An attribute-based policy hiding and puncturing encryption method and system

Abstract

The application discloses an encryption method based on attribute-based strategy hiding and puncturing, relates to the technical field of data encryption, and can enable a user to autonomously update a secret key, so that the user loses decryption capability, thereby not needing to rely on a centralized secret key distribution mechanism.In the scheme, the secret key update does not need to delete secret key components, and seamless revocation of decryption capability can be realized.In addition, the scheme utilizes blockchain technology, verifies an access strategy by integrating an attribute authorization center into a consensus node, and thus reduces a calculation cost.The application also discloses an encryption system based on attribute-based strategy hiding and puncturing, realizes a puncturing function, and is a forward security encryption scheme, so that a user can actively revoke a secret key decryption function.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data encryption, and particularly relates to an attribute-based encryption method and system for policy hiding and puncturing. BACKGROUND

[0002] The rise of the Internet of Things has significantly improved the quality of life, especially in the fields of smart home, healthcare, and intelligent urban traffic management. Although the Internet of Things has shown great potential in terms of intelligence and interconnection, its technical characteristics and application scenarios also have obvious shortcomings. Due to limited storage and processing capabilities, Internet of Things systems face challenges in managing large-scale data workloads. In addition, limited resources make a large amount of data vulnerable to security risks. In order to solve these problems and enhance data protection, researchers are increasingly integrating attribute encryption with Internet of Things technology.

[0003] Since Sahai and Waters pioneered attribute-based encryption in 2005, research on attribute encryption has rapidly expanded. Subsequently, Goyal et al. proposed an attribute encryption scheme that embeds attributes into ciphertexts, while Bethencourt et al. proposed a scheme that embeds attributes into decryption keys. Since the ciphertext policy attribute-based encryption scheme delegates access control rights to data owners, allowing them to define access policies for ciphertexts and specify which data users are allowed to access it, the ciphertext policy attribute-based encryption scheme is more suitable for secure data sharing systems than the key policy attribute-based encryption scheme. However, attribute encryption has also been widely applied in the Internet of Things due to its fine-grained access control mechanism, which enables privacy protection and data sharing.

[0004] Hiding access policies is extremely important, for example, in a healthcare application, if the access policy is (user ID: 11256) AND (department: mental health), an attacker can easily infer that the associated ciphertext is related to a mental illness patient, because the policy is publicly disclosed in plaintext. In order to solve such privacy problems, some researchers have begun to design attribute-based encryption schemes that support hiding access policies.

[0005] The puncturing concept is that after reading the decrypted plaintext, the user uses the selected label to puncture the decryption key. Once punctured, the key will permanently lose its decryption ability. The combination of puncturing encryption and attribute encryption makes the puncturing encryption scheme have the fine-grained access control of attribute encryption. There are two key defects in the existing public encryption methods, which limit their application in high security and privacy protection scenarios. First, these methods usually cannot guarantee forward security. Once the user's private key is leaked at a certain time point, the attacker can use the key to decrypt the historical ciphertext, which may cause the user's past privacy data to be at risk of leakage. The lack of forward security means that the system cannot effectively block illegal access to old data when facing key leakage events, which seriously threatens the long-term confidentiality of data. Second, in most public encryption schemes, access policies are usually directly embedded in ciphertext in plaintext form, which not only easily leaks the access control intention of the data owner, but also may expose sensitive information related to the policy (such as identity, occupation, health status, etc.). Even if the attacker cannot decrypt the ciphertext, he may infer the approximate content of the data by analyzing the access policy, causing indirect information leakage. Therefore, the existing scheme still has obvious shortcomings in privacy protection and security robustness, and it is urgent to introduce an access policy hiding and flexible forward security supporting encryption mechanism to improve it. SUMMARY

[0006] The technical problem to be solved by the present application is to overcome the shortcomings of the prior art and provide an attribute-based policy hiding and puncturing encryption method and system. The access policy exists in the ciphertext in an encrypted form. After successfully verifying the access policy, the user can choose to puncture the key with decryption function to lose the decryption ability.

