A file layered ciphertext policy attribute-based encryption method, system, and electronic device

Abstract

This invention provides a file hierarchical ciphertext policy attribute-based encryption method, system, and electronic device, relating to the field of cryptography. The method includes: a trusted center generating a master public key and a master private key; a user generating an identity private key pair, and the trusted center generating an outsourced decryption key based on the identity public key and sending it to a cloud server; the data owner constructing a hierarchical access tree, associating symmetric keys with level nodes, and employing a dual polynomial mechanism to allocate secret and noise components to each node, thereby generating a complete ciphertext containing hierarchical ciphertext, attribute ciphertext, and transmission ciphertext, which is then uploaded to the cloud server; after verifying the user's request, the cloud server preprocesses the complete ciphertext using the user's outsourced decryption key, obtaining an outsourced decrypted ciphertext returned to the user; finally, the user uses their identity private key to decrypt the outsourced decrypted ciphertext, recovering the symmetric key and obtaining the target plaintext. This invention maintains the computational efficiency of file hierarchical encryption while effectively resisting multi-user collusion attacks.

Description

Technical Field

[0001] This invention relates to the fields of data security and cryptography, and more specifically, to a file layered ciphertext policy attribute-based encryption method, system, and electronic device. Background Technology

[0002] With the popularization of cloud computing, cloud storage services are widely used due to their convenience and scalability. Users encrypt data before uploading it to the cloud for secure storage and sharing. Attribute-Based Encryption (ABE), as an encryption technology that supports one-to-many sharing, enables fine-grained access control. Ciphertext-Policy ABE (CP-ABE) allows data owners to define their own access policies; decryption is only possible if user attributes meet the defined access policy, making it suitable for data sharing in cloud environments.

[0003] However, the traditional CP-ABE scheme faces efficiency bottlenecks when handling hierarchical multi-file structures. To optimize this scenario, researchers have proposed a CP-ABE scheme that supports file hierarchies. This scheme constructs a hierarchical access tree, organizing files with similar access permissions under the same subtree. Users only need to decrypt the root policy once to quickly access all sub-files within their access permissions using intermediate computation results, significantly reducing redundant computation overhead.

[0004] While layered access schemes improve efficiency, they also introduce new security risks. In a layered access tree, the ciphertexts of different files are linked through a multinomial secret sharing mechanism. This allows users with different permissions to potentially deduce the decryption keys of unauthorized parent or sibling nodes through joint computation (i.e., collusion attacks). Specifically, two users who can decrypt different child files under the same parent node can exchange and combine intermediate values ​​obtained during their decryption process, generated based on the same parent node's secret components, to illegally calculate the parent node's decryption information and gain unauthorized access to the files. Existing anti-collusion CP-ABE schemes mainly prevent collusion by embedding different random numbers in different user keys, but in a layered file scenario, this mechanism may fail due to the computational relationships between levels.

[0005] Therefore, there is an urgent need for a new encryption scheme that can fundamentally disrupt the computational correlation required for collusive attacks while maintaining the efficiency advantages of layered encryption of files, so as to ensure the security of layered data in cloud storage. Summary of the Invention

[0006] This invention aims to address the problem of multi-user collusion attacks in the existing layered encryption and decryption process for files. While maintaining the efficiency advantages of layered computation, this invention provides a secure encryption method that can effectively resist such attacks. Specifically, it addresses the following issues:

[0007] This prevents users with different access permissions to child nodes from accessing files on their parent node or other unauthorized sibling nodes through federated computation.

[0008] While introducing security enhancement mechanisms, the overall memory footprint of computing, storage, and communication is not excessively increased, thus maintaining the practicality of the solution.

[0009] Ensure the solution is compatible with existing performance optimization technologies such as outsourced decryption, reducing the burden on the user end.

[0010] To achieve the above objectives, this invention provides a file layered ciphertext policy attribute-based encryption method. Its core lies in introducing a key structure deeply bound to user identity through a dual polynomial mechanism, thereby disrupting the equation derivation relationships upon which collusion attacks rely. The method includes the following steps:

[0011] Step S1: System Initialization. Executed by a fully trusted center, the center selects the first and second master private parameters, constructs a bilinear mapping function, defines the required hash function, and randomly generates the system's master public key and the master key to be kept secret. The master key is cryptographically stored locally by the center.

