciphertext C, and the key SKu and public key PKs of the encrypted user IDs as input, and the non-encrypted user ID Du executes the ciphertext decryption algorithm to decrypt the ciphertext C, thereby obtaining the medical message m, including:

[0049] 1) The unencrypted user ID is calculated using the following formula:

[0050] m=[μ-<μ1,s U >-<μ2, psk U >] q mod 2.;

[0051] 2) Next, calculate as follows:

[0052] The following conditions must be met:

[0053]

[0054] 3) If the verification is successful, the non-encrypted user IDu receives the medical information m; otherwise, the erroneous medical information L is output.

[0055] In some embodiments of the present application, the encrypted text linkability check phase includes:

[0056] The doctor user checks whether the two cipher texts C1 and C2 are valid and refuses to answer if one of the cipher texts is invalid;

[0057] If the two link tags L1 corresponding to the cipher text are equal to L2, then output "link", otherwise output "cancel link".

[0058] According to a second aspect of an embodiment of the present application, a linkable post-quantum certificateless signcryption system is provided, including a medical monitoring device (MMD), a key generation center (KGC), a doctor terminal, and a medical cloud server (MCS); specifically:

[0059] Key Generation Center (KGC), used to execute the Setup algorithm to initialize and generate the public parameters pp and the master public key pair (mpk, msk);

[0060] The key generation center (KGC) uses the public parameter pp and the user identity ID i As input, the partial key psk is calculated by the partial key extraction algorithm i , and send part of the key psk i Give identity ID i users;

[0061] Users include medical monitoring device (MMD) users or doctor-side users, who are used to send public parameters pp and identity ID i As input, combined with the partial key psk i Execute the KeyGen algorithm to calculate the public key pair (PK i , SK i );

[0062] The signature encryption user IDs takes the public parameter pp, the medical message m, and the secret key SKs and public key Pku of the non-encrypted user IDu, and the encryption user IDs performs the ciphertext encryption algorithm to generate the ciphertext C and the link tag ls, and sends them to the non-encrypted user IDu;

[0063] The non-encrypted user ID Du takes the public parameter pp, ciphertext C, and the key SKu and public key PKs of the encrypted user IDs as input. The non-encrypted user ID Du executes the ciphertext decryption algorithm to decrypt the ciphertext C, thereby obtaining the medical message m.

[0064] The Medical Cloud Server (MCS) is used to store medical data. The Medical Monitoring Device (MMD) uploads patient data to the Medical Cloud Server (MCS) through the gateway; the doctor diagnoses the patient based on the patient data.

[0065] According to a third aspect of an embodiment of the present application, a linkable post-quantum certificateless signcryption device is provided, comprising: a storage unit for storing executable instructions; and a processing unit for connecting to the memory to execute the executable instructions to complete a linkable post-quantum certificateless signcryption method.

[0066] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored; the computer program is executed by a processor to implement a linkable post-quantum certificateless signcryption method.

[0067] The linkable post-quantum certificateless signcryption method, system and device of the present application include a medical monitoring device (MMD), a key generation center (KGC), a doctor's terminal and a medical cloud server (MCS). The key generation center (KGC) executes the Setup algorithm to initialize and generate the public parameter pp and the master public key pair (mpk, msk); the key generation center (KGC) uses the public parameter pp and the user identity ID i As input, the partial key psk is calculated by the partial key extraction algorithm i , and send part of the key psk i Give identity ID i The user will use the public parameter pp and identity ID i As input, combined with the partial key psk i Execute the KeyGen algorithm to calculate the public key pair (PK i , SK i This application proposes a new post-quantum CLSC scheme to achieve interconnected IoMT. The design proposed in this application facilitates the secure transmission of medical data between doctors and patients.

[0068] In summary, the linkable post-quantum certificateless signcryption method, system, and device of this application have the following technical effects:

[0069] We propose a linkable post-quantum certificateless signature encryption scheme, named PQ-CLSCL. This quantum-safe certificateless signature encryption protocol is designed for IoT medical scenarios. It aims to ensure the security of medical data transmission between monitoring devices and users (patients and doctors) in IoT medical scenarios. It also verifies the legitimacy of users, mitigates the risk of private information leakage, and quickly determines whether multiple ciphertexts belong to the same patient.

[0070] This application combines lattice-based certificateless signatures and public-key cryptography into a single primitive. It offers several security advantages, including confidentiality, unforgeability, linkability, and authenticity of transmitted data under two types of attacks.

[0071] This application has also been shown to satisfy IND-CCA2, EU-CMA, and linkability in the random oracle model (ROM). Through rigorous security analysis, it was demonstrated that the IND-CCA2, EU-CMA, and linkability of the PQ-CLSCL primitive of this application can be simplified to the difficulty of LWE and SIS, respectively. Through comprehensive security comparisons, this application's solution successfully meets the desired properties of IND-CCA2, UF-CMA, quantum resistance, and linkability, surpassing the existing technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0073] Figure 1 It is a traditional IoMT framework;

[0074] Figure 2 : shows an entity framework diagram of a linkable post-quantum certificateless signcryption scheme according to an embodiment of the present application;

[0075] Figure 3 : shows a schematic diagram of the steps of system initialization according to an embodiment of the present application;

[0076] Figure 4 : shows a schematic diagram of the approximate running time comparison of the signcryption overhead according to an embodiment of the present application;

[0077] Figure 5 FIG. 4 shows an approximate running time comparison of the decryption overhead according to an embodiment of the present application;

[0078] Figure 6 : shows a schematic diagram of the comparison of the approximate running time of the computational overhead according to an embodiment of the present application;

[0079] Figure 7 : A schematic structural diagram of a linkable post-quantum certificateless signcryption system according to an embodiment of the present application is shown in FIG.

