Attribute-based encryption method for trusted data space
By acquiring user attribute change status in the trusted data space, classifying and calculating the adjustment magnitude, and adjusting the access policy tree only for changed attribute elements, the system performance degradation and security risks caused by user attribute changes are solved, and efficient access control is achieved.
Patent Information
- Application Number
- CN202610273858.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-03-07
- Publication Date
- 2026-05-08
AI Technical Summary
Existing technologies require rebuilding the entire access policy tree when user attributes change, leading to decreased system performance, increased security risks, and a worse user experience.
By acquiring the user attribute change status, classifying it into different change status subsets, calculating the adjustment magnitude, and only adjusting the strategy tree for the changed attribute elements, the entire tree reconstruction is avoided.
It reduces system overhead in scenarios with frequent attribute changes, improves response efficiency, reduces security risks, and optimizes user experience.
Smart Images
Figure CN122001664A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of encrypted data transmission. More specifically, this invention relates to an attribute-based encryption method for trusted data spaces. Background Technology
[0002] Trusted data spaces, as an emerging data sharing and collaboration framework, have become a core technical architecture for ensuring data security, privacy protection, and efficient data circulation. Attribute-based encryption (ABE) is an advanced access control encryption mechanism that plays a crucial role in trusted data spaces. It allows data owners to define access policies based on user attributes (such as roles, permissions, location, or time), thereby achieving fine-grained access control. The access policy tree is the core data structure in attribute-based encryption used to define ciphertext access conditions.
[0003] In the application of trusted data space, dynamic changes in user attributes are common (such as employee role adjustments, temporary permission grants, or time-based attribute updates). Existing technologies will rebuild the entire access policy tree whenever user attributes change, regardless of the magnitude of the change. This leads to a decrease in system performance under high-frequency attribute changes, which in turn increases security risks and deteriorates the user experience. Summary of the Invention
[0004] To address the problem that the existing attribute-based encryption technology reconstructs the entire access policy tree regardless of the magnitude of the change, leading to a decline in system performance under high-frequency attribute changes, which in turn increases security risks and degrades user experience, this invention provides solutions in the following aspects.
[0005] To achieve the above objectives, this application proposes an attribute-based encryption method for trusted data spaces. The method includes: obtaining the change state of each attribute element in each user attribute set; using the user attribute set at the current update time as the target set and the user attribute set at the previous update time as the reference set; classifying the attribute elements according to the change state to obtain different subsets of change states; taking the union of all subsets of change states to obtain a set of change attributes; taking any attribute element in the set of change attributes as the target element; obtaining the associated leaf nodes of the target element in a preset access policy tree to construct a set of associated leaf nodes; calculating the influence degree of the target element based on the set of associated leaf nodes; obtaining the total number of associated non-leaf nodes of the target element in the preset access policy tree; calculating the adjustment magnitude caused by the target element based on the influence degree and the total number of associated non-leaf nodes; traversing to obtain the adjustment magnitude caused by each attribute element in the set of change attributes; for each attribute element in the set of change attributes, adjusting the corresponding threshold and associated leaf nodes in the preset access policy tree based on the change state and adjustment magnitude; updating the key based on the adjusted access policy tree to complete the encryption.
[0006] Preferably, the attribute element consists of an attribute type and an attribute value.
[0007] Preferably, obtaining the change state of each attribute element in each user attribute set includes: taking any attribute element in the target set as a first reference element; in response to the attribute type of the first reference element not existing in the reference set, adding it as the change state of the first reference element, and iterating to obtain the change state of each attribute element in the target set; taking any attribute element in the reference set as a second reference element; in response to the attribute type of the second reference element not existing in the target set, deleting it as the change state of the second reference element, and iterating to obtain the change state of each attribute element in the reference set; obtaining the intersection of the attribute types of the target set and the attribute types of the reference set; taking any attribute type in the intersection as the target type; in response to the attribute value of the target type in the target set being different from the attribute value of the target type in the reference set, modifying it as the change state of the attribute element corresponding to the target type in the target set, and iterating to obtain the change state of the attribute element corresponding to each attribute type in the intersection in the target set.
