A method of attribute access control supporting multi-domain tracking and user management

Abstract

The application relates to a property access control method supporting multi-domain tracking and user management, and belongs to the field of information security.The method comprises the following steps: a property authorization center generates a unique identity according to user properties, and completes the registration of a new data user; a data owner encrypts plaintext data to obtain intermediate ciphertext; a cloud server performs re-encryption on the intermediate ciphertext; the property authorization center generates a property key and identifies a legal user and a malicious user among the registered new data users based on a conversion key; a proxy server performs initial decryption conversion on the re-encrypted ciphertext; a legal user uses a user private key to complete final decryption, and obtains plaintext data. The method aims to solve the technical problems that the prior art is difficult to realize multi-domain tracking under a multi-domain environment, is difficult to realize user revocation under the premise of considering forward and backward security, and is difficult to realize user addition under the premise of ensuring forward security.

Description

An attribute access control method that supports multi-domain tracking and user management Technical Field

[0001] This invention relates to an attribute access control method that supports multi-domain tracking and user management, belonging to the field of information security. Background Technology

[0002] With the rapid development of the Internet of Things (IoT) and artificial intelligence (AI), smart devices and sensors are widely used in smart homes, smart cities, and industrial automation, driving an explosive growth in massive amounts of data. This data includes not only users' daily behavioral information but also the operational status of critical infrastructure. The surge in data volume has prompted more and more enterprises and individuals to outsource data to third-party platforms such as cloud servers to reduce storage and computing costs and improve data processing efficiency. However, data outsourcing leads to a significant decrease in users' control over their data, posing serious challenges to privacy and security. For example, risks such as unauthorized data access, malicious attacks, insecure transmission, or leaks within third-party platforms can all pose significant threats to user privacy and business security, potentially leading to incalculable losses. To address this challenge, access control for outsourced data is necessary. However, traditional access control schemes are mostly designed for static environments, making it difficult to adapt to complex scenarios involving user updates. Especially in multi-domain environments, they struggle to efficiently track malicious users and cannot guarantee forward and backward security during dynamic user updates, thus limiting their application in dynamic environments.

[0003] Currently, various attribute-based encryption (ABE) schemes have implemented dynamic management functions such as user tracking, user addition, and user revocation. Regarding user tracking, related research has proposed tracking mechanisms based on white-box, black-box, and a combination of both to track malicious users. For user addition, some studies generate pseudonyms and have a central authority verify and register them, while others use a CDH (Computational Diffie-Hellman) ring structure to add new users. For user revocation, mainstream methods employ KEK (Key Encryption Key) encryption of key binary trees and the KUNodes algorithm to achieve efficient user revocation. These technical approaches provide effective solutions for attribute-based encryption in dynamic environments.

[0004] However, existing tracking solutions are primarily designed for single domains, making it difficult to meet the needs of accurate user tracking in multi-domain environments. While existing user addition methods can complete user registration, they fail to ensure secure addition while maintaining forward security. Similarly, existing user revocation solutions fail to balance forward and backward security during the revocation process. Specifically, forward security in user revocation means that after revocation, the revoked user cannot access data from before the revocation; backward security in user revocation means that after revocation, the revoked user cannot access data from after the revocation; and forward security in user addition means that after a new user registers, they cannot access data from before registration.

[0005] In view of the above shortcomings, this application proposes an attribute access control method that supports multi-domain tracking and user management. This method not only enables accurate tracking of malicious users across multiple domains, but also achieves efficient user addition under forward security (user addition does not involve backward security) and flexible revocation under both forward and backward security. This method effectively prevents unauthorized access and significantly improves the overall security and operational flexibility of the system. Summary of the Invention

[0006] The technical problem this invention aims to solve is to provide an attribute access control method that supports multi-domain tracking and user management. It addresses the limitations of traditional dynamic attribute access control in multi-domain environments, such as the difficulty in achieving multi-domain tracking, balancing forward and backward security for user revocation, and ensuring forward security for user addition. This method effectively prevents access privilege abuse while ensuring secure data sharing. It achieves forward and backward security during user revocation, forward security during user addition, and efficient tracking of malicious users in multi-domain scenarios, meeting the growing demands for data security and user management flexibility in dynamic environments.

[0007] The technical solution of this invention is: an attribute access control method supporting multi-domain tracking and user management, wherein the specific steps of the method are as follows:

[0008] Step 1: Set up five entities: Attribute Authorization Center, Cloud Server, Proxy Server, Data Owner, and Data User; Among them, the Attribute Authorization Center generates the system public key and the system master key, distributes the system public key to the data owner, cloud server, and proxy server, and stores the system master key in the Attribute Authorization Center and distributes it to the proxy server;

[0009] Step 2: After receiving the registration request from a new data user, the attribute authorization center generates a unique identity identifier based on the user's attributes and completes the registration.

[0010] Step 3: The cloud server uses the system public key to generate a proxy public key and a proxy private key, and sends the proxy public key to the attribute authorization center and the proxy private key to the proxy server.

[0011] Step 4: The data owner uses the system public key and preset access policy to encrypt the plaintext data, obtain the intermediate ciphertext, and upload it to the cloud server.

[0012] Step 5: The cloud server uses the system public key and preset access policy to re-encrypt the intermediate ciphertext, obtains the re-encrypted ciphertext, and stores it.

[0013] Step 6: Newly registered data users submit their unique identity, user attribute set, and domain attribute set of their domain to the attribute authorization center. The attribute authorization center generates attribute keys based on the system public key, system master key, unique identity, user attributes, domain attributes, proxy public key, and linkable ring signature, and distributes them to the newly registered data users. The attribute keys include user private keys and transformation keys.

[0014] Step 7: Newly registered users send an access request to the cloud server, and the cloud server sends the re-encrypted ciphertext to the proxy server.

[0015] Step 8: The Attribute Authorization Center identifies legitimate and malicious users among the newly registered data users based on the conversion key; if a user is identified as legitimate, access is granted and a new conversion key is issued; if a user is identified as malicious, access is revoked.

