Privacy protection attribute-based security access control method and system, and storage medium

Abstract

The embodiment of the invention provides a privacy protection attribute-based security access control method and system and a storage medium, and belongs to the technical field of data protection. The method comprises the following steps: a data owning end obtains an institution public key for encrypting a target plaintext from a cloud server, and determines an attribute mapping ciphertext and an access structure according to an attribute privacy sub-public key in the institution public key; and according to the first mechanism sub-public key, the second mechanism sub-public key and the access structure in the mechanism public key, determining a target ciphertext and sending the target ciphertext to the cloud server. The cloud server side performs semi-decryption on the target ciphertext and sends the target ciphertext to the data use side based on a stored first user token, a user end attribute key containing the target attribute token and a second user token in an access request initiated by the data use side; the user end attribute key is generated by the cloud server side based on a user original attribute key, a user public key and a first user token of the mechanism side; according to the embodiment of the invention, the privacy and security of data access can be improved at the same time.

Description

Technical Field

[0001] The present application relates to the field of public data protection technology, and in particular to a method, system and storage medium for attribute-based security access control with privacy protection. Background Art

[0002] In the digital age, data covers a variety of confidential data such as government affairs, commerce, and healthcare, and has commercial value and privacy sensitivity. Although edge and cloud servers bring great convenience to data sharing, the untrustworthiness of edge and cloud server providers, and the openness, dynamism, and collaboration of the data environment bring great security challenges to data sharing. As a new access control technology, attribute-based access control can achieve fine-grained access control while encrypting data, but there is a possibility that institutions, cloud service terminals, and users may abuse keys, thereby undermining the security of access control. At the same time, the access structure, user name, and attributes (access rights) of the ciphertext involved in requesting and sending the ciphertext cause privacy leaks to the data owner and data user. For example, in electronic medical systems, electronic medical records are privacy-sensitive data. Patients are the owners of these records, and only authorized personnel have access. When attribute-based access control technology is applied to electronic medical systems, for example, a medical record must possess the attributes "(cardiology department of hospital A)" or "neurology department of hospital B" or "audit department of the social security bureau" or "research institute of a medical university" to be accessible. In existing technologies, when accessing the ciphertext corresponding to these medical records, the access structure in the ciphertext can be intercepted and the patient's cardiac and neurological conditions determined based on the parameters within the access structure. Furthermore, existing technologies require data users on the data consumption side to access these medical records based on their identities (such as their names or IDs). This can easily lead to the leakage of user information and their characteristics (attributes). This not only reveals that the data accessor may be engaged in cardiology research, such as the cardiology department of hospital A, but also reveals that the patient (and this medical record) is related to heart disease. However, existing attribute-based security access control technology cannot simultaneously address both security and privacy issues. Summary of the Invention

[0003] The main purpose of the embodiments of the present application is to propose a method, system and storage medium for privacy-preserving attribute-based security access control, which can improve the security and privacy of data access.

[0004] To achieve the above objectives, a first aspect of an embodiment of the present application proposes a privacy-preserving attribute-based security access control method, which is applied to a data owner. The method includes:

[0005] Obtain an organization public key from the cloud service end for encrypting the target plaintext, the organization public key comprising a first organization sub-public key, a second organization sub-public key, and an attribute privacy sub-public key, the first organization sub-public key being set correspondingly to a first organization random number on the organization end, the second organization sub-public key being set correspondingly to a second organization random number on the organization end, and the attribute privacy sub-public key being set correspondingly to the attribute privacy random number on the organization end;

[0006] Determining an attribute mapping ciphertext according to the attribute privacy sub-public key;

[0007] Determining an access structure corresponding to the target plaintext in a one-to-one manner according to the attribute mapping ciphertext and the target plaintext;

[0008] Determining a target ciphertext corresponding one-to-one to the target plaintext based on the first institution sub-public key, the second institution sub-public key, and the access structure;

[0009] Sending the target ciphertext to the cloud service end;

[0010] Among them, the cloud server stores the user terminal attribute key and the first user token. The cloud server semi-decrypts the target ciphertext based on the stored first user token and the user terminal attribute key, and sends the semi-decrypted ciphertext obtained by semi-decryption to the data user end. The user terminal attribute key is generated by the cloud server based on the user original attribute key. The user original attribute key includes a target attribute token and a user original attribute key component; the user original attribute key component is generated by the corresponding institution end according to the user public key, the first user token, the target attribute, the first institution random number and the second institution random number. The target attribute token is a token corresponding to the target attribute generated by the institution end based on the attribute privacy random number.

[0011] To achieve the above objectives, a second aspect of an embodiment of the present application proposes a privacy-preserving attribute-based security access control method, which is applied to a cloud service end. The method includes:

[0012] Receive the original public key of the institution, the user public key, the first user token, and the original attribute key of the user sent by the institution side, the institution side being used for authorization of the target attribute; the original public key of the institution includes the first original sub-public key of the institution corresponding to the first random number of the institution side, the second original sub-public key of the institution corresponding to the second random number of the institution side, and the attribute privacy sub-public key corresponding to the attribute privacy random number of the institution side; the original attribute key of the user includes the original attribute key component of the user and the target attribute token;

[0013] Generate the first institution sub-public key and the second institution sub-public key based on the first institution original sub-public key, the second institution original sub-public key, and the corresponding first cloud random parameter;

[0014] Combine the first organization sub-public key, the second organization sub-public key, and the attribute privacy sub-public key to obtain a one-to-one corresponding organization public key for the organization end and publish it;

[0015] Performing a key update on the user original attribute key component according to the user public key and the first user token to obtain a user final attribute key, and associating and storing the user final attribute key with the corresponding first user token;

[0016] Receiving an access request for the target ciphertext from a data user; the access request carries a second user token;

[0017] When the first user token is consistent with the second user token, the semi-decrypted ciphertext corresponding to the target ciphertext is obtained according to the user terminal attribute key corresponding to the second user token and sent to the data user.

[0018] To achieve the above objectives, a third aspect of the embodiments of the present application proposes a privacy-preserving attribute-based security access control method, which is applied to an institution. The method includes:

[0019] Determine, based on the global public parameters, the first institution original sub-public key, the second institution original sub-public key, and the attribute privacy sub-public key corresponding to the randomly generated first institution random number, second institution random number, and attribute privacy random number, respectively;

[0020] Sending the original organization public key obtained by combining the first organization original sub-public key, the second organization original sub-public key, and the attribute privacy sub-public key to the cloud server, so that the cloud server generates an organization public key consisting of the attribute privacy sub-public key and the first organization sub-public key and the second organization sub-public key corresponding to the first organization original sub-public key and the second organization original sub-public key, respectively;

[0021] Receiving user-related data from a data user requesting authorization of a target attribute, the user-related data including at least a user public key and a first user token;

[0022] Generate a target attribute token according to the attribute privacy random number and the target attribute hash value of the target attribute;

[0023] Generate a user original attribute key component according to the user public key, the target attribute, the first institution random number, the second institution random number, and the first user token, and obtain a user original attribute key based on the user original attribute key component and the target attribute token;

[0024] Send the user public key, the first user token and the user original attribute key to the cloud service end;

[0025] Among them, the data owner encrypts the target plaintext based on the institutional public key to obtain the target ciphertext and sends it to the cloud service end; the attribute mapping ciphertext in the access structure of the target ciphertext is determined by the attribute privacy sub-public key; the cloud service end updates the user original attribute key component in the user original attribute key to obtain the user terminal attribute key, and when it is detected that the access request from the data user end to access the target ciphertext carries a second user token and is consistent with the first user token stored in itself, it generates a semi-decrypted ciphertext corresponding to the target plaintext according to the user terminal attribute key corresponding to the second user token and sends it to the data user end.

