Attribute-driven single-encryption multi-level differential privacy output method

Abstract

This invention discloses a single-pass encryption multi-level differential privacy output method based on attribute-driven principles. The method comprises three entities: an attribute management organization, a data owner, and a data accessor. The steps include: the attribute management organization inputs data information into a computer system and performs system initialization based on the security parameters, generating a system master key, public parameters, and directory metadata, which are then signed and published; the data owner obtains the directory metadata and the signature result for verification, generating multiple privacy-level output results through incremental noise accumulation; and combines attribute encryption and authentication encryption mechanisms to form an encrypted data packet; the data accessor obtains the encrypted data packet and directory metadata, performs consistency verification, and upon successful verification, performs decryption operations from highest to lowest privacy level, outputting the highest-level result. This invention improves privacy protection capabilities while ensuring data availability and is suitable for multi-level access control data sharing scenarios.

Description

Technical Field

[0001] This invention relates to the field of data security and privacy protection technology, and in particular, to an attribute-driven single-pass encryption multi-level differential privacy output method. Background Technology

[0002] With the rapid development of technologies such as cloud computing, big data, and the Internet of Things, the demand for data sharing across organizations and systems continues to grow. In actual business data sharing scenarios, data access users typically have hierarchical access permissions. Higher-privilege users expect to obtain more accurate data results to support in-depth business analysis and decision-making. Lower-privilege users only receive statistical results that have been affected by noise or have reduced precision, thereby reducing the risk of personal information leakage and protecting the privacy and security of data subjects.

[0003] Currently, attribute-based access control and attribute encryption technologies are being applied in data sharing permission management due to their flexible, fine-grained authorization capabilities. These technologies can accurately determine and authorize data access permissions based on user attribute sets and preset access policies. However, these technologies typically focus on determining whether an accessor has decryption privileges. Once an accessor meets the access policy and completes data decryption, they often directly obtain complete plaintext or high-precision data, making it difficult to further limit output precision or privacy protection strength after decryption. This presents a technical problem of uncontrollable privacy after decryption.

[0004] Differential privacy technology, as a means to provide formal privacy protection, can effectively avoid the risk of personal information leakage by injecting pre-audit noise into raw data or query results. However, in data sharing scenarios with multi-level permissions, the privacy budget parameters of differential privacy technology are often statically configured by the data publisher, making it difficult to establish a deterministic binding relationship with the access permissions of visitors. This results in the inability to output data results with different privacy protection levels for visitors with different permission levels. Furthermore, if multiple data outputs with different noise levels are generated and published to adapt to visitors with different permission levels, it usually requires multiple processing or even multiple encryptions of the same set of data. This not only incurs computational and management overhead but may also introduce security risks such as the forgery, splicing, or replaying of low-noise results.

[0005] In summary, attribute-based access control and attribute encryption technologies suffer from the drawback of uncontrollable privacy after decryption. Differential privacy technologies, in multi-level scenarios, are limited by insufficient privacy budget and permission binding, high cost and risk of multiple version releases. Therefore, to address these limitations, a single-encryption multi-level differential privacy output method based on attribute-driven principles is proposed. Summary of the Invention

[0006] The main objective of this invention is to provide an attribute-driven single-encryption multi-level differential privacy output method to address the shortcomings of existing attribute-based access control and attribute encryption technologies, which suffer from uncontrollable privacy after decryption. Differential privacy technology also suffers from insufficient privacy budget and permission binding in multi-level scenarios, high cost of multiple version releases, and the risk of low-noise results being forged, spliced, or replayed.

[0007] Based on the first main aspect of the present invention, a single-pass encrypted multi-level differential privacy output method based on attribute-driven methods is provided. This method includes three entities: an attribute management agency, a data owner, and a data accessor. The method comprises the following steps:

[0008] The attribute management organization inputs data information into the computer system; the data information includes security parameters, data sensitivity level, multi-level access policy, number of output layers, and budget pairs; and performs system initialization based on the security parameters to generate the system master key and public parameters;

[0009] Noise-derived keys are generated based on data sensitivity levels and multi-level access strategies. Directory metadata is constructed and signed to obtain a signature result. The directory metadata and signature result are then published.

[0010] The data owner obtains the directory metadata and signature results for verification, constructs incremental noise, and generates multiple privacy-level output results by accumulating incremental noise.

[0011] The data owner randomly generates a session key and derives symmetric keys for the data side and the parameter side. The data is then encapsulated using a ciphertext policy attribute encryption. Simultaneously, the output result and its corresponding privacy parameters are encrypted using an authentication encryption algorithm to form an encrypted data packet.