[0012] Step S2: User Key Generation. The user first generates their own public and private identity keys. Then, the user registers with the Trusted Center to obtain their user attribute set. Based on the system master public key, master key, user attribute set, and the user's public identity key, the Trusted Center generates an outsourced decryption key for that user. The outsourced decryption key deeply embeds the user's public identity key information, ensuring that different users' private identity keys cannot be substituted for or used in combination. Simultaneously, the generated outsourced decryption key is securely sent to the cloud server.

[0013] Step S3: Layered Data Encryption. This step is performed by the data owner. The data owner first constructs a layered access tree, where leaf nodes are associated with attributes, and non-leaf nodes and leaf nodes constitute the access strategy. Each level node is associated with a symmetric key used for symmetric encryption of the file.

[0014] In step S3, the data owner defines two polynomials in parallel for each node in the access tree: a secret polynomial and a noise polynomial. For level nodes, the constant term of their secret polynomial is set to the secret component associated with that node, while the constant term of their noise polynomial is set to a random noise component. For non-level nodes, the constant terms of their two polynomials are determined by the value of the corresponding polynomial of their parent node at a specific index. Through this top-down construction method, a pair of values ​​is assigned to each node: a secret component and a noise component.

[0015] Next, the data owner uses the system's master public key, symmetric key, and the secret and noise components of each node to calculate and generate three types of ciphertext:

[0016] Layered ciphertext: Binds the symmetric key to the result of bilinear mapping encryption of the secret component and noise component of the level node;

[0017] Attribute ciphertext: generated based on the associated attributes of leaf nodes, secret components, and noise components, ensuring that only users with matching attributes can correctly decrypt it;

[0018] Transmission ciphertext: Calculated and generated for transmission nodes and their child nodes in the hierarchical access tree, used to authorize users to quickly decrypt subtree files under the same subtree without repeatedly traversing the entire hierarchical access tree;

[0019] Finally, the hierarchical ciphertext, attribute ciphertext, transmission ciphertext, and access tree structure description are packaged together into a complete ciphertext and uploaded to the cloud server.

[0020] Step S4: Outsourced Decryption. When a user sends an access request to the cloud server, the cloud server verifies its legitimacy. Upon successful verification, the cloud server uses the pre-stored outsourced decryption key for the user to preprocess the complete ciphertext. This process is a recursive calculation from leaf nodes to root nodes: for leaf nodes where the user attributes are satisfied, the cloud server uses the key component of the corresponding attribute from the outsourced decryption key to perform pairing operations with the attribute ciphertext of that leaf node, obtaining intermediate value pairs for the leaf nodes; for non-leaf nodes, the intermediate value pairs of nodes that meet the conditions are calculated using Lagrange interpolation. Finally, the cloud server calculates the partial decryption results corresponding to the highest-level node that the user is authorized to access. These partial decryption results not only contain the information needed to recover the target plaintext file key but also include the user's public key and noise components generated during the encryption process. The cloud server returns these partial decryption results, along with the related transmitted ciphertext, as the outsourced decrypted ciphertext to the user.

[0021] Step S5: Final Decryption by the User. After receiving the outsourced decrypted ciphertext, the user performs the final calculation using their own private key. Using their private key, the user can eliminate the influence of random factors introduced by their own public key in the outsourced decrypted ciphertext. The user can then recover the bilinear mapping value used to protect the symmetric key by combining this value with their outsourced decryption key. Finally, the user processes the layered ciphertext with this value to recover the symmetric key, thereby decrypting and obtaining the target plaintext.

[0022] Furthermore, if a user has successfully decrypted a parent-level node and wishes to access a child-level node under the same subtree, the bilinear mapping value of the child-level node can be directly derived from the bilinear mapping value used by the parent-level node to protect the symmetric key using the transmitted ciphertext generated in step S3, thereby obtaining the target plaintext and achieving fast access, fully preserving the efficiency advantages of layered encryption.

[0023] The present invention also provides a file hierarchical ciphertext policy attribute-based encryption system, comprising:

[0024] The Trusted Center module is configured to perform system initialization and generate outsourced decryption keys for users.

[0025] The data owner module is configured to perform layered encryption of data and generate complete ciphertext.

[0026] The cloud server module is configured to store encrypted data and perform outsourced decryption calculations in response to requests from legitimate users.