[0026] To achieve the above objectives, the fourth aspect of the embodiments of the present application proposes a privacy-preserving attribute-based access control system, including a data user, an institution, a cloud service, and a data owner; wherein:

[0027] The data user is configured to generate a user public key and a first user token based on the first user random number, send user-related data requesting authorization of a target attribute to the institution, the user-related data including at least the user public key and the first user token, and send an access request corresponding to the target ciphertext to the cloud service end and receive a semi-decrypted ciphertext corresponding to the access request, the access request including the second user token;

[0028] The institution side executes the privacy-preserving attribute-based security access control method as described in any one of the third aspects;

[0029] The cloud service terminal executes the privacy-preserving attribute-based security access control method as described in any one of the second aspects;

[0030] The data owner executes the privacy-preserving attribute-based security access control method as described in any one of the first aspects of claims.

[0031] To achieve the above-mentioned purpose, the fifth aspect of an embodiment of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the privacy-preserving attribute-based security access control method described in any one of the first, second, and third aspects.

[0032] The privacy protection attribute-based secure access control method, system and storage medium provided by the application, which generates an original public key of an organization based on a first organization random number, a second organization random number and an attribute privacy random number, and sends the organization public key to a cloud server device to generate an organization public key for encrypting a target plaintext. Since the attribute mapping ciphertext in the target plaintext is generated based on an attribute privacy sub-public key, the data user of the data using end can be checked whether the corresponding attribute is possessed by the data user through the target attribute token, and even if the access structure is intercepted, the target attribute required by the target ciphertext cannot be obtained. Secondly, since the user terminal attribute is generated based on the first user token, the first organization random number, the second organization random number, the target attribute and the user public key, when the target ciphertext is decrypted, the target ciphertext can be semi-decrypted through the second user token and the user terminal attribute key. At this time, the data using end requests the ciphertext access without carrying the user identifier and the attribute related content, and the data owning end does not display the attribute related content when the target ciphertext is published to the cloud server. Therefore, compared with the related art, the application embodiment can realize full privacy protection of the data using end by protecting the identity identifier (such as user ID, device fingerprint and other identity information) and attribute (such as access permission or feature) of the data using end. The privacy protection of the data owner is realized by hiding the attribute in the access structure, so as to improve the security and privacy of data access. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 is a flowchart of an embodiment of the privacy protection attribute-based secure access control method provided by the application applied to an organization end;

[0034] Figure 2 is a flowchart of an embodiment of the privacy protection attribute-based secure access control method provided by the application applied to a cloud server;

[0035] Figure 3 is a flowchart of an embodiment of the privacy protection attribute-based secure access control method provided by the application applied to a data owning end;

[0036] Figure 4 is a system diagram of an embodiment of the privacy protection attribute-based access control system provided by the application;

[0037] Figure 5 is an interaction diagram of an embodiment of the privacy protection attribute-based access control system provided by the application;

[0038] Figure 6 is a structure diagram of the hardware structure corresponding to the privacy protection attribute-based secure access control method provided by the application. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0040] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0041] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0042] In the digital age, data covers a variety of confidential data such as government affairs, commerce, and healthcare, and has commercial value and privacy sensitivity. Although edge and cloud servers bring great convenience to data sharing, the untrustworthiness of edge and cloud server providers, and the openness, dynamism, and collaboration of the data environment bring great security challenges to data sharing. As a new access control technology, attribute-based access control can achieve fine-grained access control while encrypting data, but there is a possibility that institutions, cloud service terminals, and users may abuse keys, thereby undermining the security of access control. At the same time, the access structure, user name, and attributes (access rights) of the ciphertext involved in requesting and sending the ciphertext cause privacy leaks to data users on both the data owner and data user end. For example, in electronic medical systems, electronic medical records are privacy-sensitive data. The patient is the owner of the electronic medical record, and only relevant personnel have access rights. When attribute-based access control technology is applied to electronic medical systems, for example, a medical record requires the attributes "(cardiology department of hospital A)" or "neurology department of hospital B" or "audit department of the social security bureau" or "research institute of a medical university" to be accessible. In existing technologies, the access structure exists in plaintext. By intercepting the access structure in the encrypted medical record, it can be determined that the patient suffers from heart and neurological diseases based on the access structure. Furthermore, in existing technologies, access to the medical record by the data user requires identity (such as name or ID), which can easily lead to the leakage of user information and its characteristics (attributes). For example, if the attributes in the access structure include "cardiology department of hospital A," not only may the data accessor be engaged in cardiology research, but also the user's relationship with heart disease may be revealed. Therefore, existing attribute-based security access control technology cannot simultaneously address both security and privacy issues. Based on this, the embodiments of the present application provide a privacy-preserving attribute-based access control method, system, and storage medium, which can improve the security and privacy of data access.

[0043] The method, system and storage medium for privacy-preserving attribute-based security access control provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the method for privacy-preserving attribute-based security access control in the embodiments of the present application is described.

[0044] The privacy-preserving attribute-based security access control method of the present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The initial descriptor scheduling method of the present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0045] Reference Figure 1 As shown, a privacy-preserving attribute-based security access control method provided in an embodiment of the present application is applied to an institution side, and the method includes:

[0046] Step S110: Determine, based on the global public parameters, the first institution original sub-public key, the second institution original sub-public key, and the attribute privacy sub-public key that correspond one-to-one to the randomly generated first institution random number, second institution random number, and attribute privacy random number;

[0047] Step S120: Send the original organization public key obtained by combining the first organization original sub-public key, the second organization original sub-public key, and the attribute privacy sub-public key to the cloud server, so that the cloud server generates an organization public key consisting of the attribute privacy sub-public key and the first organization sub-public key and the second organization sub-public key corresponding to the first organization original sub-public key and the second organization original sub-public key, respectively;

[0048] Step S130: Receive user-related data requesting authorization of a target attribute from a data user, where the user-related data includes at least a user public key and a first user token;

[0049] Step S140: Generate a target attribute token based on the attribute privacy random number and the target attribute hash value corresponding to the target attribute;

[0050] Step S150: Generate a user original attribute key component based on the user public key, the target attribute, the first institution random number, the second institution random number, and the first user token, and obtain the user original attribute key based on the user original attribute key component and the target attribute token;

[0051] Step S160: Send the user public key, the first user token, and the user original attribute key to the cloud server;

[0052] Among them, the data owner encrypts the target plaintext based on the institutional public key to obtain the target ciphertext and sends it to the cloud service end; the attribute mapping ciphertext in the access structure of the target ciphertext is determined by the attribute privacy sub-public key; the cloud service end updates the user original attribute key component in the user original attribute key to obtain the user terminal attribute key, and when it detects that the data user end's access request to the target ciphertext carries a second user token and the second user token is consistent with the first user token stored in itself, it generates a semi-decrypted ciphertext corresponding to the target plaintext according to the user terminal attribute key corresponding to the second user token and sends it to the data user end.