[0007] The present application solves the above technical problems by adopting the following technical solutions:

[0008] According to the attribute-based policy hiding and puncturing encryption method proposed by the present application, the following steps are included:

[0009] Step A, set the system public parameters PK and the master private key MSK;

[0010] Step B, encrypt the access policy according to PK and MSK to obtain the encrypted access policy wherein, is an access matrix, and ρ is a function of mapping a row of to an attribute, is a matrix in the access policy after policy hiding, and ρ' is a mapping function in the access policy after policy hiding;

[0011] Step C, according to PK and the label set t1,...,t dEncrypt message M to obtain ciphertext CT, where t d′ The d′-th tag is embedded in the ciphertext, 1≤d′≤d, where d is the maximum number of tags;

[0012] Step D: Based on PK and MSK, generate the user's private key SK and piercing key KP0 from the attribute set ω;

[0013] Step E: Generate the post-puncture key KP based on PK and the puncture key KP0;

[0014] Step F: Verify the encrypted access policy based on ω and SK. Ensure policy encryption It has not been maliciously altered;

[0015] Step G: Based on SK,KP,CT,t1,...,t d Restore message.

[0016] As a further optimization of the attribute-based policy hiding and penetration encryption method described in this invention, step A includes:

[0017] Step A1: Select a group G of order p;

[0018] Step A2: Select a safety parameter 1 with length k. k Choose a bilinear mapping e: G×G→G T Where → indicates output, G T It is a multiplicative cyclic group of order p, which is a prime number.

[0019] Step A3: In the modulo p integer group that does not contain zero elements Randomly select exponents α and a from G, and then randomly select element h from G. j,d′ Where j∈[1,n] max ] and d'∈1,...,d,h j,d′ For the element in column j with label d′, n max For matrix The maximum number of columns, where all attribute authority centers AA are blockchain nodes; set the attribute authority center set U. θ ={AA1,AA2,...,AA b ,...,AA θ}, AA b Let μ be the b-th attribute authority center, and each attribute authority center will be randomly assigned an integer μ. b Then calculate the MSK components. Where b∈[1,θ], θ is the total number of attribute authority centers;

[0020] System Public Parameters The master private key is MSK=(g α ,μ);define a d-order polynomial q(x) and set V(x)=g q(x) , where g is the generator of group G, e(g,g) α represents the α power of e(g,g), e(g,g) represents the pairing operation of g, g, the hash function F:U→G maps the attribute to G, U is the attribute set, t0 is the initial label selected not to participate in puncture, V(x) is the value calculated by Lagrange interpolation in the exponential field, and x is the interpolation point of the reconstructed polynomial value.

[0021] As a further optimization scheme of the attribute-based policy hiding and puncturing encryption method, step B comprises:

[0022] The attribute authority center calculates (1+μ b ·p), and sets policy encryption components B, B' and B", wherein

[0023] For each attribute attr in the access policy, a hidden factor γ x is randomly selected in , and the policy hiding coefficient is calculated. Then, each row in is mapped to a hidden policy , wherein I is the value after the bilinear mapping of B, F(*) is the hash value obtained by mapping the attribute to G, attr σ is the σth attribute, F(attr σ ) is the hash value obtained by mapping the σth attribute attr σ to G, is the value obtained by performing bilinear operation on B, that is, the pairing operation of B.

[0024] As a further optimization scheme of the attribute-based policy hiding and puncturing encryption method, step C comprises:

[0025] In , select the position vector s and z ε are elements in , 2≤ε≤n max , select a matrix with l rows and n max columns, and then calculate the ciphertext

[0026]

[0027] wherein s is a shared value, C0, C1, C 2,i,j , C 3,d are ciphertext components, is an element of the i-th row, j-th column, is a vector of the j-th column, is an element of the i-th row, j-th column, of s raised to the power of p(l'), V(F(t d′ )) is a value obtained by computing F(t d′ ), F(t d′ ) is a value obtained by computing the d'-th label using a hash function F.

[0028] As a further optimization of the attribute-based policy hiding and puncturing encryption method described in the present invention, step D comprises:

[0029] selecting r, r a , r ξ are elements in , 1≤ξ≤n max , outputting the user private key and the puncture key, which are

[0030] wherein D, D 1,i , D 2,σ , D 3,σ are attribute private key components, KP 01 , KP 02 , KP 03 , KP 04 are puncture private key components, is r ξ raised to the power of the j-th column, the σ-th element, F(*) is a hash value obtained by computing using a hash function F, r i is a randomization factor of the i-th row share, V(F(t0)) is a value obtained by computing F(t0).