[0027] The user module is configured to generate public and private identity keys, request access, and perform the final decryption operation.

[0028] The present invention also provides an electronic device, including a processor and a memory, the memory storing a computer program, wherein the processor executes the computer program to implement steps such as a file hierarchical ciphertext policy attribute-based encryption method.

[0029] The beneficial effects of this invention are as follows:

[0030] This invention disrupts the computational correlation of intermediate decryption values ​​between different users through a dual polynomial mechanism (parallel use of secret and noisy polynomials) and a key bound to user identity. Even if multiple malicious users exchange their intermediate computation results, because these results contain their own unique and irremovable identity factors and different random noise, they cannot deduce the decryption information of any unauthorized node through joint computation, thus effectively resisting collusion attacks.

[0031] Secondly, while ensuring security, this invention, through the design of transmitting encrypted text, allows legitimate users to quickly deduce the keys of other files using existing decryption results when accessing multiple hierarchical files, thus avoiding the need to repeatedly perform decryption calculations on the entire access tree and inheriting the efficiency of traditional hierarchical schemes.

[0032] Furthermore, this invention is compatible with outsourced decryption architectures, transferring most of the complex bilinear pairing and recursive calculations to cloud servers, greatly reducing the decryption burden on the user end. The user end only needs to perform a small number of exponentiation operations and simple division operations to complete the final decryption.

[0033] Finally, this invention provides a complete process from system initialization, key management, data encryption to secure decryption, which is easy to deploy and implement in real cloud storage systems.

[0034] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing embodiments of the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a flowchart illustrating the method of an embodiment of the present invention;

[0037] Figure 2 This is a schematic diagram of a hierarchical access tree structure according to an embodiment of the present invention;

[0038] Figure 3 This is a system schematic diagram according to an embodiment of the present invention. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0040] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0041] Example 1:

[0042] This embodiment details the implementation process of a file hierarchical ciphertext policy attribute-based encryption method. This method involves four entities: a trusted center, a data owner, a cloud server, and a data user.

[0043] The specific descriptions of each entity are as follows:

[0044] (1) Trusted Center: The Trusted Center is a completely trusted entity responsible for system initialization and key distribution.

[0045] (2) Data owner: The data owner is a completely trustworthy entity, the user who provides the data, and is responsible for encrypting multiple copies of the file.

[0046] (3) Data user: The data user is an untrusted entity that is the user who accesses the data and needs to obtain multiple files from the cloud server, i.e., the user in this invention.

[0047] (4) Cloud server: A cloud server is a semi-trusted entity that is responsible for providing data storage, access and outsourced decryption services.

[0048] like Figure 1 As shown, the method includes the following steps:

[0049] Step S1: System initialization, the trusted center generates the master public key and master private key.

[0050] Step S1 specifically includes:

[0051] Step S101: The center of trust selects a prime number. And based on this, construct a prime number of order. Multiplication cyclic group ,make Multiplication cyclic group A generator. Simultaneously, a bilinear mapping function is constructed from the multiplicative cyclic group to another target cyclic group, the expression of which is as follows: ,in It is also a prime number. The multiplicative cyclic group.

[0052] Step S102: The Trust Center defines three cryptographic hash functions. The first hash function maps binary strings of arbitrary length to a multiplicative cyclic group. The first hash function maps binary strings to multiplication cyclic groups. The third hash function will target the cyclic group. The elements in the mapping are mapped to integers. The specifics are as follows:

[0053] Map any string to a multiplication loop group ;

[0054] Map any string to a multiplication loop group ;

[0055] , target cyclic group Elements in the mapping are mapped to non-zero integers. A set;

[0056] The mapping process of the three hash functions consists of two steps: First, the input parameters are mapped to a string, where... and Using SHA-256, Use SHA-512; then, use that string as the target cyclic group for generation. The input parameters of the elements are used to obtain the output values ​​using a defined encoding method. Here, the group element generation algorithm with input parameters is called.

[0057] Step S103: The Trusted Center randomly selects two master privacy parameters. And generate the system master public key. and master key as follows:

[0058] ;

[0059] ;

[0060] The master public key includes generators. Multiplication Cyclic Group Bilinear mapping function Hash function , , Other system parameters , , , Master key Including the first primary privacy parameter Second private parameters And for ease of representation, we define... , and They represent , and The inverse of the original.