[0016] Step 9: The legitimate user sends the new conversion key to the proxy server. The proxy server uses the system public key, the proxy private key and the new conversion key to perform the initial decryption and conversion on the re-encrypted ciphertext, generate the converted ciphertext, and return it to the legitimate user.

[0017] Step 10: The authorized user receives the converted ciphertext, uses the user's private key to complete the final decryption, and obtains the plaintext data.

[0018] Optionally, the attribute authorization center generates the system public key and system master key in the following ways:

[0019] First, set security parameters in the Attribute Authorization Center. and attribute universe ,choose Two prime numbers of order Multiplication cyclic group, Therefore, prime numbers For a finite field of the modulus, yes generator, defined It is a bilinear mapping used to establish the bilinear pair structure of the attribute encryption system;

[0020] Secondly, the attribute authorization center obtains information from the group. With finite fields Randomly select elements and And randomly select a hash function from group G2. Thus, the parameters are calculated. and ;

[0021] Then, for the attribute universe Each attribute in The attribute authorization center is based on a limited domain. Select random numbers And calculate parameters ;

[0022] Finally, we obtain the system public key generated by the attribute authorization center. and system master key .

[0023] Optionally, Step 2 specifically includes:

[0024] The attribute authorization center uses a secret sharing mechanism to dynamically adjust the share parameters while keeping the threshold unchanged, and uses the newly generated share as the user's unique identifier; at the same time, the current timestamp is added as an attribute to the user attribute set to expand the user attributes, thereby completing the registration; wherein, the timestamp is used to ensure that new data users cannot access their encrypted data before registration.

[0025] Optionally, Step 4 specifically includes:

[0026] Step 4.1: From a finite field Select random number and construct vectors For secret The sharing, where T is the transpose matrix, for each attribute Calculate parameters , of which M i For attribute vectors, The range is , This is the total number of attributes;

[0027] Step 4.2: From the group Randomly select a number ,choose The first 32 bits are used as the symmetric key for the AES algorithm, and the plaintext data is encrypted using AES_ECB mode. The result of symmetric encryption is denoted as ;

[0028] Step 4.3: Using a hash function calculate hash value To ensure The integrity is not compromised during transmission to the cloud server;

[0029] Step 4.4: Encrypt using the CP-ABE algorithm Calculate parameters , and ,in, , , ;

[0030] Step 4.5: Output intermediate ciphertext ;

[0031] Step 4.6: Using a hash function calculate hash value To ensure that the data is not tampered with during the process of being sent to the cloud server and to maintain its integrity;

[0032] Step 4.7: The data owner will send the intermediate ciphertext. Preset access policies and hash values Send them to the cloud server together.

[0033] Optionally, the generation of the linkable ring signature specifically involves:

[0034] First, define , for Cyclic group of order 1 for The generators, where, , , They are distinct prime numbers, defined , yes Two independent hash functions are used for each user. ( Each has a different and independent public key. and a private key , making ,definition It includes A list of public keys, and A ring can be uniquely identified;

[0035] Secondly, calculate the parameters. and ,in, It is a linking token for a linkable ring signature. For private key;

[0036] Next, from the finite field Random selection Based on random numbers Generate from position The Beginning Challenge ,in, For message;

[0037] Then, for From the group Random selection , A random response, arbitrarily filled in for non-signer positions, combined with the public key. Combined into commitment value and the corresponding Domain commitment value Thus, the result is delivered to the hash function. Calculate and generate the next challenge Among them, due to Loop through the ring index sequentially, skipping... Therefore, the challenge will be from Transmitted to The previous position, thus forming a challenge chain;

[0038] Finally, when the challenge wheel reached the signer's position... When choosing a signatory, position Response at the location To make the challenge consistent from beginning to end, the expression is: Thus, a chainable ring signature can be generated based on all response outputs. ,in, For the first round of challenges, For all responses.

[0039] Optionally, the generation of the attribute key includes two stages, wherein the first stage specifically includes:

[0040] Newly registered data users select their domain attribute set. With user attribute set merged into Submit attributes Request an attribute key from the attribute authorization center;

[0041] The attribute authorization center returns an arbitrary and random message to the newly registered data user. The new data user signs the arbitrary and random message, creates a linkable ring signature, and returns it to the attribute authorization center for signature verification. After the attribute authorization center verifies the signature, it proceeds to the second stage of generating an attribute key. The second stage specifically includes:

[0042] Attribute authorization center from finite domain Four numbers are randomly selected from the middle. ,in, The user key is embedded in a short signature format, and then the parameters required to calculate the user's private key and the conversion key are calculated, including... , , , , ,in, For the attribute authorization center from the finite domain A number randomly selected from the middle. It is a random polynomial. For the attribute authorization center from the finite domain A number randomly selected from the data and used as a secret. , For cloud servers from a limited domain A number randomly selected from the list;

[0043] For user attribute set Each attribute Calculate parameters ,in, For the attribute authorization center from the finite domain Select a random number from the list and set it. ;

[0044] Generate conversion key and user private key Where DID is the domain ID. For newly registered data users about secrets . share.

[0045] Optionally, the signature verification involves checking the chainable ring signature using the message and a list of public keys, specifically:

[0046] Calculation parameters ,from Begin iterative calculation , Finally, they received the nth round of challenges. ;

[0047] examine Is it equal to If they are equal, the signature verification passes; otherwise, it fails.

[0048] Optionally, the attribute authorization center identifies legitimate and malicious users among the newly registered data users based on the conversion key, specifically as follows:

[0049] The attribute authorization center performs a integrity check on the conversion key of all newly registered data users. If the conversion key meets the integrity requirements, the DID and unique identity identifier are restored. After the data owner confirms that there is no error, the attribute authorization center determines that the newly registered data user is a legitimate user.

[0050] If the conversion key does not meet the integrity requirements, it indicates that the newly registered data user may be a malicious user. In this case, user tracking will be carried out to further identify and determine whether the user is a malicious user.

[0051] The integrity check includes the following three conditions:

[0052] Condition 1:

[0053] Condition 2:

[0054] Condition 3:

[0055] If the conversion key passes all the conditions, then the conversion key meets the sanity requirements; otherwise, it is determined that it does not meet the sanity requirements.