[0008] Preferably, obtaining the associated leaf nodes of the target element in the preset access strategy tree includes: taking the leaf nodes in the preset access strategy tree that are the same as the target element as the associated leaf nodes of the target element.
[0009] Preferably, calculating the influence degree of the target element based on the associated leaf node set includes: taking any associated leaf node in the associated leaf node set as the target node, and using the ratio of the node level of the target node to the depth of the preset access strategy tree as the first perturbation degree of the target node; constructing a historical user attribute set, and using the ratio of the frequency of occurrence of the target element in the historical user attribute set to the total number of attribute elements in the historical user attribute set as the second perturbation degree of the target node; using the product of the first perturbation degree and the second perturbation degree as the comprehensive perturbation degree of the target element on the target node; traversing to obtain the comprehensive perturbation degree of the target element on each associated leaf node in the associated leaf node set, and using the average of all comprehensive perturbation degrees as the influence degree of the target element.
[0010] Preferably, constructing a historical user attribute set includes: obtaining the user attribute set for each time between the current update time and the preset initial time, and using the user attribute set for each time as a set element to construct a historical user attribute set.
[0011] Preferably, the adjustment range caused by the target element based on the degree of influence and the total number of associated non-leaf nodes includes: taking the sum of the total number of elements in the set of associated leaf nodes and the total number of associated non-leaf nodes as the total number of associated nodes; multiplying the ratio of the total number of associated nodes to the total number of nodes in the preset access strategy tree, the degree of influence, and the preset hyperparameter, and rounding the result of the multiplication as the adjustment range caused by the change in the target element.
[0012] Preferably, adjusting the threshold values and associated leaf nodes in the preset access strategy tree based on the change state and adjustment magnitude includes: In response to the target element's change state being "added," adding the associated leaf node corresponding to the target element to the preset access strategy tree, using the parent node of the added associated leaf node as the node to be amplified; in response to the node to be amplified being an OR gate, calculating the sum of the original threshold value and the adjustment magnitude of the node to be amplified to obtain the new threshold value of the node to be amplified; in response to the node to be amplified being an AND gate, using the number of child nodes of the node to be amplified as the new threshold value of the node to be amplified; In response to the target element's change state being "deleted," deleting the associated leaf node corresponding to the target element in the preset access strategy tree, using the parent node of the deleted associated leaf node as the node to be reduced; in response to the node to be reduced... If the node is an OR gate, the difference between the original threshold and the adjustment range of the node to be reduced is used to obtain the new threshold of the node to be reduced. If the node to be reduced is an AND gate, the number of child nodes of the node to be reduced is used as the new threshold of the node to be reduced. If the target element changes to a modified state, the associated leaf node corresponding to the target element is modified in the preset access strategy tree, and the parent node of the modified associated leaf node is used as the node to be adjusted. If the node to be adjusted is an OR gate, the sign function value of the difference between the preset influence threshold and the influence degree is calculated. The product of the sign function value and the adjustment range is calculated, and the sum of the original threshold and the product is used as the new threshold of the node to be adjusted. If the node to be adjusted is an AND gate, the number of child nodes of the node to be adjusted is used as the new threshold of the node to be adjusted.
[0013] Preferably, the attribute-based encryption method further includes: assigning 1 to the adjusted threshold value in response to the adjusted threshold value being less than 1; and assigning the number of child nodes to the adjusted threshold value in response to the adjusted threshold value being greater than the corresponding number of child nodes.
[0014] The beneficial effects of this invention are: This invention first obtains the change state of each attribute element, then categorizes all attribute elements according to their change states, resulting in multiple subsets of change states. Attribute elements within each subset belong to the same change state, while different subsets represent different change states. The union of these subsets yields a set of changed attributes. Next, the adjustment magnitude for each attribute element in the set of changed attributes is calculated, and the access strategy tree is adjusted based on this adjustment magnitude. Compared to existing technologies that require rebuilding the entire access strategy tree upon attribute change, this method focuses only on the changed attribute elements. By categorizing change states and calculating adjustment magnitudes, it locates the nodes requiring adjustment, avoiding full tree reconstruction. This reduces system overhead in scenarios with frequent attribute changes, improves response efficiency, reduces security risks, and optimizes user experience. Attached Figure Description
[0015] Figure 1This is a flowchart of steps S1-S3 in an attribute-based encryption method for a trusted data space according to an embodiment of the present invention. Detailed Implementation
[0016] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.
