An efficient puncturable, revocable attribute-based encryption method and system

Abstract

The application discloses a high-efficiency puncturable and revocable attribute-based encryption method, and relates to the technical field of data encryption. p The application discloses a high-efficiency puncturable and revocable attribute-based encryption method, and relates to the technical field of data encryption. p The application discloses a high-efficiency puncturable and revocable attribute-based encryption method, and relates to the technical field of data encryption. partly The application discloses a high-efficiency puncturable and revocable attribute-based encryption method, and relates to the technical field of data encryption. partly The application discloses a high-efficiency puncturable and revocable attribute-based encryption method, and relates to the technical field of data encryption. The application discloses a high-efficiency puncturable and revocable attribute-based encryption system, which comprises a parameter setting module, an encryption module, a key generation module, a puncturing module, a pre-decryption module and a decryption module. The application can hide an access strategy and protect user attribute privacy, and realizes efficient revocation under the condition of guaranteeing forward and backward security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data encryption, and particularly relates to an efficient puncturable and revocable attribute-based encryption method and system. BACKGROUND

[0002] With the development of technology, the high combination of Internet of Things and cloud computing promotes the rapid development of Internet of Medical Things (IoMT). The health data of patients is stored by Internet of Things devices into cloud servers, which reduces the data storage pressure, but also brings data security problems. Considering that the data of Internet of Medical Things in the cloud environment may be shared among a group of users, the traditional one-to-one public key encryption cannot be applied to the Internet of Medical Things scene, and the attribute-based encryption (ABE) is widely used in IoMT because of the fine-grained access control and one-to-many characteristics. ABE can design access policies according to the needs of users to encrypt the ciphertext, and the access policy specifies which attributes the data accessors need to have to decrypt the ciphertext, so the data encryptors do not need to consider the number of recipients. For example, the encryptor selects the access policy {“Position:Director” AND “Department:Neurology Department”}, only the user who has both attributes can decrypt the corresponding ciphertext.

[0003] The Internet of Medical Things will inevitably face the problem of user exit in the actual application scene, and if the user exits, an efficient and secure algorithm is needed to realize the user revocation. The existing user revocation is divided into direct revocation and indirect revocation, but most of these revocation schemes need to update the ciphertext and the key at the same time to realize, and rely on the user revocation list to prevent illegal users from accessing, which limits the flexibility of the scheme, so it is necessary to design an efficient and flexible revocation scheme. In addition to user revocation, user privacy is also a key point to focus on. Here, the privacy referred to is not the plaintext information that needs to be encrypted, but the attribute privacy exposed by the user by the access policy. For example, there is an access policy {“Position:Director” AND “Disease:Cerebral palsy”}, if this access policy is directly displayed, then the attribute “Cerebral palsy” undoubtedly exposes the privacy of the user, which is not appropriate, so it is necessary to hide the access policy in the encryption scheme. SUMMARY

[0004] The technical problem to be solved by the present application is to overcome the shortcomings of the prior art and provide an efficient puncturable and revocable attribute-based encryption method and system, which can realize user revocation only by updating the ciphertext; and the complete hiding of the access policy is realized by constructing a new mapping relationship.

[0005] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0006] According to the present invention, an efficient puncture-resistant and revocable attribute-based encryption method includes:

[0007] Step A: Set the system public key PK and master key MSK;

[0008] Step B: Encrypt the plaintext message M according to PK to obtain the first ciphertext CT;

[0009] Step C: Generate the user's private key SK and conversion key TK based on PK, MSK, user attribute set S, and tag set T;

[0010] Step D: Based on the PK, CT, and puncture tag t in tag set T. p Generate a second ciphertext CT', and revoke the holding of t. p User access permissions;

[0011] Step E: Decrypt the second ciphertext CT' based on PK and TK to obtain the partially decrypted ciphertext CT. partly ;

[0012] Step F, based on CT', CT partly Using SK, the plaintext message M is decrypted.