[0056] Optionally, the user tracking specifically includes:

[0057] The attribute authorization center searches for user domain information in the domain tracking list. If a matching record is found, the corresponding DID is output; if no matching item is found, a preset symbol is output, indicating that the tracking information of the potentially malicious user does not exist in the current domain tracking list.

[0058] Once the Attribute Authorization Center obtains the DID, it performs user-level tracing. Either the Attribute Authorization Center or the domain administrator can then search for the linkable ring signature in the user tracing list. ,like If the user exists, output the corresponding unique identifier and determine that the user is malicious; if the user does not exist, output a preset symbol to indicate that there is no tracking record of the user who may be malicious in the current domain.

[0059] Optionally, the revocation of access permissions specifically includes:

[0060] When a newly registered user is identified as a malicious user, the Attribute Authorization Center adds the malicious user to the revocation list. The revocation list is maintained by the Attribute Authorization Center, and a proxy revocation key PRK is generated based on the revocation list.

[0061] The Attribute Authorization Center sends the PRK to the proxy server. The proxy server combines the PRK, the system master key, and the conversion key TK to generate a new conversion key TK′, and distributes TK′ only to all legitimate users. When a malicious user submits a ciphertext conversion request to the proxy server, the ciphertext conversion fails because the malicious user cannot provide TK′, thus revoking the access rights.

[0062] The beneficial effects of this invention are: it integrates a two-layer tracking mechanism of short signature and linkable ring signature, and achieves efficient tracking in a multi-domain environment based on white-box tracking; through a secret sharing mechanism, it achieves efficient user revocation while ensuring forward and backward security; and by introducing a key component update strategy, it achieves high efficiency in the user registration process and flexible scalability of the system while ensuring forward security. Attached Figure Description

[0063] Figure 1 is a system model diagram of an embodiment of the present invention;

[0064] Figure 2 is a flowchart of the steps in an embodiment of the present invention;

[0065] Figure 3 is a graph showing the relationship between the tracking time of different attribute quantities in the embodiments of the present invention and the prior art;

[0066] Figure 4 is a graph showing the relationship between the update time of different attribute quantities in the embodiments of the present invention and the prior art;

[0067] Figure 5 is a graph showing the relationship between the number of added users and the user registration time under different attribute numbers in the embodiments of the present invention. Detailed Implementation

[0068] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0069] Example 1: As shown in Figures 1 and 2, an attribute access control method supporting multi-domain tracking and user management is presented. This method uses an Attribute Authorization Center (AA), a Cloud Server (CS), a Proxy Server (PS), a Data Owner (DO), and a Data User (DU) as core entities. Through system initialization, user registration, data encryption and re-encryption, attribute key distribution, proxy server ciphertext conversion, user revocation, and multi-domain tracking, a dynamic, fine-grained, and scalable access control mechanism is formed. This invention can achieve flexible user management and efficient tracking in a multi-domain environment while ensuring data security, balancing system security, controllability, and scalability. The method includes the following steps:

[0070] Step 1: Set up five entities: Attribute Authorization Center, Cloud Server, Proxy Server, Data Owner, and Data User; Among them, the Attribute Authorization Center generates the system public key and the system master key, distributes the system public key to the data owner, cloud server, and proxy server, and stores the system master key in the Attribute Authorization Center and distributes it to the proxy server;

[0071] Optionally, the Attribute Authorization Center sets security parameters. and attribute universe ,choose Two prime numbers of order Multiplication cyclic group, Therefore, prime numbers For a finite field of the modulus, yes generator, defined It is a bilinear mapping used to establish the bilinear pair structure of the attribute encryption system, supporting the subsequent encryption and decryption process.

[0072] AA generates system public keys and master key Previously, parameter calculations and random number selection were required. Specifically, AA was obtained from the group. With finite fields Randomly select elements and And randomly select a hash function from group G2. Thus, the parameters are calculated. and Furthermore, regarding the attribute universe Each attribute in The attribute authorization center is based on a limited domain. Select random numbers And calculate parameters Finally, AA combines the above parameters to generate the system public key. and master key Among them, the system public key The master key will be distributed to the data owner (DO) and the cloud server (CS). The data is then saved by AA and passed to the proxy server PS.

[0073] Step 2: After receiving the registration request from a new data user, the attribute authorization center generates a unique identity identifier based on the user's attributes and completes the registration.

[0074] Optionally, the attribute authorization center AA uses a secret sharing algorithm to perform new data user registration operations, using the attribute set of the new data user. As input, output a unique identifier for the new data user.

[0075] Step 2.1: AA from a finite field Two numbers are randomly selected from the middle. and ,in As a secret; and construct a sequence of order random polynomial ,satisfy AA calculates data user DU about secrets. share ,in This represents the identity identifier of the data user.

[0076] Step 2.2: When new data users enter their own attributes AA adds the current timestamp TS as an attribute to the user attribute to expand the user attribute, adding "equal to the current timestamp" through a logical AND operation. In this embodiment, the user attribute... ={123456 (student ID), School of Information Science, Master's student}, current registration date is October 17, 2024, then the expanded user attributes are... It will become {123456 (student ID), School of Information Science and Technology, Master's student, TS=October 17, 2024}, where October 17, 2024 is the current timestamp.

[0077] Step 2.3: AA dynamically adjusts the total share Add 1, and keep the threshold. The newly generated share remains unchanged, and the newly generated share is used as the share for the new data user, and parameters are calculated. The final share information for new data users is expressed as follows:

[0078]

[0079] Among them, User represents the final share information of new data users.

[0080] As is understandable, Step 2 of this embodiment details the new data user registration mechanism. Upon receiving a new data user's registration request, the AA generates a unique identifier (UID) based on the user's attribute set. To ensure forward security, the AA extends the user attribute set with a timestamp (TS) attribute during registration. This timestamp ensures that the user can only decrypt ciphertext generated after registration and cannot access data from before registration. Simultaneously, the AA dynamically increases the total share of secret sharing by one to support new data users joining, while maintaining the threshold unchanged, thus achieving dynamic user expansion without affecting the overall system security. Through this mechanism, the new data user registration process not only ensures the system's dynamism and scalability but also meets the forward security requirement, meaning that new data users cannot access encrypted data from before registration.

