User data attribute encryption device, method and system based on IMS architecture and storage medium
By using a user data attribute encryption device based on the IMS architecture, combined with ABE and TEE technologies, the key management and security issues of user data in the IMS system are solved, realizing dynamic access control and full lifecycle cryptographic protection in scenarios with a large number of users, thereby improving the security and efficiency of the system.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-09
- Publication Date
- 2026-04-10
AI Technical Summary
Traditional IMS systems suffer from complex key management for user address books, high cloud security risks, susceptibility to centralized vulnerabilities, rigid policies, and low efficiency. Existing improvement solutions have failed to effectively address the issue of deep integration between key derivation and attribute policies.
The user data attribute encryption device based on the IMS architecture includes an offline key generation and secure transmission unit, an attribute encryption and cloud synchronization unit, and an attribute policy decryption unit. It utilizes ABE encryption technology and a TEE environment to achieve offline key generation, secure transmission, and dynamic access control.
It achieves full lifecycle confidential protection of user data in the IMS system, improves security and efficiency in scenarios with massive numbers of users, and supports fine-grained dynamic access control and zero-trust security model.
Smart Images
Figure CN121842664A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of wireless communication and information security technology, and more specifically, to a user data attribute encryption device, method, system, and storage medium based on the IMS architecture. Background Technology
[0002] In traditional IMS systems, sensitive data such as user contact lists are typically stored in the cloud using symmetric encryption or public key infrastructure (PKI), which presents the following problems: 1) Complex key management: Users need to obtain the private keys of other users in the address book to decrypt data, which makes key distribution and storage difficult in scenarios with a large number of users; 2) Cloud security risks: Cloud service providers may cause data leaks due to vulnerabilities or malicious attacks, and traditional encryption cannot achieve fine-grained access control; 3) Centralized vulnerability: The HSS / UDM database storage key in the cloud is vulnerable to supply chain attacks or theft by insiders; 4) Rigid Strategy: The E2EE model only supports "all or nothing" decryption and cannot achieve dynamic control based on attributes such as roles and departments. Existing improvement schemes (such as identity-based encrypted IBE) still rely on centralized key distribution and have not solved the problem of deep integration between key derivation and attribute policies; 5) Inefficiency: In large user groups, key updates and revocations need to be frequently synchronized, resulting in high system overhead. Summary of the Invention
[0003] The purpose of this invention is to overcome the shortcomings of the prior art and provide a user data attribute encryption device, method, system and storage medium based on the IMS architecture, which realizes full life cycle encryption protection of user data in the IMS system and improves security and efficiency in scenarios with a large number of users.
[0004] The objective of this invention is achieved through the following solution: A user data attribute encryption device based on IMS architecture includes an offline key generation and secure transmission unit, an attribute encryption and cloud synchronization unit, and an attribute policy decryption unit; The offline key generation and secure transmission unit is used to generate, derive, encrypt and securely transmit the system master private key in an offline environment, ensuring the security and traceability of the root key. The attribute encryption and cloud synchronization unit is used to receive ciphertext in the cloud environment and establish a dynamic access control mechanism to achieve secure storage of ciphertext and attribute index management. The attribute policy decryption unit is used to securely perform attribute verification and decryption operations on the terminal side, with the entire process completed within the TEE to defend against side-channel attacks.
[0005] Furthermore, the offline key generation and secure transmission unit specifically includes: The master private key generation module is used to generate the system's master private key on the offline KGC server, which serves as the root key for the entire attribute encryption system. The key synchronization and binding module is used to synchronize the generated master private key with the HSS / UDM database through hash chain binding; The attribute key storage module is used to store various attribute keys derived from the master private key using the HSS / UDM database; The policy binding encryption module is used to encrypt target files using the ciphertext policy attribute-based encryption algorithm through the ABE encryption engine, based on a predefined policy tree. The policy tree defines attribute-based access rules. The ciphertext optimization and output module processes the encrypted file using the encrypted file generator and performs compression optimization. The secure transmission module transmits encrypted files to the cloud environment via offline file transfer, ensuring that there is no risk of leakage in the transmission link.
[0006] Furthermore, the attribute encryption and cloud synchronization unit specifically includes: The file receiving and storage module, the cloud call session control function server CSCF receives encrypted files from the offline environment and stores them in a secure database; The attribute index generation module extracts attribute tags from the policy tree T used during encryption and generates an attribute tag index, which is used to query the set of user attributes of accessible files. The access control module is used by the dynamic access controller to verify the legitimacy and integrity of access requests initiated by the terminal using the BLS signature verification mechanism, ensuring that only authorized requests can trigger the decryption process.