[0031] As a further optimization of the attribute-based policy hiding and puncturing encryption method described in the present invention, step E comprises:

[0032] selecting λ' and by inputting the existing key {KP0, KP1,..., KP τ′ ,..., KP τ-1} after τ-1 punctures; wherein KP τ′ is the key obtained after the τ'-th puncture, 0≤τ'≤τ-1; and obtaining the latest puncture key KP = (KP 01 ', KPτ1 ,KP 02 ',KP τ2 ,KP 03 ',KP τ3 ,KP 04 ',KP 04 ), wherein are elements selected in , KP 01 ',KP 02 ',KP 03 ', are key components after puncturing, KP τ1 , KP τ2 , KP τ3 are key components obtained by calculation, KP 04 ' is a tag without puncturing operation, KP 04 is a tag, t is a single target tag, and V(F(t)) is a value obtained by calculating F(t).

[0033] As a further optimization of the attribute-based policy hiding and puncturing encryption method described in the present application, step F includes:

[0034] The data user calculates and compares it with I to verify whether the access policy is correct; wherein, are elements in , I' is a value obtained by bilinear mapping D σ , D 3,σ , D σ is a policy hiding coefficient, e(*) is a bilinear pairing operation, F(*) is a hash value obtained by mapping attributes to G, and ρ(l') is a function of mapping the l'th row of to attributes, wherein 1≤l'≤l, and γ x is a hiding factor.

[0035] As a further optimization of the attribute-based policy hiding and puncturing encryption method described in the present application, step G includes:

[0036] The message is recovered by inputting the ciphertext CT, the private key SK, the puncturing key KP, and the tag set (t1,...,t d ); first, calculate and wherein T and A are values obtained by bilinear mapping calculation, Γ is a set of row indexes and Γ={i|ρ(i)∈ω}, and finally the message is a weighted product of multiple exponents ω d′ weighted product, ωd′ It is a set of weights used to reconstruct shared values, ω * The decryption weight set for recovering messages during the decryption process. v for ciphertext component i The power of ρ(i) is the power of The i-th row is the function that maps to the attribute, and τ is the number of times the key is pierced.

[0037] An attribute-based policy hiding and penetration encryption system includes a system parameter setting module, a policy hiding module, an encryption module, a private key generation module, a key penetration module, a policy verification module, and a decryption module; wherein,

[0038] The system parameter setting module is used to set the system public parameter PK and master private key MSK; among them, PK is output to the policy hiding module, encryption module, private key generation module, and key penetration module, and MSK is output to the policy hiding module and private key generation module;

[0039] The policy hiding module is used to set access policies based on PK and MSK. Encryption is performed to obtain the encrypted access policy. in, Let ρ be the access matrix, and ρ be the value of the access matrix. A function that maps a line to a property. Let ρ' be the matrix in the access policy after policy hiding, and let ρ' be the mapping function in the access policy after policy hiding.

[0040] The encryption module is used to determine the encryption based on the PK and tag set t1,...,t. d Encrypt message M to obtain ciphertext CT, where t d′ The d′-th tag is embedded in the ciphertext, 1≤d′≤d, where d is the maximum number of tags;

[0041] The private key generation module is used to generate the user's private key SK and piercing key KP0 based on PK, MSK, and attribute set ω.

[0042] The key puncture module is used to generate the punctured key KP based on PK and the puncture key KP0.

[0043] The policy verification module is used to verify the encrypted access policy based on ω and SK. Ensure that the encrypted part of the policy has not been maliciously tampered with;

[0044] The decryption module is used to decrypt SK,KP,CT,t1,...,t d Restore message.

[0045] A computer device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that the processor implements the steps of the attribute-based policy hiding and piercing encryption method as described above when executing the computer program.

[0046] Compared with the prior art, the above technical solution has the following technical effects:

[0047] (1) The policy hiding is realized by means of the blockchain technology, and the possibility of access policy leakage is solved;

[0048] (2) The piercing function is realized, and the encryption scheme has forward security, so that the user can actively revoke the key decryption function. BRIEF DESCRIPTION OF DRAWINGS

[0049] Figure 1 is a working schematic diagram of the encryption system of the present application.

