Method and system for policy-based access control based on distributed cuckoo filter

Abstract

The application discloses a policy hidden access control method and system based on a distributed cuckoo filter, and specifically comprises the following steps: based on system parameters, making each attribute authority generate a respective public-private key pair, and making the public key of the public-private key pair public to all entities; based on the system parameters, the public-private key pair and a user attribute set, generating a corresponding user key component; making a data owner generate a policy fingerprint and an attribute fingerprint according to an access policy, and encrypting a plaintext by using the system parameters, the public-private key pair and the access policy to obtain a ciphertext containing the policy fingerprint; reconstructing the access policy by using a policy row set, and decrypting and verifying the ciphertext in combination with the user key component. The application designs a distributed cuckoo filter to realize a completely hidden policy, and converts the access policy and attributes into fingerprint information tables stored in the DCF, thereby hiding the mapping between the policy and the attributes.

Description

Technical Field

[0001] This invention relates to the field of data privacy protection technology, and in particular to a policy-hidden access control method and system based on a distributed Cuckoo filter. Background Technology

[0002] The widespread adoption of the Internet of Things (IoT) and smart wearable devices has further propelled e-health systems, enabling patients to manage their health data in real time and providing reliable and comprehensive analysis for medical data. However, this has also highlighted the growing importance of protecting electronic health data and safeguarding patient privacy. Outsourcing sensitive health data to a semi-trusted cloud environment, while offering convenience, introduces significant security and privacy challenges.

[0003] To address the aforementioned challenges, Attribute-Based Encryption (ABE), with its inherent fine-grained access control and policy flexibility, has become a key technological breakthrough for building next-generation secure e-health cloud systems.

[0004] Unlike traditional encryption that relies on user identity, ABE abstracts user permissions into a set of attributes (such as "department = finance department" or "job title = manager"), using cryptographic mechanisms to ensure that only users who meet specific attribute conditions can decrypt data. Depending on the policy embedding location, ABE can be divided into two categories:

[0005] Key Policy ABE (KP-ABE): Access policies are bound to user private keys, and ciphertext is associated with a set of attributes. For example, a user's private key might contain the policy "(Department = R&D OR Job Level = Executive) AND Project = Confidential," while the ciphertext is labeled with the attribute set {Department = R&D, Project = Confidential}. If the user attributes satisfy the private key policy, the data can be decrypted.

[0006] Ciphertext Policy ABE (CP-ABE): The access policy is directly embedded in the ciphertext, and the user's private key is associated with a set of attributes. For example, if the ciphertext policy is "(Department=Finance AND Job Level=Manager) OR Audit=Authorized", the user needs to hold a private key containing either {Department=Finance, Job Level=Manager} or {Audit=Authorized} to decrypt it.

[0007] Compared to KP-ABE, CP-ABE is better suited to the needs of cloud computing scenarios: data owners can directly define encrypted access policies (e.g., "Hospital Department = Cardiovascular Department AND Role = Attending Physician") without needing to know the user attribute structure in advance, thus supporting dynamic and decentralized access control. This feature makes it an ideal choice for scenarios such as medical data sharing and IoT device collaboration. In CP-ABE, a user's private key, issued by a central authority (CA), is associated with a specific attribute, and the encrypted data is associated with the access policy. Data is encrypted using the access policy, and users can only decrypt it if their attributes satisfy the policy.

[0008] However, in traditional CP-ABE schemes, the access structure is often appended to the ciphertext in plaintext form. This allows anyone with access to the ciphertext to infer sensitive user information from the explicit access structure. A typical example is a hospital's Electronic Medical Records (EMR) system for storing patients. Figure 1 In this scenario, patient Alice has access to the EMR (Electronic Medical Records), while Bob, although a doctor, has a department that doesn't match the access policy. Clearly, other users in the system can still access the access policy and infer that Alice may have a psychiatric or surgical condition. The leakage of sensitive information would cause serious distress to users like Alice, highlighting the importance of hiding the access structure in CP-ABE (Content-Based Access Management). Furthermore, malicious users might leak decryption keys to third parties within the electronic medical record system. Because decryption keys are associated with attributes, it's impossible to identify the user who leaked the decryption key. Figure 1 As shown, both Alice and Anna can access medical records through the access policy, but when the key is leaked, it is impossible to determine who leaked it. Summary of the Invention

[0009] The purpose of this invention is to provide a policy-hidden access control method and system based on a distributed cuckoo filter. A distributed cuckoo filter is designed to achieve a completely hidden policy. By transforming the access policy and its attributes into a fingerprint information table stored in the DCF, the mapping between the hidden policy and the attributes is hidden, thereby solving at least one of the aforementioned problems of the prior art.

[0010] In a first aspect, the present invention provides a policy-hidden access control method based on a distributed Cuckoo filter, the method specifically comprising:

[0011] The system is initialized by a centrally authorized agency using a complete set of security parameters and attributes to generate system parameters, which include public parameters and a master key.

[0012] Based on system parameters, each attribute authorization authority generates its own public-private key pair and discloses the public key of the public-private key pair to all entities;

[0013] Based on system parameters, public and private key pairs, and user attribute sets, the central authorization agency and attribute authorization agencies collaborate to generate corresponding user key components.

[0014] The data owner generates a policy fingerprint and an attribute fingerprint based on the access policy. The policy fingerprint, attribute fingerprint, and corresponding policy line information are stored in the DCF table of the distributed Cuckoo Filter through the corresponding attribute authorization authority to hide the policy. The plaintext is encrypted using system parameters, public and private key pairs, and access policies to obtain ciphertext containing the policy fingerprint.