[0013] As a further optimization of the efficient puncture-resistant and revocable attribute-based encryption method described in this invention, step A includes:

[0014] Step A1: Select two groups G and G', whose order is a prime number p. T , where the generator of group G is g;

[0015] Step A2: Select the security parameter λ and the number of tags d, and choose the bilinear mapping e: G×G→G T Collision-resistant hash function H:{0,1} * →G, where → represents the output, * represents arbitrary length, and e represents a bilinear mapping;

[0016] Step A3: Select h, h' ∈ G, and a, α, β, η ∈ Z. p ; Calculate g1 = g a g2 = g β g1 is a public key component, g2 is a public key component, and g is a generator of group G; a polynomial of degree d is selected, q(x), and the constant term of polynomial q(x) is set to β; Q(x) = g q(x) Q(x) is a function where x ranges from 1 to d, and x is an integer. h and h′ are elements of group G, and a, α, β, and η are elements of group Z. p The element in Zp Z is an integer in a finite field modulo p. p ={0,1,...,p-1};

[0017] Select initial label t0, system public key PK = (e, G, G) T ,h,h',H,g1,g2,g q(1) ,...,g q(d) ,e(g,g) α ,g η g1 η ,t0); Master key MSK = (a,η,g α ); where H represents a collision-resistant hash function, e(g,g) α e(g,g) represents the α power of e(g,g), and e(g,g) represents the pairing operation between g and g.

[0018] As a further optimization of the efficient puncture-resistant and revocable attribute-based encryption method described in this invention, step B includes:

[0019] Step B1: Select an access policy in, It is a shared matrix, where l and m represent respectively The number of rows and columns, ρ(i) represents a mapping function that will share the matrix. The row is mapped to an attribute; select r∈Z p Calculate the new mapping relationship σ j For the newly defined j-th mapping relation, H(att) j To use the collision-resistant hash function H:{0,1} * →G will attribute att j The mapped value, e(*), is the value obtained by bilinearly mapping the value within the parentheses. ρ′(i) is the new mapping function that replaces ρ(i), j is an element in J, J is the number of attributes in the attribute set associated with the shared matrix, and r is Z. p The elements in l are i, and i is an element in l;

[0020] Step B2, calculate D' = g r D′ is the recovery key, and M∈G is set. T Choose e, and calculate g3 = g s g3 is the puncture component, g s G raised to the power of s; M is encrypted. Let g be the ciphertext component, and e(g,g) be the value obtained by performing a bilinear mapping on the two g's. αsLet e(g,g) be an α·s power; select r2, r3, ..., r m ∈Z p Construct column vectors calculate Where, λ i This represents the i-th secret share. It is a shared matrix The i-th row, s,r2,r3,...,r m It is Z p Elements in;

[0021] Step B3, for the matrix each line Select u i ∈Z p ,calculate Among them, C i (1) C i (2) C i (3) C i (4) C5 and C6 are both ciphertext components, and x1 is... For each row, the corresponding attribute H(x1) is the value of x1 mapped using a collision-resistant hash function, u i It is Z p Elements in;

[0022] Step B4: Select k0∈Z p Calculate the initial puncture encryption key Output the first ciphertext Where k0 is Z p In the array, K0, L0, and Q0 are the initial puncture encryption key components, t0 is the initial tag, sk0 is the puncture encryption key component, sk0 is composed of t0, K0, L0, and Q0, Q(t0) is the value of the function Q(x) when the variable takes the value t0, and ρ' is the new mapping relationship.

[0023] As a further optimization of the efficient puncture-resistant and revocable attribute-based encryption method described in this invention, step C includes:

[0024] Select calculate D1 and D2 are the transformation key components; for each att∈S, r is selected. att ∈Z p ,calculate

[0025] D att and D att′ is the transformation key component, att is an element in S, and r att It is Z p The element in the array, H(att), is the value of att mapped using a collision-resistant hash function. It is Z p Elements in;

[0026] For each label in the label set T, calculate D. i′ ={Q(t) i' ) a} i'∈[1,d] D i' Let t represent the i'-th tag conversion key component. i' This represents the i'-th label, where i' ranges from 1 to d, and Q(t) i' ) represents the function Q(x) taking the value t. i' The value of the time, the conversion key TK = {D1, D2, {D att D att '} att∈S ,{D i′} i'∈[1,d]}, private key Where the label set T = {t1, t2, ..., t} d}