[0007] Furthermore, the attribute policy decryption unit specifically includes: The request initiation and authentication module is used by users to obtain file access credentials using the IMS terminal, and send the access request to the cloud CSCF server through the network to complete IMS network layer registration and authentication. The security environment activation and key preparation module is used to activate the TEE security area within the terminal after successful identity authentication. Under the dual-domain architecture of the client application CA and the trusted application TA, the key and decryption operations are isolated from the main operating system. The key decryption module is located within the TEE and derives the final decryption user private key using the SHA-256 algorithm based on the attribute key from the HSS / UDM. The policy verification and access control module is used for the interaction between the terminal and the dynamic access controller in the cloud to initiate policy queries; the dynamic access controller uses the BLS signature verification mechanism to verify the legality and attribute integrity of the terminal request. The attribute verification and decryption execution module is used by the attribute policy verifier within the TEE secure area. It uses the derived user private key and ciphertext and policy parameters obtained from the cloud to perform bilinear pairing operations to verify whether the terminal user attribute set meets the policy tree set during encryption. If the verification is successful, the file is decrypted within the TEE, and the user obtains the plaintext; if the verification fails, access is denied.
[0008] Furthermore, the IMS terminal includes a 5G mobile phone.
[0009] Furthermore, obtaining the file access credentials includes obtaining the file access credentials by scanning a QR code.
[0010] A method for encrypting user data attributes based on the IMS architecture includes the following steps: Step S1: Offline key and ciphertext preparation, specifically including: S11: The offline KGC server generates the system master private key msk, which serves as the root key for attribute encryption; S12: Through the hash chain binding mechanism, the master private key is synchronized to the HSS / UDM database to ensure key integrity and traceability; S13: The HSS / UDM database stores attribute keys derived from the master private key, enabling centralized and secure key management; S14: The ABE encryption engine uses the CP-ABE algorithm and executes the binding policy tree T to encrypt the target file. The policy tree defines access rules based on user attributes. S15: The encrypted file generator performs ASN.1 compression optimization on the encrypted file; S16: Send the encrypted text to the cloud environment via offline file transfer; Step S2: Cloud policies and access control, specifically including: S21: The cloud-based CSCF server receives encrypted files from offline sources and stores them in a secure storage system; S22: The application server AS generates an attribute label index from the policy tree T to match user attributes with accessible files; S23: When a terminal access request is received, the dynamic access controller performs BLS signature verification to verify the legality and attribute integrity of the request. Step S3: Terminal request and secure decryption, specifically including: S31: On the IMS terminal, the user initiates a file access request by scanning a QR code, requesting transmission over the 5G network; S32: This request triggers the startup of the TEE secure zone within the terminal, entering the secure execution environment of the CA / TA dual-domain architecture to isolate sensitive operations; S33: Within the TEE, the key decryption module uses the SHA-256 algorithm to execute the derived user decryption key, based on the attribute key synchronized in the cloud; S34: The terminal executes a policy query to the cloud and uses the obtained policy parameters to perform a bilinear pairing operation within the TEE to verify the attribute matching. S35: The attribute policy validator performs a verification on the calculation result to determine whether the user attribute matches the policy tree T; S36: After successful verification, the ciphertext is decrypted inside the TEE, and the user obtains the plaintext data, completing secure access.
[0011] A user data attribute encryption system based on IMS architecture includes the apparatus as described in any of the preceding claims.
[0012] A computer-readable storage medium storing a computer program that, when loaded by a processor, executes the method described above.