[0050] Figure 2 is a system flowchart of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be described in detail below with reference to the drawings and specific embodiments.

[0052] Theoretical explanation used in the present application:

[0053] 1. Bilinear mapping

[0054] G,G T is a cyclic group of order p, and g is a generator of G. If a mapping e: G x G→ G T satisfies the following three properties, then it is a bilinear mapping:

[0055] Bilinearity:

[0056] Non-degeneracy: e(h,f)≠1

[0057] Computability: e is efficiently computable.

[0058] 2. DBDH difficulty assumption

[0059] Given a tuple (g,g a ,g b ,g c )∈G 4 and an element Z∈G T as input, if an adversary A has |Pr[A(g,g a ,g b ,g c ,e(g,g)abc )=0]-Pr[A(g,g a ,g b ,g c If [,Z)=0]|≤ε(k), then the DBDH difficulty assumption holds on G.

[0060] like Figure 2 As shown, the specific execution flow of the encryption method provided by this invention is as follows:

[0061] Step A, System Parameter Generation:

[0062] Choose a group G of order p; choose a security parameter 1 of length k. k Choose a bilinear mapping e: G×G→G T Where → indicates output, G T Let U be a multiplicative cyclic group of order p prime numbers, and U be a set of attributes; let U be a group of integers modulo p that does not contain zero elements. Randomly select exponents α and a from G, and then randomly select element h from G. j,d′ , where j∈[1,n max And labels d'∈1,...,d. All attribute authority centers AA are blockchain nodes. Set the attribute authority center set Uθ={AA1,AA2,...,AA...} θ}, and each attribute authority will randomly select an integer μ. b Then calculate the MSK components. The number of attribute authority centers is b∈[1,θ].

[0063] System Public Parameters The master private key is MSK=(g α Define a d-order polynomial q(x) and set V(x) = g. q(x) Where g is a generator of group G, e denotes a bilinear mapping, and e(g,g) α Let e(g,g) be raised to the power of α, where e(g,g) represents the pairing operation of g and g. Let F be the hash function that maps attributes to G: U→G. Let t0 be the selected initial label that does not participate in the puncture. Let V(x) be the value calculated in the exponent field by Lagrange interpolation, where x is the interpolation point of the reconstructed polynomial value.

[0064] Step B, Strategy Hiding:

[0065] Attribute authority center calculation (1+μ) b ·p), and set policy encryption components B, B′ and B”, where

[0066] For each attribute attr in the access policy, in A hidden factor γ is randomly selected x and the strategy hidden coefficient is calculated Then each row in is mapped to a hidden strategy For the matrix in the access strategy after strategy hiding, ρ' is the mapping function in the access strategy after strategy hiding, where I is the value after the bilinear mapping of B;

[0067] Step C, encrypt the plaintext:

[0068] In , select the vector s and z ε are elements in , the number of rows is l, and the number of columns is n max matrix Then the ciphertext is obtained by calculating

[0069]

[0070] Where C0, C1, C 2,i,j , C 3,j are ciphertext components, is the element in the i-th row and j-th column, is the vector in the j-th column, is the element of the i-th row and the ρ(i)-th column raised to the power of-s, V(F(t d′ )) is the value obtained by calculating F(t d′ ), and F(t d′ ) is the value obtained by calculating the d'th label through the hash function.

[0071] Step D, generate the key:

[0072] Select r, r a , r ζ are elements in , and output the user private key and the puncture key

[0073] Where D, D 1,i , D 2,σ , D 3,σ are attribute private key components, KP 01 , KP 02 , KP 03 , KP 04 are puncture private key components, ​​r for the jth row, the σth element j .

[0074] Step E, Key puncturing:

[0075] Select λ' and By inputting the existing key {KP0, KP1,..., KP τ-1} after τ-1 times of puncturing, and calculating the latest puncturing key KP = KP 01 ', KP τ1 , KP 02 ', KP τ2 , KP 03 ', KP τ3 , KP 04 ', KP 04 , where KP 04 ' = t0, KP 04 = t, λ', r0, r are all elements selected in , KP 01 ', KP τ1 , KP 02 ', KP τ2 , KP 03 ', KP τ3 , KP 04 ', KP 04 are all puncturing keys obtained by calculation.