[0053] Therefore, by generating the original public key of the organization based on the first organization random number, the second organization random number and the attribute privacy random number and sending it to the cloud service end device to generate the organization public key for encrypting the target plaintext, since the attribute mapping ciphertext in the target plaintext is generated based on the attribute privacy sub-public key, the target attribute token can be used to verify whether the data user at the data user end has the corresponding attribute and even if the access structure is intercepted, the target attribute required for the target ciphertext cannot be known. Secondly, since the user terminal attribute is generated based on the first user token, the first organization random number, the second organization random number, the target attribute and the user public key, when decrypting the target ciphertext, the target ciphertext can be semi-decrypted by the second user token and the user terminal attribute key. At this time, the data user end does not need to carry the user identifier and attribute plaintext when requesting ciphertext access, and the data owner end does not need to include the attribute plaintext when publishing the target ciphertext to the cloud service end. Therefore, the embodiment of the present application can achieve full privacy protection for the data user end by protecting the identity identifier (such as user ID, device fingerprint and other identity information) and attributes (such as access rights or features) of the data user end. The privacy of data owners is protected by hiding attributes in the access structure, thereby improving the security and privacy of data access.

[0054] Data users are users who operate at the data consumption end.

[0055] The embodiments of this application do not restrict how the first institution random number, the second institution random number, and the attribute privacy random number are generated. The first institution random number, the second institution random number, and the attribute privacy random number are different from each other. The first institution random number and the second institution random number are random numbers associated with the institution side, and the attribute privacy random number is a random number associated with the institution side and the attributes of the data user. The attribute privacy random number is set in a one-to-one correspondence with the institution side.

[0056] The global public parameters are pre-configured. In some embodiments, the global public parameters are Among them, G1 and G2 are multiplicative cyclic groups, and the order of G1 and G2 is a large prime number p∈Θ{2 λ}, g is the generator of G1, is a bilinear mapping from G1 to G2, i.e. The attribute domain (i.e. the set of attributes) is set as U A is a set of authority identifiers, H1 and H2 are both anti-collision hash functions, H1 is used to map the user identifier to an element of the group G1; H2 is used to map the attribute to an element of the group G1; f represents the mapping of the attribute to the authority, such as the identifier of the authority managing the attribute a is f(a). Wherein, an authority can be composed of multiple or one electronic device, different authorities manage different attributes.

[0057] The first authority original sub-public key, the second authority original sub-public key and the attribute privacy sub-public key are generated based on the generator in the global public parameter and the corresponding random number, the first authority original sub-public key and the second authority original sub-public key are the original sub-public keys related to the authority, and the attribute privacy sub-public key is the sub-public key related to the target attribute managed by the authority. For example, assuming that for the authority with the authority identifier i, the first authority random number, the second authority random number and the attribute privacy random number are respectively represented as i ,β i ,γ i ∈Z * p ; the first authority random number i corresponding authority sub-public key is The second authority random number i corresponding authority sub-public key is The attribute privacy random number i corresponding authority sub-public key is At this time, the authority original public key of the authority with the authority identifier i is

[0058] The authority public key is the public key publicly published by the cloud service end, and the cloud service end performs secondary encryption on the original sub-public key related to the authority end in the original authority public key based on the randomly generated first cloud end random parameter to obtain the authority public key, so as to further improve the security of the use of the authority public key. In some embodiments, there are multiple first cloud end random parameters, and the multiple first cloud end random parameters are respectively used to perform secondary power operation on the first authority original sub-public key and the second authority original public key in the authority public key related to the authority end, so as to respectively encrypt the first authority random number and the second authority random number.

[0059] The first user token is a credential allowing the data using end to anonymously access data. The data using end manages at least one data user, and the number of data users managed by the data using end can be selectively set according to actual needs, and the embodiments of the present application do not limit this.

[0060] The target attribute is the attribute of the user request authorization initiated by the target data user. The target attribute token is a credential that allows the target data user to anonymously access the data that requires the target attribute. Different target data users have the same target attribute, and their corresponding target attribute tokens are the same. In some embodiments, the institution side stores the attribute token corresponding to the attribute. When the target attribute token corresponding to the target attribute already exists in the institution side, the target attribute token can be determined by query. When the target attribute token corresponding to the target attribute does not exist, it needs to be calculated and saved. In other embodiments, the institution side does not store the attribute token corresponding to the attribute, and it will generate the target attribute token corresponding to the target attribute after receiving the authorization request from the data user side. In this regard, those skilled in the art can selectively set it according to actual needs.

[0061] The attribute privacy random number is used to encrypt the target attribute to generate the target attribute token.

[0062] It is understandable that in some embodiments, the user-related data also includes a user identifier. In this case, the user-related data can be mutually verified through the user public key verification code and the user token verification code. The user token verification code is a bilinear mapping value calculated based on the first user token and the attribute privacy sub-public key; the user token verification code can be sent by the data user end or calculated by the institution end, and this is not limited by the embodiments of the present application. In some embodiments, the attribute privacy random number can be used as the exponent, and the user hash value corresponding to the user identifier can be used as the base to perform a power operation to obtain a user public key verification parameter; the user public key verification code is obtained based on the bilinear mapping value calculated based on the user public key and the user public key verification parameter. Step S150 includes: when the user token verification code and the user public key verification code are the same, according to the user public key, the target attribute, the first institution random number, the second institution random number and the first user token, a user original attribute key component is generated and the user original attribute key is obtained based on the user original attribute key component and the target attribute token.

[0063] The user identifier is a unique identifier for identifying the data user in the data user end.

[0064] For example, assume that the user identifier is u j , the user's public key is The first user token is a is the target attribute of the authorization request. θ j The user identifier is u j The user random number generated by the data user at the corresponding data usage end. The first user token, user public key and user identity identifier u can be j For example, assuming the user's token verification code is The user's public key verification code is It can be judged by Whether it is established to determine whether to generate the user original attribute key, where f(a) is the organization identifier that manages the target attribute a, The institution identifier is γ f(a) The attribute privacy sub-public key corresponding to the attribute a managed by the institution. At this time, based on the characteristics of the bilinear mapping, it can be seen that when This means that the first user's token and public key are abnormal (for example, the user identifier is not u j Otherwise, the first user token and user public key are the same as the user identity identifier u j The corresponding data user’s first user token and user public key are legally owned by the user.

[0065] In some embodiments, the method at the institution end further includes verifying the target attribute of the data user requesting the target attribute, and terminating the operation when the data user does not have the target attribute; and terminating the operation when the data user has the target attribute. Generate user original attribute keys.

[0066] Therefore, by hiding the user identifier in the first user token, anonymous access to data can be achieved based on the first user token, thereby avoiding leakage of identity-related information of the data user (such as the user identifier) ​​during the access process of the data user.

[0067] The user original attribute key component includes a first user original attribute subkey and a second user original attribute subkey; the user original attribute key component is generated according to the user public key, the target attribute, the first institution random number, the second institution random number and the first user token and based on the user original attribute key component; including:

[0068] Generate the first user's original attribute subkey based on a randomly generated third-party random number;

[0069] Generate a first parameter based on the user public key and the first institution random number;

[0070] Generate a second parameter based on the first user token and the second institution random number;

[0071] Generate a third parameter based on the target attribute hash value corresponding to the target attribute and a third-party random number;

[0072] Generate a second user original attribute subkey according to the first parameter, the second parameter, and the third parameter.

[0073] Generate the target attribute token based on the attribute privacy random number and the target attribute hash value, including:

[0074] The target attribute hash value is taken as a base number, and the attribute privacy random number is taken as an exponent to obtain the target attribute token.

[0075] The first parameter, the second parameter, and the third parameter are obtained through exponentiation.

[0076] For example, the target attribute is a, and the third authority random number is ξ a , and For example, for a target data user with a user identifier u j , a first user token , and a user public key , the target attribute token corresponding to the target attribute possessed by the target data user is where H2(a) is the target attribute hash value of the target attribute a, γ f(a) is an attribute privacy random number generated by an authority with an authority identifier f(a). The first user original attribute subkey The second user original attribute subkey where the first parameter represents a power with PK j as a base number and a f(a) as an exponent, the second parameter represents a power with T j as a base number and β f(a) as an exponent, and the third parameter is a power element with H2(a) as a base and the third authority random number as an exponent. At this time, the user original attribute key AK j,a =(T a ,K j,a,1 ,K j,a,2 ).