[0012] The data accessor obtains the encrypted data packet and directory metadata, performs consistency verification, and if the verification is successful, performs decryption operations from high to low level, outputting the result of the highest obtainable level.

[0013] As a further preferred embodiment, in the aforementioned method, the access strategy is represented by an attribute-based access control structure, which is a Boolean logic expression or a linear secret sharing structure.

[0014] The system initialization execution steps include:

[0015] The attribute management organization runs the initialization algorithm for encrypted attribute encryption based on preset security parameters, generates the attribute encryption common key and the system master key, and runs the signature algorithm to generate a signature key pair;

[0016] Simultaneously, the hash function and authentication encryption scheme are fixed, authentication encryption algorithm configuration parameters are formed, public parameters are published, and the system master key and signature key pair are stored.

[0017] As a further preferred embodiment, in the aforementioned method, the step of generating the noise-derived key includes:

[0018] The attribute management organization uses bilinear mapping to bind the data sensitivity level, multi-level access strategy and the system master key to obtain the noise-derived key;

[0019] Specifically:

[0020]

[0021] in, To standardize coding, It is a bilinear mapping. The secret index associated with the master key. For hash functions, This is the system master key. Sensitivity level, For the first The access strategy corresponding to the layer This represents the group generator in an attribute-based cryptosystem. This represents a cryptographic key derivation function. Indicates a noise-derived key;

[0022] The execution steps for signing and publishing directory metadata include:

[0023] The directory metadata includes directory identifier, version number, validity period, access policy, and privacy budget parameters;

[0024] Perform a serialization operation on the constructed directory metadata, convert it into a standard bit string format, and then sign it using its own signing key to obtain the signature result;

[0025] The final constructed directory metadata and the signature result are published together, completing the process of signing and publishing the directory metadata.

[0026] As a further preferred embodiment, in the aforementioned method, the steps for the data owner to verify the directory metadata and signature result include:

[0027] The data owner performs three checks on the directory metadata obtained and the signature result:

[0028] First, the verification function is called, and the signature public key in the signature key pair of the attribute management agency is used to match and verify the serialized metadirectory data with the signature result;

[0029] Secondly, check whether the current time is within the expiration period specified in the directory metadata;

[0030] Finally, check if the version number of the directory metadata is a trusted version;

[0031] If any verification fails, the process will terminate and refuse to generate the encrypted packet.

[0032] The steps for constructing incremental noise include:

[0033] The data owner calculates the actual query results and determines the sensitivity parameters;

[0034] The sensitivity parameter can be obtained by the sensitivity level mapping provided by the attribute management agency, or it can be calculated by the data owner according to the query type and then verified to be consistent with the sensitivity level in the directory metadata.

[0035] Based on the sensitivity parameter, the data owner generates incremental noise using the following formula:

[0036] Specifically:

[0037]

[0038]

[0039] in, Represents the Laplace distribution. Represents the sensitivity parameter. This represents the differential privacy budget corresponding to layer 1. Indicates the first Differential privacy budget corresponding to the layer, This represents the incremental noise of the first layer. Indicates the first Incremental noise of the layer, Indicates a hierarchical index;

[0040] The execution steps for generating output results with multiple privacy levels include:

[0041] Multiple privacy-level output results are obtained based on the actual query results and the accumulated incremental noise results; if the output results are vectors, the incremental noise can be sampled independently by dimension, or sampled using any of the same distribution vector noise mechanisms.

[0042] As a further preferred embodiment, in the aforementioned method, the specific steps for forming the encrypted data packet are as follows:

[0043] First, perform the encapsulation operation of ciphertext policy attribute encryption, as shown in the following formula:

[0044]

[0045] in, This refers to an encryption algorithm that uses ciphertext policy attributes for encryption. This refers to the encrypted public parameters of the attributes generated by the attribute management organization. Indicates the first Layer session key, Indicates the first The key ciphertext of the layer;

[0046] Secondly, construct related data.

[0047]

[0048] in, Indicates the number of output layers. Indicates directory identifier, Indicates the directory version number. Directory expiration time The hash value representing the ciphertext of the key. Indicates an encrypted version. Indicates the first Layer-related data;

[0049] Furthermore, perform data-side symmetric key encryption and parameter-side symmetric key encryption:

[0050]

[0051]

[0052] in, This indicates an authentication encryption algorithm with associated data. This represents the associated data on the data side of the first layer. Indicates the first Related data on the parameter side of the layer Indicates the first The data side symmetric key of the layer, Indicates the first The layer's parametric side symmetric key, Indicates the first Differential privacy output results of the layer, Indicates the first The layer output ciphertext, Indicates the first Layer parameter ciphertext;

[0053] Finally, the data owner generates an encrypted data packet and sends the encrypted data packet to the data accessor.