[0013] The beneficial effects of this invention include: This invention solves the problem of secure storage and efficient access to massive user address books in IMS systems by combining attribute-based encryption (ABE) with offline key management. Specific advantages include: (1) Dynamic access control: Fine-grained access control is implemented based on the policy verification and access control module in the attribute policy decryption unit, which can adapt to the dynamic changes in the organizational structure, such as dynamically adjusting decryption permissions according to user roles or department attributes. (2) Zero Trust Architecture: With the help of attribute encryption and cloud synchronization unit, the cloud only stores ciphertext, and the decryption capability is completely controlled by the terminal attribute, which conforms to the zero trust security model and reduces the risk of data leakage from the source; (3) Lightweight deployment: By using QR code and Trusted Execution Environment (TEE) technology in the offline key generation and secure transmission unit, the dependence on dedicated hardware is reduced, making it suitable for mobile terminals and improving the scalability and usability of the system. Attached Figure Description
[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0015] Figure 1 This is a schematic diagram of the core system architecture of an embodiment of the present invention; Figure 2 This is a flowchart illustrating the system encryption process according to an embodiment of the present invention. Detailed Implementation
[0016] All features disclosed in all embodiments of this specification, or steps in all methods or processes implied in the disclosure, may be combined and / or extended or replaced in any way, except for mutually exclusive features and / or steps.
[0017] This invention specifically relates to the encrypted storage and secure transmission of massive amounts of sensitive user data (such as address books) in cloud communication systems based on the IMS architecture. Combining Attribute-Based Encryption (ABE) and Trusted Execution Environment (TEE) technologies, it aims to achieve encrypted protection throughout the entire data lifecycle, and is particularly suitable for instant messaging systems requiring massive user numbers, high security, and privacy protection. Specifically, it proposes an IMS address book security architecture scheme that combines End-to-End Encryption (E2EE) and Attribute-Based Encryption (ABE). By integrating ABE technology onto the traditional E2EE, it eliminates the dependency on private key sharing, supports secure communication in scenarios with massive user numbers, and ensures encrypted security throughout the entire data lifecycle.
[0018] The core architecture of the system is as follows Figure 1 As shown, the interaction between offline, cloud, and terminal environments is illustrated, including key components of key generation, encryption synchronization, and decryption processes.
[0019] As a first aspect of the present invention, a user data attribute encryption device based on the IMS architecture is provided, specifically including an offline key generation and secure transmission unit, an attribute encryption and cloud synchronization unit, and an attribute policy decryption unit.
[0020] An offline key generation and secure transmission unit performs the generation, derivation, encryption, and secure transmission of the system's master private key in an offline environment, ensuring the security and traceability of the root key. In a further implementation, such as... Figure 1 As shown, it specifically includes the following modules: The master private key generation module is used to generate the system's master private key on the offline KGC server. This key serves as the root key for the entire attribute encryption system, ensuring the security of the key's origin.
[0021] The key synchronization and binding module is used to synchronize the generated master private key with the HSS / UDM database through hash chain binding technology, and to ensure the integrity and traceability of key transmission by leveraging the immutability of the hash chain.
[0022] The attribute key storage module is used to securely store various attribute keys derived from the master private key using the HSS / UDM database, thereby achieving centralized key management.
[0023] The policy binding encryption module is used by the ABE encryption engine to encrypt target files according to the ciphertext policy attribute-based encryption (CP-ABE) algorithm based on a predefined policy tree (denoted as T). The policy tree defines access rules based on attributes (such as department or role).
[0024] The ciphertext optimization and output module is used by the encrypted file generator to process the encrypted file. It uses ASN.1 encoding for compression optimization, reduces storage overhead through field simplification and structure reorganization, and generates the final encrypted file.
[0025] The secure transmission module is used to transmit encrypted files to the cloud environment via offline file transfer methods (such as physical media or secure channels), ensuring that there is no risk of leakage in the transmission link.
[0026] In actual operation, the offline Key Generation Center (KGC) server generates the system master private key (denoted as msk). The user inputs a strong password (denoted as pwd), which, combined with a salt value, is used to calculate a derived key (denoted as K_derived) using a hash function (such as SHA-256). Then, K_derived is used to encrypt the master private key, the user's private key (denoted as sk_u), and the X.509 certificate (denoted as cert_u), generating ciphertext (denoted as C_res). This ciphertext is converted into a QR code format, scanned by the terminal device, and stored in a Trusted Execution Environment (TEE). It is then decrypted by K_derived and stored in an isolated manner to prevent unauthorized access.
[0027] The attribute encryption and cloud synchronization unit receives ciphertext in a cloud environment and establishes a dynamic access control mechanism to achieve secure storage of ciphertext and attribute index management. In a further implementation, such as... Figure 1 As shown, it includes the following modules: The file receiving and storage module is used by the cloud call session control function (CSCF) server to receive encrypted files from the offline environment and store them in a secure database.
