Data processing method and device, first equipment, second equipment, storage medium and product

Abstract

The invention provides a data processing method, a data processing device, first equipment, second equipment, a computer readable storage medium and a computer program product. The data processing method is applied to a first device, and the method comprises the following steps: obtaining a to-be-encrypted data set; the to-be-encrypted data set comprises a plurality of data items; generating an encrypted ciphertext of the data set to be encrypted; generating a key ciphertext; and sending the key ciphertext and the encrypted ciphertext to the third equipment. The method and the device can realize fine-grained data access control.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a data processing method, a data processing apparatus, a first device, a second device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] In modern communication systems, secure sharing of data is an important means to protect user privacy and information security. With the diversification of data applications, users with different roles have different access needs for the same data resources, especially when sensitive information such as user identity and behavior is involved. Different levels of data decryption results need to be provided according to the permission level of the user.

[0003] In related technologies, attribute-based encryption is widely used to implement fine-grained access control. By associating a key with a user attribute and binding a ciphertext with an access policy, only users who meet the conditions can decrypt the data. However, such schemes usually only allow or prohibit users to access the entire data, and cannot achieve fine-grained data access control. SUMMARY

[0004] The embodiments of the present application provide a data processing method, a data processing apparatus, a first device, a second device, a computer readable storage medium and a computer program product, which can achieve fine-grained data access control.

[0005] The technical solutions of the embodiments of the present application are implemented as follows: The embodiments of the present application provide a data processing method applied to a first device, and the method comprises: obtaining a data set to be encrypted; the data set to be encrypted comprises a plurality of data items; generating an encryption ciphertext of the data set to be encrypted; generating a key ciphertext; sending the key ciphertext and the encryption ciphertext to a third device.

[0006] The embodiments of the present application provide a data processing method applied to a second device, and the method comprises: sending a data access request to a third device; the data access request carries attributes and an identity of a user; receiving a key ciphertext and an encryption ciphertext sent by the third device.

[0007] The embodiments of the present application provide a data processing apparatus applied to a first device, which comprises: a first processing unit configured to obtain a data set to be encrypted; the data set to be encrypted comprises a plurality of data items; the first processing unit is configured to generate an encryption ciphertext of the data set to be encrypted; The first processing unit is configured to generate key ciphertext. The first sending unit is configured to send the key ciphertext and the encryption ciphertext to the third device.

[0008] Embodiments of the present application provide a data processing apparatus, applied to a second device, comprising: The second sending unit is configured to send a data access request to the third device; the data access request carries the attribute and the identity of the user. The second receiving unit is configured to receive the key ciphertext and the encryption ciphertext sent by the third device.

[0009] Embodiments of the present application provide a first device, comprising a first communication interface and a first processor; wherein, The first processor is configured to obtain a data set to be encrypted; the data set to be encrypted comprises a plurality of data items. The first processor is configured to generate encryption ciphertext of the data set to be encrypted. The first processor is configured to generate key ciphertext. The first communication interface is configured to send the key ciphertext and the encryption ciphertext to the third device.

[0010] Embodiments of the present application provide a second device, comprising a second communication interface and a second processor; wherein, The second communication interface is configured to send a data access request to the third device; the data access request carries the attribute and the identity of the user. The second communication interface is configured to receive the key ciphertext and the encryption ciphertext sent by the third device.

[0011] Embodiments of the present application provide a computer readable storage medium, storing a computer program or computer executable instructions, for being executed by a processor to implement the data processing method provided by the embodiments of the present application.

[0012] Embodiments of the present application provide a computer program product, comprising a computer program or computer executable instructions, for being executed by a processor to implement the data processing method provided by the embodiments of the present application.

[0013] The embodiments of the present application have the following beneficial effects: the first device obtains a data set to be encrypted; the data set to be encrypted includes a plurality of data items; an encryption ciphertext of the data set to be encrypted is generated; a key ciphertext is generated; and the key ciphertext and the encryption ciphertext are sent to the third device, so that fine-grained data access control can be achieved; the present application divides the data set to be encrypted into a plurality of data items, and respectively generates corresponding encryption ciphertexts and key ciphertexts, so that independent encryption and access control of each data item can be achieved, and the problem that in the related art, a user is generally only allowed or prohibited to access an entire data, and fine-grained data access control cannot be achieved, is solved. BRIEF DESCRIPTION OF DRAWINGS

[0014] Figure 1 is a first flowchart of a data processing method provided by the embodiments of the present application; Figure 2 is a second flowchart of a data processing method provided by the embodiments of the present application; Figure 3 is a third flowchart of a data processing method provided by the embodiments of the present application; Figure 4 is a fourth flowchart of a data processing method provided by the embodiments of the present application; Figure 5 is a schematic diagram of a data processing framework provided by the embodiments of the present application; Figure 6 is a structural schematic diagram of a data processing apparatus applied to a first device provided by the embodiments of the present application; Figure 7 is a structural schematic diagram of a data processing apparatus applied to a second device provided by the embodiments of the present application; Figure 8 is a structural schematic diagram of a first device provided by the embodiments of the present application; Figure 9 is a structural schematic diagram of a second device provided by the embodiments of the present application.

[0015] It should be noted that the "first" and "second" above are only used to distinguish different schemes, and do not represent the advantages or disadvantages of the schemes or the priority in the implementation process. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be described in further detail below with reference to the drawings, and the described embodiments should not be regarded as limiting the present application, and all other embodiments obtained by a person of ordinary skill in the art without making creative efforts fall within the scope of protection of the present application.

[0017] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" can be the same subset or different subsets as each other and can be combined with each other as long as there is no conflict.

[0018] In the following description, the terms "first\second\third" are only to distinguish similar objects, and do not represent a specific order of the objects. It is understood that "first\second\third" can be interchanged in a specific order or sequence as long as it is allowed, so that the embodiments of the application described herein can be implemented in an order other than that illustrated or described herein.

[0019] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory) or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an integral module or unit that includes the functions of the module or unit.

[0020] Unless otherwise defined, all technical and scientific terms used in the embodiments of the present application have the same meanings as those commonly understood by a person skilled in the art. The terms used in the embodiments of the present application are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0021] The relevant data collection process in the embodiments of the present application should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and within the scope of authorization of laws and regulations and the personal information subject, carry out subsequent data use and processing.