[0054] As a further preferred embodiment, in the aforementioned method, the specific execution process of the consistency verification is as follows:

[0055] Data visitors first verify the signature and validity period of the directory metadata, and then check for consistency of the content;

[0056] The consistency content includes:

[0057] Does the identifier of the encrypted data packet match the directory identifier of the directory metadata?

[0058] Does the version number of the encrypted data packet match the directory version number of the directory metadata?

[0059] Does the expiration time of the encrypted data packet not exceed the expiration time of the directory metadata?

[0060] During verification, if any consistent content is inconsistent, the data accessor will refuse to process it.

[0061] As a further preferred embodiment, in the aforementioned method, the decryption operation includes decapsulation, reconstruction of associated data, and decryption output, with the specific execution steps as follows:

[0062] Starting from the top layer, perform the decryption operation sequentially downwards to the first layer:

[0063] The decapsulation process includes:

[0064] The decryption algorithm of the ciphertext policy attribute encryption is invoked, and the private key of attribute encryption is used to decrypt the key text of the current level to obtain the session key of the current level; if the decapsulation operation fails, the current level is skipped and the decryption attempt is continued to the next lower level.

[0065] The steps for reconstructing the associated data include:

[0066] Extract the entry structure of the current level from the encrypted data packet, combine it with the corresponding field in the directory metadata, reconstruct the associated data of the level, and at the same time confirm that the key ciphertext hash in the reconstructed associated data is consistent with the original value;

[0067] The decryption output result is achieved through the following calculation:

[0068]

[0069]

[0070] in, This represents a hash-based key derivation function. This represents the session key obtained after decapsulation. This represents the decryption operation of the authentication encryption algorithm. Indicates the first The layer output ciphertext, Indicates the first Layer-related data Indicates salinity. Indicates asking for information from above or below. Indicates the length of the output key. Indicates the first Differential privacy output results for each layer;

[0071] If the authentication process of the encryption algorithm fails, the current level is rejected and the next lower level is tried.

[0072] When a certain level successfully completes the decapsulation and authentication / decryption process, the differential privacy result of that level is output, and decryption at subsequent lower levels is stopped.

[0073] The decryption operation also includes decryption audit parameters:

[0074] Specifically, using the current layer noise-derived key as the salt value and the session key as input, through... The function generates a symmetric key on the parameter side;

[0075] Based on the aforementioned parameter-side symmetric key, and in conjunction with associated data, the ciphertext of the parameters in the encrypted data packet is decrypted using an authentication encryption algorithm to obtain the privacy budget and sensitivity parameters for this level.

[0076] Based on a second key aspect of the present invention, a single-pass encrypted multi-level differential privacy output system based on attribute-driven methods is provided, comprising:

[0077] The system initialization module is used to input data information to generate the system master key and public parameters;

[0078] A privacy parameter binding module is used to generate noisy derived keys based on access policies and data sensitivity.

[0079] A single-encryption multi-level output generation module is used to generate encrypted output results with multiple privacy levels during a single encryption process;

[0080] The decryption and output module is used to decrypt and output the matching privacy level results based on user attributes.

[0081] According to a third key aspect of the present invention, an electronic device is provided, comprising: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0082] The memory stores a computer program that, when executed by the processor, causes the processor to perform the aforementioned attribute-driven single-pass encryption multi-level differential privacy output method.

[0083] Based on a fourth key aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed, implements the attribute-driven single-pass encryption multi-level differential privacy output method as described above.

[0084] Compared with existing technologies, this invention provides an attribute-driven single-encryption multi-level differential privacy output method. First, this invention binds the access policy of the ciphertext policy attribute encryption with the privacy budget and output precision of the multi-level differential privacy, establishing a correspondence between attribute permissions and privacy protection strength. This solves the shortcomings of traditional attribute encryption technology, which only determines access permissions and has uncontrollable privacy after decryption. It ensures that high-privilege users can only obtain the corresponding high-precision differential privacy output, while low-privilege users can only obtain low-precision privacy-protected results, avoiding the risk of high-precision data being leaked to low-privilege users.