[0061] Trusted Center publicly released information containing the aforementioned multiplication cycle group. The generator element The bilinear mapping function The three hash functions , , The master public key and other system parameters It is used for data encryption and decryption; meanwhile, the trusted center stores the master key locally. This is used to generate the user's outsourced decryption key.

[0062] This step involves selecting prime numbers. Constructing a multiplication cyclic group Define a bilinear mapping function. Three cryptographic hash functions with different mapping domains are used to generate random parameters to define the master public key and master private key, respectively. This achieves the goal of providing public parameters to all participants in the system while retaining the system key at the trusted center. Its effect is that it both exposes the necessary parameters to support multi-party encryption and decryption operations and uses the master key... The confidentiality of the system fundamentally ensures its security and provides secure parameter protection for all subsequent encryption and decryption operations.

[0063] Step S2: The user generates an identity public key and an identity private key, and generates a user attribute set in the trusted center; the trusted center generates an outsourced decryption key based on the master public key, the master private key, the user attribute set and the identity public key, and sends it to the cloud server.

[0064] Step S2 specifically includes:

[0065] Step S201: The user randomly selects from integers. Choose a number as your private key. The identity private key and through the master public key generator Calculate and obtain the public key of identity The calculation formula is: Identity public key It can be made public.

[0066] Step S202: The user submits their attribute set to the Trusted Center. and identity public key Obtain the user attribute set .

[0067] Step S203: The trusted center selects a first random number pair for the user. , The first random number pair .

[0068] Step S204: For the user attribute set Each attribute The trust center selects a corresponding second random number pair for each attribute. ,in .

[0069] Step S205: Based on the first master private parameter in the master key With the first random number pair , Generate the first key component;

[0070] The expression for the first key component is as follows:

[0071] ;

[0072] Based on the user-provided public key The first random number pair , and the second master privacy parameter Generate a second key component, the expression of which is as follows:

[0073] ;

[0074] Based on each attribute The generator The first random number pair , The corresponding second random number pair and master key The second primary privacy parameter The third key component corresponding to this attribute is calculated and generated. The expression of the third key component is as follows:

[0075] ;

[0076] The first key component, the second key component, and the third key component corresponding to each attribute constitute the outsourced decryption key, and the expression of the outsourced decryption key is:

[0077]

[0078] Among them, the user's public key It is deeply bound to the second key component.

[0079] Step S206: The trusted center transmits the outsourced decryption key through a secure channel. Send to the cloud server.

[0080] This step requires the user to generate a unique public key. and identity private key The trusted center will use the user's public key when generating an outsourced decryption key with identity attributes. It is deeply embedded as a core variable into the outsourced decryption key. In specific components, the goal of strongly binding a user's decryption capabilities to their unique digital identity is achieved. Its effect lies in introducing a user's public key identity. This ensures that each user's decryption key is unique, and keys from different users cannot be used together or combined due to differences in identity factors. This effectively prevents keys from being shared or used for joint computation, providing a secure key structure to resist collusion attacks.

[0081] Step S3: Data layered encryption. The data owner constructs a layered access tree containing multiple nodes and associates a symmetric key with each level node. A double polynomial mechanism, including secret polynomials and noise polynomials, is used to generate layered access number parameters and assign secret and noise components to each node in the layered access tree.

[0082] The specific process of step S3 is as follows:

[0083] Step S301: Assume the data user possesses... document Encrypted sharing is required;

[0084] The data is randomly generated. symmetric key And encrypt the corresponding files using them respectively, to obtain Plain text ; and use a file-layered attribute-based encryption method to encrypt the symmetric key. .

[0085] Step S302: The data owner constructs a tree like... Figure 2 Hierarchical access tree shown In a tree, leaf nodes are associated with attributes, while non-leaf nodes are threshold nodes (such as AND, OR, or "n-of-m"; in this embodiment, the threshold for an AND gate is 2, and the threshold for an OR gate is 1). If a non-leaf node in a hierarchical access tree has a corresponding file, it is called a level node. For example, the hierarchical access tree in Figure 2 has three levels of nodes. , and Data owner designation Nodes For "level node" "Each level node" Will be associated with a symmetric key The selected secret component and the selected noise component .