[0027] As a further optimization of the efficient puncture-resistant and revocable attribute-based encryption method described in this invention, step D, generating the second ciphertext CT', includes:

[0028] Step D1: Select the puncture tag t p The puncture encryption key SK in the first encrypted CT scan. p-1 ={sk0,sk1,...,sk p-1} Perform puncture, where SK p-1 SK0 represents the punctured encryption key that has been punctured p-1 times, where the number of punctures p ranges from 1 to d. When p = 1, SK0 represents the initial punctured encryption key that has not been punctured. p′ For the p'-th puncture encryption key component, 0 ≤ p' ≤ p-1, each time the puncture encryption key is punctured, an additional puncture encryption key component is added; γ is selected. p ,k p ∈Z p ,calculate Where sk0' represents the new puncture encryption key component, and the new puncture encryption key components K0′, L0′, and Q0′ are calculated using the elements K0, L0, and Q0 in sk0, γ p k p It is Z p Elements in;

[0029] calculate Among them, sk p K is a new puncture encryption key component generated in the p-th puncture. p ,L p Q p It is a puncture encryption key component, Q(t) p ) is the function Q(x) with the variable taking the value t. p The value of the time is used to output the latest puncture encryption key SK. p ={sk0',sk1,...,sk p}, of which SK p It is the new puncture encryption key generated after the p-th puncture; output

[0030] As a further optimization of the efficient puncture-resistant and revocable attribute-based encryption method described in this invention, step E includes:

[0031] Step E1: Calculate {σ} j′ ′:σ j′ ′=e(D',H(att j′ ) η )} j′∈S ,calculate Where, σ j′ ' is the new mapping relationship σ generated during encryption. j′ Recovery attempt, σ j′ ′=e(D',H(att j′ ) η ) is the calculation of σ j′ The specific formula for ′ This indicates that for all attributes at in S j′ Using formula σ j′ ′=e(D',H(att j′ ) η The set of values ​​after calculation. Indicates for The set of values ​​after mapping all rows, ρ'(i2) is The value after mapping the i2th row in the array, where I represents the value in the array. In the middle, i corresponds to the row number of S, i2 is an element in I and also an element in l, and I is a subset of l;

[0032] If the user's attribute set satisfies the access policy, then Find a set of coefficients c i2 ∈Z p ,get in yes line i2 The set consisting of Mi2 yes The vector composed of the values ​​of i2, where the coefficient c is the second coefficient. i2 It is Z p The elements in This indicates the process of accumulation. The specific value is a vector (1,0,...,0), and then the first partial decryption is performed. Among them, c i To satisfy the access policy coefficient, A is the attribute decryption component, e(C) i (1) ,D1),e(D ρ(i) C i (4) ), e(D ρ(i) ′,C i (2) ), e(D2,C i (3) Both ) represent the values ​​of the bilinear mapping, D ρ(i) The transformation key component D represents the attribute att mapped to ρ(i). att D ρ(i) ′ represents the transformation key component D corresponding to the attribute att mapped to ρ(i). att ′;

[0033] Step E2: Perform the second partial decryption. For i3 = 1, 2, ..., p, calculate the Lagrange coefficients {ω1, ω2, ..., ω...} d ,ω *}, where p is the number of punctures, {ω1,ω2,...,ω d} and ω * These are a set of values ​​calculated using Lagrange interpolation, called Lagrange coefficients. Where, ω m It is the m-th Lagrange coefficient, q(t) m ) is q(x) as x takes the value t. m The value of t m Representing the m-th label, calculate Z i3 It is the puncture decryption component for the i3rd tag, where e(K) i3 C6) e(Q i3 C5) both represent the values ​​of bilinear mappings, K i3 L i3 Q i3 The puncture encryption key component, D, is generated during the i3rd puncture. m Represents the transformation key component for the m-th tag, calculate B is the puncture decryption component; finally, the CT scan is obtained.partly = (A, B), where (A, B) represents the set consisting of attribute decryption component A and puncture decryption component B together.