[0015] Data users can query the DCF table through the attribute authorization authority, match the fingerprint in the DCF table with the attribute fingerprint of the data user to obtain the policy row set, reconstruct the access policy using the policy row set, and decrypt and verify the ciphertext in combination with the user key component.

[0016] The integrity of the key structure is verified by the collaborative inspection of group elements and pairing equations by the central authorization agency and attribute authorization agencies, and the identities of malicious users are traced and identified.

[0017] Secondly, this invention provides a policy-hidden access control system based on a distributed Cuckoo Filter, the system specifically comprising:

[0018] An initialization module is used to initialize the system based on the central authorized agency using a complete set of security parameters and attributes, and to generate system parameters, including public parameters and a master key.

[0019] The key pair generation module is used to enable each attribute authorization authority to generate its own public and private key pair based on system parameters, and to make the public key of the public and private key pair public to all entities;

[0020] The user key module is used to enable the central authorization agency and the attribute authorization agency to collaborate in generating the corresponding user key component based on system parameters, public and private key pairs and user attribute sets.

[0021] The plaintext encryption module is used to enable the data owner to generate policy fingerprints and attribute fingerprints according to the access policy. The policy fingerprints, attribute fingerprints and corresponding policy line information are stored in the DCF table of the distributed Cuckoo Filter through the corresponding attribute authorization authority to hide the policy. The plaintext is encrypted using system parameters, public and private key pairs and access policies to obtain ciphertext containing the policy fingerprint.

[0022] The decryption and verification module enables data users to query the DCF table through the attribute authorization authority, match the fingerprint in the DCF table according to the data user's attribute fingerprint, obtain the policy row set, reconstruct the access policy using the policy row set, and decrypt and verify the ciphertext in conjunction with the user key component.

[0023] The structure verification module is used to verify the integrity of the key structure by checking the group elements and pairing equations in collaboration between the central authorization authority and the attribute authorization authority, and to trace and identify the identity of malicious users.

[0024] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, and a computer program stored in the memory, wherein when the computer program is executed on the processor, it implements the policy-hidden access control method based on a distributed Cuckoo filter as described in any of the above methods.

[0025] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the policy-hidden access control method based on a distributed Cuckoo filter as described in any of the above methods.

[0026] Compared with the prior art, the present invention has at least one of the following technical effects:

[0027] 1. This invention designs a distributed Cuckoo Filter to achieve a completely hidden strategy. By transforming the access strategy and its attributes into a fingerprint information table stored in the DCF, the mapping between the hiding strategy and the attributes is realized.

[0028] 2. This invention designs a multi-authorization system for parameter definition and key management. Multiple authorization agencies operate independently, each maintaining its own distributed Cuckoo Filter table, thus solving the performance bottleneck and single point of failure problem of single authorization.

[0029] 3. This invention employs white-box tracking, embedding the user's unique identity information into a well-formatted decryption key, which is used to effectively track users after they have performed malicious attacks or unauthorized decryption operations.

[0030] 4. This invention implements policy-hidden access control based on a distributed Cuckoo filter, which ensures the secure sharing of medical data while hiding access policies, preventing the leakage of sensitive information, and can trace the identity of malicious users.

[0031] 5. This invention initializes system parameters based on a complete set of security parameters and attributes, providing basic cryptographic components and key parameters for the entire system and ensuring its secure operation.

[0032] 6. This invention ensures the secure identity and normal communication of each attribute authorization authority by generating its own public-private key pair and publishing the public key.

[0033] 7. This invention enables multiple agencies to collaboratively manage user keys by generating user key components through collaboration between a central authorization agency and attribute authorization agencies, thereby enhancing the security and flexibility of key generation.

[0034] 8. This invention enables data owners to generate policy fingerprints and attribute fingerprints based on access policies, providing unique identifiers and indexes for subsequent policy hiding and encryption operations.

[0035] 9. This invention stores the policy fingerprint, attribute fingerprint, and policy row information in a distributed Cuckoo filter and encrypts the plaintext to achieve policy hiding and ciphertext generation, thus ensuring data security.

[0036] 10. This invention enables data users to obtain a set of policy rows by querying the DCF table and matching the fingerprints in the DCF table with the data user's attribute fingerprints, thus providing necessary information for reconstructing access policies and decryption verification.

[0037] 11. This invention utilizes a policy row set to reconstruct the access policy and combines it with a user key component for decryption verification, ensuring that only users who meet the conditions can correctly decrypt the data, thus guaranteeing data access security.

[0038] 12. This invention enhances system security and the ability to prevent malicious behavior by having a central authorization agency and attribute authorization agencies collaborate to check the integrity of the key structure and trace the identity of malicious users. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a diagram of an electronic health record system under conventional ABE provided in an embodiment of the present invention;

[0041] Figure 2 This is a system model diagram of a policy hiding access control method based on a distributed Cuckoo Filter provided in an embodiment of the present invention;

[0042] Figure 3 This is a flowchart illustrating a policy-hidden access control method based on a distributed Cuckoo filter, according to an embodiment of the present invention.