[0086] Step S303: Apply the double polynomial mechanism. The double polynomial mechanism specifically includes: for hierarchical access trees Each non-leaf node (Starting from the root node), construct two polynomials respectively:

[0087] Secret polynomial The order is , It is a node Access threshold;

[0088] Noise polynomial The order is also The coefficients of the non-constant terms in the polynomial are , All from integers Randomly selected from the middle; the coefficients of the constant term are respectively the secret components. and noise components .

[0089] Among them, for non-leaf nodes that are level nodes :

[0090] Its secret component is: ,in For a symmetric key The associated secret components.

[0091] The noise component is: ,in It is a randomly selected noise component.

[0092] For non-leaf nodes or leaf nodes that are not level nodes:

[0093] Its secret component is: ;

[0094] Its noise component is: ;

[0095] in, for The parent node, The function is The index value in the list of child nodes of its parent node. This represents the distance value between the two polynomial index values, and is a random integer exceeding a certain value. It is set to generate different Lagrange interpolation coefficients. and :

[0096] ;

[0097] .

[0098] Step S304: Calculate and generate a complete ciphertext containing layered ciphertext, attribute ciphertext, and transmission ciphertext;

[0099] Based on symmetric key First primary private parameters and the secret component Calculate each level node Hierarchical ciphertext The expression for the hierarchical ciphertext is as follows:

[0100] ;

[0101] For each leaf node Returns the associated attributes of the leaf node. , It is the set of attributes corresponding to the leaf nodes in the hierarchical access count structure. Based on system parameters in the system parameters. Generator Hash function, secret component of the leaf node and noise components Computational attribute ciphertext The expression for the attribute ciphertext is as follows:

[0102] ;

[0103] The secret component is used when computing attribute ciphertext. and noise components Simultaneously, encryption is used to achieve the purpose of providing component values ​​in a closed state.

[0104] The data owner is a hierarchical access tree. Configure transmission nodes, such as non-leaf nodes. a child node If the threshold is specified, then the non-leaf node is a transmission node. For example... Figure 2 As shown, the number of hierarchical accesses There is only one transmission node, the root node. The data owner selects a third random number. Calculate parameters Based on bilinear mapping function The third random number , Calculate the ciphertext by using the secret components of the parent and child nodes. :

[0105] ;

[0106] In this context, transmitting ciphertext allows users to protect the bilinear mapping value of the symmetric key through the parent node. Quickly calculate the bilinear mapping values ​​of child-level nodes. .

[0107] Step S305: Data users will access the hierarchical tree. The structure description, all levels of ciphertext, all attribute ciphertext, and all transmission ciphertext are packaged together to form a complete ciphertext, which is then uploaded to the cloud server.

[0108] The complete ciphertext is represented as follows: .

[0109] This step involves constructing a secret polynomial and a noise polynomial in parallel for each node in the hierarchical access tree, and setting the polynomial constant term based on whether it's a level node or a non-level node. This achieves the goal of injecting random noise into each node while assigning access policies to files. The effect is that in the generated ciphertext, the secret component and the noise component required for decryption are synchronously encrypted and mathematically correlated. This completely destroys the direct equivalence of intermediate values ​​obtained by different users when decrypting different files under the same policy, making the equation substitution relied upon by collusion attacks impossible. Therefore, it effectively solves the problem of multi-user collusion attacks on existing file hierarchies.

[0110] Step S4: After verifying the user's access request, the cloud server preprocesses the complete ciphertext based on the user's outsourced decryption key to obtain the outsourced decrypted ciphertext, and sends it to the user.

[0111] Step S4 specifically includes:

[0112] Step S401: When a user wants to access data, an access request is sent to the cloud server.

[0113] Step S402: The cloud server verifies the user's identity (e.g., through digital signature verification) and access permissions (preliminarily determining whether the user's attribute set might match the hierarchical access tree). (Matching). After successful verification, the cloud server retrieves the outsourced decryption key corresponding to the user. .