[0017] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.
[0018] Reference Figure 1 An attribute-based encryption method for trusted data spaces includes steps S1-S3, as detailed below: Step S1: Obtain the change state of each attribute element in each user attribute set, take the user attribute set at the current update time as the target set, and take the user attribute set at the previous update time as the reference set.
[0019] It should be noted that the update time is the moment when it is detected whether there are any changes in the attribute elements in the user attribute set. The interval between the current update time and the previous update time is one update cycle, which can be set as needed, such as 5 seconds.
[0020] It should be noted that user attribute sets can be obtained through SQL (Structured Query Language) queries or API (Application Program Interface) calls.
[0021] Preferably, the attribute element consists of the attribute type and the attribute value.
[0022] For example, attribute types include roles and departments, attribute values for roles include ordinary users, visitors, and administrators, and attribute values for departments include administrative departments and R&D departments.
[0023] Preferably, obtaining the change state of each attribute element in each user attribute set includes: taking any attribute element in the target set as the first reference element; in response to the attribute type of the first reference element not existing in the reference set, adding it as the change state of the first reference element, and iterating to obtain the change state of each attribute element in the target set; taking any attribute element in the reference set as the second reference element; in response to the attribute type of the second reference element not existing in the target set, deleting it as the change state of the second reference element, and iterating to obtain the change state of each attribute element in the reference set; obtaining the intersection of the attribute types of the target set and the attribute types of the reference set; taking any attribute type in the intersection as the target type; in response to the attribute value of the target type in the target set being different from the attribute value of the target type in the reference set, modifying it as the change state of the attribute element corresponding to the target type in the target set, and iterating to obtain the change state of the attribute element corresponding to each attribute type in the intersection in the target set.
[0024] It should be noted that there are three main change states: addition, deletion, and modification. The methods for obtaining these three change states are as follows: 1. Add: Use a hash lookup algorithm to check the attribute type of each attribute element in the user attribute set (target set) corresponding to the current update time, and determine whether it exists in the user attribute set (reference set) corresponding to the previous update time. Add the attribute element as a change state of a non-existent attribute element.
[0025] 2. Deletion: Use a hash lookup algorithm to check the attribute type of each attribute element in the user attribute set (reference set) of the previous update time at the current update time, and determine whether it exists in the user attribute set (target set) corresponding to the current update time. If it is deleted, it is treated as a change state of the non-existent attribute element.
[0026] 3. Modify: Obtain the intersection of the attribute types of the target set and the attribute types of the reference set. The intersection contains the attribute types that exist in both the target set and the reference set. For each common attribute type, compare the attribute value in the target set with the attribute value in the reference set. If they are different (e.g., the "role" attribute is "visitor" and "administrator" respectively), modify the change state of the corresponding attribute element in the target set.
[0027] Step S2: Classify the attribute elements according to the change state to obtain different subsets of change states. Take the union of all subsets of change states to obtain the set of change attributes. Take any attribute element in the set of change attributes as the target element. Obtain the associated leaf nodes of the target element in the preset access strategy tree to construct a set of associated leaf nodes. Calculate the influence degree of the target element based on the set of associated leaf nodes. Obtain the total number of associated non-leaf nodes of the target element in the preset access strategy tree. Calculate the adjustment range caused by the target element based on the influence degree and the total number of associated non-leaf nodes. Iterate through the set of change attributes to obtain the adjustment range caused by each attribute element.
[0028] It should be further explained that the changed state subset includes the added subset, the deleted subset, and the modified subset. The elements of the added subset are the attribute elements whose changed state is "added," the elements of the deleted subset are the attribute elements whose changed state is "deleted," and the elements of the modified subset are the attribute elements whose changed state is "modified." Taking the union of the added subset, the deleted subset, and the modified subset yields the changed attribute set.