[0022] The present application provides a data processing method, which is a secure data outsourcing scheme with access control function, aiming at solving the problem that in related technologies, only the access of users to the whole data is usually allowed or prohibited, and fine-grained data access control cannot be realized. By applying Ciphertext-policy Attribute-Based Encryption (CPABE) technology to the encryption and distribution of keys, and combining the access control policy of multiple data item dimensions, users with different permissions can obtain the corresponding data plaintext within their permission range, thereby realizing fine-grained access control and privacy protection of data.

[0023] In the related art, although there are access control schemes based on CPABE or key-policy attribute-based encryption (KPABE), these schemes usually only focus on whether the entire data can be decrypted, and do not consider different decryption results of the same data by different users. For example, a high-privilege user can decrypt all data items, while a low-privilege user can only decrypt part of the data items. Such differentiated decryption capabilities are particularly important in communication data sharing scenarios, because each item of information in the data vector has a different privacy level.

[0024] The present application divides the encryption key according to the data item, and encrypts each key using CPABE, so that the access permission of each data item can be set independently. When a user accesses the data, the user matches the corresponding access control policy according to the user's own attributes, and can only decrypt the corresponding key within the user's permission range, and then decrypt the plaintext of the corresponding data item. In this way, even if the same encrypted data vector is faced, different users with different permissions can obtain different decryption results, thereby realizing fine-grained access control and privacy protection of the data.

[0025] Figure 1 is the first flowchart of the data processing method provided by the embodiments of the present application, which will be described below in combination with the steps shown in Figure 1 It should be noted that, Figure 1 The method in the first device is used as an example to illustrate the execution subject, and the first device can be a data outsourcing institution, a communication operator server, or other devices with data encryption and key generation capabilities, such as Figure 1 The method includes the following steps 101 to 104. Step 101, obtaining a set of data to be encrypted; the set of data to be encrypted includes a plurality of data items.

[0026] In actual application, the set of data to be encrypted D refers to a set of data that needs to be processed securely, which is usually represented in the form of a data vector, for example, a data vector containing user information, each element representing a specific data item. The data item of the present application is the basic unit of the data vector, such as the username, mobile phone number, and package fee fields in the communication data. In the present application, the privacy levels of different data items are different, and the present application supports a fine-grained access control mechanism, so that users with different permissions can only access the data items authorized by them.

[0027] In some embodiments, the data items can have different privacy protection levels. For example, in a communication data sharing scenario, a data vector can include fields such as name, phone number, ID number, address, and the like. The ID number and address in the data vector are data items with a higher privacy protection level, and the phone number and amount of the data vector are data items with a lower privacy protection level.

[0028] In some embodiments, the data items can have different privacy protection levels, and therefore the permissions need to be set separately in the access control policy.

[0029] By setting access control policies for each data item in the data set D to be encrypted, different users can achieve different access results for the same data in the decryption phase.

[0030] In practical applications, the data outsourcing organization can read user data from the local database and organize these data into structured data vectors to ensure the integrity and consistency of the data items. By organizing user data into structured data vectors and ensuring the integrity and consistency of the data items, the access control mechanism relied on by subsequent attribute-based encryption (CPABE) technology can be effectively supported, thereby improving the security and flexibility of the data.

[0031] Here, the data vector form means that a set of related data items are arranged in a vector structure in a certain order for unified processing and management. For example, a user's personal information is represented as a data vector: [name, phone number, ID number, address], and each position of the data vector corresponds to a specific type of data item. After using this structure, it is not only helpful for the data processing of the data encryption algorithm, but also convenient for the binding and execution of the access control policy.

[0032] Step 102, generating an encrypted ciphertext of the data set to be encrypted.

[0033] Here, the encrypted ciphertext E means the result obtained by encrypting the original data vector in the data set D to be encrypted using the encryption key K. Only the user who has the corresponding decryption key can obtain the plaintext of part or all of the data items. The encryption process ensures the security of the data during transmission and storage, preventing unauthorized users from obtaining the plaintext data. For example, assuming that the data item is a phone number: 138…, the encryption process will convert the data into a string of characters that cannot be directly identified. Only the user who has the decryption key corresponding to the encryption key can decrypt the encrypted data, thereby restoring the original data content.

[0034] In practical applications, the encryption operation can be implemented by a symmetric encryption algorithm or an asymmetric encryption algorithm, but the present embodiment uses a CPABE (Ciphertext-Policy Attribute-Based Encryption) technique to encrypt the key, thereby further enhancing the access control capability.

[0035] In some embodiments, by independently encrypting each data item and binding an access control policy, it can be ensured that users with different permissions can only decrypt the data items that have been authorized, thereby achieving fine-grained data access control.

[0036] Step 103, generating a key ciphertext.

[0037] Here, the key ciphertext (CT) is an intermediate structure formed after CPABE is performed on the key used to encrypt the data. The key ciphertext contains an access control policy and a random parameter, which are used to verify whether the user has the corresponding permission in the decryption phase. The present application forms an intermediate structure after performing CPABE on the key used to encrypt the data. The present application uses CPABE, which is an attribute-based encryption technique. When data is encrypted, an access control policy is defined, and only users with an attribute set that satisfies the policy can decrypt the data. Unlike traditional public key encryption, the decryption permission of CPABE is determined by the user's attributes, rather than a single identity.

[0038] In some embodiments, the key ciphertext CT not only contains information about the key itself, but also embeds an access control policy, so that users who meet certain attribute conditions can successfully decrypt the corresponding key. For example, for a data item of a call charge amount, the access control policy of the data item can be defined as the user must have the attribute of a data analyst. Only users with the attribute of a data analyst can obtain the decryption key of the data item and view the plaintext value of the field corresponding to the data item. The implementation method of the access control policy includes a linear secret sharing structure (LSSS), that is, a constraint condition expressed in the form of a matrix is used to control the access permission.

[0039] In practical applications, the data owner constructs a linear secret sharing scheme (LSSS) matrix for each data item and generates a key ciphertext CT in combination with the bilinear pairing parameters. The process of constructing the LSSS matrix by the data owner and generating the key ciphertext CT in combination with the bilinear pairing parameters ensures the secure distribution of the key and the effective implementation of access control. At the same time, the service provider does not need to master the plaintext form of the key, and only needs to be responsible for storing and forwarding the key ciphertext CT, avoiding the risk of key leakage. Among them, the bilinear mapping defines a group G with prime order p, which satisfies the properties of bilinearity, non-degeneracy and computability. It is often used to construct exponential operations in attribute-based encryption systems to ensure security and support complex access control logic.