[0085] Secondly, this invention uses an incremental noise accumulation mechanism to generate multi-level differential privacy output with a single encryption, eliminating the need to process and encrypt the original data separately for visitors with different permission levels. This solves the problem of insufficient privacy budget and permission binding in traditional differential privacy technology, and also reduces the computational and management overhead caused by the release of multiple versions of data. At the same time, through the binding and hash verification mechanism of associated data, it effectively avoids the security risks of low-noise results being forged, spliced, and replayed.

[0086] Finally, this invention achieves multi-level privacy protection output for the same data by unifying the attribute access control mechanism and the differential privacy protection mechanism, without repeatedly encrypting the original data. Furthermore, after obtaining the privacy output results, data users can further decrypt the corresponding privacy budget parameters and sensitivity parameters for privacy compliance auditing and result credibility verification, thereby achieving the auditability of the multi-level differential privacy output. Attached Figure Description

[0087] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0088] Figure 1 The following is a flowchart illustrating the execution of an attribute-driven single-pass encryption multi-level differential privacy output method according to an embodiment of the present invention. Detailed Implementation

[0089] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the invention. It should be understood that the following embodiments are not intended to limit the scope of the invention, but are merely illustrative of the essential spirit of the technical solution of the invention.

[0090] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0091] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0092] The following is a description of the specific meanings of technical terms, English abbreviations, and formula parameters that may be used in this invention:

[0093] Differential privacy definition: random mechanism satisfy - Differential privacy, when considering any adjacent datasets With any set of output events ,satisfy

[0094]

[0095] The total budget for multiple sequential combinations of mechanisms is:

[0096] Query and Sensitivity: For query functions To make the actual output ,That -Sensitivity is defined as

[0097] in, Represents the d-dimensional real space. This represents the set of all adjacent dataset pairs.

[0098] CP-ABE: Ciphertext Policy Attribute Encryption. The access policy is embedded in the ciphertext, and the user's private key is embedded in their own attribute set. Decryption can only be completed when the user's attribute set satisfies the access policy carried in the ciphertext.

[0099] HKDF: Hash-based key generation function, is a cryptographic key derivation algorithm based on the Hexi Message Authentication Code. It can derive one or more keys with cryptographic security strength from input key material of arbitrary length.

[0100] AEAD: Authentication Encryption with Associated Data is a general term for a class of symmetric encryption algorithms. It combines data encryption with integrity and authenticity authentication functions. It can encrypt and protect core data while authenticating associated data to prevent data from being tampered with, forged, or replayed.

[0101] DP: Differential Privacy, a privacy protection technology framework based on rigorous mathematical proof. By injecting pre-set random noise into the dataset or query results, the addition or removal of any record will not significantly affect the probability distribution of the query results. Attackers cannot infer whether a specific individual exists in the original dataset from the final output results, thereby achieving a balance between individual privacy and data availability.

[0102] Attribute-driven: A technical paradigm that uses the attribute characteristics of users or data as the core basis to determine the access permissions, processing strategies, or output formats of data.

[0103] Multi-level differential privacy output: Based on different privacy protection strength requirements, a technical solution is to inject noise perturbation of different strengths into the same original query result to generate multiple privacy protection output results with gradient differences. Different output results correspond to different privacy protection levels and precision.

[0104] like Figure 1 As shown, in one embodiment, an attribute-driven single-pass encrypted multi-level differential privacy output method of the present invention includes the following steps S1-S5:

[0105] S1, the attribute management agency inputs data information into the computer system; the data information includes security parameters, data sensitivity level, multi-level access policy, output layer number, budget pair; and performs system initialization based on the security parameters to generate system master key and public parameters;

[0106] S2, Generate a noisy derived key based on the data sensitivity level and multi-level access strategy, construct directory metadata and sign it to obtain a signature result, and publish the directory metadata and the signature result;

[0107] S3, the data owner obtains the directory metadata and signature results for verification, constructs incremental noise and generates multiple privacy-level output results by accumulating incremental noise;

[0108] S4, the data owner randomly generates a session key and derives symmetric keys for the data side and the parameter side, encapsulates the attribute encryption using a ciphertext policy attribute encryption, and simultaneously encrypts the output result and its corresponding privacy parameters using an authentication encryption algorithm to form an encrypted data packet;

[0109] S5, the data accessor obtains the encrypted data packet and directory metadata, performs consistency verification, and if the verification is successful, performs decryption operations from high to low level, and outputs the result of the highest obtainable level.

[0110] In one feasible embodiment, the present invention includes the following entities:

[0111] Attribute Authority (AA): Used for system initialization, publishing policy catalog metadata, generating noise-derived keys that are bound to access policies and sensitivities, and signing catalog metadata for external verification.