[0029] It should be further explained that the preset access policy tree is generated using existing technology. The access policy tree is a tree used to control access permissions to the system. This tree is the access control center of the entire secret-sharing algorithm, indicating which participants (attributes) can share the secret and which participants cannot. This tree is constructed by the data encryptor based on the attributes of all users. The tree consists of leaf nodes and non-leaf nodes. The core component of the leaf nodes is attribute elements, representing specific attributes (such as "visitor," "administrator," etc.); non-leaf nodes represent logic gates (such as "AND," "OR," "threshold gate," etc.), used to combine the access conditions of the leaf nodes.
[0030] Preferably, obtaining the associated leaf nodes of the target element in the preset access strategy tree includes: taking the leaf nodes in the preset access strategy tree that are the same as the target element as the associated leaf nodes of the target element.
[0031] It should be further explained that non-leaf nodes in the descendants that have related leaf nodes are considered as related non-leaf nodes. A depth-first search algorithm can be used to traverse the access strategy tree to query related leaf nodes and related non-leaf nodes.
[0032] Preferably, constructing a historical user attribute set includes: obtaining the user attribute set for each time between the current update time and the preset initial time, and using the user attribute set for each time as a set element to construct a historical user attribute set.
[0033] It should be noted that the historical user attribute set does not include the user attribute set at the current update time.
[0034] Preferably, calculating the influence degree of the target element based on the associated leaf node set includes: taking any associated leaf node in the associated leaf node set as the target node, and using the ratio of the node level of the target node to the depth of the preset access strategy tree as the first perturbation degree of the target node; constructing a historical user attribute set, and using the ratio of the frequency of occurrence of the target element in the historical user attribute set to the total number of attribute elements in the historical user attribute set as the second perturbation degree of the target node; using the product of the first perturbation degree and the second perturbation degree as the comprehensive perturbation degree of the target element on the target node; traversing to obtain the comprehensive perturbation degree of the target element on each associated leaf node in the associated leaf node set, and using the average of all comprehensive perturbation degrees as the influence degree of the target element.
[0035] For example, the formula for calculating the degree of influence is as follows: In the formula middle, For the set of changing attributes The degree of influence of each attribute element can also be understood as the degree of influence of the first attribute element. The degree to which changes in individual attribute elements affect the entire access strategy tree. The larger the value, the more likely it is to be the first... The greater the impact of changes in individual attribute elements on the access policy tree, the greater the degree of adjustment required to the access policy tree.
[0036] In the formula middle, For the first The total number of associated leaf nodes for each attribute element.
[0037] In the formula middle, For the first The first attribute element The node level of the associated leaf node, i.e., the th related leaf node. The depth of each associated leaf node in the access strategy tree The depth of the access strategy tree; For the first The first attribute element The first perturbation level of the associated leaf node indicates the degree of perturbation of the first associated leaf node. The first attribute element The position of an associated leaf node in the access strategy tree has an impact. The larger the value, the larger the range of subtrees affected by the change in the attribute. For example, a change in a deep leaf node may cause the threshold gate it belongs to to fail, thereby affecting the access logic of the entire subtree path.
[0038] In the formula middle, For the first The first attribute element The frequency of occurrence of each associated leaf node in the historical user attribute set; The total number of attribute elements in the historical user attribute set; For the first The first attribute element The second perturbation level of the associated leaf node indicates the degree of perturbation of the first associated leaf node. The first attribute element The activity level of each associated leaf node. The larger, The larger the value, the more active it is, and the greater its impact on the system.
[0039] In the formula middle, For the first The first attribute element The overall perturbation level of each associated leaf node.
[0040] It's important to note that dynamic changes in user attributes are inevitable and commonplace in trusted data spaces. For example, an employee might change their role from "regular user" to "administrator," or temporary permissions might be granted based on time attributes (e.g., valid only on a specific date). If these changes are not detected, the static attribute tree of the traditional CP-ABE algorithm will become inadequate, requiring the reconstruction of access policies or the regeneration of all user keys for each change. This leads to: 1. Significant computational resource consumption: In high-concurrency, multi-user data-sharing environments, frequent reconstruction operations increase system latency; 2. Amplified security risks: Brief access control vacuums may exist during reconstruction, easily leading to data leaks or tampering; 3. Deteriorating user experience: Users need to repeatedly wait for key updates, reducing system availability and trustworthiness. In decentralized trusted data spaces, when multiple participants (such as enterprises and institutions) share data, attribute changes often involve cross-domain synchronization. If detection is not timely, consistency issues can arise. For example, if an attribute update from one participant is not promptly propagated to others, inconsistent access policies can occur, leading to data access conflicts. Traditional methods rely on full updates, causing even minor changes to trigger global operations and resulting in wasted resources. Therefore, this invention calculates the degree of attribute change to quantify the severity and scope of the change, thereby facilitating targeted adjustments and avoiding blind global updates.