[0034] As a further optimization of the efficient puncture-resistant and revocable attribute-based encryption method described in this invention, M in step F is:

[0035]

[0036] A highly efficient puncturable and revocable attribute-based encryption system includes a parameter setting module, an encryption module, a key generation module, a puncture module, a pre-decryption module, and a decryption module; wherein,

[0037] The parameter setting module is used to generate the system public key PK and master key MSK. The system public key PK is sent to the encryption module, key generation module, puncture module, and pre-decryption module, and the master key is sent to the key generation module.

[0038] The encryption module is used to encrypt the plaintext message M according to PK to obtain the first ciphertext CT; the first ciphertext CT is sent to the puncture module and the pre-decryption module;

[0039] The key generation module is used to generate a user private key SK and a transformation key TK based on PK, MSK, user attribute set S and tag set T; the transformation key TK is sent to the pre-decryption module and the user private key SK is sent to the decryption module.

[0040] The puncture module is used to determine the puncture label t based on PK, CT, and label set T. p Generate a second ciphertext CT', and send the second ciphertext CT' to the pre-decryption module and the decryption module;

[0041] The pre-decryption module is used to partially decrypt the second ciphertext CT' based on PK and TK to obtain the partially decrypted ciphertext CT. partly and CT partly Send to the decryption module;

[0042] The decryption module is used to decrypt CT', CT partly Using SK, the plaintext message M is decrypted.

[0043] A computer device includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the computer program to implement the steps of the efficient puncture-resistant, revocable attribute-based encryption method described above.

[0044] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the efficient puncture-resistant, revocable attribute-based encryption method described above.

[0045] Compared with the prior art, the present invention, employing the above technical solution, has the following technical effects:

[0046] (1) Efficient User Revocation Based on Puncture: When user revocation occurs, the ciphertext is directly punctured. After being punctured, users holding the same tag will be unable to decrypt the ciphertext. A large number of users can be revoked simultaneously. This process does not require interaction with users or updating keys and ciphertext, achieving constant-level user revocation. This technology firstly implements puncture-based revocation, ensuring the forward and backward security of messages. Moreover, since revoking users does not require communication with any users, the need for secure channels is reduced.

[0047] (2) Complete policy hiding: The mapping function of the secret sharing matrix is ​​replaced with a new mapping relationship to hide the attribute corresponding to each row. Only users holding the attribute recovery key can calculate which row of the matrix their attribute corresponds to, thus achieving complete hiding of the access policy and protecting user privacy. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of the operation of the encryption system of the present invention.

[0049] Figure 2 This is a flowchart of the encryption method of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0051] The theory behind this invention is as follows:

[0052] 1. Bilinear mapping

[0053] Let G and G T Let G be a multiplicative cyclic group of two prime-order p, where g is a generator of G. Let e ​​be a bilinear mapping e: G × G → G T The mapping e satisfies the following three properties:

[0054] Bilinear: For There is e(g) a ,g b )=e(g,g) ab

[0055] Computability: For e(x,y) can be computed in polynomial time using an algorithm.

[0056] Nondegeneracy: e(g,g)≠1, where the symbol 1 denotes group G. T The unit element in the text.

[0057] 2. Access Structure

[0058] Assume {P1, P2, ..., P} n} is a set of participants. A word is monotonic if it satisfies the following condition: for any P, Q, if and So

[0059] 3. Linear secret sharing scheme

[0060] If the share of secrets can be in Z p This forms a vector, and there exists an l x m share generation matrix. So we call it a secret sharing scheme. In Z p The above is linear. In In the matrix, there exists a mapping function ρ(i) that maps the matrix to i. The i-th row is mapped to the attribute set. For the secret s to be shared, m-1 values ​​(r2, r3, ..., r) are randomly selected. m ), forming a column vector It is the shared share of secret s, λ i Associated with attribute ρ(i), where It is a matrix The i-th row. To recover the secret s, the attribute must satisfy the access policy. Users can find a set of constants {ω1,ω2,...,ω l},calculate Where I represents the row number of the matrix associated with the user attributes. Then recover the secret s:

[0061] 4. Difficult Assumption

[0062] Let g be a generator of a p-order group G, and randomly select a, b, c, z ∈ Z. p The probability of correctly distinguishing two tuples with a negligible advantage ε in probabilistic polynomial time is negligible:

[0063] The specific implementation process of this invention is as follows:

[0064] like Figure 1 As shown, the efficient puncture-resistant and revocable attribute-based encryption system provided by this invention includes the following six modules:

[0065] 1. Parameter setting module Setup(1) λ,d): Input security parameter λ and number of tags d to generate system public key PK and master key MSK.