[0112] Data Owner (DO): Used to perform differential privacy perturbations on raw data or query results and generate multi-level privacy-preserving ciphertext packages during a single encryption process.

[0113] Data access user: Used to decrypt the output with the privacy level matching their permissions based on their own attribute key, and can decrypt the corresponding privacy parameters for auditing or compliance checks.

[0114] The overall process of this invention includes the AA stage, the EncML stage, and the DecML stage.

[0115] Specifically, the AA phase includes system initialization and directory metadata publication.

[0116] EncML stage: DO performs a single encryption and generates a multi-level differential privacy output ciphertext packet;

[0117] DecML phase: The User decrypts based on attributes and obtains the privacy level output that matches their permissions, and can also decrypt privacy parameters for auditing.

[0118] In this embodiment, privacy level refers to the different output precision results of the same query result under different privacy budget parameters, denoted as hierarchical index. .

[0119] For ease of description, the following conventions are used. ,in The corresponding output level with the highest precision (lowest noise).

[0120] Access Policy It is an access structure (AND / OR threshold tree) used for CP-ABE key encapsulation.

[0121] The directory metadata is used for publishing policies, budgets, and sensitivity bindings, and includes a version number and expiration date; the version number is used to upgrade or revert old policies, and the expiration date is used to resist replay.

[0122] In one feasible embodiment, step S1 is described in detail:

[0123] System initialization (executed by Attribute Management Authority AA):

[0124] Attribute Management Agency AA uses security parameters As input, run CP-ABE.Setup to generate attribute encryption public and master key pairs. Run the signature algorithm to generate a signature key pair.

[0125] Meanwhile, a fixed hash function and authentication encryption scheme are used:

[0126]

[0127] Select AEAD and confirm. Parameters such as nonce length and tag length.

[0128] Attribute Management Organization AA issued the following statement:

[0129]

[0130] And store safely , .

[0131] In one feasible embodiment, step S2 is described in detail:

[0132] Directory metadata publication and noise-derived key generation (executed by the Attribute Management Authority (AA)):

[0133] Attribute Management Agency (AA) gives sensitivity level Number of output layers And the strategy for each layer and provide the budget. .

[0134] The attribute management authority (AA) may optionally perform the following constraint checks:

[0135] (1) Inspection Monotonically increasing: ;

[0136] (2) Check the minimum interval: ;

[0137] in, The system presets thresholds to prevent values ​​from being too close, which could lead to abnormal noise scales.

[0138] The Attribute Management Authority (AA) generates noise-derived keys for each layer. The core idea is to bind the strategy and sensitivity to the master key through a bilinear mapping:

[0139]

[0140] in, To standardize coding, It is a bilinear mapping. The secret index associated with the master key. For hash functions, This is the system master key. Sensitivity level, For the first The access strategy corresponding to the layer This represents the group generator in an attribute-based cryptosystem. This represents a cryptographic key derivation function. Indicates a noise-derived key;

[0141] And record and The relationship between them.

[0142] in, To standardize coding, It is a bilinear mapping. The secret index associated with the master key. For hash functions, This is the system master key. Sensitivity level, For the first The access strategy corresponding to the layer This represents the group generator in an attribute-based cryptosystem. This represents a cryptographic key derivation function. Indicates a noise-derived key;

[0143] This construction makes it possible to... (without mastering...) In this situation, attackers cannot predict This prevents the forgery of derived keys used for parameter-side decryption, ensuring policy / sensitivity and parameter key binding.

[0144] Attribute Management Authority (AA) constructs directory metadata

[0145]

[0146] in, Indicates directory identifier; Indicates the version number (used for policy upgrades or reversals); Indicates the validity period; Indicates the sensitivity level or sensitivity parameter identifier; Indicates the number of layers; Indicates the first Layer strategy, budget, and noise-derived key entries.

[0147] And sign it:

[0148]

[0149] in, This represents the serialization function. Digital signature algorithm.

[0150] Finally, the attribute management organization AA released... .

[0151] In one feasible embodiment, step S3 is described in detail:

[0152] Single-sample multi-level output and encrypted packet generation (EncML, executed by the data owner DO):

[0153] (1) Validation of the directory:

[0154] Data owner DO acquisition ,implement:

[0155] Verify signature:

[0156]

[0157] Verify current time:

[0158]

[0159] examine Is it a trusted version?

[0160] If any verification fails, the process terminates and refuses to generate the encrypted packet.