[0043] Figure 4 This is a schematic diagram of a policy-hidden access control system based on a distributed Cuckoo Filter according to an embodiment of the present invention;

[0044] Figure 5 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0045] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0046] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0047] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0048] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0049] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0050] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0051] like Figure 2 As shown, Figure 2The system model diagram of this invention illustrates that the Central Authorization Authority (CA) protects the system by setting parameters and distributing keys to other entities. Furthermore, it coordinates the distributed management of multiple Attribute Authorities (AAs) through mapping rules F(x). Data Owners (DOs) are responsible for generating ciphertext CTs by executing encryption algorithms based on access policies, while simultaneously hiding the mapping relationship between attributes and policies through a Distributed Cuckoo Filter (DCF) mechanism. Specifically, this includes calculating global policy fingerprints and attribute fingerprints, and coordinating attribute authorities to construct a DCF index structure. Data Users (DUs), as data consumers, must first match user attributes in the access policy attribute set using DCF queries. After verifying access permissions, they execute decryption algorithms to recover the plaintext; if the attributes do not meet the policy, the process terminates. Attribute Authorities (AAs) are responsible for generating and publishing AA key pairs during system initialization; collaborating with the CA during key generation to generate user private keys based on user attribute sets; and receiving DCF parameters from DOs and constructing a local Cuckoo Filter table during encryption to support subsequent attribute matching queries. Cloud Servers (CSs) store the ciphertext CTs uploaded by DOs and provide ciphertext access and DCF query services to DUs.

[0052] In this application embodiment, the entity executing the process includes a terminal device. This terminal device includes, but is not limited to, devices capable of executing the methods disclosed in this application, such as servers, computers, smartphones, and tablets. Figure 3 A flowchart illustrating a policy-hiding access control method based on a distributed Cuckoo filter, according to an embodiment of the present invention, is shown below in detail:

[0053] S301, The system is initialized based on the central authorized agency using the complete set of security parameters and attributes, and system parameters are generated, including public parameters and master key;

[0054] S302, based on system parameters, enables each attribute authorization authority to generate its own public-private key pair and discloses the public key of the public-private key pair to all entities;

[0055] S303 enables the central authorization authority and the attribute authorization authority to collaborate in generating the corresponding user key component based on system parameters, public and private key pairs and user attribute sets.

[0056] S304 enables the data owner to generate a policy fingerprint and attribute fingerprint based on the access policy. The policy fingerprint, attribute fingerprint, and corresponding policy line information are stored in the DCF table of the distributed Cuckoo Filter through the corresponding attribute authorization authority to hide the policy. The plaintext is encrypted using system parameters, public and private key pairs, and access policy to obtain ciphertext containing the policy fingerprint.

[0057] S305 enables data users to query the DCF table through the attribute authorization authority, match the fingerprint in the DCF table with the attribute fingerprint of the data user to obtain the policy row set, reconstruct the access policy using the policy row set, and decrypt and verify the ciphertext in combination with the user key component.

[0058] S306, based on the collaboration between the central authorization agency and the attribute authorization agency, checks group elements and pairing equations to verify the integrity of the key structure, traces and identifies the identity of malicious users.

[0059] In this embodiment, the invention comprises six entities: data owner, data user, central authorizing authority, attribute authorizing authority, and cloud server. This invention is applicable to attribute-based encryption models in a cloud computing environment, where the central authorizing authority is trusted, and specifically includes the following steps:

[0060] Initialization Phase: The Central Authorized Authority (CA) utilizes security parameters The system initializes with the complete set of attributes U, generating public parameters (PP) and master secret key (MSK).

[0061] Attribute Authorization (AA) initialization phase: Each Attribute Authorization (AA) generates its own private key. Secret Key and Public Key (Public Key), and make the authorized organization's public key public to all entities;

[0062] Key generation phase: The Central Authorization Authority (CA) and Attribute Authorization As (AAs, the plural form) collaborate to generate the user's private key. The CA first calculates the user key component. Then, a secret parameter t is generated and sent to AAS, and each A then generates a corresponding user key component for the user. ;

[0063] Encryption Phase: In the encryption phase, the Data Owner (DO) first generates two fingerprints associated with the policy and attributes, and simultaneously constructs the location parameters of the Distributed Cuckoo Filter (DCF) table to establish the DCF table. Next, the access policy, public parameter PP, and attribute public key are combined. Generate encryption components, and finally generate ciphertext (CT) containing policy fingerprint and encryption components;

[0064] Decryption Phase: Data User (DU) uses attribute fingerprints and dual indexes to query the DCF table to obtain the policy row set. Using this set, DU reconstructs the access strategy, verifies the attribute satisfaction conditions, and finally performs a bilinear pairing operation to recover the plaintext. If the conditions are not met, it returns failure.

[0065] Traceability Phase: The Central Authorization Authority (CA) collaborates with the Attribute Authorization Authority (AA) to verify the integrity of the key structure by checking group elements and pairing equations. If the key is valid, the user identifier (uid) is output; if the key is invalid or cannot be traced, ⊥ is output.

[0066] In some embodiments, step S301 above, which involves initializing the system based on the central authorization agency using a complete set of security parameters and attributes to generate system parameters, specifically includes:

[0067] Based on the input security parameters, construct the basic cryptographic components containing bilinear mappings and generators;

[0068] Multiple hash functions are set up for attribute fingerprint generation, policy fingerprint generation, distributed cuckoo filter index calculation, and mapping of user identity to group elements, respectively.

[0069] Randomly select group elements based on the complete set of input attributes, select secret parameters from the defined algebraic structure, and establish mapping rules to determine the attribution relationship between attributes and attribute authorization agencies.

[0070] Based on the centrally authorized agency, a public parameter is generated that can be used by the entire system by integrating basic cryptographic components, hash functions, group elements and secret parameters, and the core part of the secret parameter is stored as the master key.