[0080] Figure 8 Graph 1 shows a schematic structural diagram of a linkable post-quantum certificateless signcryption device according to an embodiment of the present application. DETAILED DESCRIPTION

[0081] Regarding this application, the Internet of Medical Things (IOMT), a new concept generated by the combination of medical sensor devices and the Internet of Things, provides patients with diverse and flexible treatment options.

[0082] like Figure 1 As shown in the figure, the traditional IOMT scenario consists of three entities: medical monitoring devices (MMDs), doctors, and patients. Data on various physical indicators is transmitted to the hospital for storage via the internet. Doctors can access the patient's medical health data by accessing the patient's record database. They then use artificial intelligence algorithms to analyze the patient's data, identify possible conditions, provide remote treatment, prescribe potential medications, and make near-real-time decisions for the patient. When the patient is recovering from an illness, the doctor can also remotely consult the patient for advice and preventive measures to prevent the disease.

[0083] IOMT provides patients with convenient and reliable healthcare services, enabling them to prevent or treat illnesses remotely and promptly. However, the data transmission model of IoMT can be intercepted and even tampered with by adversaries during communication, leading to the leakage of large amounts of sensitive information and even misdiagnosing a patient's condition. This can affect the patient's health. Therefore, securely transmitting and protecting medical data for IOMT is both important and challenging.

[0084] To address these issues, certificateless signature cryptography (CLSC) has emerged as a promising solution. Many researchers have employed digital signature public key cryptography to secure data transmission between medical monitoring devices and users, enabling user authentication and personal information protection. However, directly combining these cryptographic primitives in a single scheme significantly increases computational and storage overhead, making it impractical in IoMT scenarios.

[0085] Alternatively, signature cryptography has been proposed, which can perform encryption and signing operations simultaneously. It not only meets the authenticity and confidentiality requirements, but is also more efficient than the traditional "sign then encrypt" or "encrypt then sign" methods. Classic signcryption structures mainly include identity-based public key cryptography (IB-PKC) and public key infrastructure (PKI). However, the PKI-based CLSC scheme requires the certificate authority (CA) to distribute a large number of certificates to users, resulting in complex management and high storage overhead. In addition, the prototype of the public key cryptography (IB-PKC) system faces the key escrow problem, in which the key generation center (KGC) can arbitrarily decrypt users' messages and forge their signatures, posing a serious security risk.

[0086] Alternatively, a certificateless public key cryptography (CL-PKC) primitive has been proposed. Unlike IB-PKC, it introduces a semi-honest KGC, where the master key is only used to generate the user's partial key. The concept of CLSC was later formalized based on bilinear pairing. In this protocol, the user's key consists of a user-selected key value and a partial key. Since then, many new CLSC schemes have been proposed.

[0087] However, these schemes either require significant computational overhead or fail to provide data confidentiality in IoMT scenarios. Furthermore, most schemes are vulnerable to quantum attacks and cannot provide linkability, making them insecure and impractical.

[0088] Regarding signcryption primitives, they can simultaneously perform the functions of public key encryption and digital signature, thereby ensuring the confidentiality and integrity of data transmission. Compared with traditional signature-after-encryption schemes, these primitives provide lower communication overhead.

[0089] There is currently little research on practical schemes for protecting healthcare data in the Internet of Things using signature cryptographic primitives.

[0090] While the Internet of Things (IoMT) offers patients more reliable and convenient healthcare services, enabling them to access timely medical treatment, transmitting medical data across the IoMT presents significant security and privacy challenges. For example, data could be tampered with by malicious adversaries, potentially leaking sensitive patient information. These issues pose a bottleneck to the development of the IoMT. Therefore, achieving quantum security while ensuring the confidentiality and integrity of medical data remains a key challenge.

[0091] Based on the above considerations, this application prioritizes practicality, efficiency, and security. To address these issues, this application develops a signcryption primitive that simultaneously performs the functions of public-key encryption and digital signatures. Furthermore, this application incorporates lattice hardness to protect against quantum attacks.

[0092] To simplify the complexity of key management and deployment, this application also incorporates a certificateless framework, thereby avoiding the certificate management challenges associated with public key infrastructure (PKI).

[0093] In terms of security requirements, the design of this application is quantum-resistant and can ensure the confidentiality, unforgeability and linkability of medical data.

[0094] The linkable post-quantum certificateless signcryption method and system of this application achieves the following effects:

[0095] This application proposes a linkable post-quantum certificateless signature encryption scheme, PQ-CLSCL, designed to secure medical data transmission between monitoring devices and users (patients and doctors) in IoT healthcare scenarios. It verifies the legitimacy of users, mitigates the risk of private information leakage, and quickly determines whether multiple ciphertexts belong to the same patient. To the best of our knowledge, this is the first quantum-safe certificateless signature encryption protocol for IoT healthcare scenarios.