[0040] In practical applications, for each data item in the data vector, different access control policies can be set according to the privacy sensitivity of the data item, and these access control policies are bound to the corresponding key ciphertext CT. Through this access control policy setting method based on the privacy sensitivity of the data item, differential access control of different data items can be achieved, thereby improving the flexibility and security of the data processing system.

[0041] Step 104, send the key ciphertext and the encrypted ciphertext to the third device.

[0042] Here, the third device refers to a service provider or a data storage platform as an intermediary platform, and the main function of the third device is to receive and store the encrypted data and key information, and provide the corresponding encrypted data and key ciphertext CT according to the user's access request. For example, in the communication data sharing scenario, the service provider can be a cloud storage platform, and the user accesses the cloud storage platform to obtain the required data, and the cloud storage platform verifies whether the user meets the access conditions according to the user's identity and attributes, and returns the corresponding encrypted ciphertext E and key ciphertext CT.

[0043] In practical applications, the service provider acts as an intermediary platform and is responsible for storing and distributing encrypted data and key information. The service provider does not master the plaintext data, but only provides encrypted data and key ciphertexts according to user requests to ensure the security outsourcing of data.

[0044] In practical applications, the first device packages and sends the encrypted ciphertext E and the key ciphertext CT to the third device for storage. Since the encrypted ciphertext E and the key ciphertext CT are in an encrypted state, even if the third-party storage platform is attacked, the original data or decryption key cannot be obtained, thereby ensuring the security of the data.

[0045] Further, when accessing the data, the user also needs to match the access control policy according to the user's own attributes, so as to successfully decrypt the data items within the user's permission range, and realize multi-level protection of the data.

[0046] In actual application, in the entire data processing process, the to-be-encrypted data set D is first represented in the form of a data vector, then an encryption ciphertext E is generated through an encryption operation, and a key ciphertext CT is generated through a CPABE technology. Subsequently, the encryption ciphertext E and the key ciphertext CT are sent to a third device for storage. In the entire data processing process, the data is always in an encrypted state, and only the user who satisfies the access control policy can gradually decrypt the required data items, and the method realizes efficient protection and flexible access control of the data.

[0047] The data processing method provided by the embodiment of the application can realize independent encryption and access control of each data item by dividing the to-be-encrypted data set D into multiple data items and respectively generating corresponding encryption ciphertexts E and key ciphertexts CT. The key ciphertext contains an access control policy and a random parameter, which is used to verify whether the user has corresponding permissions in the decryption phase; that is, the application encapsulates the key by using the CPABE technology, so that users with different attributes can obtain decryption permissions of some data items when satisfying a specific access policy, thereby realizing differentiated access control of different data items in the same data set. Compared with the related art which can only realize two states of full decryption or no decryption, the application realizes fine-grained data access control, and improves data security and flexibility.

[0048] To sum up, the data processing method provided by the embodiment of the application encrypts the key by introducing the CPABE technology in the encryption phase, and differentiates the data items in combination with the access control policy, so that users with different access permissions can obtain different degrees of decryption results. The above data processing method not only improves the security of the data, but also enhances the flexibility and practicality of the data processing system, and is particularly suitable for scenarios involving user privacy data in the communication field. Through the above data processing method, the data owner can flexibly control the access range of the data, ensure that sensitive information is not illegally accessed, and at the same time, does not hinder the legitimate user from obtaining the business data required by the legitimate user.

[0049] In some embodiments, step 102: generating an encryption ciphertext of the to-be-encrypted data set, as shown in Figure 2 As shown in the figure, it includes steps 201-202, wherein: Step 201: generating an encryption key with the same dimension as the to-be-encrypted data set; Here, the dimension of the encryption key K must be consistent with the structure of the data set D to be encrypted to ensure that each element of the data set D to be encrypted can be independently encrypted. For example, if the data set D to be encrypted is a vector containing n elements, the encryption key K should also be a vector of length n, and each element corresponds to the encryption parameter of an element of the data set D to be encrypted. Wherein, n is a positive integer greater than 1. The encryption key K can be a randomly generated sequence or matrix, and the specific form is determined according to the encryption algorithm used. In this way, it can be ensured that each element of the data set D to be encrypted has an independent encryption mechanism, thereby enhancing the security of the data and the flexibility of access control.

[0050] In practical applications, there is a one-to-one mapping relationship between the encryption key K and the data set D to be encrypted. Each element of the data set D to be encrypted has its own exclusive key parameter. Based on the above design method of one-to-one mapping relationship between the encryption key K and the data set D to be encrypted, it is helpful to realize more fine-grained data protection and differentiated access control.

[0051] Step 202: encrypting the data set to be encrypted using the encryption key to generate the encrypted ciphertext.

[0052] This step uses the encryption key K generated in the previous step to encrypt each element in the data set D to be encrypted, and finally generates the corresponding encrypted ciphertext E. The encryption process is usually based on attribute-based encryption (ABE) technology, such as ciphertext policy attribute-based encryption (CP-ABE) implementation, which allows the data owner to set access policies and embed these policies into the ciphertext. Only users with corresponding attributes can decrypt part or all of the plaintext information of the data set D to be encrypted.

[0053] For example, in the field of communication, the elements of the data set D to be encrypted may include user identity information, call records, location information, etc. Different types of users (such as administrators, analysts, customer service personnel) can access different elements of the data set D to be encrypted based on their permissions. By using the encryption key K consistent with the dimension of the data set D to be encrypted for encryption, fine-grained access control can be achieved while ensuring data privacy, meeting the different needs of multi-level users.

[0054] In summary, in the embodiments of the present application, an encryption key K with the same dimension as the data set D to be encrypted is generated, and the data set D to be encrypted is encrypted using the encryption key K to generate the encrypted ciphertext E. In this way, it can be ensured that each element of the data set D to be encrypted has an independent encryption mechanism, thereby realizing differentiated access control for different elements of the data set D to be encrypted, and further supporting different users with different permissions to obtain different degrees of decryption results for the same encrypted data.

[0055] In practical applications, by generating an encryption key K consistent with its dimension for each data item and using this key to encrypt the corresponding data item, the consistency and integrity of the data encryption process can be ensured. This design facilitates subsequent attribute-based access control mechanisms to accurately match the key with the data item, improving decryption efficiency and security.

[0056] In the entire encryption process of this application, the structure and dimensions of the dataset D to be encrypted must first be defined. Then, a matching encryption key K is generated. Finally, the encryption key K is applied to encrypt each item of the data, forming the encrypted ciphertext E. The above encryption process not only ensures the confidentiality of the data, but also, by introducing an attribute-based encryption mechanism, this application achieves flexible access control capabilities, making it suitable for complex application scenarios with multiple roles and permissions.