[0114] Step S403: The cloud server executes a recursive decryption algorithm, starting from the root node or the root node of the subtree that the user is interested in, for any node... :

[0115] if It is a leaf node and has attributes. For each leaf node in the user attribute set that has passed user access verification, the cloud server uses the third key component of the corresponding attribute in the user's outsourced decryption key to perform a pairing operation with the attribute ciphertext of that leaf node to obtain the leaf node intermediate value pair. , The expression is as follows:

[0116]

[0117]

[0118] if For each non-leaf node, select a set of child nodes that meet its threshold requirement from all child nodes. Then, using Lagrange interpolation, calculate the intermediate value pairs of the leaf nodes of each child node in this set. , ), calculate the node median pair of the non-leaf node ( , The non-leaf node intermediate value pairs ( , The expression values ​​are shown below:

[0119]

[0120]

[0121] in, and These are the Lagrange interpolation coefficients; a subset of the user attribute set is represented as... , If the subset does not satisfy If the user's attribute set is not a subset of the user's attribute set, it means that the user's attributes do not meet the hierarchical access strategy, and the system returns "". ",symbol" This indicates that the operation failed, the output was invalid, or access was denied.

[0122] Step S404: Recursively calculate upwards from the leaf nodes until the user has access rights, i.e., the user attribute set S satisfies the hierarchical access tree. A certain level of node Its corresponding sub-hierarchical access tree structure This will give you the sub-hierarchical access tree. The calculation result of the node median pair ( , The final calculated node intermediate value pair will be used as part of the decryption result of the node at that level.

[0123] The final expression of the partial decryption result is as follows:

[0124]

[0125] The partial decryption result contains the information needed to recover the symmetric key, but it is also mixed with user identity factors (public key identity). The influence of noise components added during encryption.

[0126] Step S405: The cloud server packages all these partial decryption results and related transmission ciphertext into an outsourced decryption ciphertext and sends it to the user. The expression of the outsourced decryption ciphertext is as follows: .

[0127] This step utilizes the stored outsourced decryption key, which includes user identity binding components, on a cloud server. By performing recursive pairing and Lagrange interpolation calculations from leaf nodes upwards, the most computationally intensive bilinear mapping function pairing and hierarchical access tree traversal processes are transferred from the user end to the cloud server. The user's public key is cleverly preserved in the partial decryption results output by the cloud server. and noise components This ensures that it can only be accessed by the corresponding identity's private key. This process ensures that intermediate results are not maliciously exploited by the server or other users, thus maintaining the security of the decryption process.

[0128] Step S5: The user uses their private key to decrypt the outsourced ciphertext to obtain the target plaintext.

[0129] Step S501: The user uses their identity private key Decrypting ciphertexts outsourced The partial decryption results of each level node are calculated to eliminate the influence of the user's public key. The interference term generated by the action is used to obtain the first intermediate value, and the expression for the first intermediate value is as follows:

[0130] ;

[0131] Step S502: The user divides the hierarchical ciphertext corresponding to the level node by the first intermediate value to recover the symmetric key associated with that level node. At this time, the secret component and noise components The generated random noise is eliminated, and the symmetric key The calculation expression is as follows:

[0132] ;

[0133] Obtain the symmetric key Afterwards, the user can decrypt the corresponding ciphertext to obtain the target plaintext. .

[0134] In some preferred embodiments, the method further includes rapidly decrypting child-level nodes by transmitting ciphertext, specifically including:

[0135] If the user has successfully decrypted and obtained the first intermediate value corresponding to a certain parent-level node, then for the child-level nodes of that tree, the user uses the transmission ciphertext corresponding to that parent-level node. and the first intermediate value of the parent-level node Calculations are performed to obtain the child-level nodes. ( The second intermediate value corresponding to the child-level node. The expression for the second intermediate value is shown below:

[0136] ;

[0137] Based on the second intermediate value and the hierarchical ciphertext corresponding to the level node, the symmetric key of the sub-level file can be quickly recovered. This cleverly utilizes the efficiency advantages of layered encryption to quickly obtain the target plaintext.

[0138] The user first uses a strictly confidential identity private key Perform specific operations to eliminate outsourced decryption ciphertext. Identity Public Key and noise components The relevant interference terms were used to recover the bilinear mapping value of the encrypted symmetric key. Through identity private key Only then can this decryption process be completed, as any colluding party will be unable to obtain the identity private key. However, it cannot eliminate interference values ​​in the other party's results, thus rendering the joint calculation ineffective, and ultimately achieving effective defense against multi-user collusion attacks.