[0161] (2) Calculate the actual query results and sensitivity:

[0162] DO calculates the actual query results :

[0163]

[0164] in, Represents the original dataset. Represents query function , Let represent the d-dimensional real space.

[0165] And determine the sensitivity parameters It can be provided by AA The mapping can be obtained, or it can be calculated by DO based on the query type and compared with the directory. Verify consistency.

[0166] (3) Single-sample multi-stage DP output:

[0167] Data owner (DO) generates incremental noise:

[0168]

[0169]

[0170] in, Represents the Laplace distribution. Represents the sensitivity parameter. , representing the differential privacy budget corresponding to layer 1. Indicates the first Differential privacy budget corresponding to the layer, This represents the incremental noise of the first layer. Indicates the first Incremental noise of the layer, This indicates a hierarchical index.

[0171] And the output of each layer is accumulated:

[0172]

[0173] in, Indicates the first Differential privacy output results of the layer, This represents the actual query results. Indicates the first Incremental noise of the layer.

[0174] When the output is a vector, It can be sampled independently by dimension, or a similarly distributed vector noise mechanism can be used.

[0175] This invention does not limit the specific implementation, as long as it meets the corresponding requirements. -DP is sufficient.

[0176] In one feasible embodiment, step S4 is described in detail:

[0177] (1) Session key generation and derivation:

[0178] For each layer The data owner (DO) generates the session key using a secure random number generator: And derive symmetric keys for the data side and the parameter side:

[0179]

[0180]

[0181] in, Indicates salinity. , Indicates contextual information, Indicates the length of the output key.

[0182] As a salt, the policy / sensitivity binding is injected into the parameter-side key derivation, thereby achieving a strong binding between audit parameters and policies.

[0183] (2) Key encapsulation and AEAD-associated data binding:

[0184] Encryption performs the following operations at each layer of the original data:

[0185] CP-ABE package:

[0186]

[0187] in, Indicates the first The key ciphertext of the layer, This indicates the encryption algorithm for the ciphertext policy attribute.

[0188] Constructing related data:

[0189]

[0190] in, Indicates the first The hash value of the layer's key ciphertext is used to bind the session key encapsulation header to the output ciphertext, preventing cross-layer concatenation and substitution. Indicates the encryption algorithm version. Indicates the effective deadline.

[0191] Data-side encryption:

[0192]

[0193] Parameter-side encryption:

[0194]

[0195] in, This indicates an authentication encryption algorithm with associated data. This represents the associated data on the data side of the first layer. Indicates the first Related data on the parameter side of the layer Indicates the first The data side symmetric key of the layer, Indicates the first The layer's parametric side symmetric key, Indicates the first Differential privacy output results of the layer, Indicates the first The layer output ciphertext, Indicates the first Layer parameter ciphertext;

[0196] After all the steps required in the encryption process described above, the data owner (DO) generates the encrypted data packet. :

[0197]

[0198] in,

[0199]

[0200] Encrypt data packets Send or publish to the data visitor (User).

[0201] In one feasible embodiment, step S5 is described in detail:

[0202] Attribute-based decryption, output, and auditing (DecML, executed by the data access user):

[0203] (1) Directory / ciphertext consistency verification:

[0204] User verifies the directory signature and validity period, and checks:

[0205]

[0206]

[0207]

[0208] If there is a discrepancy, the application will be rejected.

[0209] (2) Decrypt from high to low level (refinement: failed branches)

[0210] right Perform the following operations:

[0211] ABE decapsulation:

[0212]

[0213] If you fail, you proceed to the next level.

[0214] reconstruction :from Reconstructing with directory fields and check Consistent.

[0215] Decryption output:

[0216]

[0217]

[0218] If AEAD authentication fails, the layer is rejected and the process proceeds to the next layer.

[0219] Decrypt audit parameters:

[0220]

[0221] in, This represents a hash-based key derivation function. This represents the session key obtained after decapsulation. This represents the decryption operation of the authentication encryption algorithm. Indicates the first The layer output ciphertext, Indicates the first Layer-related data Indicates salinity. Indicates asking for information from above or below. Indicates the length of the output key. Indicates the first Differential privacy output results for each layer.

[0222] (3) Output the highest level result.

[0223] When a certain level exists Upon successful decapsulation and authentication, the output will be... This stops subsequent decryption attempts, ensuring that the visitor only receives the highest precision output that matches their attribute permissions.

[0224] In the above embodiments, At the same time bound as well as .