[0096] 2. This application scheme combines lattice-based certificateless signatures and public-key cryptography into a single primitive. It provides several security advantages, including confidentiality, unforgeability, linkability, and authenticity of transmitted data under two types of attacks.

[0097] 3. Our scheme has been shown to satisfy IND-CCA2, EU-CMA, and linkability in randomized models (ROMs). Through rigorous security analysis, we demonstrate that the IND-CCA2, EU-CMA, and linkability properties of our PQ-CLSCL primitive can be simplified to the hardness of LWE and SIS, respectively. Through comprehensive security comparisons, our scheme successfully meets the desired properties of IND-CCA2, UF-CMA, quantum resistance, and linkability simultaneously, surpassing previous approaches.

[0098] 4. Through comprehensive experiments, the present application determined that the signature encryption and signature decryption overheads of the present application are 21.067 milliseconds and 10.567 milliseconds, respectively, and the total computational overhead is 31.634 milliseconds. Comparative analysis with other signature encryption protocols shows that the performance of the PO-CLSCL scheme of the present application is superior to the overhead of all other lattice-based schemes. It is worth noting that compared with all other schemes, the signature encryption and signature decryption overheads of the present application are only 0.30 to 1.0 times and 0.28 to 1.0 times, respectively. The computational overhead of the present application is only 0.31 to 1.0 times that of the existing dry lattice signature encryption scheme.

[0099] Compared to the traditional format-based signature encryption scheme that usually uses the encryption-then-signing method, this application involves incorporating the hash function H1 and SamplePre technology into the partial key algorithm to calculate psk i Each user then chooses a secret value Si and compares it with psk i Combined, we get its secret key SK i .

[0100] Due to the huge amount of medical data available, doctors need to spend a lot of time downloading and decrypting multiple medical data to determine whether they correspond to a specific patient. This application introduces the concept of linkability, which allows doctors to directly determine whether multiple sets of medical data belong to the same patient, thereby significantly reducing computational overhead. Most existing signature encryption schemes do not consider linkability. This application adds a link tag ls=psk in the ciphertext generation stage. s +A T Ss. In the ciphertext linkability checking stage, the doctor can easily determine whether two ciphertexts C1 and C2 are from the same patient by comparing the two link labels L1 and L2.

[0101] In order to make the technical solutions and advantages of the embodiments of the present application more clearly understood, the exemplary embodiments of the present application are further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, and are not an exhaustive list of all the embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other unless they conflict.

[0102] Example 1

[0103] In order to better illustrate the solution of this application, we first explain the prerequisites, including a brief summary of symbols, lattices, LWE difficulty and lattice-based algorithms.

[0104] Table 1 explains the acronyms and descriptions used in this application.

[0105]

[0106] Table 1

[0107] In this application, we use lowercase bold letters to represent vectors, such as (ega), uppercase bold letters to represent matrices, such as (egA), and Z to represent integers. We use [A|B] to represent the concatenation of matrices A and B. We use ← to represent sample values.

[0108] Definition 1: Given linearly independent vectors b1, b2, .., b n ∈R m , the m-dimensional grid Λ is defined below.

[0109]

[0110] Then B={b1,b2,..,b n}∈R m×n is a basis of Λ.

[0111] Definition 2: Given a positive parameter σ∈R + , a center c∈Z m and any x∈Z m , then it is believed that is a discrete Gaussian distribution over Λ:

[0112]

[0113] where c is a center and

[0114] Definition 3: Given two positive integers n, α∈(0,1), a prime number q=q(n)>2, where And a secret The definition is as follows:

[0115] (1) LWE distribution: uniformly select a matrix A sample Output

[0116] (2) Uniform distribution: Randomly select the matrix and vector Then, return

[0117] Lemma 1: Given a vector e←D Zm ,s and inequality and but With overwhelming probability.

[0118] Definition 4: Given a positive integer q, a random matrix m random vectors and a real number β (a>β), find a nonzero integer vector z∈Z m , whose norm ||z||≤βs.t., so that

[0119] Lemma 2: Informally, when c = 0, we say Abbreviated as Given a vector It has Impressive maneuverability.

[0120] Given a real number λ>0 and a vector g∈Z n , we have:

[0121]

[0122] where σ=Ψ(||g||), The probability distribution of is:

[0123]

[0124] Theorem 1: Given three integers n, m and q, the TrapGen(n,mq) algorithm publishes the matrix A∈ Heki where A is statistically close to uniform, and

[0125] Theorem 2: Assume three integers n, q>2, m≥2nlog9. Use the matrix lattice basis and Gaussian parameters As input, the SamplePre(A, T, v, σ) algorithm computes a vector It is statistically close to distribution D Satisfies Ax=v mod q.

[0126] Definition 5: A simplified version of the residual hashing lemma, consisting of two universal functions F = {f:X→Y}, which, given two vectors X1, X2 (X1≠X2), always satisfy: Specifically, given a finite additive group Any integer m > 1, and a matrix function It is doubly universal.

[0127] Figure 2 ] shows an entity framework diagram of a linkable post-quantum certificateless signcryption scheme according to an embodiment of the present application.