[0066] 2. Encryption module Input plaintext message M and access policy And the system public key PK, outputting the first ciphertext CT.

[0067] 3. Key Generation Module KeyGen(PK,MSK,S,T): Inputs system public key PK, master key MSK, user attribute set S, tag set T, outputs transformation key TK and user private key SK.

[0068] 4. Puncture module (PK, CT, t) p Input system public key PK, first encrypted CT, and puncture tag t: p Output the second ciphertext CT'.

[0069] 5. Pre-decryption module Decryptout(CT',TK,PK): Inputs the second ciphertext CT', the conversion key TK, and the system public key PK; outputs the partially decrypted ciphertext CT. partly .

[0070] 6. Decrypt module Decrypt(CT', CT) partly ,SK): Input the second ciphertext CT', and partially decrypt the ciphertext CT. partly Combine the user's private key SK with the plaintext output.

[0071] The following section will provide a detailed explanation of each module of the encryption system, using a flowchart of the efficient user revocation attribute-based encryption system and method based on puncture-resistant technology.

[0072] like Figure 2 As shown, the specific execution flow of the encryption method provided by this invention is as follows:

[0073] Step A, System Parameter Generation:

[0074] System initialization is performed by the Key Generation Center (KGC). λ is the security parameter, and d is the number of tags. The KGC chooses a bilinear mapping e: G×G→G T Collision-resistant hash function H:{0,1} * →G. The generators and order of group G are g and p, respectively. Randomly select h, h' ∈ G, and a, α, β, η ∈ Z. p Calculate g1 = g a g2 = g β Next, KGC randomly selects a polynomial of degree d, q(x), and sets the value of the constant term to β. Then, he sets Q(x) = g q(x)Select the initial tag t0. Next, output the system public key PK and master key MSK. PK = (e, G, G T ,h,h′,H,g1,g2,g q(1) ,...,g q(d) ,e(g,g) α ,g η g1 η ,t0),MSK=(a,η,g α ).

[0075] Step B: Encrypt the plaintext message M:

[0076] The encryption algorithm is implemented by the data owner (DO). The DO first defines the access policies. This is used to specify which attributes can access the data, where J is the number of attributes in the attribute set associated with the shared matrix. Randomly select r∈Z. p Calculate the new mapping relationship Then set ρ'(i) is the new mapping function that replaces ρ(i). Next, the recovery key D′=g is calculated. r The data user (DU) will use the recovery key to restore part of the mapping functionality. Select plaintext message M∈G. T Randomly select s∈Z p Calculate g3 = g s Then encrypt M. Randomly select r2, r3, ..., r m ∈Z p Construct column vectors Next, DO calculates the i-th secret share. in It is a shared matrix The i-th row. For the shared matrix. each line Randomly select u i ∈Z p ,calculate Where x1 is The attributes corresponding to each row. Then calculate C5 = g1. s C6 = g2 s Randomly select k0∈Z p Calculate the initial puncture encryption key

[0077] Step C, generate the user's private key and conversion key:

[0078] The user DU input parameters are generated by KGC using the user's private key and transformation key, where S is the user attribute set, and T = {t1, t2, ..., t}.d} is a tag set. KGC randomly selects tags. calculate For each att∈S, randomly select r att ∈Z p ,calculate For each label in the label set, calculate D. i′ ={Q(t) i′ ) a} i′∈[1,d] Next, the algorithm outputs the user's private key SK and transformation key TK, sending TK to the cloud server (CS) and SK to the user. TK = {D1, D2, {D...} att D att ′} att∈S ,{D i′} i′∈[1,d]},

[0079] Step D, Piercing the Cipher:

[0080] The cloud server CS receives the puncture tag t sent by DO. p Subsequently, the puncture encryption key SK in the first encrypted CT scan will be used. p-1 ={sk0,sk1,...,sk p-1 Perform puncture. For sk0 = {t0, K0, L0, Q0}, randomly select γ. p ,k p ∈Z p ,calculate Next calculation The latest puncture encryption key is SK. p ={sk0',sk1,...,sk p CS updates the first ciphertext CT and outputs the second ciphertext CT′.