[0028] The attribute index generation module is used by the application server (AS) to extract attribute tags (such as "Department: R&D Department") from the policy tree (T) used during encryption, and generate an attribute tag index for quickly querying the set of user attributes of accessible files.
[0029] The access control module is used by the dynamic access controller to verify the legitimacy and integrity of access requests initiated by the terminal using the BLS signature verification mechanism, ensuring that only authorized requests can trigger the decryption process.
[0030] In actual operation, the IMS terminal generates an attribute public key (denoted as PK_ABE) and a private key (denoted as SK_ABE) based on the user attribute set (denoted as S). The address book data (denoted as D) is encrypted into attribute base ciphertext (denoted as C_ABE) according to the policy tree (T) and transmitted to the cloud through a TLS 1.3 secure channel.
[0031] An attribute policy decryption unit securely performs attribute verification and decryption operations on the terminal side, with the entire process completed within the TEE to defend against side-channel attacks. In a further implementation, such as... Figure 1 As shown, it includes the following modules: The request initiation and authentication module is used by users to obtain file access credentials by scanning QR codes using IMS terminals (such as 5G mobile phones). The access request is sent to the cloud CSCF server through the 5G network to complete IMS network layer registration and authentication.
[0032] The security environment activation and key preparation module is used to activate the TEE security zone within the terminal after successful identity authentication. Under the dual-domain architecture of client application (CA) and trusted application (TA), all key and decryption operations are isolated from the main operating system. The key decryption module is located within the TEE and derives the final decryption user private key using the SHA-256 algorithm based on the attribute key from HSS / UDM.
[0033] The policy verification and access control module is used for the interaction between the terminal and the dynamic access controller in the cloud to initiate policy queries; the dynamic access controller uses the BLS signature verification mechanism to verify the legality and attribute integrity of the terminal request.
[0034] The attribute verification and decryption execution module is used by the attribute policy verifier within the TEE secure area. It uses the derived user private key and the ciphertext and policy parameters obtained from the cloud to perform bilinear pairing operations (such as elliptic curve pairing) to verify whether the terminal user attribute set satisfies the policy tree (T) set during encryption. If the verification is successful, the file is decrypted within the TEE, and the user obtains the plaintext; if the verification fails, access is denied.
[0035] In actual operation, the terminal verifies whether its own attributes satisfy the policy tree (T). If they do, it decrypts the ciphertext (C_ABE) to obtain the plaintext data (D).
[0036] The device described above by the present invention can eliminate the dependency on private key sharing, support secure communication in scenarios with a large number of users, and ensure the cryptographic security of data throughout its entire lifecycle.
[0037] As a second aspect of the present invention, based on the above-described apparatus, a user data attribute encryption method based on an IMS architecture is provided, such as... Figure 2 As shown, the specific steps include: Step S1: Offline Key and Ciphertext Preparation S11: The offline KGC server generates the system master private key (msk), which serves as the root key for attribute encryption.
[0038] S12: Through the hash chain binding mechanism, the master private key is synchronized to the HSS / UDM database to ensure key integrity and traceability.
[0039] S13: The HSS / UDM database stores attribute keys derived from the master private key, enabling centralized and secure key management.
[0040] S14: The ABE encryption engine uses the CP-ABE algorithm and executes a binding policy tree (T) to encrypt the target file. The policy tree defines access rules based on user attributes (such as role or department).
[0041] S15: The encrypted file generator performs ASN.1 compression optimization on the encrypted file, reducing the data size through a hybrid compression algorithm (such as LZ77 and Huffman coding).
[0042] S16: Send the encrypted text to the cloud environment via offline file transfer to ensure no leakage during the transmission process.
[0043] Step S2: Cloud Policy and Access Control S21: The cloud-based CSCF server receives encrypted files from offline sources and stores them in a secure storage system.
[0044] S22: The AS application server generates an attribute label index from the policy tree (T) for quickly matching user attributes with accessible files.
[0045] S23: When a terminal access request is received, the dynamic access controller performs BLS signature verification to verify the legality and attribute integrity of the request.
[0046] Step S3: Terminal Request and Security Decryption S31: On the IMS terminal, the user initiates a file access request by scanning a QR code, requesting transmission via the 5G network.
[0047] S32: This request triggers the startup of the TEE secure zone within the terminal, entering the secure execution environment of the CA / TA dual-domain architecture to isolate sensitive operations.