[0128] like Figure 2 As shown in the figure, the linkable post-quantum certificateless signcryption system includes medical monitoring devices (MMDs), gateways, key generation centers (KGCs), doctors, and medical cloud servers (MCSs); specifically:

[0129] Medical monitoring devices (MMDs) are used by patients to carry and monitor various health indicators of patients; they usually consist of, for example, stethoscope holders, blood pressure monitors, and continuous positive airway pressure monitors;

[0130] Gateway, used to transmit data from medical monitoring devices (MMDs) to a gateway router via a short-range wireless transceiver in IoMT scenarios;

[0131] Key Generation Center (KGC), used to generate public parameters and main public key pairs; and calculate the partial secret keys of patients and doctors;

[0132] Doctor users are used to obtain medical information from the medical center. There is a corresponding relationship between the signed encrypted plaintext stored in the medical center and the patient's private information. Doctors obtain the corresponding encrypted plaintext from the medical center based on the patient's public information.

[0133] MCS is a cloud server used to store medical data. Medical monitoring devices (MMDs) upload patient data to MCS through a gateway; doctor users diagnose patients based on the patient data.

[0134] Based on the above entities, the PO-CLSCL scheme of this application mainly includes six algorithm modules: initial setup, partial secret key extraction key generation, signcryption, no signcryption and linking. The algorithm modules are defined as follows.

[0135] 1) Initial setting algorithm: Given a system parameter n and a security parameter λ, the algorithm is executed by KGC and outputs a public parameter pp and a master public key pair (mpk, msk).

[0136] 2) Partial Key Extraction Algorithm, PSK i ←Partial key extraction (ID i ,pp); given an ID i and a public parameter pp for the user, the algorithm returns the user's partial key psk i .

[0137] 3) Public key pair algorithm (PK i , SK i )←KeyGen(ID i ,pp); given a user identity ID i and a public parameter pp, the algorithm calculates a secret key value Si as an intermediate value and publishes a public key pair (PK i , SK i ).

[0138] 4) Cipher algorithm C, given a public parameter pp, a medical message m, a signature encryption user ID s and its key SK i , a non-encrypted user IDu and its public key Pku, the algorithm outputs a ciphertext c.

[0139] 5) Decryption algorithm, m or L ← decrypt(pp, c, IDs, PKs, IDu, SKu); given a public parameter pp, a ciphertext c, a signed encrypted user IDs and its public key PKs, and a non-encrypted user IDu and its key Sku, the algorithm obtains m or L.

[0140] 6) Linking algorithm, “Link” or “Unlink L” ← Link(C1, C2, L1, L2): Given two texts C1, C2 and two link labels L1, L2, this algorithm returns a link or an unlink.

[0141] Therefore, this application proposes PO-CLSCL, a new post-quantum CLSC scheme, which realizes IoMT with linkability. The design proposed in this application facilitates the secure transmission of medical data between doctors and patients, effectively verifies the legitimacy of users, and minimizes the risk of private information leakage. To achieve this, this application utilizes a lattice sampling algorithm and a hash function component key, and then adopts a signature encryption method, while designing link tags. This application also formally proves the security of the design of this application, including indistinguishability against chosen ciphertext attacks (IND-CCA2), unforgeability against the existence of chosen message attacks (EU-CMA), and linkability. Finally, through a comprehensive performance evaluation, the computational overhead of this application is only 31% of other existing schemes. The evaluation results show that the solution of this application is practical and efficient.

[0142] Figure 3 hereinafter is a schematic diagram showing the steps of a linkable post-quantum certificateless signcryption method according to an embodiment of the present application.

[0143] like Figure 3 As shown, a linkable post-quantum certificateless signcryption method according to an embodiment of the present application includes:

[0144] S1: The Key Generation Center (KGC) executes the Setup algorithm to initialize and generate the public parameters pp and the master public key pair (mpk, msk);

[0145] S2: The key generation center (KGC) sends the public parameter pp and the user identity ID i As input, the partial key psk is calculated by the partial key extraction algorithm i , and send part of the key psk i Give identity ID i users;

[0146] S3: The user enters the public parameter pp and identity ID i As input, combined with the partial key psk i Execute the KeyGen algorithm to calculate the public key pair (PK i , SK i );

[0147] S4: The signature encryption user IDs takes the public parameter pp, the medical message m, and the key SKs and public key Pku of the non-encrypted user IDu, and the encryption user IDs performs the ciphertext encryption algorithm to generate the ciphertext C and the link label ls, and sends them to the non-encrypted user IDu;

[0148] S5: The non-encrypted user ID Du takes the public parameter pp, the ciphertext C, and the key SKu and public key PKs of the encrypted user IDs as input, and the non-encrypted user ID Du executes the ciphertext decryption algorithm to decrypt the ciphertext C, thereby obtaining the medical message m.

[0149] In other embodiments, the method also includes an encrypted text linkage check stage; the encrypted text linkage check stage includes: after the doctor user receives the two ciphertexts C1 and C2, the corresponding two link tags L1 and L2 and the ciphertexts C1 and C2 are used as input to execute the Link link algorithm to check whether the two ciphertexts C1 and C2 are generated by the same signing user.

[0150] In specific implementation, the encrypted text linkage check stage includes: first, the doctor user checks whether the two cipher texts C1 and C2 are valid, and refuses to answer if one cipher text is invalid; if the two link labels L1 corresponding to the cipher text are L2, then output "link", otherwise output "cancel link".