[0077] Therefore, by associating an attribute token T a with an attribute a, and hiding the attribute a through the attribute token T a , the risk of attribute a being leaked and cracked can be reduced. The attribute key AK j,a of the user stores the attribute token T a corresponding to the attribute a.

[0078] It can be understood that the method further includes one of the following steps:

[0079] Sending a user attribute revocation request to the cloud server to make the cloud server delete the user terminal attribute key corresponding to both the first user token and the target attribute token in the user attribute revocation request;

[0080] Sending a user revocation request to the cloud server to make the cloud server delete the first user token corresponding to the user revocation request and the user terminal attribute key corresponding thereto;

[0081] Send an attribute revocation request to the cloud server to cause the cloud server to delete all user terminal attribute keys corresponding to the target attribute token in the attribute revocation request.

[0082] The user cancellation request is received by the institution from the system for the user identifier u j The data is generated by the revocation request initiated by the user.

[0083] User attribute revocation and attribute revocation requests are both generated by the institution itself.

[0084] For example, the institution-side revoked user identifier is u j Taking the corresponding target attribute a as an example, the following steps may be included:

[0085] The institution requests the cloud server to delete user u j Corresponding user token T j Attribute token T in the corresponding attribute key set a The corresponding user final attribute key AK′ j,a .

[0086] For example, taking the institution side canceling attribute a as an example, the steps are as follows:

[0087] The institution requests the cloud server to delete the attribute token T a All corresponding user final attribute keys AK′ j,a .

[0088] For example, the cloud server revokes user u j For example, the steps are as follows:

[0089] The cloud server deletes user u j Corresponding user token T j All user final attribute keys AK′ in the corresponding attribute key set j,a .

[0090] It is understandable that, referring to Figure 2 As shown, a privacy-preserving attribute-based security access control method provided in an embodiment of the present application is applied to a cloud service end, and the method includes:

[0091] Step S210: Receive the original public key, user public key, first user token, and user original attribute key sent by the institution, which are used by the institution to authorize the target attribute. The original public key includes a first original sub-public key corresponding to the first random number of the institution, a second original sub-public key corresponding to the second random number of the institution, and an attribute privacy sub-public key corresponding to the attribute privacy random number of the institution. The original attribute key of the user includes the original attribute key component of the user and the target attribute token.

[0092] Step S220, generating a first agency sub-public key and a second agency sub-public key according to the first agency original sub-public key, the second agency original sub-public key and the respective one-to-one corresponding first cloud random parameter;

[0093] Step S230, combining the first agency sub-public key, the second agency sub-public key and the attribute privacy sub-public key to obtain an agency public key corresponding to the agency one-to-one and publishing;

[0094] Step S240, performing key update on the user original attribute key component according to the user public key and the first user token to obtain a user terminal attribute key, and storing the user terminal attribute key and the corresponding first user token in association;

[0095] Step S250, receiving an access request of the target ciphertext from the data using end; the access request carries a second user token;

[0096] Step S260, when the first user token is consistent with the second user token, obtaining a semi-decryption ciphertext corresponding to the target ciphertext according to the user terminal attribute key corresponding to the second user token and sending the semi-decryption ciphertext to the data using end.

[0097] Therefore, by generating the agency original public key based on the first agency random number, the second agency random number and the attribute privacy random number and sending the agency original public key to the cloud service end device to generate the agency public key used for encrypting the target plaintext, since the attribute mapping ciphertext in the target plaintext is generated based on the attribute privacy sub-public key, the data user of the data using end can be verified by the target attribute token whether the data user has the corresponding attribute, and even if the access structure is intercepted, the target attribute required by the target ciphertext cannot be obtained. Secondly, since the user terminal attribute is generated based on the first user token, the first agency random number, the second agency random number, the target attribute and the user public key, when the target ciphertext is decrypted, the semi-decryption of the target ciphertext can be realized by the second user token and the user terminal attribute key. At this time, the data using end does not need to carry the user identifier and the attribute plaintext when requesting the ciphertext access, and the data owning end does not need to include the attribute plaintext when publishing the target ciphertext to the cloud service end, so that the full privacy protection of the data using end can be realized by protecting the identity identifier (such as user ID, device fingerprint and other identity information) and the attribute (such as access permission or feature) of the data using end. The privacy protection of the data owner is realized by hiding the attribute in the access structure; thereby the security and privacy of data access are improved.

[0098] The user public key and first user token are sent from the data user to the institution. The user original attribute key and institution original public key are generated by the institution. The user original attribute key and the user public key are set in a one-to-one correspondence. The user public key and the first user token are set in a one-to-one correspondence. The second institution random number, the first institution random number, and the attribute privacy random number are all randomly generated by the institution. The attribute privacy random number and the attribute privacy sub-public key are also set in a one-to-one correspondence with the institution.

[0099] The target attribute token is one of the credentials generated by the institution and can be used to determine whether the data user has the authority to anonymously access the target ciphertext. This embodiment of the application does not limit how the user terminal attribute key and the corresponding first user token are associated and stored. Those skilled in the art can set the corresponding data structure for storage.

[0100] The publication of the organization's public key can be automatically published by the cloud service end to the required application end, such as the data owner end, the data user end, etc., or it can be actively requested by the corresponding application end. In this regard, the embodiment of this application does not limit how the organization's public key is published.

[0101] The user original attribute key component can be generated by the institution based on the first institution random number, the second institution random number, the third random number, the user public key and the first user token.

[0102] For example, the institution terminal A receives the institution identifier i i The original public key of the institution For example, the cloud server selects the first cloud random parameter and and satisfy and Then obtain the cloud server key δ from the cloud server preset key list CSK, where δ is randomly generated. Then the first institution sub-public key and the second institution sub-public key are respectively as well as ,A i The institution's public key And (i,α i ′,β i ′) Save in the cloud server key list CSK and publish the organization public key APK i At this time, the first cloud random parameter and the cloud server key can be used to implement secondary encryption of the original sub-public key of the organization related to the organization in the original public key of the organization.

[0103] In some embodiments, a data user with target attribute a has a user original attribute key AK j,a =(T a ,K j,a,1 ,K j,a,2 ); For example, the user terminal attribute key is AK' j,a = (T a , K j,a,1 , K j,a,2 ), wherein . Wherein, δ is the cloud server key of the cloud server, ξ' a is the third cloud random parameter and and That is, ξ' a is different from ξ a ; K j,a,1 , K j,a,2 is the original attribute key component of the user; T j is the first user token; PK j is the public key of the user.

[0104] The cloud server stores the first user token and the corresponding user terminal attribute key as a set. For example, the cloud server stores {T j , {AK' j,a}} into CSK, wherein T j is the data usage end anonymous access credential (that is, the first user token), AK' j,a is the user with target attribute a u j The corresponding user terminal attribute key, since the target attribute a is implicitly stored in the user terminal attribute key in the form of the target attribute token T a , so as not to leak the attribute of the data usage end. By saving the above key information of each data user through the cloud server, the access request initiated by the data usage end can be verified by the key information and the ciphertext is semi-decrypted.