[0081] Step 3: The cloud server uses the system public key to generate a proxy public key and a proxy private key, and sends the proxy public key to the attribute authorization center and the proxy private key to the proxy server.

[0082] Optionally, the cloud server CS utilizes the system public key Generate proxy keys for the Attribute Authorization Center (AA) and the Data User (DU). Specifically, CS generates these keys from a finite domain. Randomly select a number And calculate parameters This generates the proxy public key. and proxy private key Ultimately, CS will proxy the public key. Send to the Attribute Authorization Center and the proxy private key Distribute to the proxy server.

[0083] Step 4: The data owner uses the system public key and preset access policy to encrypt the plaintext data, obtain the intermediate ciphertext, and upload it to the cloud server.

[0084] Step 4.1: From a finite field Select random number and construct vectors For secret The sharing, where T is the transpose matrix, for each attribute Calculate parameters , of which M i For attribute vectors, The range is , This is the total number of attributes;

[0085] Step 4.2: From the group Randomly select a number ,choose The first 32 bits are used as the symmetric key for the AES algorithm, and the plaintext data is encrypted using AES_ECB mode. The result of symmetric encryption is denoted as ;

[0086] Step 4.3: Using a hash function calculate hash value To ensure The integrity is not compromised during transmission to the cloud server;

[0087] Step 4.4: Encrypt using the CP-ABE algorithm Calculate parameters , and ,in, , , ;

[0088] Step 4.5: Output intermediate ciphertext ;

[0089] Step 4.6: Using a hash function calculate hash value To ensure that the data is not tampered with during the process of being sent to the cloud server and to maintain its integrity;

[0090] Step 4.7: The data owner will send the intermediate ciphertext. Preset access policies and hash values Send them to the cloud server together.

[0091] It is important to understand that the preset access policies are defined based on different scenarios. If the scenario is a hospital, the data owner can be a doctor or a nurse, etc. Assuming the data owner is a doctor, the doctor can set the data access policy as "Inpatient Department And Nurse", meaning that only users in the inpatient department can access the data. If the scenario is a bank, the data owner can be people from various departments. Assuming the data owner is someone from the technology department, the technology department can set the access policy as "Technology Department or Finance Department or Risk Department", meaning that only people from the technology department, finance department, and risk department can access the data.

[0092] Step 5: The cloud server uses the system public key and preset access policy to re-encrypt the intermediate ciphertext, obtains the re-encrypted ciphertext, and stores it.

[0093] Step 5.1: Receive intermediate ciphertext Its integrity needs to be verified next, and the hash function is used again. calculate and hash value , If the hash value and This indicates that the ciphertext was not tampered with during transmission;

[0094] Step 5.2: From the group Randomly select a number ,choose The first 32 bits are used as the symmetric key for the AES algorithm, and encryption is performed using AES_ECB mode. The result of symmetric encryption is denoted as ;

[0095] Step 5.3: From a finite field Select random number and construct vectors For secret The sharing, where T is the transpose matrix, for each attribute Calculate parameters ,in, For attribute vectors, The range is , This is the total number of attributes;

[0096] Step 5.4: Encrypt using the CP-ABE algorithm Calculate the parameters required to re-encrypt the ciphertext. , and ,in , , ;

[0097] Step 5.4: Output the re-encrypted ciphertext And save it.

[0098] Step 6: Newly registered data users submit their unique identity, user attribute set, and domain attribute set of their domain to the attribute authorization center. The attribute authorization center generates attribute keys based on the system public key, system master key, unique identity, user attributes, domain attributes, proxy public key, and linkable ring signature, and distributes them to the newly registered data users. The attribute keys include user private keys and transformation keys.

[0099] Step 6.1: Generate a linkable ring signature and authentication for user key registration, specifically as follows:

[0100] Step 6.1.1: Signature Initialization: Definition , for Cyclic group of order 1 for The generators, where, , , They are distinct prime numbers, defined , yes Two independent hash functions are used for each user. ( Each has a different and independent public key. and a private key , making ,definition It includes A list of public keys, and A ring can be uniquely identified.

[0101] Step 6.1.2: Signature Generation: Given a message Public key list and private key , Indicates which member of the ring the signer belongs to. The process of generating a linkable ring signature is as follows:

[0102] Calculation parameters and ,in, It is a linking identifier for a linkable ring signature;

[0103] From finite fields Random selection Based on random numbers Generate from position The Beginning Challenge ;

[0104] for From the group Random selection , A random response, arbitrarily filled in for non-signer positions, combined with the public key. Combined into commitment value and the corresponding Domain commitment value Thus, the result is delivered to the hash function. Calculate and generate the next challenge Among them, due to Loop through the ring index sequentially, skipping... Therefore, the challenge will be from Transmitted to The previous position, thus forming a challenge chain;

[0105] When the challenge sprocket reaches the signer's position When choosing a signatory, position Response at the location To make the challenge consistent from beginning to end, the expression is: Thus, a chainable ring signature can be generated based on all response outputs. ,in, For the first round of challenges, For all responses.

[0106] Step 6.1.3: Signature Verification: Any verifier verifies the signature via message. and public key list right Perform the following checks:

[0107] Calculation parameters ,from Begin iterative calculation , Finally, they received the nth round of challenges. ;

[0108] examine Is it equal to If they are equal, the signature verification passes; otherwise, it fails.

[0109] Step 6.1.4: Linkability verification, for a given list of public keys. Given two signatures, namely and ,in and It is any of the same messages. and In response to the message and After the verifier verifies the validity of the generated signature, it checks whether the linking flags of the linkable ring signatures of the two signatures are equal. If they are equal, the two signatures were generated by the same signer; otherwise, the two signatures were generated by two different signers.