[0151] In the specific implementation, in S1, the key generation center (KGC) executes the Setup algorithm to initialize and generate the public parameters pp and the master public key pair (mpk, msk), including:

[0152] Input the system parameter n and security parameter X into the Setup algorithm to initialize the entire system; the Setup algorithm generates the public parameter pp and the master public key pair (mpk, msk) through the following steps.

[0153] Initialization specifically includes: 1. The key generation center (KGC) initially calls the q←poly(n) function, where q is a prime number; then Random selection;

[0154] 2. The Key Generation Center (KGC) defines Θ = 2·n([logq]); then, calculates the error distribution parameter

[0155] 3. Key Generation Center (KGC) Setting Tool Matrix: gT=[1,2,..,2 k-1 ], k = [logq];

[0156] 4. The Key Generation Center (KGC) selects two common hash functions:

[0157]

[0158] 5. Next, the Key Generation Center (KGC) executes the TrapGen(n,Θ,q) algorithm to calculate and its base

[0159] 6. Key Generation Center (KGC) calculates discrete Gaussian distribution And define σ as the discrete highland distribution parameter;

[0160] 7. Then, the key generation center (KGC) defines the master public key mpk:=A, the master secret key msk:=T, and P as the grid sampling parameter.

[0161] 8. Finally, it returns a public parameter pp:={a, λ, d, P, H1, H2} and a master public-secret key pair (mpk, msk).

[0162] Next, in S2, the key generation center (KGC) sends the public parameter pp and the user ID i As input, the partial key psk is calculated by the partial key extraction algorithm i ,include:

[0163] 1) Users include signature encryption user IDs and non-signature encryption user Idu; the signature encryption user IDs set is defined as in is the total number of signature encryption users, S i ∈{0,1}*;Define the set of non-signature encrypted users Idu as U:=(U1,U2,…U k ), where k is the total number of non-signing encryption users, i∈[1,k], U i ∈{0,1}*;

[0164] 2) The Key Generation Center (KGC) calculates U i =H1(ID i ),in Indicates general users;

[0165] 3) The Key Generation Center (KGC) calculates the formula Parsed Then call SamplePre(A, T, U i , p) algorithm obtains the partial key psk of user IDi i ,in

[0166] In the specific implementation, in S3, the user will use the public parameter pp and identity ID i As input, combined with the partial key psk i Execute the KeyGen algorithm to calculate the public key pair (PK i , SK i ),include:

[0167] 1. User ID i Randomly choose a secret value The key is represented as SK i =(S i , psk i )∈Z n ×Z Θ ;

[0168] 2. Then, user ID i Selection Matrix and a random vector

[0169] 3. Calculate by algorithm formula:

[0170] Among them, the vector and

[0171] 4. Then, calculate through the algorithm As user ID i The public key of

[0172] In the following implementation, in S4, the signature encryption user IDs takes the public parameter pp, the medical message m, and the key SKs and public key Pku of the non-encrypted user IDu, and the encryption user IDs performs the ciphertext encryption algorithm to generate the ciphertext C and the link tag ls, and sends it to the non-encrypted user IDu, including:

[0173] (1) First, the signature encrypted user IDs resolve SKs into psk s , Ss, and calculate the link label

[0174] (2) Signature encryption user IDs randomly select four vectors

[0175] (3) Then randomly select three values And define the vector

[0176] (4) Signature encrypted user IDs calculate the following two vectors:

[0177] in,

[0178] (5) Signature encryption user IDs calculate signature Where, sig't=t+g;

[0179] (6) Then, the signature and encryption user IDs are calculated into three ciphertext elements as follows:

[0180]

[0181] μ=(2v U +m+ <w,H1(ID S , ID U )>+ <m U , r>)mod q.;

[0182] (7) Finally, ID defines and transmits the final ciphertext C = (u1|u2|u) and the link label ls to the non-encrypted user IDu.

[0183] In the following implementation, in S5, the non-encrypted user ID Du takes the public parameter pp, the ciphertext C, and the key SKu and public key PKs of the encrypted user IDs as input, and the non-encrypted user ID Du executes the ciphertext decryption algorithm to decrypt the ciphertext C, thereby obtaining the medical message m, including:

[0184] 1) The unencrypted user ID is calculated using the following formula:

[0185] m=[μ-<μ1,s U >-<μ2, psk U >] q mod 2.;

[0186] 2) Next, calculate as follows:

[0187] The following conditions must be met:

[0188]

[0189] 3) If the verification is successful, the non-encrypted user IDu receives the medical information m; otherwise, the erroneous medical information L is output.

[0190] Finally, this paper also analyzes the security of the PQ-CLSCL scheme in terms of confidentiality, unforgeability, and linkability. It proves that this scheme has designed security, including indistinguishability against chosen ciphertext attacks (IND-CCA2), existential unforgeability against chosen message attacks (EU-CMA), and linkability.

[0191] In addition, the present application scheme is compared and analyzed with other existing signature schemes in terms of computational overhead and communication overhead.

[0192] Regarding communication overhead, we focused on comparing the size of ciphertext and public keys. The public key size is significantly lower than that proposed by other existing schemes. Regarding ciphertext size, this application's ciphertext size is significantly smaller than other lattice-based signature encryption schemes.