[0081] Step E, pre-decrypt the ciphertext:

[0082] DU obtains the first ciphertext CT from CS, and first attempts to recover part of the mapping relationship, calculating {σ}. j′ ′:σ j′ ′=e(D',H(att j′ ) η )} j′∈S Next, the user can calculate which row of the matrix corresponds to their attribute. And send it to CS along with the conversion key TK. If the user's attribute set satisfies the access policy, then A set of coefficients c can be found i2∈Z p ,get Then CS performs partial decryption. c i The coefficients are used to satisfy the access strategy. For i3 = 1, 2, ..., p, the CS can use the Lagrange coefficients {ω1, ω2, ..., ω...} d ,ω *} to calculate calculate Next calculation Now CS obtains some plaintext CT. partly = (A, B), and send them to the user.

[0083] Step F: Decrypt the partially decrypted ciphertext to obtain the plaintext:

[0084] After DU receives the partially decrypted ciphertext from CS, it can decrypt it to obtain the plaintext through simple calculations:

[0085] The following section will explain the application of the above-described puncture-based, high-efficiency user revocation attribute-based encryption system in a medical IoT system.

[0086] When medical IoT device A' detects and records a user's disease information, it needs to be uploaded to the network for access by hospital device B'. According to the steps of this invention, the specific process is as follows: When A' needs to upload private data using the medical IoT device, it selects an access policy based on the user's situation to restrict which users with certain attributes can access the data. Then, it encrypts its data using the system's public key and access policy and uploads the ciphertext to the cloud server. Device B' intends to access A's data. It obtains a user private key and a conversion key matching its own attributes and tags from the key generation center. Then, B' submits its conversion key to the cloud server, where partial decryption is performed and the partially decrypted ciphertext is sent to B'. B' uses its own user private key to completely decrypt and obtain A's data locally. If A' intends to delete access permissions for some users, it submits a specific tag (e.g., tag: device B') to the cloud server. The cloud server uses a puncture algorithm to revoke the user's access. After the puncture is completed, device B' can no longer decrypt the ciphertext to obtain the plaintext.

[0087] The beneficial effects of this invention are as follows: User revocation implemented using the puncture algorithm is quick, simple, and secure. The execution time of the puncture algorithm is in the millisecond range, and the revocation time is not affected by whether the number of users revoking is one or a group. Moreover, the entire process does not require interaction with other users, improving security and computational efficiency. Furthermore, by constructing a new mapping relationship, the access policy is completely hidden, protecting user privacy and preventing the exposure of user attributes. This invention's method is used to solve the user revocation and privacy issues in multi-user systems.

[0088] This invention proposes a highly efficient puncturable and revocable attribute-based encryption system. The system includes a parameter setting module, an encryption module, a key generation module, a puncture module, a pre-decryption module, and a decryption module. The parameter setting module generates a public key and a master key. The public key is made public to other modules, and the master key is sent to the key generation module. The encryption module encrypts the plaintext message M. The key generation module combines user attributes and tags to generate a user private key and a conversion key, and sends the conversion key to the pre-decryption module. The puncture module punctures the ciphertext to revoke the user's identity. The pre-decryption module decrypts part of the ciphertext in advance to reduce computation. The decryption module completely decrypts the ciphertext to obtain the plaintext message.

[0089] The parameter setting module is used to generate the system public key PK and master key MSK. The system public key PK is sent to the encryption module, key generation module, puncture module, and pre-decryption module, and the master key is sent to the key generation module.