[0057] In some embodiments, step 103: generating key ciphertext, such as Figure 3 As shown, steps 301-305 are included, wherein: Step 301: Define access control; access control is used to constrain data decryption permissions through the matching relationship between policies and attributes.

[0058] Here, access control refers to a mechanism that restricts user access to resources, determining which users can access which data. In this application, access control ensures that only users with the corresponding attributes can decrypt the corresponding data items by setting specific policies and matching rules between attributes. For example, access control can be defined as requiring a user to possess both the attributes 'Province=Beijing' and 'Identity=Data Analyst' in order to decrypt the mobile phone number information in a certain data entry.

[0059] Here, access control is typically implemented based on attribute-based encryption (ABE) techniques, such as CPABE (Ciphertext Policy Attribute-Based Encryption) or KPABE (Key Policy Attribute-Based Encryption). This application uses the CPABE method, where the access policy is embedded in the ciphertext, and whether a user can decrypt it depends on whether the user meets the policy embedded in the access control.

[0060] This application uses an encryption method based on access control policies, which allows only users who comply with the access control policies to obtain the plaintext of a portion of the data items without decrypting the entire data vector. This method enables the management of different decryption permissions for different users.

[0061] Step 302: Select a first random number for each of the multiple data items.

[0062] In practical applications, for each data item This application is for data items. Choose a first random number independently (i.e., a random number) ). The random number is used as a basis parameter for constructing a random vector, which is used to generate an encryption key component related to the data item . Wherein, i is a positive integer.

[0063] In practical applications, the selection of the random number in the present application should meet the unpredictability and uniqueness to ensure that the generated encryption key cannot be guessed or reused. For example, the random number is generated by a secure pseudo-random number generator (CSPRNG). The use of random numbers in the present application can prevent attackers from inferring the original data or key structure by observing the relationship between multiple keys, thereby enhancing the anti-attack ability of the first device.

[0064] Step 303: Constructing a first random vector and a second random vector based on the first random number.

[0065] In practical applications, two random vectors are constructed respectively based on the random number corresponding to each data item, which are a first random vector and a second random vector . The first random vector and the second random vector constructed by the first device serve as the basis for subsequent intermediate vectors and .

[0066] In practical applications, the construction method of the random vector can select different mathematical models according to actual needs, for example, a uniformly distributed real number vector can be used, or a vector on a finite field can be used. In the present application, since it involves bilinear operation, a random vector can be constructed on a prime order group.

[0067] In practical applications, the first random vector and the second random vector constructed will participate in subsequent bilinear operations as an exponential parameter, thereby affecting the security and flexibility of the final generated key ciphertext .

[0068] Step 304: For each row of the access matrix of the access control, based on the first random vector and the second random vector, calculating a first intermediate vector and a second intermediate vector.

[0069] Wherein, the access matrix is a mathematical representation of the access control policy, which is usually used to describe the logical relationship between user attributes and data access permissions. Each row represents a possible attribute combination, and the column represents the value range of each attribute.

[0070] Here, User Attributes are used to describe a collection of information about user identity characteristics and permission levels. In this application, User Attributes are used to determine whether they satisfy the access control policy, so as to decide whether they can decrypt a specific data item.

[0071] Here, for each row of the access matrix of the access control, the first device calculates two intermediate vectors based on the first random vector and the second random vector : the first intermediate vector and the second intermediate vector . The first device uses the first intermediate vector and the second intermediate vector in subsequent bilinear operations.

[0072] Here, the first intermediate vector and the second intermediate vector can be calculated by linear transformation or nonlinear function. The generation of the first intermediate vector and the second intermediate vector depends on the access control policy expressed by the current row and the values of the first random vector and the second random vector , so this method can be flexibly adapted to different access control scenarios.

[0073] By introducing intermediate vectors, the first device can more efficiently handle multi-attribute, multi-level access control logic, while the first device can maintain the scalability and security of the calculation process.

[0074] In practical applications, each row in the access matrix of the access control is bound to a specific user attribute, and the first intermediate vector and the second intermediate vector together constitute the decryption capability identifier of the user under the specific user attribute, and there is a logical association between the first intermediate vector and the second intermediate vector .

[0075] Here, the first intermediate vector and the second intermediate vector are used as the exponent parameters of bilinear operations. Bilinear operations are a kind of mathematical operations widely used in cryptography, especially in Attribute-Based Encryption (ABE) schemes.

[0076] In this application, the exponent parameters of bilinear operations are provided by the first intermediate vector and the second intermediate vector . The exponent parameters of bilinear operations are provided by the first intermediate vector Second intermediate vector This design provides that the generated key ciphertext This not only relies on access control policies but is also closely related to random numbers and intermediate vectors, thereby enhancing the unpredictability and security of the ciphertext. The application of bilinear operations in this application enables the first device to achieve fine-grained access control; that is, different users, based on their own attribute sets, can decrypt corresponding encrypted data and obtain the plaintext content of the corresponding data items, thus achieving differentiated data decryption results.

[0077] In practical applications, the first intermediate vector Second intermediate vector As an exponential parameter in bilinear operations, its numerical change directly affects the key ciphertext. The generated result is the core bridge connecting access control policies and encrypted output.

[0078] Step 305: For each row of the access control access matrix, perform a bilinear operation based on the second random number, the first intermediate vector, and the second intermediate vector to generate the key ciphertext corresponding to each item.

[0079] In practical applications, the first device performs a bilinear operation independently on each row of the access control matrix. The input to the operation includes a second random number (i.e., a random number). ), first intermediate vector Second intermediate vector The output is the data item. Corresponding key ciphertext .

[0080] Here, random number The introduction of this increases the randomness of the computation, further improving the key ciphertext. The security of the data item and access policy is ensured. Each pair of data items and access policies generates a unique key ciphertext. The combination of data items and access policies ensures that even if the same user requests access to the same data item multiple times, the same key will not be obtained repeatedly.

[0081] Here, the final generated key ciphertext This information will be used in subsequent data encryption and decryption processes. Only users who meet the access control conditions can successfully decrypt and obtain the corresponding plaintext data item; users who do not meet the access control conditions will not be able to obtain any valid information.