[0193] In order to conduct a comparative analysis of computational overhead, this application provides the theoretical calculated values of signature encryption and decryption overhead in our basic elements and six other existing mechanisms. It can be concluded that the time scheduling overhead of the protocol of this application is significantly lower than that of the lattice-based scheme.

[0194] The MALTAB experimental platform was used to conduct simulation experiments to compare the present application scheme with six other key encryption protocols.

[0195] Figure 4 、 Figure 5 and Figure 6 1 and 2 show a schematic diagram of the approximate running time comparison of the signcryption overhead, a schematic diagram of the approximate running time comparison of the decryption overhead, and a schematic diagram of the approximate running time comparison of the computation overhead according to an embodiment of the present application. Figure 4 、 Figure 5 、 Figure 6 It can be seen that the signature encryption overhead of the present application scheme is much lower than the existing format-based signature encryption scheme.

[0196] Through comprehensive experiments, it was determined that the signature encryption and signature decryption overheads of this application are 21.067 milliseconds and 10.567 milliseconds respectively, with a total computational overhead of 31.634 milliseconds. Comparative analysis with other signature encryption protocols shows that the performance of the PO-CLSCL scheme of this application is superior to the overhead of all other lattice-based schemes. It is worth noting that compared with all other schemes, the signature encryption and signature decryption overheads of this application are only 0.30 to 1.0 times and 0.28 to 1.0 times respectively. The computational overhead of this application is only 0.31 to 1.0 times that of existing dry lattice signature encryption schemes.

[0197] Finally, through a comprehensive performance evaluation, the computational overhead of this application is only 31% of that of other existing solutions. The evaluation results show that this application's solution is practical and efficient.

[0198] In summary, the linkable post-quantum certificateless signcryption method, system, and device of this application have the following technical effects:

[0199] We propose a linkable post-quantum certificateless signature encryption scheme, named PQ-CLSCL. This quantum-safe certificateless signature encryption protocol is designed for IoT medical scenarios. It aims to ensure the security of medical data transmission between monitoring devices and users (patients and doctors) in IoT medical scenarios. It also verifies the legitimacy of users, mitigates the risk of private information leakage, and quickly determines whether multiple ciphertexts belong to the same patient.

[0200] This application combines lattice-based certificateless signatures and public-key cryptography into a single primitive. It offers several security advantages, including confidentiality, unforgeability, linkability, and authenticity of transmitted data under two types of attacks.

[0201] This application has also been shown to satisfy IND-CCA2, EU-CMA, and linkability in the random oracle model (ROM). Through rigorous security analysis, it was demonstrated that the IND-CCA2, EU-CMA, and linkability of the PQ-CLSCL primitive of this application can be simplified to the difficulty of LWE and SIS, respectively. Through comprehensive security comparisons, this application's solution successfully meets the desired properties of IND-CCA2, UF-CMA, quantum resistance, and linkability, surpassing the existing technology.

[0202] Example 2

[0203] This embodiment provides a linkable post-quantum certificateless signcryption system. For details not disclosed in the linkable post-quantum certificateless signcryption system of this embodiment, please refer to the specific implementation content of the linkable post-quantum certificateless signcryption method in other embodiments.

[0204] Figure 7 Graph 2 shows a schematic structural diagram of a linkable post-quantum certificateless signcryption system according to an embodiment of the present application.

[0205] like Figure 7 As shown, the linkable post-quantum certificateless signcryption system includes a medical monitoring device (MMD) 21, a key generation center (KGC) 10, a doctor terminal 22 and a medical cloud server (MCS) 30; specifically:

[0206] Key Generation Center (KGC) 10, used to execute the Setup algorithm to initialize and generate the public parameters pp and the master public key pair (mpk, msk);

[0207] The key generation center (KGC) 10 uses the public parameter pp and the user identity ID i As input, the partial key psk is calculated by the partial key extraction algorithm i , and send part of the key psk i Give identity ID i users;

[0208] The user includes a medical monitoring device (MMD) 21 user or a doctor 22 user, which is used to send the public parameter pp and the identity ID i As input, combined with the partial key psk i Execute the KeyGen algorithm to calculate the public key pair (PK i , SK i );

[0209] The signature encryption user IDs takes the public parameter pp, the medical message m, and the secret key SKs and public key Pku of the non-encrypted user IDu, and the encryption user IDs performs the ciphertext encryption algorithm to generate the ciphertext C and the link tag ls, and sends them to the non-encrypted user IDu;

[0210] The non-encrypted user ID Du takes the public parameter pp, ciphertext C, and the key SKu and public key PKs of the encrypted user IDs as input. The non-encrypted user ID Du executes the ciphertext decryption algorithm to decrypt the ciphertext C, thereby obtaining the medical message m.

[0211] The medical cloud server (MCS) 30 is used to store medical data. The medical monitoring device (MMD) uploads the patient data to the medical cloud server (MCS) through the gateway; the doctor diagnoses the patient based on the patient data.

[0212] This application's linkable post-quantum certificateless signcryption system discloses a new post-quantum CLSC scheme that implements a linkable IoMT. The proposed design facilitates the secure transmission of medical data between doctors and patients, effectively verifying the legitimacy of users and minimizing the risk of private information leakage. To achieve this, this application utilizes a lattice sampling algorithm and a hash function to form a key, followed by a signature encryption method and the design of a link tag.