[0110] Step 6.2: AA selects the public key Master key Unique Identifier User's domain attribute set User attribute set Proxy public key User's linkable ring signature As input, a private key is generated for the data user. and conversion key The process of generating attribute keys for data users is divided into two stages. The first stage is to check the validity of the user, and the process is as follows:

[0111] Newly registered data users select their domain attribute set. With user attribute set merged into Submit attributes Request an attribute key from the attribute authorization center;

[0112] Specifically, in this embodiment, the domain Dn DID Taking a domain user (where DID is the domain ID) as an example, before key registration, the domain attributes and user attributes are merged, such as the user attribute set of a graduate student at a certain school. The student ID is "123456 (student ID), Master's student". This student is from the School of Information Science (domain). Assuming the domain attribute set includes at least the domain ID and domain name, then the domain attribute set... The merged attribute set is "YnXx497 (domain ID), School of Information Science (domain name)". The attribute set is "YnXx497 (domain ID), School of Information Science (domain name), 123456 (student ID), Master's student". Therefore, the user will merge the attribute set. Submit to the Authorization Center (AA) to request a key.

[0113] The attribute authorization center returns an arbitrary and random message to the newly registered data user. The newly registered data user signs the arbitrary and random message to create a linkable ring signature. (Assuming there are n users in the domain of YnXx497), and return the result to the attribute authorization center for signature verification;

[0114] Step 6.3: Through the interactive steps in Step 6.2, the Attribute Authorization Center (AA) can check the user's validity and obtain the user's domain identity. If the user fails signature verification, key registration will be interrupted. After the user passes signature verification, the second stage of attribute key generation will proceed. The second stage specifically involves:

[0115] Attribute authorization center from finite domain Four numbers are randomly selected from the middle. ,in, The user key is embedded in a short signature format, and then the parameters required to calculate the user's private key and the conversion key are calculated, including... , , , , ;

[0116] For user attribute set Each attribute Calculate parameters and set ;

[0117] Generate conversion key and user private key and will and Send to data users.

[0118] Step 7: Newly registered users send an access request to the cloud server, and the cloud server sends the re-encrypted ciphertext to the proxy server.

[0119] Step 8: The Attribute Authorization Center identifies legitimate and malicious users among the newly registered data users based on the conversion key; if a user is identified as legitimate, access is granted and a new conversion key is issued; if a user is identified as malicious, access is revoked.

[0120] Step 8.1: Multi-Domain White-Box Tracing: First, a key integrity check is performed to determine if the user's key is abnormal, thus deciding whether further tracing is needed. In practice, the system first uses the key integrity check to locate the domain information to which the user belongs, and then uses this domain information to further trace and identify specific malicious users within the domain. Specifically, the Attribute Authorization Center (AA) uses the public key... Master key private key and conversion key As input. First check. and If it conforms to the format, AA first obtains it through the tracking list TL. Domain Then obtain it by tracking the list TL. The user If the format is not correct, the algorithm outputs a symbol. This indicates that no tracking is required. and .

[0121] Step 8.1.1: Key integrity check is used to assess whether the decryption key needs to be traced. If the private key is suspected... and conversion key The key will be checked for integrity based on the following three conditions:

[0122] Condition 1:

[0123] Condition 2:

[0124] Condition 3:

[0125] If the key passes all the conditions, then and If the key is well-formatted and meets the integrity requirements, the algorithm will output 1. Otherwise, and If it is not a good key, the algorithm will output a specific symbol. Due to the conversion key and These are paired user keys, generated simultaneously. If either key is faulty, it indicates a problem with the user's behavior. This is related to user attributes and access policies. Therefore, only need to check As long as the format is good, that's fine. When the format is good, AA will be in the domain tracking list. Search in ,if If it exists, AA will output the corresponding value. Otherwise, AA outputs a specific symbol. ,express There is no information about Domain tracking information.

[0126] Step 8.1.2: User tracking can be performed by the Attribute Authorization Center (AA) or by the Domain Administrator (DA). The advantage of this method is that both primary and secondary levels of the organization can track malicious users. If the Attribute Authorization Center (AA) outputs... ,Right now From the domain In the middle. Regardless of whether the tracking is done by AA or DA, it needs to be in the user tracking list. Search in ( ),if If it exists, then AA or DA will output the corresponding value. Otherwise, AA or DA will output special symbols. ,express There is no information about User tracking information.

[0127] Step 8.2: User Revocation: Upon identifying a malicious user, the revocation operation is immediately executed to terminate their access permissions, ensuring system security and data confidentiality. User revocation is jointly performed by the Attribute Authorization Center (AA) and the Proxy Server (PS). First, AA generates a proxy revocation key and sends it to the proxy server, which then executes the user revocation.

[0128] Step 8.2.1: Whenever the Attribute Authorization Center (AA) needs to revoke a data user's registration, add the user's identifier to the revocation list. Generate proxy revocation keys based on the revocation list And send it to the proxy server PS. The proxy revocation key generation process is as follows:

[0129] From finite fields Select random number ,set up The user is unaware that a new key has been created and revoked.

[0130] Calculation parameters and revocation key parameters ;

[0131] Cancel list All users Calculate the secret share of the revoked user:

[0132]

[0133] Thus broadcasting the proxy key If you want to retrieve , Need to have One share, because of the Lagrange interpolation polynomial The threshold is If the list is withdrawn. The number of users in AA will randomly generate virtual identities. And calculate , This is achieved without corresponding to any real data users. Total share required .

[0134] Step 8.2.2: The proxy server uses the master key Key conversion and agent revocation key As input, the updated transformation key is output. Specifically, the key conversion Includes parameter components , , , and The component associated with user identity is Therefore, only the conversion key needs to be updated. key components ,get Keep the rest of the components unchanged:

[0135]

[0136] Step 8.2.3: Finally, return the updated conversion key. And distribute it to users who have not withdrawn their accounts.

[0137] As is understood, Step 8 of this embodiment details the multi-domain tracking and user revocation mechanism. Before the proxy server performs the ciphertext conversion, the Attribute Authorization Center (AA) first performs a sanity check on the data user's conversion key TK. This sanity check, as the first step of multi-domain tracking, aims to verify the integrity and validity of the conversion key and locate the domain identifier (DID) to which the user belongs based on the check results.