[0105] It can be understood that the attribute mapping ciphertext in the access structure of the target ciphertext is a power element with the first data random parameter as the exponent, which is randomly generated by itself and based on the attribute bilinear mapping credential. The attribute bilinear mapping credential is a bilinear mapping value calculated based on the attribute privacy sub-public key and the target attribute hash value of the target attribute managed by the agency end where the attribute privacy sub-public key is located; according to the user terminal attribute key corresponding to the second user token, the semi-decrypted ciphertext corresponding to the target ciphertext is determined, including:

[0106] Extract the ciphertext attribute public parameter corresponding to the access structure from the target ciphertext;

[0107] Determine the target attribute token verification code corresponding to each target attribute token corresponding to the second user token based on the bilinear mapping values ​​calculated from the ciphertext attribute public parameters and the target attribute tokens corresponding to the second user token, wherein the ciphertext attribute public parameters are powers with the generator in the global public parameters as the base and the first data random parameter as the exponent;

[0108] When there is a target attribute token verification code that satisfies the access structure, a semi-decrypted ciphertext corresponding to the target ciphertext is generated according to the user terminal attribute key corresponding to the second user token.

[0109] For the cloud server, since each data user has at least one attribute, each first user token stored in the cloud server corresponds to at least one target attribute token.

[0110] For example, the target ciphertext For example, (M,φ′) represents the access structure, C 0,2 Represents the public parameters of the ciphertext attributes, which are set in one-to-one correspondence with the access structure. Among them, l represents the number of attributes, and the attribute mapping ciphertext in, The attribute privacy sub-public key generated for the institution with the institution identifier ψ(n) is ψ(n) = f(φ(n)), where φ(n) represents the attribute. H2(φ(n)) is the target attribute hash value of the target attribute φ(n), and η X is the first data random parameter. When the target attribute token set is determined to be S j The target attribute set corresponding to the first user token; the target attribute verification code set generated by calculating the target attribute token corresponding to each target attribute in the target attribute token set It should be noted that the target attribute verification code here refers to The verification code used to prove that the data user corresponding to the first user's token has attribute a, but this verification code Will not reveal any information about attribute a. j There exists a subset that satisfies the access structure (M,φ′), namely S′ j There are some target attribute verification codes in the attribute mapping ciphertext set , and satisfies the access structure (M, φ′), it means that the data user corresponding to the first user token has the authority to access the target ciphertext.

[0111] Therefore, by using C 0,2 and T aCalculate the target attribute token verification code of the attribute of the data user, and use the attribute mapping ciphertext of the same attribute as the access structure to realize the data user's authority verification. 0,2 and T a Find the target attribute token verification code of attribute a If the attribute corresponding to the nth row of the access structure is a, then the attribute mapping ciphertext φ′(n) mapped by this row is equal to the target attribute token verification code Therefore, the target attribute token verification code can be used to determine whether the access structure is met, making it difficult for the identifier and attributes of the data accessor to be peeped. That is, the user identifier and attributes of the data user on the data usage end are protected at the same time, and complete anonymous access can be achieved, realizing complete privacy protection for data users.

[0112] It is understandable that, referring to Figure 3 As shown, according to an embodiment of the present application, a privacy-preserving attribute-based security access control method is provided, which is applied to the data owner. The method includes:

[0113] Step S310: Obtain the organization public key from the cloud service end and used to encrypt the target plaintext. The organization public key includes a first organization sub-public key, a second organization sub-public key, and an attribute privacy sub-public key. The first organization sub-public key is set correspondingly to the first organization random number on the organization end, the second organization sub-public key is set correspondingly to the second organization random number on the organization end, and the attribute privacy sub-public key is set correspondingly to the attribute privacy random number on the organization end.

[0114] Step S320: Determine the attribute mapping ciphertext according to the attribute privacy sub-public key;

[0115] Step S330: Determine an access structure that corresponds one-to-one with the target plaintext based on the attribute mapping ciphertext and the target plaintext;

[0116] Step S340: Determine a target ciphertext that corresponds one-to-one with the target plaintext based on the first organization sub-public key, the second organization sub-public key, and the access structure;

[0117] Step S350: Send the target ciphertext to the cloud server;

[0118] Among them, the cloud server stores the user terminal attribute key and the first user token. The cloud server semi-decrypts the target ciphertext based on the stored first user token and the user terminal attribute key, and sends the semi-decrypted ciphertext to the data user. The user terminal attribute key is generated by the cloud server based on the user original attribute key of the institution; the user original attribute key includes the target attribute token and the user original attribute key component. The user original attribute key component is generated by the corresponding institution based on the user public key, the first user token, the target attribute, the first institution random number and the second institution random number. The target attribute token is a token corresponding to the target attribute generated by the institution based on the attribute privacy random number.

[0119] Therefore, it generates an original public key based on the first random number, the second random number and the attribute privacy random number and sends it to the cloud service end device to generate an organization public key for encrypting the target plaintext. Since the attribute mapping ciphertext in the target plaintext is generated based on the attribute privacy sub-public key, the target attribute token can be used to verify whether the data user at the data user end has the corresponding attribute, and even if the access structure is intercepted, the target attribute required to access the target ciphertext cannot be known. Secondly, since the user terminal attribute is generated based on the first user token, the first random number, the second random number, the target attribute and the user public key, when decrypting the target ciphertext, the target ciphertext can be semi-decrypted by the second user token and the user terminal attribute key. At this time, the data user end does not need to carry the user identifier and attribute plaintext when requesting ciphertext access, and the data owner end does not need to include the attribute plaintext when publishing the target ciphertext to the cloud service end. Therefore, the embodiment of the present application can achieve full privacy protection for the data user end by protecting the identity identifier (such as user ID, device fingerprint and other identity information) and attributes (such as access rights or features) of the data user end. The privacy of data owners is protected by hiding attributes in the access structure, thereby improving the security and privacy of data access.

[0120] The target plaintext is the plaintext that is expected to be encrypted by the public key of the organization corresponding to the target attribute contained in the access structure to obtain the target ciphertext. This embodiment of the application does not limit how the public key of the organization is obtained in step S310. It can be actively issued by the cloud service end or actively requested by the data owner.

[0121] When the target plaintext supports access by data users with multiple different target attributes, there are also multiple attribute mapping ciphertexts, and the attribute mapping ciphertexts correspond one-to-one to the target attributes.

[0122] The embodiments of this application do not limit how the attribute mapping ciphertext is determined. In some embodiments, a bilinear mapping value based on the attribute privacy sub-public key can be calculated, or it can be determined by other methods. In this regard, the embodiments of this application do not impose any restrictions, and only need to ensure that the attribute mapping ciphertext can be verified by zero-knowledge of the attribute using the target attribute token and the ciphertext attribute public parameters in the target ciphertext.

[0123] It is understandable that, according to the attribute privacy sub-public key, the attribute mapping ciphertext is determined, including:

[0124] Randomly generate first data random parameters;

[0125] Obtain an attribute bilinear mapping certificate based on a bilinear mapping value calculated from the attribute privacy sub-public key and the target attribute hash value of the target attribute managed by the institution where the attribute privacy sub-public key is located;

[0126] The attribute mapping ciphertext is constructed with the attribute bilinear mapping certificate as the base and the first data random parameter as the exponent.

[0127] In some embodiments, accordingly, a ciphertext attribute public parameter corresponding to the attribute mapping ciphertext is generated.

[0128] The target attribute hash value is the attribute hash value corresponding to the target attribute identifier.

[0129] For example, attribute mapping ciphertext in, is the attribute privacy sub-public key of the institution with the institution identifier ψ(n), ψ(n) = f(φ(n)) is the institution identifier of the institution that manages the target attribute φ(n), and φ(n) represents the target attribute. H2(φ(n)) is the hash value of the target attribute. η X is the first data random parameter.