[0213] Example 3

[0214] This embodiment provides a linkable post-quantum certificateless signcryption device. For details not disclosed in the linkable post-quantum certificateless signcryption device of this embodiment, please refer to the specific implementation content of the linkable post-quantum certificateless signcryption method or system in other embodiments.

[0215] Figure 8 Graph 2 shows a schematic structural diagram of a linkable post-quantum certificateless signcryption device 400 according to an embodiment of the present application.

[0216] like Figure 8As shown, the linkable post-quantum certificateless signcryption device 400 includes: a storage unit 402: for storing executable instructions; and a processing unit 401: for connecting with the storage unit 402 to execute the executable instructions to complete the linkable post-quantum certificateless signcryption method.

[0217] Those skilled in the art will understand that Figure 8 The present invention is merely an example of a linkable post-quantum certificateless signcryption device 400 and does not limit the linkable post-quantum certificateless signcryption device 400. The present invention may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the linkable post-quantum certificateless signcryption device 400 may also include input and output devices, network access devices, buses, etc.

[0218] The so-called processing unit 401 (Central Processing Unit, CPU) can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), field-programmable gate arrays (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or the processing unit 401 can also be any conventional processor, etc. The processing unit 401 is the control center of the linkable post-quantum certificateless signcryption device 400, and uses various interfaces and lines to connect various parts of the entire linkable post-quantum certificateless signcryption device 400.

[0219] The storage unit 402 can be used to store computer-readable instructions. The processing unit 401 implements the various functions of the linkable post-quantum certificateless signcryption device 400 by running or executing the computer-readable instructions or modules stored in the storage unit 402 and calling the data stored in the storage unit 402. The storage unit 402 may mainly include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as a sound playback function or an image playback function); the data storage area may store data created based on the use of the linkable post-quantum certificateless signcryption device 400. In addition, the storage unit 402 may include a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, a read-only memory (ROM), a random access memory (RAM), or other non-volatile / volatile storage devices.

[0220] If the modules integrated in the linkable post-quantum certificateless signcryption device 400 are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the present invention can also implement all or part of the processes in the above-mentioned method embodiments by instructing the relevant hardware through computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium. When executed by a processor, the computer-readable instructions can implement the steps of each of the above-mentioned method embodiments.

[0221] Example 4

[0222] This embodiment provides a computer-readable storage medium having a computer program stored thereon; the computer program is executed by a processor to implement the linkable post-quantum certificateless signcryption method in other embodiments.

[0223] Those skilled in the art will appreciate that the terms used in the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. As used in the present invention and the appended claims, the singular forms "a," "the," and "the" are intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any or all possible combinations of one or more of the associated listed items.

[0224] It should be understood that although the terms "first," "second," "third," etc. may be used in the present invention to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present invention. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0225] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0226] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A linkable post-quantum certificateless signcryption method, characterized in that: include: The Key Generation Center (KGC) executes the Setup algorithm to initialize and generate the public parameters pp and the master public key pair (mpk, msk); The key generation center (KGC) uses the public parameter pp and the user identity ID i As input, the partial key psk is calculated by the partial key extraction algorithm i , and sends the partial key psk i Give identity ID i users; The user enters the public parameter pp and identity ID i As input, combined with the partial key psk i Execute the KeyGen algorithm to calculate the public key pair (PK i , SK i ); The signature encryption user IDs takes the public parameter pp, the medical message m, and the key SKs and public key Pku of the non-encrypted user IDu, and the encryption user IDs performs the ciphertext encryption algorithm to generate the ciphertext C and the link tag ls, and sends them to the non-encrypted user IDu; The non-encrypted user ID Du takes the public parameter pp, ciphertext C, and the key SKu and public key PKs of the encrypted user IDs as input. The non-encrypted user ID Du executes the ciphertext decryption algorithm to decrypt the ciphertext C, thereby obtaining the medical message m.

2. The linkable post-quantum certificateless signcryption method according to claim 1, characterized in that: It also includes the encrypted text linkability checking stage; The encrypted text linkability check stage includes: after the doctor user receives the two ciphertexts C1 and C2, he takes the corresponding two link tags L1 and L2 and the ciphertexts C1 and C2 as input, and executes the Link algorithm to check whether the two ciphertexts C1 and C2 are generated by the same signing user.

3. The linkable post-quantum certificateless signcryption method according to claim 1, characterized in that: The key generation center (KGC) executes the Setup algorithm to initialize and generate the public parameters pp and the master public key pair (mpk, msk), including: The system parameters n and security parameters X are input into the Setup algorithm to initialize the entire system; the Setup algorithm generates the public parameters pp and the master public key pair (mpk, msk) through the following steps, including: The Key Generation Center (KGC) initially calls the q←poly(n) function, where q is a prime number; then Random selection; The key generation center (KGC) defines Θ = 2·n([logq]); then, the error distribution parameter is calculated Key Generation Center (KGC) Settings Widget Matrix: gT=[1,2,..,2 k-1 ], k = [logq]; The Key Generation Center (KGC) selects two common hash functions: Next, the Key Generation Center (KGC) executes the TrapGen(n,Θ,q) algorithm to calculate and its base The Key Generation Center (KGC) calculates the discrete Gaussian distribution And define σ as the discrete highland distribution parameter; Then, the key generation center (KGC) defines the master public key mpk:=A, the master secret key msk:=T, and P as the grid sampling parameter; Finally, it returns a public parameter pp:={a,λ,d,P,H1,H2} and a master public-secret key pair (mpk,msk).