[0076] Step F, Verify access policy:

[0077] Then the data user calculates and compares it with I to verify whether the access policy is correct; I' is the value obtained by bilinear mapping on D σ , D 3,σ .

[0078] Step G, Decrypt ciphertext:

[0079] By inputting the ciphertext CT, the private key SK, the puncturing key KP and the label set (t1,..., t d ), the message is recovered. First, calculate and where T, A are values obtained by bilinear mapping calculation, and finally the message

[0080] The specific calculation is as follows:

[0081]

[0082] The following will illustrate the specific application of the above-mentioned encryption scheme in the Internet of Things.

[0083] Suppose the sender is an authorized organization, which intends to send a security message to all SM series engine control boards in a specific area. The receivers are various vehicles. Assume that receiver No. 1 is a jeep equipped with an SM1 type engine control board; receiver No. 2 is an SUV equipped with an SM2 type engine control board; and receiver No. N is a vehicle of unknown type, whose engine control board is of the SMX type. The key distribution center is only responsible for creating and distributing the initial key.

[0084] The sender includes a linear access structure (for example, corresponding to the SM series engine control board in this example) and a tag (such as a message identifier or a time identifier) in each message sent to a specific Internet of Things device. Since the first key is generated, the secret key of the Internet of Things device is the decryption key embedded in its attribute ω. The purpose of this system is to allow Internet of Things devices with attributes that meet the access structure to decrypt, and in addition, it allows the corresponding Internet of Things device to selectively revoke the decryption capability of messages with a specific tag. This is achieved by puncturing the key at time point t. The receiver updates its existing key to generate a new punctured key with tag t. In this way, even if the new key used for communication is leaked, the attacker cannot use it to decrypt other important information embedded with t. Moreover, generating a punctured key does not require communication with the key distribution center, nor does it require deleting components in the existing key to generate a new key.

[0085] As Figure 1 , an attribute-based encryption system based on policy hiding and puncturing includes a system parameter setting module, a policy hiding module, an encryption module, a private key generation module, a key puncturing module, a policy verification module, and a decryption module; wherein,

[0086] The system parameter setting module is used to set the system public parameter PK and the master private key MSK; wherein, PK is output to the policy hiding module, the encryption module, the private key generation module, and the key puncturing module, and MSK is output to the policy hiding module and the private key generation module;

[0087] The policy hiding module is used to encrypt the access policy according to PK and MSK, to obtain the encrypted access policy wherein, is an access matrix, and ρ is a function of mapping a row of to an attribute, is a matrix in the access policy after policy hiding, and ρ' is a mapping function in the access policy after policy hiding;

[0088] an encryption module configured to encrypt the message M to obtain ciphertext CT according to the PK and the label set t1,...,t d encrypt the message M to obtain ciphertext CT, wherein t d′ the d'th label embedded in the ciphertext, 1≤d'≤d, d is the maximum number of labels;

[0089] a private key generation module configured to generate a user private key SK and a puncture key KP0 according to the PK and the MSK and the attribute set ω;

[0090] a key puncture module configured to generate a punctured key KP according to the PK and the puncture key KP0;

[0091] a policy verification module configured to verify the encrypted access policy according to ω and SK ensure that the policy encryption part is not maliciously tampered with;

[0092] a decryption module configured to decrypt the ciphertext CT according to SK, KP, CT, t1,...,t d recover the message.

[0093] The embodiment of the present application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the processor implements the steps of the attribute-based policy hiding and puncturing encryption method as described above when executing the computer program.

[0094] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program, and the computer program implements the steps of the attribute-based policy hiding and puncturing encryption method as described above when executed by a processor.

[0095] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt a computer program product in the form of one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code. The solutions in the embodiments of the present application can be implemented in various computer languages, such as object-oriented programming language Java and interpreted scripting language JavaScript.

[0096] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0097] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0098] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0099] While the preferred embodiments of the application have been described, additional variations and modifications can be made to the embodiments by those of skill in the art once they have the benefit of the present disclosure without departing from the spirit and scope of the application. Accordingly, the attached claims are intended to cover all such additional variations and modifications as falling within the scope of the application.