[0071] In this embodiment, the initialization phase includes the following steps:

[0072] a) The centrally authorized agency (CA) uses security parameters Generate a bilinear mapping ,in and Two prime numbers of order 1 Multiplication cyclic group, It is a bilinear pair mapping. yes Generators;

[0073] b) CA defines a collision-resistant and one-way hash function. , , and . Mapping the attribute at to a binary fingerprint Its fingerprints are of fixed length . The access policy matrix M is serialized and hashed to generate a policy fingerprint. The index position used to calculate the binding relationship between the hash fingerprint and the row number of the access matrix in the Distributed Cuckoo Filter (DCF) table. Map the user's identity to an element in G. {0,1} represents the set of binary numbers containing elements 0 and 1. This is a safety parameter representing the fixed length of the binary string;

[0074] c) Let U be the set of system attributes, and |U| represent the size of the system attribute set U. Randomly select group elements. , A mapping rule F(x)->Aid is defined to correspond to a predefined attribute and the authority that manages that attribute, where Aid is the identifier of the authority, and F(x) represents the mapping function used to map attribute x to the identifier Aid of the authority that manages that attribute; Denotes the multiplication group modulo p; Multiplication group The elements in the key are used as secret parameters for cryptographic operations such as key generation;

[0075] d) Obtain the system's common parameters and the system's master private key e represents a bilinear mapping; These are common parameters based on bilinear mappings, used for subsequent cryptographic operations; For generators of The power of F; refers to the mapping rule used to determine the correspondence between attributes and authoritative institutions.

[0076] In some embodiments, step S302 above, which involves enabling each attribute authorization authority to generate its own public-private key pair based on system parameters and disclosing the public key of the public-private key pair to all entities, specifically includes:

[0077] Each attribute-authorizing authority independently selects multiple sets of random secret parameters from its respective algebraic domain as its own private key;

[0078] Using its own private key, the exponential operation based on the generators in the public parameters is used to derive multiple group element components that constitute the public key of each attribute authorization authority.

[0079] The derived group element components are combined to form a complete public key, which is then made public to all entities.

[0080] In this embodiment, the attribute authorization authority initialization phase includes the following steps:

[0081] a) Each attribute authorization agency is randomly selected by AA. and will Set as AA's private key Keep it confidential; , , These are elements randomly selected by each attribute-authorizing organization AA, belonging to the multiplicative group. ;

[0082] b) AA uses the private key To generate a public key And then, the public key is made public to other entities. , , It utilizes the private key parameters of the Attribute Authorization Authority (AA). , , with generator The group elements obtained by performing exponentiation.

[0083] In some embodiments, step S303 above, which involves enabling the central authorization agency and the attribute authorization agency to collaborate in generating the corresponding user key component based on system parameters, public-private key pairs, and user attribute sets, specifically includes:

[0084] Based on the centrally authorized agency, an intermediate parameter is randomly selected according to the public parameters and combined with the master key to calculate the first user key component;

[0085] The intermediate parameters are sent as collaboration parameters to the attribute authorization agency associated with the user attributes.

[0086] Each associated attribute authorization agency calculates and generates multiple second user key components bound to the user attribute based on the collaboration parameters, public parameters, corresponding user attributes, and their own private keys.

[0087] The first user key component generated by the central authorizing authority and the second user key components generated by all associated attribute authorizing authorities together constitute the corresponding target user key component.

[0088] In this embodiment, the key generation stage includes the following steps:

[0089] a) The centrally authorized agency (CA) uses PP as input and then randomly selects... Calculate the CA key The secret parameter t is sent to the attribute authorization agency AA to generate the AA end key; K is the key. A key element, Represents generator of Power of 1 Represents generator of and Product raised to a power Represents generator of Power of 1.

[0090] b) For each attribute Based on Aid=F(x), the relevant authoritative institution to which attribute x belongs can be found; Indicates a specific user A collection of related attributes.

[0091] c) Attribute authority AA randomly selects values And calculate the AA end key. ; , , , , All are keys Key elements in; It is a group element associated with attribute x; It is to use users Mapping to group elements Hash function; This indicates that the private key parameter of the attribute authority AA will be used. As the result of exponentiation of y; This indicates that the private key parameter of the attribute authority AA will be used. , and user identifier As the result of exponentiation of y; Indicates that the generator will be generated The result of raising the power of t.

[0092] d) Finally, the user's private key can be obtained. .

[0093] In some embodiments, step S304 above, which involves enabling the data owner to generate a policy fingerprint and an attribute fingerprint based on the access policy, specifically includes:

[0094] This enables data owners to obtain public parameters, access policy structures, and public keys of authorization authorities for each attribute. The access policy structure includes an access matrix and its mapping relationship with attributes.

[0095] The access policy structure is taken as input, and a unique global policy fingerprint is generated through hash calculation.

[0096] For each attribute involved in the access strategy structure, a corresponding attribute fingerprint is generated through hash calculation;

[0097] Based on each attribute fingerprint, the first and second index positions of its corresponding information in the DCF table of the distributed Cuckoo Filter are determined by the index calculation function.

[0098] In some embodiments, in step S304 above, storing the policy fingerprint, attribute fingerprint, and corresponding policy row information in the DCF table of the distributed Cuckoo filter via the corresponding attribute authorization authority to hide the policy, and encrypting the plaintext using system parameters, public-private key pairs, and access policies to obtain ciphertext containing the policy fingerprint, specifically includes:

[0099] Based on policy fingerprints and attribute fingerprints, the attribute licensing authority to which each attribute belongs is determined, and DCF construction parameters containing the attribute fingerprint and its index position are generated and sent to the corresponding attribute licensing authority.

[0100] Each attribute authorization agency, based on the received DCF construction parameters, searches for the stored entry in the DCF table of its maintained distributed Cuckoo Filter according to the first index position and the second index position, and inserts the policy fingerprint, the corresponding attribute fingerprint, and policy row information into the appropriate entry to complete the filling of the DCF table.

[0101] By utilizing public parameters, the public keys of the authorizing agencies for each attribute, and access policies, an initial ciphertext containing multiple components is generated by selecting a random vector and a secret share.