[0082] In actual application, the above steps form a complete encryption process chain: starting from the definition of access control policy, via random number generation, random vector construction, intermediate vector calculation, and finally generating key ciphertext through bilinear operation. The encryption process chain realizes differentiated encryption of data items, and the encryption process chain supports users to complete authorized decryption based on their own attributes.

[0083] In summary, in the embodiments of the present application, by defining access control, constructing a first random vector and a second random vector , calculating a first intermediate vector and a second intermediate vector , and performing bilinear operation, the corresponding key ciphertext of each data item is generated. In this way, differentiated encryption of different data items can be realized, so that users with different access permissions can obtain different degrees of decryption results, thereby meeting the needs of data privacy protection and permission grading in the communication field.

[0084] Figure 4 is a fourth flowchart of the data processing method provided by the embodiments of the present application, which will be described below in combination with the steps shown in Figure 4 . It should be noted that Figure 4 the method is described by taking the second device as an execution subject, and the second device can be a user-side device, which can be a mobile device, a personal computer (PC) or a server; as shown in Figure 4 , the method includes the following steps 401 to 402, Step 401: sending a data access request to a third device; the data access request carries the attributes and identity of the user.

[0085] The data access request contains the identity of the user and the attribute information of the user. The identity is used to uniquely identify the user, for example, it can be a user identifier (ID), a mobile phone number, an account, etc.; and the attributes of the user are a set of characteristics related to the user, such as department role, permission level, organization, etc. These attribute information is used to determine whether the user has the permission to decrypt a particular data item in the subsequent step.

[0086] The attributes of the user are one of the core concepts for realizing multi-level access control in the present application, and the attributes of the user determine which data items the user can access. By embedding the attributes of the user into the data access request, the second device can determine whether to allow the user to obtain the corresponding encryption key or plaintext data according to the preset access policy. For example, in the field of communication, a card salesperson may have access to telephone numbers and home address information, but not to identity card numbers and address information.

[0087] In actual application, when a user attempts to access some encrypted data, the second device collects attribute information of the current user, encapsulates the attribute information of the user into a data access request, and sends the data access request to the third device for processing. By encapsulating the attribute information of the user into the data access request, the second device ensures that only the user meeting the access condition can obtain the corresponding key, thereby realizing fine-grained access control of the data.

[0088] By carrying the attribute and identity of the user in the data access request, access control based on the attribute of the user is realized without exposing the data content. By carrying the attribute and identity of the user in the data access request, unauthorized user access to sensitive data can be effectively prevented, thereby improving data security and supporting different permission levels of users to access different degrees of decryption results.

[0089] Step 402: receiving the key ciphertext and the encrypted ciphertext sent by the third device.

[0090] This step describes that the second device receives the response content from the third device, that is, the key ciphertext CT and the encrypted ciphertext E. Here, the key ciphertext CT of the third device is the key encrypted by the CPABE algorithm, and the encrypted ciphertext E is the ciphertext generated by encrypting the original data vector by the key.

[0091] The key ciphertext CT contains the key information used for decrypting the data, and the key contained in the key ciphertext CT is also encrypted. Only the user meeting the access policy can perform the decryption operation on the key ciphertext CT, thereby obtaining the real key. By using the key ciphertext CT for data processing, the key can be avoided to be directly exposed in the transmission process, and the overall security can be improved by this way.

[0092] The encrypted ciphertext E represents the encrypted form of the data vector uploaded by the data owner to the service provider.

[0093] In actual application, after receiving the data access request, the third device judges whether the attribute information of the user has the permission to access some data items, and generates the corresponding key ciphertext CT and encrypted ciphertext E according to the judgment, and then returns the key ciphertext CT and the encrypted ciphertext E to the second device. The second device processes the key ciphertext CT and the encrypted ciphertext E according to the attribute of the user, thereby determining the final decryption result.

[0094] In actual application, the second device can complete the decryption operation of the data locally by receiving and processing the key ciphertext CT and the encryption ciphertext E returned by the third device. Only users with corresponding permissions can see part or all of the plaintext data. In this way, different decryption degrees of the same data can be achieved, and the flexibility and security of the data sharing process can be enhanced, and the second device can better meet the needs of multi-level data access in the communication industry.

[0095] In some embodiments, the method further comprises: First, when the attributes meet the defined access control, the user key sent by the third device is received. Here, the attributes refer to a set of attributes of the user, which are used to describe the identity, role or permission information of the user. For example, in the communication data sharing scenario, the attributes of the user can include data analysts, card sales personnel, regional administrators, etc., and each attribute represents different access permissions. The access control is to determine whether the user has the qualification to access a specific data item according to a preset policy. The access control is usually implemented based on the CPABE technology, that is, only users who meet the access policy can decrypt the ciphertext to obtain the plaintext.

[0096] The third device refers to a service provider or a data storage platform as an intermediary platform, and the main function of the third device is to receive and store the encrypted data and key information. The third device has corresponding permissions and holds the user key, and the third device can be a mobile device, a PC or a server. When the attributes of the user meet the access control policy, the user key SK is allowed to be sent to the second device through the third device to participate in the subsequent data decryption process. The mechanism of sending the user key through the third device ensures that only legitimate users can submit the key information for decryption, thereby improving the security and controllability of the second device.

[0097] In actual application, when the user attributes meet the access control policy, the platform will return the corresponding user key SK, and the user can decrypt the required data item according to the user key SK. This mechanism ensures that only users who meet the conditions can obtain the corresponding data, effectively preventing unauthorized access.

[0098] In actual application, there is a close relationship between the attributes and the access control. The access control depends on the matching of the attributes to determine whether to allow the decryption operation to be performed. Therefore, before receiving the user key SK sent by the third device, the second device must verify whether the related attributes meet the requirements of the access policy, otherwise the submission of the user key SK will be rejected to prevent illegal access.

[0099] Secondly, based on the user key, the key ciphertext and the encryption ciphertext, a plurality of data items are obtained.

[0100] Here, the user key SK is a decryption key generated and assigned to the user by the attribute authority, and the validity of the user key SK depends on whether the attributes satisfy the access control policy. The key ciphertext CT is a ciphertext formed after the original key is encapsulated in the encryption phase, which contains the information required for decrypting the original encrypted ciphertext and is protected by the access policy. The encrypted ciphertext E is the result formed after the original data vector is encrypted by the data owner using the encryption key, which can only be decrypted by the user who satisfies the access condition.