[0225] Therefore, when attackers attempt to access different levels of... Other levels When performing directory version concatenation or reusing expired encrypted packages, it will result in... Inconsistency causes AEAD authentication decryption to fail, and the system refuses to output, thus resisting tampering, splicing, and replay attacks.

[0226] Furthermore, this embodiment does not limit the specific construction of CP-ABE, the implementation of the AEAD algorithm, the underlying hash of HKDF, etc., as long as the equivalent functionality and security requirements are met.

[0227] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0228] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A single-pass encrypted multi-level differential privacy output method based on attribute-driven approach, characterized in that, This method includes three entities: attribute management authority, data owner, and data accessor. The method comprises the following steps: The attribute management organization inputs data information into the computer system; the data information includes security parameters, data sensitivity level, multi-level access policy, output layer number, and budget pair; and performs system initialization based on the security parameters to generate the system master key and public parameters; Noise-derived keys are generated based on data sensitivity levels and multi-level access strategies. Directory metadata is constructed and signed to obtain a signature result. The directory metadata and signature result are then published. The data owner obtains the directory metadata and signature results for verification, constructs incremental noise, and generates multiple privacy-level output results by accumulating incremental noise. The data owner randomly generates a session key and derives symmetric keys for the data side and the parameter side. The data is then encapsulated using a ciphertext policy attribute encryption. Simultaneously, the output result and its corresponding privacy parameters are encrypted using an authentication encryption algorithm to form an encrypted data packet. The data accessor obtains the encrypted data packet and directory metadata, performs consistency verification, and if the verification is successful, performs decryption operations from high to low level, outputting the highest obtainable level result. The steps for the data owner to verify the directory metadata and signature results include: The data owner performs three checks on the directory metadata obtained and the signature result: First, the verification function is called, and the signature public key in the signature key pair of the attribute management agency is used to match and verify the serialized metadirectory data with the signature result; Secondly, check whether the current time is within the expiration period specified in the directory metadata; Finally, check if the version number of the directory metadata is a trusted version; If any verification fails, the process will terminate and refuse to generate the encrypted packet. The steps for constructing incremental noise include: The data owner calculates the actual query results and determines the sensitivity parameters; The sensitivity parameter can be obtained by the sensitivity level mapping provided by the attribute management agency, or it can be calculated by the data owner according to the query type and then verified to be consistent with the sensitivity level in the directory metadata. Based on the sensitivity parameter, the data owner generates incremental noise using the following formula: Specifically: in, Represents the Laplace distribution. Represents the sensitivity parameter. This represents the differential privacy budget corresponding to layer 1. Indicates the first Differential privacy budget corresponding to the layer, This represents the incremental noise of the first layer. Indicates the first Incremental noise of the layer, Indicates a hierarchical index; The execution steps for generating output results with multiple privacy levels include: Multiple privacy-level output results are obtained based on the actual query results and the accumulated incremental noise results; if the output results are vectors, the incremental noise can be sampled independently by dimension, or sampled using any of the same distribution vector noise mechanisms.

2. The attribute-driven single-pass encryption multi-level differential privacy output method according to claim 1, characterized in that, The access strategy is represented by an attribute-based access control structure, which is either a Boolean logic expression or a linear secret sharing structure. The system initialization execution steps include: The attribute management organization runs the initialization algorithm for encrypted attribute encryption based on preset security parameters, generates the attribute encryption common key and the system master key, and runs the signature algorithm to generate a signature key pair; Simultaneously, the hash function and authentication encryption scheme are fixed, authentication encryption algorithm configuration parameters are formed, public parameters are published, and the system master key and signature key pair are stored.

3. The attribute-driven single-pass encryption multi-level differential privacy output method according to claim 1, characterized in that, The steps for generating the noise-derived key include: The attribute management organization uses bilinear mapping to bind the data sensitivity level, multi-level access strategy and the system master key to obtain the noise-derived key; Specifically: in, To standardize coding, It is a bilinear mapping. The secret index associated with the master key. For hash functions, This is the system master key. Sensitivity level, For the first The access strategy corresponding to the layer This represents the group generator in an attribute-based cryptosystem. This represents a cryptographic key derivation function. Indicates a noise-derived key; The execution steps for signing and publishing directory metadata include: The directory metadata includes directory identifier, version number, validity period, access policy, and privacy budget parameters; Perform a serialization operation on the constructed directory metadata, convert it into a standard bit string format, and then sign it using its own signing key to obtain the signature result; The final constructed directory metadata and the signature result are published together, completing the process of signing and publishing the directory metadata.