[0090] The encryption module is used to encrypt the plaintext message M according to PK to obtain the first ciphertext CT; the first ciphertext CT is sent to the puncture module and the pre-decryption module;

[0091] The key generation module is used to generate a user private key SK and a transformation key TK based on PK, MSK, user attribute set S and tag set T; the transformation key TK is sent to the pre-decryption module and the user private key SK is sent to the decryption module.

[0092] The puncture module is used to determine the puncture label t based on PK, CT, and label set T. p Generate a second ciphertext CT', and send the second ciphertext CT' to the pre-decryption module and the decryption module;

[0093] The pre-decryption module is used to partially decrypt the second ciphertext CT' based on PK and TK to obtain the partially decrypted ciphertext CT. partly and CT partly Send to the decryption module;

[0094] The decryption module is used to decrypt CT', CT partly Using SK, the plaintext message M is decrypted.

[0095] A computer device includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the computer program to implement the steps of the efficient puncture-resistant, revocable attribute-based encryption method described above.

[0096] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the efficient puncture-resistant, revocable attribute-based encryption method described above.

[0097] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0098] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0099] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0100] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0101] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0102] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A highly efficient puncture-resistant, revocable attribute-based encryption method, characterized in that, include: Step A: Set the system public key PK and master key MSK; Step A includes: Step A1: Select two prime numbers. group and Among them, the group The generator is ; Step A2: Select safety parameters , with the number of tags Choose bilinear mapping Collision-resistant hash function ,in, Indicates the output. Represents any length. Represents a bilinear mapping; Step A3, Select ,as well as ;calculate , , For public key components, For public key components, For the group The generators; select polynomials of degree d. Set polynomial The value of the constant term is ;set up , It is a function. The value range is 1 to , It is an integer. They are groups The elements in They are The elements in It is an integer in a finite field modulo p. ; Select initial label System public key Master key ;in, Represents a collision-resistant hash function. express of Power of 1 express and Pairing operations; Step B: Encrypt the plaintext message M according to PK to obtain the first ciphertext CT; Step B includes: Step B1: Select an access policy ,in, It is a shared matrix. , They represent The number of rows and columns, Describes a mapping function that shares a matrix. The row is mapped to an attribute; select Calculate the new mapping relationship , For the newly defined first A mapping relationship, To use collision-resistant hash functions attributes The mapped value, To set the value after bilinear mapping of the values ​​within the parentheses. , It is a replacement The new mapping function, yes The elements in It is the number of attributes in the attribute set associated with the shared matrix. yes The elements in yes Elements in; Step B2, Calculation , Set the recovery key. Choose e and calculate. , For puncture components, for of Power; for Encryption, , For encrypted components, For two The value after bilinear mapping, for of Power; Select Construct column vectors ,calculate ,in, Indicates the first A secret share, It is a shared matrix The OK, yes Elements in; Step B3, for the matrix each line ,choose ,calculate , , , , , ,in, All are encrypted components, x1 is The attributes corresponding to each row, It is the value of x1 after being mapped using a collision-resistant hash function. yes Elements in; Step B4, Select Calculate the initial puncture encryption key Output the first ciphertext ,in, yes The elements in It is the initial puncture encryption key component. It is the initial tag. It is a puncture encryption key component. Depend on composition, It is a function When the variable takes the value The value of time, It is a new mapping relationship; Step C: Generate the user's private key SK and conversion key TK based on PK, MSK, user attribute set S, and tag set T; Step D: Based on the puncture tags in PK, CT, and tag set T. Generate the second ciphertext Cancel holding User access permissions; Step E: Analyze the second ciphertext based on PK and TK. Partial decryption yields partially decrypted ciphertext. ; Step F, according to , Using SK, the plaintext message M is decrypted.

2. The efficient puncture-resistant and revocable attribute-based encryption method according to claim 1, characterized in that, Step C includes: Select ,calculate , , , It is a key conversion component; for each Select ,calculate , , and It is a key conversion component. yes The elements in yes The elements in It uses a collision-resistant hash function to... The mapped value, yes Elements in; For tag sets Calculate each label in the text. , Indicates the first Individual tag conversion key components, Indicates the first A tag, The value range is 1 to , Representation function When the variable takes the value The value of the time, the conversion key private key ; tag set .