[0101] In actual application, each data item corresponds to an encryption key, and the second device can decrypt the corresponding key according to whether the attributes of the user carried by the access request satisfy the access control policy. Finally, the user obtains a key vector composed of a group of decryption keys, which is used for selective decryption of each data item in the encrypted data vector.

[0102] In actual application, by combining and calculating the user key SK, the key ciphertext CT and the encrypted ciphertext E The second device can gradually restore multiple data items in the original data.

[0103] In actual application, if the user has access rights to a data item, the corresponding decryption key can be calculated by the user key SK and the key ciphertext CT, and then the corresponding data item in the encrypted ciphertext E is decrypted; otherwise, if the user does not have access rights, the user cannot complete the decryption operation, and the data item remains encrypted. The combination calculation method based on the user key SK, the key ciphertext CT and the encrypted ciphertext E realizes differential decryption of the same encrypted data vector, and different users with different permissions can obtain different degrees of plaintext data, thereby meeting the needs of multi-level access control.

[0104] In summary, in the embodiment of the present application, the user key SK is received when the user satisfies the access control policy, and the key ciphertext CT and the encrypted ciphertext E are combined and decrypted, so that multiple data items can be extracted. The above method can realize partial decryption of the same encrypted data vector, thereby supporting users with different access rights to obtain different degrees of plaintext data, thereby improving data security and access flexibility.

[0105] In actual application, the entire implementation process is a collaborative decryption process: first, it is judged whether the user has the right to decrypt the data according to the attributes and the access control policy; second, the user key SK is used to verify the identity of the user; finally, the key ciphertext CT and the encrypted ciphertext E are used for item-by-item decryption, so that users with different permissions can only decrypt the data portions they have the right to access. The entire implementation process performed according to the above steps not only guarantees the security of the data, but also realizes flexible access control.

[0106] In some embodiments, when the attribute does not satisfy the defined access control, it is determined that the data item corresponding to the encrypted ciphertext cannot be accessed.

[0107] In actual applications, when the attribute of a user does not satisfy the defined access control, a matching judgment is performed according to the attribute set of the user and the access control policy of the data item corresponding to the encrypted ciphertext. If the attribute of the user does not satisfy the condition in the access control policy, it indicates that the attribute of the user does not have the right to access the data item corresponding to the encrypted ciphertext. In this case, it is determined that the data item corresponding to the encrypted ciphertext cannot be accessed, and the decryption operation on the data item corresponding to the encrypted ciphertext is prevented.

[0108] Here, the access control is a technical mechanism for limiting the access rights of a user to a specific resource. In the present application, the access control is implemented based on attributes, that is, each user has a set of attributes, and each data item or key is embedded with a specific access control policy. Only when the attribute of the user satisfies the access control policy, the user corresponding to the attribute is allowed to access the plaintext data of the data item corresponding to the encrypted ciphertext.

[0109] Here, the encrypted ciphertext refers to a data form generated by an encryption algorithm, so that unauthorized users cannot directly read the original data content. In the present application, each data item in the data vector is encrypted using the CPABE technology, so as to ensure that only the user with the corresponding attribute can obtain the decryption key, and the plaintext data corresponding to the data item encrypted by the CPABE technology can be obtained.

[0110] Here, the data item is the basic unit constituting the data vector, and each data item can have different privacy protection levels. For example, in the field of communication, the data item can include user name, mobile phone number, ID number, IP home location, monthly call charge, package cost, address, etc. There are differentiated access rights requirements between different data items, so the access control policy should be independently set for each data item.

[0111] Through the above steps, the second device can allow only the data item corresponding to the encrypted ciphertext with the right of the user to be accessed without decrypting the entire data vector, and the data item corresponding to the encrypted ciphertext without the access right is kept in an encrypted state and cannot be accessed. In this way, high-sensitive data leakage can be effectively prevented, thereby improving data security. At the same time, since the access control policy can be accurate to a single data item, more flexible and fine-grained access management can be achieved. Further, different needs of multi-level user access to data in the communication industry can be met, and the security and practicality of the second device are improved.

[0112] In summary, the embodiment provides an attribute-based access control mechanism, which realizes fine-grained access control of encrypted data by setting access strategies at the data item level, so as to guarantee data security while meeting diversified user access requirements.

[0113] In an implementable secure data outsourcing scheme with access control function, the scheme is applied to a data processing framework as shown in the figure Figure 5 The data processing framework includes a data outsourcing institution, a platform and a user device. The data outsourcing institution generates an encryption key and an encrypted data item (such as an encrypted data vector) and uploads it to other platforms. The user device sends a data access request (carrying user attributes, etc.) to the platform. The platform sends the encrypted data vector and the encryption key vector to the user device. According to the user attributes, the key vector is determined. Users with different access control permissions obtain different degrees of decrypted plaintext. For example, if the user has access permission to the key encrypted data item, the plaintext data item is obtained; if the user does not have access permission to the key encrypted data item, the ciphertext data item is obtained.

[0114] The processing flow of the secure data outsourcing scheme of the embodiment is as follows: Initialization stage: first, a bilinear group G of a prime number p is randomly selected, and the generator is Then, a random number is selected as the private key Finally, the public key is generated.

[0115] I. Encryption key vector generation stage: 1. Assume that the data vector is , where n represents the length of the data vector, represents the data item . For the data item , generate an f*l matrix as the encryption key component , and generate satisfying . Therefore, the key is represented as . Where f and l are random numbers.

[0116] 2. Encrypt the key using CP-ABE technology: This step is used to generate an encryption key. Define an LSSS access control policy, , which represents a shared matrix, , represents a labeling function.

[0117] The input of this step is the access control The algorithm consists of a public key (APK) and a global parameter (GP). The output of the algorithm is the encryption key K and the ciphertext CT. The data owner (e.g., a telecommunications operator) generates an encryption key K with the same dimensions as the original data vector. Used to encrypt data vectors during the encryption phase, and the corresponding decryption key. For encapsulation The data owner is randomly selected. and calculate At the same time, the data owner defines access controls to restrict user access to the data; only users who meet the access control conditions can obtain the data during decryption. The data owner generates two random vectors. , Further calculations , These two values ​​will serve as the exponent parameters for the bilinear pairing operation. For a of rows The data owner selects a random number. And generate the ciphertext of the key. Ultimately, the data owner sends the CT scan to the service provider.

[0118] (1) Define LSSS access control For data items Data outsourcing agencies are randomly selected. And generate two random vectors. For a of of rows Data outsourcing agencies calculate .