[0100] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. An encryption method for attribute-based policy hiding and puncturing, characterized by, Comprising: Step A, setting system public parameter PK and master secret key MSK; Step B: Apply access policies based on PK and MSK Encryption is performed to obtain the encrypted access policy. in, Let ρ be the access matrix, and ρ be the value of the access matrix. A function that maps a line to a property. Let ρ' be the matrix in the access policy after policy hiding, and let ρ' be the mapping function in the access policy after policy hiding. Attribute authority center calculates (1 + μ b ; p), and sets policy encryption components B, B' and B", wherein B = g B′ ; wherein θ is the total number of attribute authority centers, μ b is an integer, and p is a prime number; Step C. Encrypting the message M to get ciphertext CT, where t d Encrypting the message M to get ciphertext CT, where t d′ d'th label embedded in the ciphertext, 1≤d'≤d, d is the maximum number of labels Step D, generating user secret key SK and puncture key KP0 according to PK and MSK and attribute set ω; Step E, generating punctured key KP according to PK and puncture key KP0; Step F, the encrypted access policy is verified by ω, SK Ensuring the policy encryption part Not maliciously tampered with; Step G, recover message according to SK, KP, CT, t1,..., t d recovery message; Step F comprises: Data user computing And compared with I, verify access policy is correct; Wherein, Both are in The element, I' is the value after the bilinear mapping of D σ ,D 3,σ , D σ Is the strategy hidden coefficient, e(*) is the bilinear pairing operation, F(*) is the hash value obtained by mapping the attribute to G, ρ(l') is the function of mapping the l'th row of D To attribute, wherein 1≤l'≤l, l is the number of rows of D , γ x Is the hidden factor, D 3,σ Is the attribute private key component, g is the generator of the group G, γ x Is the hidden factor, μ is the MSK component.

2. The attribute-based policy hiding and piercing encryption method according to claim 1, wherein, Step A comprises: Step A1, selecting a group G of order p; Step A2, select a security parameter 1 of length k k , select a bilinear mapping e:G×G→G T ; wherein, → represents output, G T is a multiplicative cyclic group of prime order p; Step A3, randomly select an exponent a in the zero-element-free modulo p integer group G , and then randomly select an element h in G j,d′ , where j ∈ [1, n max ] and d' ∈ 1,..., d, h j,d' is the element of the jth column and corresponds to the d'th label, n max is the maximum number of columns of the matrix , and all attribute authorities AA are blockchain nodes; Set the attribute authority set U θ = {AA1, AA2,..., AA b ,..., AA θ}, AA b is the bth attribute authority, and each attribute authority will randomly select an integer μ b , and then calculate the MSK component , where b ∈ [1, θ], and θ is the total number of attribute authorities; System Public Parameters The master private key is MSK=(g α Define a d-order polynomial q(x) and set V(x) = g. q(x) , where g is a generator of group G, and e(g,g) α Let e(g,g) be raised to the power of α, where e(g,g) represents the pairing operation of g and g. Let F be the hash function that maps attributes to G: U→G, where U is the set of attributes, t0 is the selected initial label that does not participate in the puncture, V(x) is the value calculated in the exponent field by Lagrange interpolation, and x is the interpolation point for reconstructing the polynomial value.

3. The attribute-based policy hiding and piercing encryption method of claim 2, wherein, Step B comprises: For each attribute attr in the access policy, a hidden factor γ is randomly selected in x and the policy hidden coefficient is calculated as Each row in the matrix is then mapped to a hidden policy by calculating where I is the value after bilinear mapping of B, F(*) is the hash value obtained by mapping the attribute to G, attr σ is the σth attribute, F(attr σ ) is the hash value obtained by mapping the σth attribute attr σ to G, and is the value after bilinear operation of B, i.e., the pairing operation of B.​​​ 4. The attribute-based policy hiding and piercing encryption method of claim 3, wherein, Step C comprises: In the middle of the vector s and z ε are elements in 2≤ε≤n max , the number of rows is l, and the number of columns is n max matrix Then the ciphertext is obtained by calculation where s is a shared value, C0, C1, C 2,i,j , C 3,d are ciphertext components, is an element of the i-th row, j-th column, is a vector of the j-th column, is an element of the i-th row, p(l') -th column, s-th power, V(F(t d′ )) is a value obtained by calculating F(t d′ ), F(t d′ ) is a value obtained by calculating the d'-th label by a hash function F.