[0139] In addition, users can also use pre-generated transmission ciphertext By using the decrypted parent-level node to quickly derive the second intermediate value of the child-level node, the advantages of layered encryption and decryption are perfectly inherited without sacrificing security, achieving a high-efficiency balance between security and performance.

[0140] Example 2:

[0141] like Figure 3 As shown, this embodiment provides a file hierarchical ciphertext policy attribute-based encryption system, which includes:

[0142] Trusted Center Module: Deployed on a trusted server, it is used to implement the system initialization and user key generation functions in Example 1.

[0143] Data Owner Module: Provided as client software or API for data uploaders to use in building hierarchical access trees, applying bipolynomial mechanisms, and generating various types of encrypted data.

[0144] Cloud server module: Deployed by cloud service providers, it provides encrypted storage services and is used to obtain outsourced decrypted encrypted text.

[0145] User module: Provided as client software or API for data access users to manage user identity private keys, send requests to the cloud server, and implement the final decryption function.

[0146] The modules mentioned above communicate through network security protocols and work together to complete the entire encryption, storage, access, and decryption process.

[0147] Example 3:

[0148] The present invention also provides an electronic device including at least one processor and a memory. The memory stores a computer program that, when executed by the at least one processor, causes the electronic device to implement the file hierarchical ciphertext policy attribute-based encryption method as described in Embodiment 1. This electronic device can be a trusted central server, a personal computer of a data owner / user, a mobile terminal, or a cloud server node.

[0149] It should be noted that the specific manner in which each module performs its operation in the apparatus described in the above embodiments has been described in detail in the embodiments of the method, and will not be elaborated here.

[0150] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0151] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A file hierarchical ciphertext policy attribute-based encryption method, characterized in that, include: The trusted center generates the master public key and master private key; Users generate a public key and a private key for their identity, and generate a user attribute set in a trusted center; the trusted center generates an outsourced decryption key based on the master public key, the master private key, the user attribute set, and the public key for their identity, and sends it to the cloud server; The data owner constructs a hierarchical access tree containing multiple nodes, associating a symmetric key with each level of node; and employs a dual polynomial mechanism, including secret polynomials and noise polynomials, to assign secret and noise components to each node in the hierarchical access tree. The secret polynomial is: The order is , It is a node Access threshold; The noise polynomial is: The order is also The coefficients of the non-constant terms in the polynomial are , All from integers Randomly selected from the middle; the coefficients of the constant term are respectively the secret components. and noise components ; Based on the master public key, the symmetric key, the secret component, and the noise component, a complete ciphertext containing hierarchical ciphertext, attribute ciphertext, and transmission ciphertext is generated and uploaded to the cloud server. After verifying the user's access request, the cloud server preprocesses the complete ciphertext based on the user's outsourced decryption key to obtain the outsourced decrypted ciphertext, and sends it to the user. The user uses their private key to decrypt the outsourced ciphertext to obtain the target plaintext.

2. The file hierarchical ciphertext policy attribute-based encryption method according to claim 1, characterized in that, The trusted center generates the master public key and master private key, including: The center of trust selects a prime number and constructs a multiplicative cyclic group of prime order based on the prime number. At the same time, it selects a generator of the multiplicative cyclic group and constructs a bilinear mapping function from the multiplicative cyclic group to another target cyclic group. The Trust Center selects a first hash function, a second hash function, and a third hash function. The first and second hash functions are used to map strings of arbitrary length to the multiplicative cyclic group, and the third hash function is used to map elements in the target cyclic group to a set of integers determined by the prime number. The Trust Center randomly selects a first master private parameter and a second master private parameter, and calculates and generates a master public key and a master private key based on the generator, the first master private parameter, and the second master private parameter; The Trusted Center releases a public key containing the multiplicative cyclic group, the generator, the bilinear mapping function, the first hash function, the second hash function, the third hash function, and other system parameters. The public key is stored locally and contains at least the second private parameter.

3. The file hierarchical ciphertext strategy attribute-based encryption method according to claim 2, characterized in that, The trusted center generates an outsourced decryption key based on the master public key, the master private key, the user attribute set, and the identity public key, including: The trusted center selects a first random number pair for the user; For each attribute in the user attribute set, select a corresponding second random number pair; A first key component is generated based on the first master private parameter in the master key and the first random number pair. A second key component is generated based on the identity public key, the first random number pair, and the second master private parameter; Based on each attribute, the generator, the first random number pair, the corresponding second random number pair, and the second master private parameter in the master key are used to calculate and generate the third key component corresponding to that attribute. The first random number pair constitutes the outsourced decryption key for the first key component, the second key component, and the third key component corresponding to each attribute.