[0102] The initial ciphertext is combined with the policy fingerprint to form the target ciphertext.

[0103] In this embodiment, the encryption phase includes the following steps:

[0104] a) The data owner (DO) will use the PP and access structure. and the public key of the attribute authorization authority AA As output, M is associated with the access policy. The access matrix, and n represent the number of rows and columns of the matrix being visited, respectively. This represents the vector corresponding to the i-th row of the access matrix. This represents the attribute corresponding to the i-th row of the access matrix. And a function was set. This function represents the correspondence between access policy rows and attribute authorities. It allows you to determine the relationship based on row i of the access matrix or the corresponding attribute. Find the attribute authority that manages the access policy row corresponding to that attribute;

[0105] b) DO calculates the global policy fingerprint Furthermore, attribute fingerprints are generated for all attributes in the access policy. index position and ,in, This indicates that the operation is performed on all rows (or attributes) in the access policy; and In the attributes respectively At the first and second index positions of the Distributed Cuckoo Filter (DCF) table; This represents a hash function used to map an input access matrix M to a fixed-length output value; Indicates the attributes used for input. The mapping function at the first index position of the Distributed Cuckoo Filter (DCF) table. Indicates that it is used in Based on this, through attribute fingerprints Or, perform an XOR operation to obtain a determinable attribute. The mapping function at the second index position of the Distributed Cuckoo Filter (DCF) table;

[0106] c) According to Find the corresponding AA and generate the parameters (DP, DCF Parameter) of the DCF table. And upload it to AA;

[0107] d) Each attribute authorization body generates a DCF table. Based on the received... and The two index positions are used to search for buckets in the hierarchical Cuckoo Filter DCF table. If an empty entry exists in either bucket, the policy fingerprint is applied. Attribute fingerprint And insert the empty entry into the bucket at row=i of the strategy matrix corresponding to this attribute. If there is no empty entry, it means that the DCF table has reached its limit and should be expanded or a new DCF table should be created;

[0108] e) DO is randomly selected and Two vectors, and calculate the secret share vector of the shared cryptographic exponent s. and 0 share vector , The zero-share vector here implements a dual security mechanism to enhance user privacy protection. Furthermore, DO is randomly selected for each row of the access policy matrix. And calculate the ciphertext component , , , , , ;in, and These are two n-dimensional vectors randomly selected by the data owner DO, belonging to a multiplicative group modulo p. ; C represents the vector corresponding to the i-th row of the access matrix M; , , , , All are ciphertext components; m represents the plaintext message to be encrypted; Indicates from the multiplication group Randomly selected parameters; Representing attributes Related group elements are used to introduce attribute information into the ciphertext component to achieve attribute-based encryption; This represents a bilinear mapping and exponentiation, and assigns the system master private key parameter to the bilinear mapping and exponentiation operation. The shared encryption index s is combined into the ciphertext component C; This indicates that the system master private key parameter will be passed. and the secret share of the shared cryptographic index s As an index and generator The result of exponentiation; This indicates that the zero-share vector Parameters related to attribute authorities and random parameters Combining as an index and generator The result of exponentiation; This indicates parameters related to the attribute authority. and random parameters Combining as an index and generator The result of exponentiation; This indicates that the shared cryptographic index s and generator will be used. The result of exponentiation;

[0109] f) Finally, the ciphertext can be obtained. .

[0110] In some embodiments, step S305 above, which involves enabling the data user to query the DCF table through the attribute authorization authority, and matching the fingerprints in the DCF table with the data user's attribute fingerprints to obtain a policy row set, specifically includes:

[0111] For each user attribute of a data user, the attribute authorization agency that manages that user attribute is determined based on the mapping relationship between the user attribute and the attribute authorization agency;

[0112] Based on the user attributes, calculate the corresponding attribute fingerprint and the third and fourth index positions in the DCF table;

[0113] Based on the third and fourth index positions, query the entries in the corresponding bucket in the DCF table it maintains;

[0114] If an entry containing a policy fingerprint that matches the policy fingerprint in the ciphertext is found in any bucket, and the user attribute fingerprint satisfies the policy attribute fingerprint in the DCF table, then the policy row information recorded in that entry is added to the policy row set of the data user.

[0115] In some embodiments, step S305 above, which involves reconstructing the access policy using the policy row set and decrypting and verifying the ciphertext using the user key component, specifically includes:

[0116] Based on the set of policy rows, extract the corresponding row vectors from the complete access policy matrix to form the reconstructed effective attribute matrix and its new mapping relationship;

[0117] Based on the effective attribute matrix and its new mapping relationship, the set of attribute indexes that meet the conditions is determined, and a set of secret recovery coefficients is calculated using the secret sharing recovery algorithm;

[0118] Using the secret recovery coefficient, the user's key component of the data user, and the ciphertext, perform a bilinear pairing operation to obtain the intermediate pairing operation result;

[0119] The plaintext message is recovered by performing operations on the intermediate pairing result and the ciphertext.

[0120] If a valid secret recovery coefficient cannot be calculated or the pairing operation fails, the decryption is deemed to have failed.