[0041] Preferably, the adjustment range caused by the target element is calculated based on the degree of influence and the total number of associated non-leaf nodes. This includes: taking the sum of the total number of elements in the set of associated leaf nodes and the total number of associated non-leaf nodes as the total number of associated nodes; multiplying the ratio of the total number of associated nodes to the total number of nodes in the preset access strategy tree, the degree of influence, and the preset hyperparameters, and rounding the result of the multiplication as the adjustment range caused by the change in the target element.
[0042] For example, the formula for calculating the adjustment range is as follows: In the formula middle, For the set of changing attributes The adjustment range of each attribute element, This is a rounding function. This is the result of cumulative multiplication.
[0043] In the formula middle, These are preset hyperparameters used to limit the range of adjustment.
[0044] In the formula middle, For the set of changing attributes The degree of influence of each attribute element The larger the value, the more it indicates the number of... The wider the influence of an attribute element on the access policy tree, the higher the risk of system instability. Therefore, a more aggressive adjustment is needed, i.e., the larger the adjustment range, to avoid amplifying system risks.
[0045] In the formula middle, This represents the total number of associated nodes (the sum of the total number of associated leaf nodes and the total number of associated non-leaf nodes). The total number of nodes in the preset access strategy tree (the sum of the total number of leaf nodes and the total number of non-leaf nodes in the access strategy tree). The larger the value, the greater the adjustment range.
[0046] Step S3: For each attribute element in the set of changing attributes, adjust the corresponding threshold and associated leaf node in the preset access policy tree based on the change state and adjustment magnitude, update the key based on the adjusted access policy tree, and complete the encryption.
[0047] It should be further explained that for any attribute element in the set of changing attributes, different dynamic adjustments are made according to different change states. The objects of adjustment include the associated leaf node and all threshold values on the branch containing that associated leaf node. Specifically, this includes the following three adjustment scenarios: 1. The target element's change state is "new": In response to the change in the target element's state to "new", an associated leaf node corresponding to the target element is added to the preset access strategy tree. The parent node of the added associated leaf node is taken as the node to be amplified. In response to the node to be amplified being an OR gate, the sum of the original threshold and the adjustment range of the node to be amplified is calculated to obtain the new threshold of the node to be amplified. In response to the node to be amplified being an AND gate, the number of child nodes of the node to be amplified is taken as the new threshold of the node to be amplified.
[0048] It should be noted that the data encryptor manually adds the associated leaf node corresponding to the target element in the access policy tree. For example, if the new attribute is role-related (such as "temporary visitor"), it may be added to the OR gate of the existing "role" branch; if it is an independent attribute (such as the new "geographic location"), it may be added as a new subtree to the AND / OR gate of the root node.
[0049] It should be noted that if the change status of the target element is "new", it means that a new leaf node needs to be added to the access strategy tree. Therefore, the threshold of the non-leaf node (parent node) corresponding to the newly added leaf node needs to be appropriately increased to accommodate the new changed attributes. At the same time, the greater the adjustment, the more the threshold of the node will increase, so as to avoid the new attribute becoming invalid due to the threshold being too small.
[0050] 2. The target element has been deleted: In response to the change in the target element's state to deletion, the associated leaf node corresponding to the target element is deleted in the preset access strategy tree. The parent node of the deleted associated leaf node is taken as the node to be reduced. In response to the node to be reduced being an OR gate, the difference between the original threshold and the adjustment range of the node to be reduced is calculated to obtain the new threshold of the node to be reduced. In response to the node to be reduced being an AND gate, the number of child nodes of the node to be reduced is taken as the new threshold of the node to be reduced.