[0138] After obtaining the domain identifier (DID), the AA further combines it with the user's private key (SK) to reconstruct the user's UID, thereby accurately locating the specific user within the domain. When abnormal user behavior is detected, the user can be determined to be malicious. This tracking process can be executed directly by the AA or by the domain administrator, thus achieving multi-level malicious user tracking capabilities.

[0139] After confirming the identity of the malicious user, the system initiates the user revocation process. AA adds the user's UID to the revocation list RL and generates a proxy revocation key PRK based on this list. Subsequently, the proxy server PS uses the PRK, the system master key MSK, and the current conversion key TK to generate a new conversion key TK′, which is then distributed only to legitimate users who have not been revoked.

[0140] Because the revoked user cannot obtain the updated conversion key TK′, they will be unable to provide a valid TK′ in subsequent access requests. Therefore, the proxy server will refuse to perform its ciphertext conversion operation. This mechanism effectively cuts off the revoked user's access rights.

[0141] Through the above mechanism, this embodiment achieves traceability of malicious users in a multi-domain environment. It also ensures forward and backward security for user revocation: the revoking user cannot access data before revocation, nor can they access data after revocation.

[0142] Step 9: The legitimate user sends the new conversion key to the proxy server. The proxy server uses the system public key, the proxy private key and the new conversion key to perform the initial decryption and conversion on the re-encrypted ciphertext, generate the converted ciphertext, and return it to the legitimate user.

[0143] Step 9.1: To ensure successful ciphertext conversion, the data user needs to use their conversion key. Submitted to the proxy server. The proxy server uses the public key. Key conversion Proxy private key and re-encrypted ciphertext As input, the output is the converted ciphertext. Among them, ciphertext conversion refers to performing the initial decryption and conversion operation on the re-encrypted ciphertext, first letting... ,definition and ,in, and It is an injective function that maps each row of the policy matrix to the attribute set. Then, let and It is a set of constants that make ,if and They are secrets and The effective share, then , Specifically, the calculation process for the initial decryption and conversion is as follows:

[0144]

[0145]

[0146] in, This represents the aggregation result after pairing all attribute components that satisfy the access policy. Essentially, it restores the exponential relationship at the time of encryption and is used to recover the hidden session key in CP-ABE. Similarly, It is the corresponding calculation after re-encryption.

[0147]

[0148]

[0149] in, , Used to offset the randomness index during encryption and Ensure that the proxy decryption can recover the data. and The values ​​of the same dimension can be used to further determine the AES key.

[0150]

[0151]

[0152] in, , Blind decryption was achieved on the proxy side. The proxy server can assist in the initial decryption, but the decryption still contains... and By generating random numbers, the proxy server cannot recover the plaintext, thus ensuring privacy.

[0153] Step 9.2: Obtain the encapsulated symmetric key, which is the symmetric key originally encrypted by the CP-ABE algorithm. The calculation process is as follows:

[0154] ,

[0155] in, , The results of this initial decryption and conversion are still encapsulated AES keys, which can only be used by data users. Solve Only then can it truly recover. and .

[0156] Step 10: The authorized user receives the converted ciphertext, uses the user's private key to complete the final decryption, and obtains the plaintext data.

[0157] Step 10.1: The authorized user uses the converted ciphertext and user private key As input, to obtain the plaintext data to be decrypted. Specifically, the Lagrange interpolation polynomial is used to calculate... .make ,have:

[0158]

[0159] in, These are the interpolation coefficients in the Lagrange interpolation polynomial, used to reconstruct the secret over a finite field. These coefficients are determined by all unrevoked users. This is used to weight and combine the respective key shares. These are the weight parameters used in the interpolation calculations, ensuring that each user's share is proportionally allocated when recovering the original key. This represents a user's unique identifier (identity point). Indicates the first in the system A unique identifier for each user This indicates the reference user currently used for the refactoring.

[0160] Furthermore, It is an aggregated result of the product of exponential terms, which integrates the key shares of all users who have not revoked. It is each user's local key share. Its function is to aggregate the share index items of all users who have not withdrawn, for the purpose of calculation. Provides the foundation.

[0161] This yields the final result obtained through Lagrange interpolation, reconstructing the core key exponent term. .

[0162] Understandably, this step involves key reconstruction calculation based on Lagrange interpolation, realizing the process of a legitimate user recovering the system key from the key share, and preparing for the calculation of key encapsulation items. , Make preparations.

[0163] Step 10.2: The authorized user retrieves the encapsulated key. and Recover the unencrypted key , First calculate:

[0164]

[0165]

[0166] Understandably, this step achieves cross-group exponential fusion through bilinear mapping, enabling key information to be securely embedded in the decryption operation; that is, this step generates two encapsulations. and They carry the system's polynomial secrets and session randomness.

[0167] Step 10.3: Reconstruct and calculate the unencrypted key. and :

[0168] ,

[0169] By performing a division operation (i.e., multiplying the group by its inverse), the randomness term during encapsulation can be eliminated, yielding the original symmetric encryption key. and This completes the decryption process of recovering the symmetric encryption key from the ciphertext.

[0170] Step 10.4: When the restoration is complete and Then, use first Decryption get Where Dec represents the decryption operation, followed by verification. To ensure integrity, a hash function is used. calculate hash value ,if This demonstrates that the integrity of the ciphertext was guaranteed during transmission.

[0171] Step 10.5: Use it last. Decryption Obtain the original plaintext data .

[0172] To verify the performance advantages of the dynamic attribute access control method proposed in this invention in user tracking, update revocation, and user registration, this experiment was designed to conduct comparative tests with existing typical solutions, including TR-AP-CPABE, BATRAC-DPU, and ADAC-BIT. By comparing the performance of different solutions in terms of tracking overhead, revocation overhead, and user registration time, it is demonstrated that this invention achieves higher performance while ensuring security, and can effectively solve the problems of large update overhead and insufficient scalability in existing solutions.

[0173] Specifically, the comparison targets four attribute encryption schemes based on white-box tracing: TR-AP-CPABE, BATRAC-DPU, ADAC-BIT, and the present invention. The comparison metrics include:

[0174] User tracking overhead: used to represent tracking time for different numbers of attributes;

[0175] Revocation update overhead: used to represent the time taken to update the key or ciphertext after user revocation in different schemes;

[0176] User registration time: Used to indicate the registration time when the number of users or attributes varies.