4. The linkable post-quantum certificateless signcryption method according to claim 1, characterized in that: The key generation center (KGC) uses the public parameter pp and the user identity ID i As input, the partial key psk is calculated by the partial key extraction algorithm i ,include: Users include signature encryption user IDs and non-signature encryption user Idu; the signature encryption user IDs set is defined as S: = {S1, S2...S l }, where l is the total number of signature encryption users, i∈[1,l], S i ∈{0,1}*;Define the set of non-signature encrypted users Idu as U:=(U1,U2,…U k ), where k is the total number of non-signing encryption users, i∈[1,k], U i ∈{0,1}*; The Key Generation Center (KGC) calculates U i =H1(ID i ), where ID i ∈{S,U}={S1,S2…Sl,U1,U2,…U k } represents general users; The Key Generation Center (KGC) calculates the formula Parsed Then call SamplePre(A, T, U i , p) algorithm obtains the partial key psk of user IDi i ,in 5. The linkable post-quantum certificateless signcryption method according to claim 1, characterized in that: The user sends the public parameter pp and identity ID i As input, combined with the partial key psk i Execute the KeyGen algorithm to calculate the public key pair (PK i , SK i ),include: User ID i Randomly choose a secret value The key is represented as SK i =(S i , psk i )∈Z n ×Z Θ ; Then, the user ID i Selection Matrix and a random vector Next, calculate using the algorithm formula: Among them, the vector and Then, the algorithm calculates As user ID i The public key of 6. The linkable post-quantum certificateless signcryption method according to claim 1, characterized in that: The signature encryption user IDs performs a ciphertext encryption algorithm on the public parameter pp, the medical message m, and the key SKs and public key Pku of the non-encrypted user IDu to generate a ciphertext C and a link tag ls, and sends the ciphertext C and the link tag ls to the non-encrypted user IDu. include: (1) First, the signature encrypted user IDs parse SKs into psk s , Ss, and calculate the link label (2) The signature encryption user IDs randomly select four vectors (3) Then randomly select three values And define the vector (4) The signature encryption user IDs calculate the following two vectors: Where t = SKsg + ε∈Z 3e ; (5) The signature is encrypted using user IDs to calculate the signature Where, sig't=t+g; (6) Then, the signature and encryption user IDs are calculated into three ciphertext elements as follows: μ=(2v U +m+ <w,H1(ID S ,ID U )〉+ <m U ,r>)mod q; (7) Finally, ID defines and transmits the final ciphertext C = (u1|u2|u) and the link label ls to the non-encrypted user IDu.

7. The linkable post-quantum certificateless signcryption method according to claim 1, characterized in that The non-encrypted user ID Du takes the public parameter pp, the ciphertext C, and the key SKu and public key PKs of the encrypted user IDs as input, and the non-encrypted user ID Du executes the ciphertext decryption algorithm to decrypt the ciphertext C, thereby obtaining the medical message m, including: 1) The unencrypted user ID is calculated using the following formula: m=[μ-<μ1,s U >-〈μ2,psk U >] q mod2.; 2) Next, calculate as follows: The following conditions must be met: 3) If the verification is successful, the non-encrypted user IDu receives the medical information m; otherwise, the erroneous medical information L is output.

8. The linkable post-quantum certificateless signcryption method according to claim 2, characterized in that: The encrypted text linkability checking phase includes: The doctor user checks whether the two cipher texts C1 and C2 are valid and refuses to answer if one of the cipher texts is invalid; If the two link tags L1 corresponding to the cipher text are equal to L2, then output "link", otherwise output "unlink".

9. A linkable post-quantum certificateless signcryption system, characterized in that Including medical monitoring device (MMD), key generation center (KGC), doctor terminal and medical cloud server (MCS); specifically: Key Generation Center (KGC), used to execute the Setup algorithm to initialize and generate the public parameters pp and the master public key pair (mpk, msk); The key generation center (KGC) uses the public parameter pp and the user identity ID i As input, the partial key psk is calculated by the partial key extraction algorithm i , and sends the partial key psk i Give identity ID i users; The user includes a medical monitoring device (MMD) user or a doctor end user, which is used to send the public parameter pp and identity ID i As input, combined with the partial key psk i Execute the KeyGen algorithm to calculate the public key pair (PK i , SK i ); The signature encryption user IDs takes the public parameter pp, the medical message m, and the key SKs and public key Pku of the non-encrypted user IDu, and the encryption user IDs performs the ciphertext encryption algorithm to generate the ciphertext C and the link tag ls, and sends them to the non-encrypted user IDu; The non-encrypted user IDu takes the public parameter pp, the ciphertext C, and the key SKu and public key PKs of the encrypted user IDs as inputs, and the non-encrypted user IDu executes the ciphertext decryption algorithm to decrypt the ciphertext C, thereby obtaining the medical message m; The medical cloud server (MCS) is used to store medical data. The medical monitoring device (MMD) uploads the patient data to the medical cloud server (MCS) through the gateway; the doctor diagnoses the patient based on the patient data.

10. A computer-readable storage medium, characterized in that A computer program is stored thereon; the computer program is executed by a processor to implement the method according to any one of claims 1 to 8.

Images