[0121] In this embodiment, the decryption stage includes the following steps:

[0122] a) For each attribute of the user Based on Aid=F(x), the relevant authoritative organization AA to which attribute x belongs is found. AA is then used to determine the relevant authority based on the attribute. Calculate attribute fingerprint index position and ;in, Indicates user The i-th attribute it possesses; Representing attributes Attribute fingerprint; Indicates the property used to A hash function that maps to a fixed-length output value; and Representing attributes The index position; Indicates the property used to determine the attribute The mapping function for the first index position in the Distributed Cuckoo Filter (DCF) table; Indicates the position used at index. Based on this, through attribute fingerprints XORing the hash value yields a determinable attribute. The mapping function at the second index position of the Distributed Cuckoo Filter (DCF) table;

[0123] b) AA uses DCF to query the buckets corresponding to the two position indexes in the table. If an entry exists in the bucket... And the global policy fingerprint in the ciphertext and in that entry If they are the same, it means that the user attribute exists in the attribute set of the access policy. Finally, add the row position of the policy matrix in that entry to the row set. ;

[0124] c) DU obtains the row set Then, it was proposed The row number is obtained, and the corresponding row vector in the access strategy matrix M is used to form the user's effective attribute matrix. and new mapping relationships ,in express The j-th row;

[0125] d) DU settings I is an index set containing the values ​​that satisfy... The corresponding attribute belongs to the user attribute set. The index j is given, and the value of j is in the range {1,2,...,l}. The constant is calculated using the Lagrange interpolation formula. Make , The constant obtained by the Lagrange interpolation formula belongs to the multiplication group modulo p. Afterwards, DU can calculate the result.

[0126] ;

[0127] and the initial plaintext If the constant cannot be found , then represents the set of user attributes. If the access structure is not satisfied, output ⊥, indicating that decryption failed.

[0128] Where B represents an intermediate value obtained through calculation, used in the decryption process; This indicates performing a chain multiplication operation on all elements in the set corresponding to index j in the index set I; K, , , , , All are key components, C, , , , , All are encrypted components.

[0129] In some embodiments, step S306 above, which involves verifying the integrity of the key structure and tracing and identifying malicious users by collaboratively checking group elements and pairing equations based on the collaboration between the central authorization agency and the attribute authorization agency, specifically includes:

[0130] Obtain the decryption key for the user to be verified;

[0131] Based on the collaboration between the central authorized agency and the attribute authorized agency, the system checks whether the components of the user's decryption key conform to the predefined specified key structure;

[0132] If the structure does not match, the traceability process will be terminated.

[0133] If the key structure is correct, integrity verification is performed on the attribute-related components in the user's decryption key. The validity of the key is determined by performing a pre-defined bilinear pairing operation and checking whether the equation of the operation result is true.

[0134] If an attribute exists that makes all the pre-defined pairing operation verification conditions true at the same time, the user's decryption key is determined to be valid, and the user's bound identity identifier is output. If any verification condition is not true, the key is determined to be invalid or untraceable.

[0135] In this embodiment, the traceability phase includes the following steps:

[0136] a) Key structure check to verify the user's decryption key. Does it have the following specified structure: If the structure does not match, the algorithm terminates and outputs ⊥; K, , , , , All of these constitute the user's decryption key. The key component;

[0137] b) Key Integrity Verification: If the structure check passes, a key integrity verification check is performed. The function Aid=F(x) can be used to locate the relevant authority to which attribute x belongs. The algorithm checks whether the key simultaneously satisfies the following three conditions:

[0138] ;

[0139] ;

[0140] ;

[0141] If attributes exist If all conditions (1), (2), and (3) above are met, the key passes integrity verification, and the algorithm outputs the user's identity identifier (uid); otherwise, it outputs ⊥. This represents the group of elements related to attribute x, and S indicates that it contains all of them. The complete set of attributes.

[0142] Reference Figure 4 An embodiment of the present invention provides a policy-hidden access control system 4 based on a distributed Cuckoo Filter, wherein the system 4 specifically includes:

[0143] Initialization module 401 is used to initialize the system based on the central authorized agency using a complete set of security parameters and attributes, and generate system parameters, which include public parameters and master key;

[0144] The key pair generation module 402 is used to enable each attribute authorization authority to generate its own public and private key pair based on system parameters, and to make the public key of the public and private key pair public to all entities;

[0145] User key module 403 is used to enable the central authorization agency and the attribute authorization agency to collaborate in generating the corresponding user key component based on system parameters, public and private key pairs and user attribute sets.

[0146] Plaintext encryption module 404 is used to enable the data owner to generate policy fingerprint and attribute fingerprint according to the access policy, store the policy fingerprint, attribute fingerprint and corresponding policy line information in the DCF table of the distributed Cuckoo filter through the corresponding attribute authorization authority to hide the policy, and encrypt the plaintext using system parameters, public and private key pairs and access policy to obtain ciphertext containing policy fingerprint.

[0147] The decryption and verification module 405 is used to enable data users to query the DCF table through the attribute authorization authority, match the fingerprint in the DCF table according to the attribute fingerprint of the data user, obtain the policy row set, reconstruct the access policy using the policy row set, and decrypt and verify the ciphertext in combination with the user key component.

[0148] The structure verification module 406 is used to verify the integrity of the key structure by checking the group elements and pairing equations in collaboration between the central authorization agency and the attribute authorization agency, and to trace and identify the identity of malicious users.

[0149] It is understandable that, such as Figure 3 The content of the policy hiding access control method embodiment based on distributed Cuckoo Filter shown is applicable to the policy hiding access control system embodiment based on distributed Cuckoo Filter. The specific functions implemented by the policy hiding access control system embodiment based on distributed Cuckoo Filter are as follows: Figure 3 The illustrated example of the policy-hidden access control method based on a distributed cuckoo filter is the same, and the beneficial effects achieved are the same as those shown. Figure 3 The beneficial effects achieved by the policy-hidden access control method based on the distributed Cuckoo filter shown in the embodiment are also the same.

[0150] It should be noted that the information interaction and execution process between the above systems are based on the same concept as the method embodiments of the present invention. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0151] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0152] Reference Figure 5 The present invention also provides a computer device 5, including: a memory 502 and a processor 501, and a computer program 503 stored in the memory 502. When the computer program 503 is executed on the processor 501, it implements the policy hiding access control method based on the distributed Cuckoo filter as described in any of the above methods.