[0177] As shown in Figure 3, the schemes TR-AP-CPABE, BATRAC-DPU, ADAC-BIT, and the embodiments of this invention are all based on white-box tracking. The computational overhead of schemes TR-AP-CPABE and BATRAC-DPU is stable during user tracking, while the tracking time of schemes TR-AP-CPABE and the proposed scheme increases with the number of user attributes. Since scheme TR-AP-CPABE requires bilinear pairing operations, its overhead is higher than that of the proposed scheme. Although the overhead of the embodiments of this invention is slightly higher than that of TR-AP-CPABE and BATRAC-DPU, it supports multi-domain tracking capabilities, which TR-AP-CPABE and BATRAC-DPU do not possess.

[0178] As shown in Figure 4, after a user revokes their account, scheme TR-AP-CPABE updates the ciphertext related to the revocation, while schemes BATRAC-DPU, ADAC-BIT, and the embodiment of this invention all update the key related to the revocation. Scheme ADAC-BIT has a higher overhead due to its involvement of condition judgments and updates of multiple components. Schemes TR-AP-CPABE, BATRAC-DPU, and the embodiment of this invention have relatively stable overhead during ciphertext or key updates, but the embodiment of this invention has the shortest processing time. Specifically, scheme TR-AP-CPABE needs to update the key and revocation list in the cloud and calculate the minimum coverage set to complete the ciphertext update; scheme BATRAC-DPU needs to completely update all key components and regenerate the decryption key, resulting in a large number of component updates. The embodiment of this invention, however, completes the key component update with minimal computational overhead through simplified update steps, making it more efficient.

[0179] As shown in Figure 5, when the number of attributes for newly registered users is fixed, the registration time increases with the number of users; when the number of registered users is fixed, the registration time increases with the number of attributes. This embodiment of the invention efficiently achieves user registration through a secret sharing method with minimal time overhead. For example, when each new data user has 20 attributes, registering 50 users can be completed in approximately 0.11 ms.

[0180] The experimental results shown in Figures 3-5 above demonstrate that the embodiments of the present invention exhibit lower computational overhead and higher execution efficiency compared to existing solutions in core functions such as multi-domain tracking, update revocation, and user registration. Furthermore, this solution not only achieves flexible management of users and attributes but also ensures forward and backward security, effectively supporting access control requirements in dynamic environments. Therefore, the present invention has significant advantages in solving the technical problems of high update overhead, lack of flexibility, and insufficient scalability in traditional solutions, proving the effectiveness and practical value of the proposed method.

[0181] In summary, dynamic user updates and multi-domain user tracking are crucial in dynamic environments. To address this, this invention proposes an attribute access control method that supports multi-domain tracking and user revocation, enabling both multi-domain user tracking and dynamic user updates. Specifically, to overcome the limitations of traditional dynamic access control in malicious user tracking, this invention proposes a two-layer tracking mechanism integrating short signatures and linkable ring signatures, achieving efficient tracking in multi-domain environments based on white-box tracking. Simultaneously, a secret sharing method enables flexible user revocation and addition. Building upon the above functionalities, this invention ensures forward and backward security for user revocation, while also guaranteeing forward security for user addition (user addition does not involve backward security), effectively preventing unauthorized access and comprehensively protecting system security. This invention significantly improves efficiency while ensuring forward and backward security and resistance to collusion attacks, demonstrating excellent applicability and flexibility in IoT applications.

[0182] The specific embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention, and these changes and improvements should also be considered within the scope of protection of the present invention.

Claims

1. An attribute access control method supporting multi-domain tracking and user management, characterized in that, The method includes the following steps: Step 1: Set up five entities: Attribute Authorization Center, Cloud Server, Proxy Server, Data Owner, and Data User; wherein, the Attribute Authorization Center generates a system public key and a system master key, distributes the system public key to the data owner, cloud server, and proxy server, and stores the system master key in the Attribute Authorization Center and distributes it to the proxy server; Step 2: After receiving a new data user's registration request, the Attribute Authorization Center generates a unique identifier based on the user's attributes and completes the registration; Step 3: The cloud server uses the system public key to generate a proxy public key and a proxy private key, sends the proxy public key to the Attribute Authorization Center, and sends the proxy private key to the proxy server; Step 4: The data owner uses the system public key and a preset access policy to encrypt plaintext data to obtain intermediate ciphertext, and uploads it to the cloud server; Step 5: The cloud server uses the system public key and the preset access policy to re-encrypt the intermediate ciphertext to obtain the re-encrypted ciphertext and stores it; Step 6: The newly registered data user submits a unique identifier, a set of user attributes, and the domain of their domain to the Attribute Authorization Center. The attribute set, the attribute authorization center generates attribute keys based on the system public key, system master key, unique identity identifier, user attributes, domain attributes, proxy public key, and linkable ring signature, and distributes them to newly registered data users; wherein, the attribute key includes user private key and conversion key; Step 7: The newly registered data user initiates an access request to the cloud server, the cloud server sends the re-encrypted ciphertext to the proxy server; Step 8: The attribute authorization center identifies legitimate users and malicious users among the newly registered data users based on the conversion key; wherein, if identified as a legitimate user, access is allowed and a new conversion key is issued; if identified as a malicious user, access is revoked; Step 9: The legitimate user sends the new conversion key to the proxy server, the proxy server uses the system public key, proxy private key, and new conversion key to perform an initial decryption conversion on the re-encrypted ciphertext, generate the converted ciphertext, and return it to the legitimate user; Step 10: The legitimate user receives the converted ciphertext, uses the user private key to complete the final decryption, and obtains the plaintext data; The generation of the linkable ring signature is specifically as follows: First, define ， for Cyclic group of order 1 for generator, 、 yes Two independent hash functions are used for each user in the ring. （ Their public and private keys are respectively and ,satisfy And form a public key list. Secondly, calculate the parameters. and link mark Random selection Generate initial challenge Then, for Random selection And recursively calculate When it is pushed to the signer's position At that time, calculate The final output is a linkable ring signature. 。 2. The attribute access control method supporting multi-domain tracking and user management according to claim 1, characterized in that, The generation of the system public key and system master key by the attribute authorization center is specifically as follows: First, the attribute authorization center sets security parameters. and attribute universe ,choose Two prime numbers of order Multiplication cyclic group, Therefore, prime numbers For a finite field of the modulus, yes generator, defined For bilinear mapping, it is used to establish the bilinear pair structure of the attribute encryption system; secondly, the attribute authorization center respectively obtains from the group With finite fields Randomly select elements and And randomly select a hash function from group G2. Thus, the parameters are calculated. and Then, for the attribute universe Each attribute in The attribute authorization center is based on a limited domain. Select random numbers And calculate parameters Finally, the system public key generated by the attribute authorization center is obtained. and system master key 。 3. The attribute access control method supporting multi-domain tracking and user management according to claim 1, characterized in that, Step 2 specifically involves the attribute authorization center dynamically adjusting the share parameters using a secret sharing mechanism while keeping the threshold unchanged, and using the newly generated share as the user's unique identifier; at the same time, the current timestamp is added as an attribute to the user attribute set to expand the user attributes, thereby completing the registration; wherein, the timestamp is used to ensure that new data users cannot access their encrypted data from before registration.