[0119] (2) For data items ,right of rows Choose a random number Generate key ciphertext ciphertext yes The ciphertext, It is an auxiliary ciphertext for subsequent calculations.

[0120] .

[0121] II. Encryption Phase: This step encrypts the data vector. The input to this step is a key K and a data vector D, and the output is encrypted ciphertext E. The data owner uses key K to encrypt data vector D to obtain encrypted ciphertext E and then uploads it to the service provider.

[0122] For data items , using an encryption key component encrypting data items obtaining .

[0123] Thus, using an encryption key K to encrypt a data vector D results in an encrypted ciphertext E; .

[0124] III. Decryption phase: 1. Obtain the key vector according to the user attributes: (1) CP-ABE key generation: This step is used to generate the user key SK of the decryption CT. The input of this step is the identity identifier gid, the user's attributes S, the attribute authority private key ASK, and the global parameter GP. The output of this algorithm is the user key SK. For data item , attribute , the attribute authority randomly selects and generates the user key according to the user's gid, the attribute authority private key ASK, and the global parameter GP, and sends it to the user.

[0125] Here, for data item , the user has , and is randomly generated, where j represents the attribute, and S represents the user attribute set.

[0126] .

[0127] (2) Decrypt to get the plaintext key: This step is used to make users with different access permissions obtain the decryption result . The input of this step is the encrypted ciphertext E, the encryption key CT, and the user key SK. The output of this step is the decryption result. For data item , if the user attribute set S satisfies the access policy embedded in the key ciphertext , the data item is output; otherwise, the algorithm outputs the ciphertext . Further, after receiving the key ciphertext CT sent by the service provider, for data item , if the user's attributes satisfy , can be found to satisfy . The user calculates according to the user key SK sent by the attribute authority. Then, the user calculates , and further obtains the decryption key item , at which time can be calculated, and the data item is obtained; otherwise, the data item cannot be accessed, so that different users with different access permissions can obtain different decryption results for the same encrypted data.

[0128] An exemplary identity set is defined and If the user satisfies the access control condition , for the data item , the user can find a constant such that , therefore .

[0129] For the data item , the user calculates each under the condition of satisfying the access control policy : ; Proof: .

[0130] The user calculates ; the user obtains the required key .

[0131] Further, according to the user attribute, if the user has the right to access the data item , the key is output, otherwise, 1 is output. Therefore, the user obtains the key vector .

[0132] Further, the user decrypts: the user uses the key to decrypt and calculates . If the user has the key of the data item , the calculation is performed; otherwise, the user cannot access the data item .

[0133] The access control scheme of the related art only controls whether the user is allowed to access or not allowed to access the data vector, but cannot achieve that part of the data items of the data vector are allowed to be accessed and another part is not allowed to be accessed. However, in the field of communication, the data vector includes multiple data items, and the privacy protection degrees of different data items are different. The present application achieves that different users with different access permissions can obtain different degrees of decryption results for the same encrypted data vector.

[0134] The application has at least the following beneficial effects: different access control permissions are assigned to keys according to users, and users with different access control permissions obtain different degrees of decrypted plaintext. The CPABE technology is used to encrypt the key during encryption: this method does not need to build a key management center, and the key is stored in the platform in the form of ciphertext, so that the platform cannot obtain the plaintext data, and only authorized users can obtain the plaintext data. During decryption, the key vector is determined according to the user attribute, the key vector is different for users with different access permissions, and different degrees of decrypted plaintext are obtained: if a user has the permission of a data item, the key corresponding to the data item can be obtained, and the plaintext of the data item can be obtained; otherwise, the key corresponding to the data item cannot be obtained, and the plaintext of the data item cannot be obtained. Therefore, the same encrypted data vector can obtain different degrees of decryption results.

[0135] The application also provides a data processing device, as shown in Figure 6 which is applied to a first device and includes: A first processing unit 601 is configured to obtain a data set to be encrypted, and the data set to be encrypted includes a plurality of data items. The first processing unit 601 is configured to generate an encrypted ciphertext of the data set to be encrypted. The first processing unit 601 is configured to generate a key ciphertext. A first sending unit 602 is configured to send the key ciphertext and the encrypted ciphertext to a third device.

[0136] In some embodiments, the first processing unit 601 is configured to generate an encrypted key with the same dimension as the data set to be encrypted. The encrypted key is used to encrypt the data set to be encrypted, and the encrypted ciphertext is generated.

[0137] In some embodiments, the first processing unit 601 is configured to define an access control, the access control is used to restrict data decryption permission through a matching relationship between a policy and an attribute, a first random number is selected for each data item in the plurality of data items, a first random vector and a second random vector are constructed based on the first random number, a first intermediate vector and a second intermediate vector are calculated based on the first random vector and the second random vector for each row of an access matrix of the access control, the first intermediate vector and the second intermediate vector are used as exponential parameters of a bilinear operation, and a key ciphertext corresponding to each data item is generated by performing the bilinear operation based on the second random number, the first intermediate vector and the second intermediate vector for each row of the access matrix of the access control.

[0138] The application also provides a data processing device, as shown in Figure 7 which is applied to a second device and includes: A second sending unit 701 is configured to send a data access request to a third device, and the data access request carries an attribute and an identity of a user. The second receiving unit 702 is configured to receive the key ciphertext and the encryption ciphertext sent by the third device.

[0139] In some embodiments, the second receiving unit 702 is configured to receive the user key sent by the third device when the attribute satisfies the defined access control. As shown in Figure 7 The data processing apparatus further includes a second processing unit 703 configured to obtain the plurality of data items based on the user key, the key ciphertext and the encryption ciphertext.

[0140] In some embodiments, the second processing unit 703 is configured to determine that the data item corresponding to the encryption ciphertext cannot be accessed when the attribute does not satisfy the defined access control.

[0141] Embodiments of the present application further provide a first device, as shown in Figure 8 The first device 800 includes a first communication interface 801 and a first processor 802; the first communication interface 801 is capable of information interaction with a third device; The first processor 802 is connected with the first communication interface 801 to realize information interaction with the third device, and is configured to run a computer program to execute the method provided by one or more technical solutions of the first device side; The first memory 803 stores a computer program capable of running on the first processor 802.

[0142] The first communication interface 801 is configured to obtain a data set to be encrypted; the data set to be encrypted includes a plurality of data items; The first processor 802 is configured to generate an encryption ciphertext of the data set to be encrypted; The first processor 802 is configured to generate a key ciphertext; The first communication interface 801 is configured to send the key ciphertext and the encryption ciphertext to the third device In some embodiments, the first processor 802 is configured to generate an encryption key with the same dimension as the data set to be encrypted; and encrypt the data set to be encrypted by using the encryption key to generate the encryption ciphertext.