[0153] The computer device 5 may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device 5 may include, but is not limited to, a processor 501 and a memory 502. Those skilled in the art will understand that... Figure 5The computer device 5 is merely an example and does not constitute a limitation on the computer device 5. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0154] The processor 501 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0155] In some embodiments, the memory 502 may be an internal storage unit of the computer device 5, such as a hard disk or memory of the computer device 5. In other embodiments, the memory 502 may be an external storage device of the computer device 5, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 5. Further, the memory 502 may include both internal and external storage units of the computer device 5. The memory 502 is used to store the operating system, applications, boot loader, data, and other programs, such as the program code of the computer program. The memory 502 can also be used to temporarily store data that has been output or will be output.

[0156] This invention also provides a computer-readable storage medium storing a computer program thereon. When the computer program is run by a processor, it implements the policy-hidden access control method based on a distributed Cuckoo filter as described in any of the above methods.

[0157] In this embodiment, if the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographing device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0158] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0159] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0160] In the embodiments disclosed in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0161] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

Claims

1. A method for policy-hiding access control based on distributed cuckoo filter, characterized in that, The method specifically includes: The system is initialized by a centrally authorized agency using a complete set of security parameters and attributes to generate system parameters, which include public parameters and a master key. Based on system parameters, each attribute authorization authority generates its own public-private key pair and discloses the public key of the public-private key pair to all entities; Based on system parameters, public and private key pairs, and user attribute sets, the central authorization agency and attribute authorization agencies collaborate to generate corresponding user key components. The data owner generates a policy fingerprint and attribute fingerprint based on the access policy. The policy fingerprint, attribute fingerprint, and corresponding policy line information are stored in the DCF table of the distributed Cuckoo Filter through the corresponding attribute authorization authority to hide the policy. The plaintext is encrypted using system parameters, public and private key pairs, and access policies to obtain ciphertext containing the policy fingerprint. Data users can query the DCF table through the attribute authorization authority, match the fingerprint in the DCF table with the attribute fingerprint of the data user to obtain the policy row set, reconstruct the access policy using the policy row set, and decrypt and verify the ciphertext in combination with the user key component. The integrity of the key structure is verified by the collaborative inspection of group elements and pairing equations by the central and attribute-authorized agencies, which also allows for the tracing and identification of malicious users. The system parameters generated by initializing the system based on the complete set of security parameters and attributes by the centrally authorized agency specifically include: Based on the input security parameters, construct the basic cryptographic components containing bilinear mappings and generators; Multiple hash functions are set up for attribute fingerprint generation, policy fingerprint generation, distributed cuckoo filter index calculation, and mapping of user identity to group elements, respectively. Randomly select group elements based on the complete set of input attributes, select secret parameters from the defined algebraic structure, and establish mapping rules to determine the attribution relationship between attributes and attribute authorization agencies. Based on the centrally authorized agency, a public parameter for use by the entire system is generated by integrating basic cryptographic components, hash functions, group elements and secret parameters, and the core part of the secret parameter is stored as the master key. The step of enabling the data owner to generate policy fingerprints and attribute fingerprints based on the access policy specifically includes: This enables data owners to obtain public parameters, access policy structures, and public keys of authorization authorities for each attribute. The access policy structure includes an access matrix and its mapping relationship with attributes. The access policy structure is taken as input, and a unique global policy fingerprint is generated through hash calculation. For each attribute involved in the access strategy structure, a corresponding attribute fingerprint is generated through hash calculation; Based on each attribute fingerprint, the first and second index positions of its corresponding information in the DCF table of the distributed Cuckoo Filter are determined by the index calculation function.

2. The method of claim 1, wherein, The process, based on system parameters, enables each attribute-authorizing authority to generate its own public-private key pair and makes the public key of the public-private key pair public to all entities, specifically includes: Each attribute-authorizing authority independently selects multiple sets of random secret parameters from its respective algebraic domain as its own private key; Using its own private key, the exponential operation based on the generators in the public parameters is used to derive multiple group element components that constitute the public key of each attribute authorization authority. The derived group element components are combined to form a complete public key, which is then made public to all entities.

3. The method of claim 1, wherein, The process of enabling the central authorization agency and attribute authorization agencies to collaborate in generating corresponding user key components based on system parameters, public-private key pairs, and user attribute sets specifically includes: Based on the centrally authorized agency, an intermediate parameter is randomly selected according to the public parameters and combined with the master key to calculate the first user key component; The intermediate parameters are sent as collaboration parameters to the attribute authorization agency associated with the user attributes. Each associated attribute authorization agency calculates and generates multiple second user key components bound to the user attribute based on the collaboration parameters, public parameters, corresponding user attributes, and their own private keys. The first user key component generated by the central authorizing authority and the second user key components generated by all associated attribute authorizing authorities together constitute the corresponding target user key component.

4. The method of claim 1, wherein, The process of storing the policy fingerprint, attribute fingerprint, and corresponding policy line information in the DCF table of the distributed Cuckoo filter via the corresponding attribute authorization authority to hide the policy, and encrypting the plaintext using system parameters, public-private key pairs, and access policies to obtain ciphertext containing the policy fingerprint, specifically includes: Based on policy fingerprints and attribute fingerprints, the attribute licensing authority to which each attribute belongs is determined, and DCF construction parameters containing the attribute fingerprint and its index position are generated and sent to the corresponding attribute licensing authority. Each attribute authorization agency, based on the received DCF construction parameters, searches for storage entries in the DCF table of the distributed Cuckoo Filter it maintains, according to the first index position and the second index position, and inserts the policy fingerprint, the corresponding attribute fingerprint, and policy row information into the free storage entry of the corresponding storage bucket in the DCF table of the distributed Cuckoo Filter; if there are no free entries in the storage bucket, the DCF table is expanded or a new DCF table is created. By utilizing public parameters, the public keys of the authorizing agencies for each attribute, and access policies, an initial ciphertext containing multiple components is generated by selecting a random vector and a secret share. The initial ciphertext is combined with the policy fingerprint to form the target ciphertext.