3. The efficient puncture-resistant and revocable attribute-based encryption method according to claim 2, characterized in that, The second ciphertext is generated in step D. include: Step D1: Select the puncture tag The puncture encryption key in the first encrypted CT scan. Perform puncture, among which This indicates that the body has been punctured. The key for each puncture, the number of punctures The range is 1 to ,when hour, Indicates the initial puncture encryption key that has not been punctured; For the first A piercing encryption key component Each time the puncture encryption key is punctured, a new puncture encryption key component is added; select ,calculate ;in, This indicates a new puncture encryption key component, using elements in Calculate the new puncture encryption key component , yes Elements in; calculate ,in, It is in the The new puncture encryption key component generated during the second puncture. It is a puncture encryption key component. It is a function When the variable takes the value The value of the time, output the latest puncture encryption key. ,in It is in the The new puncture encryption key generated after the second puncture; output .

4. The efficient puncture-resistant and revocable attribute-based encryption method according to claim 3, characterized in that, Step E includes: Step E1, Calculation ,calculate ,in, It is a new mapping relationship generated during encryption. Recovery attempt It is a calculation The specific formula, Indicates for All attributes Use formula The set of values ​​after calculation Indicates for The set of values ​​after mapping all rows. for The first in The value after mapping the row Indicates in Chinese, Corresponding the number of rows, yes The elements in, and also The elements in yes A subset of; If the user's attribute set satisfies the access policy, then Find a set of coefficients ,get ;in yes The OK The set that is formed yes The vector composed of the values ​​of , the first coefficients yes The elements in This indicates the process of accumulation. The specific value is a vector Then perform the first partial decryption. ;in, To satisfy the access policy coefficient, It is an attribute decryption component. , , , Both represent the values ​​of the bilinear mapping. Indicates and Mapped properties Corresponding conversion key component , Indicates and Mapped properties Corresponding conversion key component ; Step E2: Perform a second partial decryption. Calculate the Lagrange coefficients ,in It refers to the number of punctures. and These are a set of values ​​calculated using Lagrange interpolation, called Lagrange coefficients. ,in, It is the first Each Lagrange coefficient, yes In variables Values The value of time, Indicates the first Each label, calculate , It is the first The puncture decryption component for each label, in which , , Both represent the values ​​of the bilinear mapping. It is in the The puncture encryption key component generated during the second puncture. Indicates the first The conversion key component for each tag is calculated. ,in It is a puncture decryption component; finally, we get... ,in Indicates property decryption component and puncture decryption component A collection formed together.

5. The efficient puncture-resistant, revocable attribute-based encryption method according to claim 4, characterized in that, In step F, M is: 。 6. A system based on the efficient puncture-resistant, revocable attribute-based encryption method according to claim 1, characterized in that, It includes a parameter setting module, an encryption module, a key generation module, a puncture module, a pre-decryption module, and a decryption module; among which, The parameter setting module is used to generate the system public key PK and master key MSK. The system public key PK is sent to the encryption module, key generation module, puncture module, and pre-decryption module, and the master key is sent to the key generation module. The encryption module is used to encrypt the plaintext message M according to PK to obtain the first ciphertext CT; the first ciphertext CT is sent to the puncture module and the pre-decryption module; The key generation module is used to generate a user private key SK and a conversion key TK based on PK, MSK, user attribute set S and tag set T; the conversion key TK is sent to the pre-decryption module and the user private key SK is sent to the decryption module. The puncture module is used to determine the puncture tag based on PK, CT, and tag set T. Generate the second ciphertext Second ciphertext Send to the pre-decryption module and the decryption module; The pre-decryption module is used to decrypt the second ciphertext based on the PK and TK. Partial decryption yields partially decrypted ciphertext. and will Send to the decryption module; Decryption module, used to decrypt according to , Using SK, the plaintext message M is decrypted.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the efficient puncture-resistant, revocable attribute-based encryption method as described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the efficient puncture-resistant, revocable attribute-based encryption method as described in any one of claims 1 to 5.

Images