[0130] For example, η X Taking the first data random parameter as an example, the ciphertext attribute public parameter g is the generator in the global public parameters.

[0131] For example, η X is the first data random parameter, X is the plain text, r n is the second data random parameter and For example, we can get the target ciphertext corresponding to the target plaintext in, Among them, (M,φ′) represents the access structure in ciphertext form, C 0,2 Represents the public parameter of the ciphertext attribute, and l represents the number of attributes; For As the base, r n is the power element of the exponential, For As the base, r n is the power element of the exponential, is the first sub-public key of the organization whose identifier is ψ(n), The second sub-public key of the organization whose identifier is ψ(n); φ is the sub-public key of each row in M Mapped to each attribute φ(n)∈U a Function, v n is a vector With vector The inner product of w n is a vector With vector The inner product of It is taken from the m-dimensional vector space over a finite field Two different random vectors in It is the nth row of the access structure (matrix) M, that is, the nth row vector, where n = 1,…, l.

[0132] Reference Figure 4 As shown, a privacy-preserving attribute-based access control system provided according to an embodiment of the present application includes an institution end, a cloud service end, a data ownership end, and a data usage end; wherein,

[0133] The data user terminal is used to generate a user public key and a first user token based on the first user random number, and send user-related data requesting authorization of the target attribute to the institution terminal, where the user-related data includes at least the user public key and the first user token. The data user terminal is also used to send an access request corresponding to the target ciphertext to the cloud service terminal and receive a semi-decrypted ciphertext corresponding to the access request, where the access request includes the second user token;

[0134] Among them, the institutional side is used for:

[0135] Determine, based on the global public parameters, the first institution original sub-public key, the second institution original sub-public key, and the attribute privacy sub-public key corresponding to the randomly generated first institution random number, second institution random number, and attribute privacy random number, respectively;

[0136] Send the original public key of the organization obtained by combining the original sub-public key of the first organization, the original sub-public key of the second organization, and the attribute privacy sub-public key to the cloud server;

[0137] Receive user-related data from a data user requesting authorization of a target attribute, the user-related data including a user identifier, a user public key, and a first user token;

[0138] generate a target attribute token according to the attribute privacy random number and a target attribute hash value of the target attribute;

[0139] generate a user original attribute key component according to the user public key, the first authority random number, the second authority random number, the target attribute, and the first user token, and obtain a user original attribute key based on the user original attribute key component and the target attribute token;

[0140] send the user public key, the first user token, and the user original attribute key to the cloud server;

[0141] The cloud server is configured to:

[0142] receive the authority original public key, the user public key, the first user token, and the user original attribute key sent by the authority end, and the authority end is configured to authorize the target attribute;

[0143] generate a one-to-one corresponding first authority sub-public key and a second authority sub-public key according to the first authority original sub-public key, the second authority original sub-public key, and the first cloud end random parameter corresponding thereto;

[0144] combine the first authority sub-public key, the second authority sub-public key, and the attribute privacy sub-public key to obtain an authority end one-to-one corresponding authority public key and publish the same;

[0145] perform key update on the user original attribute key component in the user original attribute key according to the user public key and the first user token to obtain a user terminal attribute key, and store the user terminal attribute key and the corresponding first user token in association;

[0146] receive an access request for the target ciphertext from the data using end, the access request carrying a second user token;

[0147] when the first user token is consistent with the second user token, obtain a semi-decryption ciphertext corresponding to the target ciphertext according to the user terminal attribute key corresponding to the first user token, and send the semi-decryption ciphertext to the data using end;

[0148] The data owning end is configured to:

[0149] request an authority public key for encrypting a target plaintext from the cloud server, the authority public key including a first authority sub-public key, a second authority sub-public key, and an attribute privacy sub-public key;

[0150] determine an attribute mapping ciphertext according to the attribute privacy sub-public key;

[0151] determine an access structure corresponding to the target plaintext according to the attribute mapping ciphertext and the target plaintext;

[0152] Determine a target ciphertext corresponding to the target plaintext based on the first organization's sub-public key, the second organization's sub-public key, and the access structure;

[0153] Send the target ciphertext to the cloud server.

[0154] It is understandable that the embodiments of the present application do not limit the number of institutional ends, data owning ends, and data using ends, do not limit the number of data using ends managed under each institutional end, and do not limit the data using ends managed under each data using end.

[0155] For example, refer to Figure 4 As shown, there are E data-owning ends, namely A1~AE; there are N institutional ends, namely d1~dN; among them, the institutional end d1 manages the attributes of all data users on the data-using ends U11~U1 J1, the institutional ends d2 and dN manage the attributes of all data users on the data-using end U11, and the institutional end dN also manages the attributes of all data users on the data-using ends UN1~UNJN.

[0156] For example, refer to Figure 5 As shown in Figure 2, the specific steps of the privacy-preserving attribute-based security access control method are as follows:

[0157] S1. Generate global public parameters GP and publish them to the cloud service end, the institution end, the data owner end, and the data user end. The steps for generating GP are as follows:

[0158] First, set a system security parameter λ; then select two multiplication cyclic groups G1 and G2, the orders of which are the same large prime number p∈Θ{2 λ}, let g be a generator of G1, and define a bilinear map on G1 Set the attribute domain to The collective name of all organizations is U A In addition, two collision-resistant hash functions H1 and H2 are selected to map the user identifier and attribute to an element of group G1 respectively; function f represents mapping the attribute to the institution that manages it, that is, the institution that manages attribute a is identified as f(a), and the global public parameter can be obtained as

[0159] S2. Initialize the cloud server, institution, and data user based on the global public parameter GP. The details are as follows: Initialize the cloud server:

[0160] The cloud server randomly selects the cloud server key It is used as the cloud server key and saved in the cloud server key list CSK.

[0161] Initialize the institution side, with the institution identifier as i∈U A Institutional side A i For example, the details are as follows:

[0162] Initialize the organization private key list ASK i , and then select the first institution random number, the second institution random number and the attribute privacy random number respectively And save it in the institution private key list ASK i , then calculate Set the original public key of the organization And the original public key APK i Sent to the cloud server to generate the organization's public key.

[0163] Among them, the cloud server receives the original public key APK of the organization i Perform the following operations:

[0164] The cloud server selects the first cloud random parameter and the first cloud random parameters and satisfy and Then obtain the cloud server key δ from the cloud server key list CSK and calculate And (i,α ′ i,β i i) Save in the cloud server key list CSK. At this time, the institution A i The institution's public key And publish the institution's public key.

[0165] Initialize the data user end, and use the user identifier of the data user managed by the data user end as u j For example, the specific steps are as follows:

[0166] Select user random parameters Initialize user attribute set Set the user's public key First User Token And set the user private key

[0167] S3. The data user requests user attribute authorization from the institution, where the attribute requested for authorization is a and the user identifier of the data user is u. j For example, the specific steps are as follows:

[0168] S3.1. Send user identifier u to the institution end f(a) j , user public key And the first user pass Authorization is requested with attribute a; the user identifier, user public key and first user token are all one of the above user-related data.

[0169] S3.2, the institution side f(a) verifies the first user's certificate and user public key. The specific steps are as follows: Calculate and judge the equation Is it established? If Then the first user's token and user's public key are judged to be illegal; otherwise, the first user's token and user's public key are judged to be legal. When the first user's token and user's public key are both legal, the data user u is judged to be j Does it have attribute a? If it does not have attribute a, then terminate the operation; if And data user u j If it has attribute a, then jump to S3.3.