[0143] In some embodiments, the first processor 802 is configured to define an access control, the access control is configured to restrict a data decryption permission through a matching relationship between a policy and an attribute, select a first random number for each of a plurality of data items, construct a first random vector and a second random vector based on the first random number, calculate a first intermediate vector and a second intermediate vector based on the first random vector and the second random vector for each row of an access matrix of the access control, the first intermediate vector and the second intermediate vector are used as exponential parameters of a bilinear operation, and perform the bilinear operation based on the second random number, the first intermediate vector and the second intermediate vector for each row of the access matrix of the access control to generate a corresponding key ciphertext of each of the data items.

[0144] The embodiments of the present application also provide a second device, as shown in the figure, the second device 900 includes a second communication interface 901 and a second processor 902; the second communication interface 901 is capable of information interaction with a third device; Figure 9 The second processor 902 is connected with the second communication interface 901 to realize information interaction with the third device, and is configured to execute a computer program to perform the method provided by one or more technical solutions of the second device side. The second memory 903 stores the computer program capable of running on the second processor 902. The second communication interface 901 is configured to send a data access request to the third device, the data access request carries an attribute and an identity of a user, and receive a key ciphertext and an encryption ciphertext sent by the third device.

[0145] In some embodiments, the second communication interface 901 is configured to receive the user key sent by the third device when the attribute satisfies the defined access control.

[0146] The second processor 902 is configured to obtain a plurality of data items based on the user key, the key ciphertext and the encryption ciphertext. In some embodiments, the second processor 902 is configured to determine that the data item corresponding to the encryption ciphertext cannot be accessed when the attribute does not satisfy the defined access control.

[0147]

[0148] ​In some embodiments, the apparatus provided by the embodiments of the present application can be implemented in a hardware manner. For example, the apparatus provided by the embodiments of the present application can be a processor in the form of a hardware decoding processor, which is programmed to perform the data processing method provided by the embodiments of the present application. For example, the processor in the form of a hardware decoding processor can be implemented by using one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Programmable Logic Devices (PLDs), Complex Programmable Logic Devices (CPLDs), Field-Programmable Gate Arrays (FPGAs), or other electronic elements.

[0149] The embodiments of the present application provide a computer program product, which includes a computer program or computer executable instructions stored in a computer readable storage medium. A processor of an electronic device reads the computer executable instructions from the computer readable storage medium, and the processor executes the computer executable instructions, so that the electronic device performs the data processing method provided by the embodiments of the present application.

[0150] The embodiments of the present application provide a computer readable storage medium, which stores computer executable instructions or computer programs. When the computer executable instructions or computer programs are executed by a processor, the processor will execute the data processing method provided by the embodiments of the present application, for example, the data processing method shown in FIG. 4. Figure 1 Or 4.

[0151] In some embodiments, the computer readable storage medium can be a RAM, a ROM, a flash memory, a magnetic surface memory, an optical disc, or a CD-ROM, etc. The computer readable storage medium can also be various devices including one or any combination of the above storage devices. In some embodiments, the computer executable instructions can be in the form of a program, software, software module, script or code, which can be written in any form of programming language (including a compiled or interpreted language, or a declarative or procedural language), and can be deployed in any form, including being deployed as an independent program or being deployed as a module, component, subroutine or other unit suitable for use in a computing environment.

[0152] By way of example, computer readable media can include computer- storage media and communication media. Computer-storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer-storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer.

[0153] By way of example, computer readable media can include computer- storage media and communication media. Computer-storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer-storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer.

[0154] The foregoing is merely illustrative of the principles of this application and various modifications can be made by those skilled in the art. For example, the principles described above can be applied to other types of data processing systems and data processing devices. Furthermore, no limitations are intended to the scope of the present application based on the teachings herein or the description thereof.

Claims

1. A data processing method, characterized in that, Applied to the first device, including: Obtain the dataset to be encrypted; the dataset to be encrypted includes multiple data items; Generate the encrypted ciphertext of the dataset to be encrypted; Generate key ciphertext; Send the key ciphertext and the encrypted ciphertext to a third device.

2. The method according to claim 1, characterized in that, The process of generating the encrypted ciphertext of the dataset to be encrypted includes: Generate an encryption key with the same dimensions as the dataset to be encrypted; The dataset to be encrypted is encrypted using an encryption key to generate the encrypted ciphertext.

3. The method according to claim 1 or 2, characterized in that, The generated key ciphertext includes: Define access control; the access control is used to constrain data decryption permissions through the matching relationship between policies and attributes; Select a first random number for each of the plurality of data items; Construct a first random vector and a second random vector based on the first random number; For each row of the access control access matrix, a first intermediate vector and a second intermediate vector are calculated based on the first random vector and the second random vector; the first intermediate vector and the second intermediate vector are used as exponential parameters for bilinear operations. For each row of the access control access matrix, a bilinear operation is performed based on the second random number, the first intermediate vector, and the second intermediate vector to generate the key ciphertext corresponding to each item.

4. A data processing method, characterized in that, Applied to a second device, including: Send a data access request to a third device; the data access request carries the user's attributes and identity identifier; Receive the key ciphertext and encrypted ciphertext sent by the third device.

5. The method according to claim 4, characterized in that, The method further includes: When the attribute satisfies the defined access control, the user key sent by the third device is received. Based on the user key, the key ciphertext, and the encrypted ciphertext, multiple data items are obtained.

6. The method according to claim 4 or 5, characterized in that, The method further includes: When the attribute does not meet the defined access control, it is determined that the data item corresponding to the encrypted ciphertext cannot be accessed.

7. A first device, characterized in that, Includes a first communication interface and a first processor; wherein, The first processor is used to obtain a dataset to be encrypted; the dataset to be encrypted includes multiple data items; The first processor is used to generate the encrypted ciphertext of the dataset to be encrypted; The first processor is used to generate key ciphertext; The first communication interface is used to send the key ciphertext and the encrypted ciphertext to the third device.

8. A second device, characterized in that, Includes a second communication interface and a second processor; wherein, The second communication interface is used to send a data access request to the third device; the data access request carries the user's attributes and identity identifier. The second communication interface is used to receive the key ciphertext and encrypted ciphertext sent by the third device.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3 or 4 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3 or 4 to 6.

Images