5. The method of claim 1, wherein, The process of enabling data users to query the DCF table through the attribute authorization authority, and matching the fingerprints in the DCF table with the attribute fingerprints of the data users to obtain a set of policy rows specifically includes: For each user attribute of a data user, the attribute authorization agency that manages that user attribute is determined based on the mapping relationship between the user attribute and the attribute authorization agency; Based on the user attributes, calculate the corresponding attribute fingerprint and the third and fourth index positions in the DCF table; Based on the third and fourth index positions, query the entries in the corresponding bucket in the DCF table it maintains; If an entry containing a policy fingerprint that matches the policy fingerprint in the ciphertext is found in any bucket, and the user attribute fingerprint satisfies the policy attribute fingerprint in the DCF table, then the policy row information recorded in that entry is added to the policy row set of the data user.

6. The method according to claim 5, characterized in that, The process of reconstructing the access policy using a policy row set and decrypting and verifying the ciphertext using a user key component specifically includes: Based on the set of policy rows, extract the corresponding row vectors from the complete access policy matrix to form the reconstructed effective attribute matrix and its new mapping relationship; Based on the effective attribute matrix and its new mapping relationship, the set of attribute indexes that meet the conditions is determined, and a set of secret recovery coefficients is calculated using the secret sharing recovery algorithm; Using the secret recovery coefficient, the user's key component of the data user, and the ciphertext, perform a bilinear pairing operation to obtain the intermediate pairing operation result; The plaintext message is recovered by performing operations on the intermediate pairing result and the ciphertext. If a valid secret recovery coefficient cannot be calculated or the pairing operation fails, the decryption is deemed to have failed.

7. The method of claim 1, wherein, The method of verifying the integrity of the key structure and tracing and identifying malicious users by collaboratively checking group elements and pairing equations based on the central authorization agency and attribute authorization agencies specifically includes: Obtain the decryption key for the user to be verified; Based on the collaboration between the central authorized agency and the attribute authorized agency, the system checks whether the components of the user's decryption key conform to the predefined specified key structure; If the structure does not match, the traceability process will be terminated. If the key structure is correct, integrity verification is performed on the attribute-related components in the user's decryption key. The validity of the key is determined by performing a pre-defined bilinear pairing operation and checking whether the equation of the operation result is true. If an attribute exists that makes all the pre-defined pairing operation verification conditions true at the same time, the user's decryption key is determined to be valid, and the user's bound identity identifier is output. If any verification condition is not true, the key is determined to be invalid or untraceable.

8. A policy-hidden access control system based on a distributed cuckoo filter, characterized in that, The system specifically includes: An initialization module is used to initialize the system based on the central authorized agency using a complete set of security parameters and attributes, and to generate system parameters, including public parameters and a master key. The key pair generation module is used to enable each attribute authorization authority to generate its own public and private key pair based on system parameters, and to make the public key of the public and private key pair public to all entities; The user key module is used to enable the central authorization agency and the attribute authorization agency to collaborate in generating the corresponding user key component based on system parameters, public and private key pairs and user attribute sets. The plaintext encryption module is used to enable the data owner to generate policy fingerprints and attribute fingerprints according to the access policy. The policy fingerprints, attribute fingerprints and corresponding policy line information are stored in the DCF table of the distributed Cuckoo Filter through the corresponding attribute authorization authority to hide the policy. The plaintext is encrypted using system parameters, public and private key pairs and access policies to obtain ciphertext containing the policy fingerprint. The decryption and verification module enables data users to query the DCF table through the attribute authorization authority, match the fingerprint in the DCF table according to the data user's attribute fingerprint, obtain the policy row set, reconstruct the access policy using the policy row set, and decrypt and verify the ciphertext in conjunction with the user key component. The structure verification module is used to check the group elements and pairing equations in collaboration between the central authorization agency and the attribute authorization agency to verify the integrity of the key structure, trace and identify the identity of malicious users; The system parameters generated by initializing the system based on the complete set of security parameters and attributes by the centrally authorized agency specifically include: Based on the input security parameters, construct the basic cryptographic components containing bilinear mappings and generators; Multiple hash functions are set up for attribute fingerprint generation, policy fingerprint generation, distributed cuckoo filter index calculation, and mapping of user identity to group elements, respectively. Randomly select group elements based on the complete set of input attributes, select secret parameters from the defined algebraic structure, and establish mapping rules to determine the attribution relationship between attributes and attribute authorization agencies. Based on the centrally authorized agency, a public parameter for use by the entire system is generated by integrating basic cryptographic components, hash functions, group elements and secret parameters, and the core part of the secret parameter is stored as the master key. The step of enabling the data owner to generate policy fingerprints and attribute fingerprints based on the access policy specifically includes: This enables data owners to obtain public parameters, access policy structures, and public keys of authorization authorities for each attribute. The access policy structure includes an access matrix and its mapping relationship with attributes. The access policy structure is taken as input, and a unique global policy fingerprint is generated through hash calculation. For each attribute involved in the access strategy structure, a corresponding attribute fingerprint is generated through hash calculation; Based on each attribute fingerprint, the first and second index positions of its corresponding information in the DCF table of the distributed Cuckoo Filter are determined by the index calculation function.

Images