[0048] S33: Within the TEE, the key decryption module uses the SHA-256 algorithm to execute the decryption key for derived users, based on the attribute key synchronized in the cloud.
[0049] S34: The terminal executes a policy query to the cloud and uses the obtained policy parameters to perform a bilinear pairing operation within the TEE to verify the attribute matching.
[0050] S35: The attribute policy validator performs a validation on the result of the operation to determine whether the user attribute matches the policy tree (T).
[0051] S36: After successful verification, the ciphertext is decrypted inside the TEE, and the user obtains the plaintext data, completing secure access.
[0052] This invention achieves full lifecycle confidentiality protection of user data in the IMS system through the above-mentioned device and method, and improves security and efficiency in scenarios with massive user volume by combining ABE and TEE technologies.
[0053] In other aspects, the present invention provides a user data attribute encryption system based on an IMS architecture, characterized in that it includes the apparatus described above.
[0054] The units described in the embodiments of the present invention can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.
[0055] According to one aspect of the present invention, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described above.
[0056] In another aspect, embodiments of the present invention also provide a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.
Claims
1. An apparatus for encrypting user data attributes based on IMS architecture, characterized by, The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises:
2. The apparatus for encrypting user data attributes based on IMS architecture according to claim 1, characterized in that, The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises:
3. The apparatus for encrypting user data attributes based on IMS architecture according to claim 1, characterized in that, The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises:
4. The apparatus for encrypting user data attribute based on IMS architecture according to claim 1, characterized in that, The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud synchronization unit comprises: The attribute encryption and cloud The attribute verification and decryption execution module is configured to perform a bilinear pair operation in the TEE security area by using the derived user private key and the ciphertext and policy parameters obtained from the cloud, to verify whether the terminal user attribute set meets the policy tree set during encryption; if the verification is successful, the file is decrypted in the TEE, and the user obtains the plaintext; and if the verification fails, the access is denied.
5. The apparatus for encrypting user data attribute based on IMS architecture according to claim 4, characterized in that, The IMS terminal comprises a 5G mobile phone.
6. The apparatus for encrypting user data attributes based on IMS architecture according to claim 1, characterized in that, The file access credential is obtained by scanning a two-dimensional code.
7. A method for encrypting user data attributes based on IMS architecture, characterized by, The method comprises the following steps: Step S1: offline key and ciphertext preparation, specifically comprising: S11: the offline KGC server performs generation of a system master private key msk as a root key for attribute encryption; S12: the master private key is synchronized to the HSS / UDM database through a hash chain binding mechanism, to ensure key integrity and traceability; S13: the HSS / UDM database stores attribute keys derived from the master private key, to realize centralized security management of the keys; S14: the ABE encryption engine uses a CP-ABE algorithm and performs encryption of a target file by using a binding policy tree T, and the policy tree defines access rules based on user attributes; S15: the ciphertext file generator performs ASN.1 compression optimization on the encrypted file; S16: the ciphertext is sent to the cloud environment through an offline file transmission mode; Step S2: cloud-side policy and access control, specifically comprising: S21: the CSCF server of the cloud side performs receiving of the offline ciphertext file and storage in a secure storage system; S22: the application server AS performs generation of an attribute label index from the policy tree T, for matching of user attributes and accessible files; S23: when receiving a terminal access request, the dynamic access controller performs BLS signature verification, to verify the legality and attribute integrity of the request; Step S3: terminal request and secure decryption, specifically comprising: S31: the user initiates a file access request on the IMS terminal by scanning a two-dimensional code, and the request is transmitted through a 5G network; S32: the request triggers starting of the TEE security area in the terminal, to enter a CA / TA dual-domain architecture security execution environment and isolate sensitive operations; S33: in the TEE, the key decryption module derives a user decryption key by using a SHA-256 algorithm, based on the cloud-synchronized attribute key; S34: the terminal performs policy query to the cloud side, and performs a bilinear pair operation in the TEE by using the obtained policy parameters, to verify attribute matching; S35: the attribute policy verifier verifies whether the user attributes match the policy tree T according to the operation result; S36: after the verification is passed, the ciphertext is decrypted in the TEE, the user obtains plaintext data, and the secure access is completed.
8. A user data attribute encryption system based on IMS architecture, characterized by, The apparatus of any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, A computer program is stored in a readable storage medium, and when loaded by a processor, the computer program performs the method of claim 7.