[0170] S3.3, the institution side f(a) runs the user original attribute key generation algorithm: first calculate the target attribute token One of the attributes a is associated with an attribute token T a , attribute token T a It is used to hide attribute a, so it will not be cracked and will not reveal attribute a. Then select a random number from a third party According to the institution's private key ASK i , user identifier u j and user public key PK j Calculate the user's original attribute key component and The institution sets the user's original attribute key AK j,a =(T a ,K j,a,1 ,K j,a,2 ), then (PK j ,T j ,AK j,a ) is sent to the cloud server.

[0171] S3.4, the cloud server receives the user's public key First User Token and user original attribute key AK j,a =(T a ,K j,a,1 ,K j,a,2 ), run the user attribute key algorithm to generate the user's final attribute key. The specific steps are as follows:

[0172] The cloud server selects random parameters from the third cloud Make Then calculate the data using end u j The user terminal attribute key corresponding to attribute a is AK′ j,a =(Ta ,K′ j,a,1 ,K′ j,a,2 ),in and are all first cloud random parameters, and δ is the cloud server key.

[0173] The cloud server will (T j ,AK′ j,a ) is stored in CSK. It should be noted that when the data user u j When you have multiple attribute permissions, the cloud server will merge and store them, that is, {T j ,{AK′ j,a :a∈S j}}, where S j is a data user u j The set of attributes (permissions) owned by AK′ j,a =(T a ,K′ j,a,1 ,K′ j,a,2 ), since attribute a is attribute token T a The implicit form is stored in AK′ j,a Therefore, the cloud server cannot know the attribute set S of the data user. j .

[0174] S4. Based on global public parameters and the institution's public key Generate the target ciphertext. Taking the plaintext to be encrypted as X as an example, the specific steps are as follows:

[0175] Set the access structure to be (M,φ), φ is the sum of each row in M Mapped to each attribute φ(n)∈U a function, let ψ be the function that converts each row Mapped to the mechanism that manages the attribute φ(n), i.e., ψ(n) = f(φ(n)).

[0176] Select the first data random parameter calculate By encrypting the plaintext access structure into a random ciphertext (M, φ′), the attributes of the access structure appear in the form of random ciphertext. This makes it impossible for users other than the encryptor to decipher or peek into the attributes associated with the ciphertext. For the same attribute a, different data owners will generate different random ciphertexts when encrypting it.

[0177] Choose a random vector For each n=1,…,l, calculate and Then select the second data random parameter and calculate The final output of the original ciphertext is The data owner sends the target ciphertext to the cloud server.

[0178] S5. The data user uses the second user's token Anonymous request to access the ciphertext in the system The specific steps are as follows:

[0179] S5.1. The data user will pass the second user token Sent to the cloud server, the cloud server looks for T j The cloud server checks whether the CSK exists. If not, the process terminates, and in some embodiments, returns: "User does not have access to data." If it does, the process proceeds to S5.2. The data user requests data access using the second user token, preventing the cloud server from knowing the user identifier of the data user initiating the access request on the data user, thereby protecting the user identifier of the data user. At this point, the cloud server can only look up the corresponding user terminal attribute key based on the second user token.

[0180] S5.2. The cloud server determines the second user's token T j Associated data user u j Whether you have access rights, the specific steps are as follows: Call T j All corresponding target attribute tokens calculate Then according to S′ j Determine data user u j Whether the access structure (M, φ′) is satisfied. It is worth noting that the cloud server is not aware of the attribute set S of the data user. j and access structure attributes, it is judged whether the data user has access rights. In other words, the data user does not leak its user attribute set, and the access structure does not leak attributes. If S′ j If the access structure (M, φ′) is not satisfied, abort and return: “The user has no right to access the data.” If S′ j If the access structure (M, φ′) is satisfied, then go to S5.3. S5.3, select S′ j The subset of M that satisfies the access structure (M, φ′) Calculate so that {c n :n∈I}, then for each n∈I, calculate It should be noted that K′ j,a,1 and k′ j,a,2 They are respectively T aThe user's final attribute key AK' j,a The second component K′ in j,a,1 and the third component K j, ' a,2 Then calculate Get the semi-decrypted ciphertext CT j =(CT1, CT2) and sends it to the data user.

[0181] S5.4. Data usage end half-decryption ciphertext CT j =(CT1,CT2) to run full decryption. j and user private key SK j Enter the preset full decryption algorithm, and then calculate and output the plaintext message X through the full decryption algorithm:

[0182] In some embodiments, further comprising:

[0183] The institution-side revoked user identifier is u j Attribute a: The institution requests the cloud server to delete T j Corresponding to the user's terminal attribute key set T a Corresponding AK′ j,a .

[0184] The institution side cancels attribute a: The institution side requests the cloud server to delete T a All corresponding AK′ j,a .

[0185] The system revokes user u j :The system requests the cloud server to delete T j All AK′ in the corresponding attribute key set j,a .

[0186] See also Figure 6 , Figure 6 The hardware structure of an electronic device to which the method for attribute-based security access control with privacy protection according to another embodiment is applied is illustrated. The electronic device includes:

[0187] The processor 601 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0188] The memory 602 may be a NAND flash. The relevant program code is stored in the memory 602, and the processor 601 calls and executes the privacy-preserving attribute-based security access control method of the embodiment of the present application;

[0189] Input / output interface 603, used to implement information input and output;

[0190] Communication interface 604, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0191] Bus 605 , which transmits information between various components of the device (e.g., processor 601 , memory 602 , input / output interface 603 , and communication interface 604 );

[0192] The processor 601 , the memory 602 , the input / output interface 603 and the communication interface 604 are connected to each other in communication within the device via a bus 605 .

[0193] An embodiment of the present application also provides a computer-readable storage medium, which is a computer-readable storage medium that stores a computer program. When the computer program is executed by a processor, the method of attribute-based security access control for privacy protection is implemented.

[0194] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0195] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0196] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0197] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0198] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0199] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0200] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0201] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0202] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0203] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0204] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0205] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A privacy-preserving attribute-based security access control method, characterized in that: Applied to the data owner, the method includes: Obtain an organization public key from the cloud service end for encrypting the target plaintext, the organization public key comprising a first organization sub-public key, a second organization sub-public key, and an attribute privacy sub-public key, the first organization sub-public key being set correspondingly to a first organization random number on the organization end, the second organization sub-public key being set correspondingly to a second organization random number on the organization end, and the attribute privacy sub-public key being set correspondingly to the attribute privacy random number on the organization end; Determining an attribute mapping ciphertext according to the attribute privacy sub-public key; Determining an access structure corresponding to the target plaintext in a one-to-one manner according to the attribute mapping ciphertext and the target plaintext; Determining a target ciphertext corresponding one-to-one to the target plaintext based on the first institution sub-public key, the second institution sub-public key, and the access structure; Sending the target ciphertext to the cloud service end; Among them, the cloud server stores the user terminal attribute key and the first user token. The cloud server semi-decrypts the target ciphertext based on the stored first user token and the user terminal attribute key, and sends the semi-decrypted ciphertext obtained by semi-decryption to the data user end. The user terminal attribute key is generated by the cloud server based on the user original attribute key. The user original attribute key includes a target attribute token and a user original attribute key component; the user original attribute key component is generated by the corresponding institution end according to the user public key, the first user token, the target attribute, the first institution random number and the second institution random number. The target attribute token is a token corresponding to the target attribute generated by the institution end based on the attribute privacy random number.