4. The attribute access control method supporting multi-domain tracking and user management according to claim 2, characterized in that, The specific steps of Step 4 are: Step 4.1: From the finite field Select random number and construct vectors For secret The sharing, where T is the transpose matrix, for each attribute Calculate parameters , of which M i For attribute vectors, The range is ， This is the total number of attributes; Step 4.2: From the group Randomly select a number ,choose The first 32 bits are used as the symmetric key for the AES algorithm, and the plaintext data is encrypted using AES_ECB mode. The result of symmetric encryption is denoted as Step 4.3: Using a hash function calculate hash value To ensure The integrity of the data is not compromised during transmission to the cloud server; Step 4.4: Encryption is performed using the CP-ABE algorithm. Calculate parameters ， and ,in, ， ， Step 4.5: Output the intermediate ciphertext Step 4.6: Using a hash function calculate hash value To ensure that the data is not tampered with during transmission to the cloud server and remains intact; Step 4.7: The data owner transmits the intermediate encrypted data. Preset access strategy and hash value Send them to the cloud server together.

5. The attribute access control method supporting multi-domain tracking and user management according to claim 1, characterized in that, The generation of attribute keys includes two stages. The first stage specifically involves: newly registered data users selecting the attribute set of their respective domains. , and user attribute set merged into Submit attribute set The new data user requests an attribute key from the attribute authorization center. The attribute authorization center returns an arbitrary and random message to the registered user. The new data user signs the arbitrary and random message, creating a linkable ring signature, and returns it to the attribute authorization center for signature verification. After successful signature verification, the attribute authorization center proceeds to the second stage of generating the attribute key. This second stage specifically involves the attribute authorization center obtaining the attribute key from a finite field. Four numbers are randomly selected from the middle. ,in, The user key is embedded in a short signature format, and then the parameters required to calculate the user's private key and the conversion key are calculated, including... 、 , ， ， ,in, For the attribute authorization center from the finite domain A number randomly selected from the middle. It is a random polynomial. For the attribute authorization center from the finite domain A number randomly selected from the data and used as a secret. ， For cloud servers from a limited domain A number randomly selected from the set of user attributes; Each attribute Calculate parameters ,in, For the attribute authorization center from the finite domain Select a random number from the list and set it. Generate conversion key and user private key Where DID is the domain ID. For newly registered data users about secrets . share.

6. The attribute access control method supporting multi-domain tracking and user management according to claim 5, characterized in that, The signature verification involves checking the chainable ring signature using the message and a public key list, specifically by calculating parameters. ,from Begin iterative calculation ， Finally, they received the nth round of challenges. ;examine Is it equal to If they are equal, the signature verification passes; otherwise, it fails.

7. The attribute access control method supporting multi-domain tracking and user management according to claim 5, characterized in that, The attribute authorization center identifies legitimate and malicious users among newly registered data users based on the conversion key as follows: The attribute authorization center performs a soundness check on the conversion key of all newly registered data users. If the conversion key meets the soundness requirements, the DID and unique identity identifier are restored. After the data owner confirms that there is no error, the attribute authorization center determines that the currently registered new data user is a legitimate user. If the conversion key does not meet the integrity requirements, it indicates that the newly registered data user may be a malicious user. Therefore, user tracking will be performed to further identify and determine whether the user is malicious. The integrity check includes the following three conditions: Condition 1: Condition 2: Condition 3: If the conversion key passes all the conditions, then the conversion key meets the soundness requirements; otherwise, it is determined that the soundness requirements are not met.

8. The attribute access control method supporting multi-domain tracking and user management according to claim 7, characterized in that, The user tracking process specifically involves: the attribute authorization center searching for user domain information in the domain tracking list; if a matching record is found, the corresponding DID is output; if no match is found, a preset symbol is output, indicating that the tracking information for the potentially malicious user does not exist in the current domain tracking list; once the attribute authorization center obtains the DID, it performs user-level tracking. Both the attribute authorization center and the domain administrator can search for linkable ring signature markers in the user tracking list. ,like If the user exists, output the corresponding unique identifier and determine that the user is malicious; if the user does not exist, output a preset symbol to indicate that there is no tracking record of the user who may be malicious in the current domain.

9. The attribute access control method supporting multi-domain tracking and user management according to claim 8, characterized in that, The revocation of access permissions specifically involves: when a newly registered data user is determined to be a malicious user, the attribute authorization center adds the malicious user to the revocation list. The revocation list is maintained by the attribute authorization center, and a proxy revocation key PRK is generated based on the revocation list. The Attribute Authorization Center sends the PRK to the proxy server. The proxy server combines the PRK, the system master key, and the conversion key TK to generate a new conversion key TK′, and distributes TK′ only to all legitimate users. When a malicious user submits a ciphertext conversion request to the proxy server, the ciphertext conversion fails because the malicious user cannot provide TK′, thus revoking the access rights.

Images