5. The attribute-based policy hiding and piercing encryption method of claim 4, wherein, Step D comprises: Selecting r, r a , r ξ are elements in , 1≤ξ≤n max , output the user private key and the puncture key, for where D, D 1,i , D 2,σ , D 3,σ are attribute private key components, KP 01 , KP 02 , KP 03 , KP 04 are puncture private key components, is the r ξ th power of the jth column, the σth element, F(*) is a hash value calculated by a hash function F, r i is a randomization factor of the i-th row share, and V(F(t0)) is a value obtained by calculating F(t0).

6. The attribute-based policy hiding and piercing encryption method of claim 5, wherein, Step E comprises: Choose λ′ and By inputting the existing key {KP0,KP1,...,KP} after τ-1 punctures... τ′ ,...,KP τ-1 }; where KP τ′ Let KP be the key obtained after the τ′th puncture, 0≤τ′≤τ-1; and calculate the latest puncture key KP=(KP 01 ′,KP τ1 KP 02 ',KP τ2 KP 03 ',KP τ3 KP 04 ',KP 04 ),in KP 04 ′=t0,KP 04 =t, λ′, r0, r1 are all in The selected elements, KP 01 ′,KP 02 ′,KP 03 ′, all are key components after puncture, KP τ1 KP τ2 KP τ3 KP is the key component obtained after computation. 04 ' is a tag indicating that no garment insertion is performed, KP 04 Let t be a single target label used to identify the object to which the key is pierced, and V(F(t)) be the value obtained by calculating F(t).

7. The attribute-based policy hiding and piercing encryption method of claim 6, wherein, Step G comprises: The message is recovered by inputting the ciphertext CT, the private key SK, the punctured key KP and the set of labels (t1,...,t d ) ; first, the following is calculated and where T, A are values calculated by bilinear mapping, Γ is a set of row indexes and Γ = { i | ρ ( i ) ∈ ω}, and finally the message is recovered The multiple exponential weights ω d′ are multiplied, ω d′ is a set of weights used to reconstruct the shared value, ω* is the decryption weight set for recovering the message in the decryption process, is the v i power of the ciphertext component, ρ ( i ) is a function mapping the i-th row of to the attribute, and τ is the number of times of key puncturing.

8. An encryption system based on the encryption method of attribute-based policy hiding and piercing of claim 1, characterized by, Comprise system parameter setting module, strategy hiding module, encryption module, secret key generation module, key puncture module, strategy verification module and decryption module; wherein, The system parameter setting module is used for setting the system public parameter PK and the master secret key MSK; wherein, the PK is output to the strategy hiding module, the encryption module, the secret key generation module, the key puncture module, and the MSK is output to the strategy hiding module and the secret key generation module; The policy hiding module is used to set access policies based on PK and MSK. Encryption is performed to obtain the encrypted access policy. in, Let ρ be the access matrix, and ρ be the value of the access matrix. A function that maps a line to a property. Let ρ' be the matrix in the access policy after policy hiding, and let ρ' be the mapping function in the access policy after policy hiding. an encryption module for encrypting the message M according to the PK and the set of tags t1,...,t d encrypting the message M to obtain a ciphertext CT, wherein t d′ is the d'th tag embedded in the ciphertext, 1≤d'≤d, d being the maximum number of tags; The secret key generation module is used for generating the user secret key SK and the puncture key KP0 according to the PK and the MSK and the attribute set ω; The key puncture module is used for generating the punctured key KP according to the PK and the puncture key KP0; A policy verification module is configured to verify the encrypted access policy according to ω and SK Ensure that the policy encryption part is not maliciously tampered with; a decryption module for decrypting the encrypted message CT according to SK, KP, CT, t1,..., t d the recovery message.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that, The processor executes the computer program to realize the steps of the attribute-based strategy hiding and puncture encryption method according to any one of claims 1 to 7.

Images