2. The privacy-preserving attribute-based security access control method according to claim 1, characterized in that: Determining the attribute mapping ciphertext according to the attribute privacy sub-public key includes: Randomly generate first data random parameters; Obtaining an attribute bilinear mapping certificate based on a bilinear mapping value calculated based on the attribute privacy sub-public key and the target attribute hash value of the target attribute managed by the institution end where the attribute privacy sub-public key is located; The attribute mapping ciphertext is constructed with the attribute bilinear mapping certificate as the base and the first data random parameter as the exponent.

3. A privacy-preserving attribute-based security access control method, characterized in that: Applied to a cloud server, the method includes: Receive the original public key of the institution, the user public key, the first user token, and the original attribute key of the user sent by the institution side, the institution side being used for authorization of the target attribute; the original public key of the institution includes the first original sub-public key of the institution corresponding to the first random number of the institution side, the second original sub-public key of the institution corresponding to the second random number of the institution side, and the attribute privacy sub-public key corresponding to the attribute privacy random number of the institution side; the original attribute key of the user includes the original attribute key component of the user and the target attribute token; Generate the first institution sub-public key and the second institution sub-public key based on the first institution original sub-public key, the second institution original sub-public key, and the corresponding first cloud random parameter; Combine the first organization sub-public key, the second organization sub-public key, and the attribute privacy sub-public key to obtain a one-to-one corresponding organization public key for the organization end and publish it; Performing a key update on the user original attribute key component according to the user public key and the first user token to obtain a user final attribute key, and associating and storing the user final attribute key with the corresponding first user token; Receiving an access request for a target ciphertext from a data user; the access request carries a second user token; When the first user token is consistent with the second user token, the semi-decrypted ciphertext corresponding to the target ciphertext is obtained according to the user terminal attribute key corresponding to the second user token and sent to the data user.

4. The privacy-preserving attribute-based security access control method according to claim 3, characterized in that: The attribute mapping ciphertext in the access structure of the target ciphertext is a power element with an attribute bilinear mapping certificate as the base and a first data random parameter randomly generated by itself as the exponent, and the attribute bilinear mapping certificate is a bilinear mapping value obtained based on the attribute privacy sub-public key and the target attribute hash value of the target attribute managed by the institution end where the attribute privacy sub-public key is located; the determining of the semi-decrypted ciphertext corresponding to the target ciphertext according to the user terminal attribute key corresponding to the second user token includes: Extracting a ciphertext attribute public parameter corresponding to the access structure from the target ciphertext; Determine target attribute token verification codes corresponding to the second user token one-to-one based on bilinear mapping values ​​calculated from the ciphertext attribute public parameters and the target attribute tokens corresponding to the second user token, wherein the ciphertext attribute public parameters are powers of the generator in the global public parameters as the base and the first data random parameter as the exponent; When the target attribute token verification code exists and satisfies the access structure, a semi-decrypted ciphertext corresponding to the target ciphertext is generated according to the user terminal attribute key corresponding to the second user token.

5. A privacy-preserving attribute-based security access control method, characterized in that: Applied to the institution side, the method includes: Determine, based on the global public parameters, the first institution original sub-public key, the second institution original sub-public key, and the attribute privacy sub-public key corresponding to the randomly generated first institution random number, second institution random number, and attribute privacy random number, respectively; Sending the original organization public key obtained by combining the first organization original sub-public key, the second organization original sub-public key, and the attribute privacy sub-public key to the cloud server, so that the cloud server generates an organization public key consisting of the attribute privacy sub-public key and the first organization sub-public key and the second organization sub-public key corresponding to the first organization original sub-public key and the second organization original sub-public key, respectively; Receiving user-related data from a data user requesting authorization of a target attribute, the user-related data including at least a user public key and a first user token; Generate a target attribute token according to the attribute privacy random number and the target attribute hash value of the target attribute; Generate a user original attribute key component according to the user public key, the target attribute, the first institution random number, the second institution random number, and the first user token, and obtain a user original attribute key based on the user original attribute key component and the target attribute token; Send the user public key, the first user token and the user original attribute key to the cloud service end; Among them, the data owner encrypts the target plaintext based on the institutional public key to obtain the target ciphertext and sends it to the cloud service end; the attribute mapping ciphertext in the access structure of the target ciphertext is determined by the attribute privacy sub-public key; the cloud service end updates the user original attribute key component in the user original attribute key to obtain the user terminal attribute key, and when it is detected that the access request from the data user end to access the target ciphertext carries a second user token and is consistent with the first user token stored in itself, it generates a semi-decrypted ciphertext corresponding to the target plaintext according to the user terminal attribute key corresponding to the second user token and sends it to the data user end.

6. The privacy-preserving attribute-based security access control method according to claim 5, characterized in that: The user-related data further includes a user identifier; generating a user original attribute key component according to the user public key, the target attribute, the first institution random number, the second institution random number, and the first user token, and obtaining a user original attribute key based on the user original attribute key component and the target attribute token, including: Obtaining a user token verification code and a user public key verification code corresponding one-to-one to the user public key and the first user token; When the user token verification code and the user public key verification code are the same, generating a user original attribute key component according to the user public key, the target attribute, the first institution random number, the second institution random number, and the first user token, and obtaining a user original attribute key based on the user original attribute key component and the target attribute token; The user token verification code is a bilinear mapping value calculated based on the first user token and the attribute privacy sub-public key; The user public key verification code is a bilinear mapping value calculated based on the user public key and the user token verification parameter, and the user token verification parameter is obtained by performing a power operation with an attribute privacy random number as an exponent and a user hash value corresponding to the user identifier as a base.

7. The privacy-preserving attribute-based security access control method according to claim 5, characterized in that: The user original attribute key component includes a first user original attribute subkey and a second user original attribute subkey; the generating of the user original attribute key component according to the user public key, the target attribute, the first institution random number, the second institution random number, and the first user token includes: generating the first user original attribute subkey according to a randomly generated third institution random number; generating a first parameter according to the user public key and the first institution random number; generating a second parameter according to the first user token and the second institution random number; generating a third parameter according to a target attribute hash value corresponding to the target attribute and the third institution random number; and generating a second user original attribute subkey according to the first parameter, the second parameter, and the third parameter. Generating a target attribute token according to the attribute privacy random number and the target attribute hash value of the target attribute includes: performing a power operation using the target attribute hash value as a base and the attribute privacy random number as an exponent to obtain the target attribute token.

8. The privacy-preserving attribute-based security access control method according to claim 5, characterized in that: The method further comprises one of the following steps: Sending a user attribute revocation request to the cloud server, so that the cloud server deletes the user terminal attribute key corresponding to the first user token and the target attribute token in the user attribute revocation request; Sending a user revocation request to the cloud server, so that the cloud server deletes the first user token and the user terminal attribute key corresponding to the user revocation request; Send an attribute revocation request to the cloud server to cause the cloud server to delete all user terminal attribute keys corresponding to the target attribute token in the attribute revocation request.

9. A privacy-preserving attribute-based access control system, characterized in that: Including data user side, institutional side, cloud service side and data owner side; among which: The data user is configured to generate a user public key and a first user token based on the first user random number, send user-related data requesting authorization of a target attribute to the institution, the user-related data including at least the user public key and the first user token, and send an access request corresponding to the target ciphertext to the cloud service end and receive a semi-decrypted ciphertext corresponding to the access request, the access request including the second user token; The institution side executes the privacy-preserving attribute-based security access control method according to any one of claims 5 to 8; The cloud service terminal executes the privacy-preserving attribute-based security access control method according to claim 3 or 4; The data owner executes the privacy-preserving attribute-based security access control method as described in claim 1 or 2.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for privacy-preserving attribute-based security access control according to any one of claims 1 to 8 is implemented.

Images