4. The attribute-driven single-pass encryption multi-level differential privacy output method according to claim 1, characterized in that, The specific steps for forming the encrypted data packet are as follows: First, perform the encapsulation operation of ciphertext policy attribute encryption, as shown in the following formula: in, This refers to an encryption algorithm that uses ciphertext policy attributes for encryption. This refers to the encrypted public parameters of the attributes generated by the attribute management organization. Indicates the first Layer session key, Indicates the first The key ciphertext of the layer; Secondly, construct related data. in, Indicates directory identifier, Indicates the directory version number. Directory expiration time The hash value representing the ciphertext of the key. Indicates an encrypted version. Indicates the first Layer-related data; Furthermore, perform data-side symmetric key encryption and parameter-side symmetric key encryption: in, This indicates an authentication encryption algorithm with associated data. This represents the associated data on the data side of the first layer. Indicates the first The associated data on the parameter side of the layer, Indicates the first The data side symmetric key of the layer, Indicates the first The parameter side symmetric key of the layer, Indicates the first Differential privacy output results of the layer, Indicates the first The layer output ciphertext, Indicates the first Layer parameter ciphertext; Finally, the data owner generates an encrypted data packet and sends the encrypted data packet to the data accessor.

5. The attribute-driven single-pass encryption multi-level differential privacy output method according to claim 1, characterized in that, The specific execution process of the consistency verification is as follows: Data visitors first verify the signature and validity period of the directory metadata, and then check for consistency of the content; The consistency content includes: Does the identifier of the encrypted data packet match the directory identifier of the directory metadata? Does the version number of the encrypted data packet match the directory version number of the directory metadata? Does the expiration time of the encrypted data packet not exceed the expiration time of the directory metadata? During verification, if any consistent content is inconsistent, the data accessor will refuse to process it.

6. The attribute-driven single-pass encryption multi-level differential privacy output method according to claim 1, characterized in that, The decryption operation includes decapsulation, reconstruction of associated data, and decryption output. The specific execution steps are as follows: Starting from the top layer, perform the decryption operation sequentially downwards to the first layer: The decapsulation process includes: The decryption algorithm of the ciphertext policy attribute encryption is invoked, and the private key of attribute encryption is used to decrypt the key text of the current level to obtain the session key of the current level; if the decapsulation operation fails, the current level is skipped and the decryption attempt is continued to the next lower level. The steps for reconstructing the associated data include: Extract the entry structure of the current level from the encrypted data packet, combine it with the corresponding field in the directory metadata, reconstruct the associated data of the level, and at the same time confirm that the key ciphertext hash in the reconstructed associated data is consistent with the original value; The decryption output result is achieved through the following calculation: in, This represents a hash-based key derivation function. This represents the session key obtained after decapsulation. This represents the decryption operation of the authentication encryption algorithm. Indicates the first The layer output ciphertext, Indicates the first Layer-related data, Indicates salinity. Indicates asking for information from above or below. Indicates the length of the output key. Indicates the first Differential privacy output results for each layer; If the authentication process of the encryption algorithm fails, the current level is rejected and the next lower level is tried. When a certain level successfully completes the decapsulation and authentication / decryption process, the differential privacy result of that level is output, and decryption at subsequent lower levels is stopped. The decryption operation also includes decryption audit parameters: Specifically, using the current layer noise-derived key as the salt value and the session key as input, through... The function generates a symmetric key on the parameter side; Based on the symmetric key on the parameter side and combined with the associated data, the ciphertext of the parameters in the encrypted data packet is decrypted through the authentication encryption algorithm to obtain the privacy budget and sensitivity parameters at this level.

7. A property-driven single-pass encryption multi-level differential privacy output system, employing the property-driven single-pass encryption multi-level differential privacy output method as described in any one of claims 1-6, characterized in that, include: The system initialization module is used to input data information to generate the system master key and public parameters; A privacy parameter binding module is used to generate noisy derived keys based on access policies and data sensitivity. A single-encryption multi-level output generation module is used to generate encrypted output results with multiple privacy levels during a single encryption process; The decryption and output module is used to decrypt and output the matching privacy level results based on user attributes.

8. An electronic device, characterized in that, include: The processor, communication interface, memory, and communication bus are connected, with the processor, communication interface, and memory communicating with each other via the communication bus. The memory stores a computer program that, when executed by the processor, causes the processor to perform the attribute-driven single-pass encryption multi-level differential privacy output method according to any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed, it implements the attribute-driven single-pass encryption multi-level differential privacy output method as described in any one of claims 1 to 6.

Images