4. The file hierarchical ciphertext strategy attribute-based encryption method according to claim 3, characterized in that, The aforementioned dual polynomial mechanism specifically includes: For each non-leaf node in the hierarchical access tree, construct a secret polynomial and a noise polynomial, the order of which is one less than the access threshold of the node. For a non-leaf node that is a level node, set its associated secret component as the value of the zero of the node's secret polynomial, and randomly select a noise component as the value of the node's noise polynomial at the zero. For a non-leaf or non-leaf node that is not a level node, its secret component is the value of the secret polynomial of the parent node at the index position of the node, and its noise component is the sum of the index value and distance value of the noise polynomial of the parent node at the node.

5. The file hierarchical ciphertext strategy attribute-based encryption method according to claim 4, characterized in that, The generation of complete ciphertext, which includes hierarchical ciphertext, attribute ciphertext, and transmission ciphertext, includes: For each level node, its associated symmetric key is combined with the result of the transformation of the node's secret component and noise component by the bilinear mapping function to generate the hierarchical ciphertext corresponding to that level node. For each leaf node, calculate the attribute ciphertext based on the generator, hash function, the attribute associated with the leaf node, and the secret and noise components of the leaf node; For a non-leaf node in the hierarchical access tree that is designated as a transmission node, a third random number is selected, and the transmission ciphertext is calculated based on the bilinear mapping function, the third random number, and the secret component of the non-leaf node. The complete ciphertext includes the structural description of the hierarchical access tree, the hierarchical ciphertext, the attribute ciphertext, and the transmission ciphertext.

6. The file hierarchical ciphertext policy attribute-based encryption method according to claim 5, characterized in that, The preprocessing of the complete ciphertext based on the user's outsourced decryption key to obtain the outsourced decrypted ciphertext includes: For each leaf node that has been verified by user access in the user attribute set, the cloud server uses the third key component of the corresponding attribute in the user outsourced decryption key to calculate the node intermediate value pair of the leaf node with the attribute ciphertext of the leaf node. For each non-leaf node, select a set of child nodes that meet its threshold requirement from all child nodes. Using the Lagrange interpolation method, calculate the node median pair of the non-leaf node based on the leaf node median pair of each child node in the set of child nodes. The calculation is performed recursively upwards from the node until the level node that the user has access to is reached. The final calculated node intermediate value pair is used as part of the decryption result of that level node. The outsourced decryption ciphertext includes partial decryption results of all user-accessible level nodes and the corresponding transmission ciphertext of those nodes.

7. The file hierarchical ciphertext policy attribute-based encryption method according to claim 6, characterized in that, The user's decryption operation on the outsourced ciphertext using their private key to obtain the target plaintext also includes: The user calculates the first intermediate value by using the private key of their identity to calculate the partial decryption result of each level node in the outsourced decrypted ciphertext; Divide the hierarchical ciphertext corresponding to the level node by the first intermediate value to obtain the symmetric key of the level node.

8. The file hierarchical ciphertext policy attribute-based encryption method according to claim 7, characterized in that, The method further includes: rapidly decrypting a subtree file by transmitting ciphertext; If the user has successfully decrypted and obtained the transmission ciphertext corresponding to a certain parent level node, then for the child level node in the subtree file, the user uses the transmission ciphertext corresponding to the parent level node and the first intermediate value of the parent level node to obtain the second intermediate value corresponding to the child level node. Divide the hierarchical ciphertext corresponding to the parent-level node by the second intermediate value to obtain the symmetric key of the child-level node.

9. A file hierarchical ciphertext policy attribute-based encryption system, used to implement the method according to any one of claims 1 to 8, characterized in that, include: The Trusted Center module is configured to perform system initialization and generate outsourced decryption keys for users. The data owner module is configured to perform layered encryption of data and generate complete ciphertext. The cloud server module is configured to store encrypted data and perform outsourced decryption calculations in response to requests from legitimate users. The user module is configured to generate public and private identity keys, request access, and perform the final decryption operation.

10. An electronic device comprising a processor and a memory, the memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 8.

Images