[0051] It should be noted that the data encryptor manually deletes the associated leaf node corresponding to the target element in the access policy tree.
[0052] It should be noted that if the target element changes to a deletion state, it means shrinking the access probability (removing leaf nodes). Therefore, it is necessary to reduce the threshold to avoid leaving invalid thresholds or excessively large thresholds that could lead to excessive security risks.
[0053] 3. The target element's change status is "modified": In response to the change in the target element's state to "modified", the associated leaf node corresponding to the target element is modified in the preset access strategy tree. The parent node of the modified associated leaf node is taken as the node to be adjusted. In response to the node to be adjusted being an OR gate, the sign function value of the difference between the preset influence threshold and the influence degree is calculated. The product of the sign function value and the adjustment magnitude is calculated. The sum of the original threshold of the node to be adjusted and the product is taken as the new threshold of the node to be adjusted. In response to the node to be adjusted being an AND gate, the number of child nodes of the node to be adjusted is taken as the new threshold of the node to be adjusted.
[0054] It should be added that the data encryptor manually modifies the associated leaf node corresponding to the target element in the access policy tree.
[0055] It should be further explained that if the change status of the target element is "modified," it indicates that the attribute value of the target element has been adjusted. In this case, the present invention introduces a preset impact threshold as a basis for judging the magnitude of the impact. When the impact of the target element is large, it indicates that the change of the target element is significant, and the threshold needs to be tightened to reduce the risk of leakage; when the impact of the target element is small, the threshold needs to be increased to appropriately improve access availability.
[0056] The target element's change state is "modified," and the formula for calculating the new threshold is as follows: In the formula middle, For the set of changing attributes The new threshold values corresponding to each attribute element. For the set of changing attributes The original threshold value corresponding to each attribute element.
[0057] In the formula middle, The preset impact threshold can be set as needed. For example, those skilled in the art can use experience to... It is set to 0.5, and the specific value can be set by those skilled in the art according to the actual situation. For the set of changing attributes The degree of influence of each attribute element To affect the difference, The sign function value that affects the difference. For the set of changing attributes The adjustment range of each attribute element.
[0058] For the formula It should be added that, Greater than 0, If the value is 1, then the original threshold value is increased to obtain the new threshold value. Equal to 0, When the value is 1, the original threshold value and the new threshold value are the same. Less than 0, If the value is -1, then the original threshold value is reduced to obtain the new threshold value.
[0059] It should be noted that during the process of adjusting the threshold for non-leaf nodes, there is a possibility that the new threshold may be too large (exceeding the number of child nodes of the non-leaf node, leading to access denial) or too small (a threshold of 0, leading to over-authorization). Therefore, this invention requires boundary checks to avoid the defects caused by adjusting the threshold.
[0060] Preferably, the attribute-based encryption method further includes: assigning 1 to the adjusted threshold value in response to the adjusted threshold value being less than 1; and assigning the number of child nodes to the adjusted threshold value in response to the adjusted threshold value being greater than the corresponding number of child nodes.
[0061] It should be noted that the adjusted threshold is the new threshold. In the trusted data space, the key is the foundation of the CP-ABE algorithm and is used to decrypt data. After adjusting the access policy tree, if the key is not updated, users will not be able to access authorized data, or the old key will lead to security vulnerabilities. Therefore, this invention requires updating the user's key.
[0062] In one embodiment, the specific process for updating the key for any user is as follows: (1) Obtain the user's original key, the adjusted access policy tree, and the threshold values before and after the adjustment (original threshold value and new threshold value) as input parameters for proxy re-encryption.
[0063] Among them, proxy re-encryption is an existing technology. Its principle is based on the proxy server converting the key without exposing the plaintext. Specifically, it converts the original key by generating a re-encryption key, and achieves attribute-level adjustment on the bilinear group without regenerating the entire key.
[0064] (2) Calculate the incremental key using proxy re-encryption.
[0065] Specifically, the proxy server generates a re-encryption key based on the threshold values before and after adjustment, transforms the original key, and outputs an incremental key. The inputs are the original key and the threshold values before and after adjustment, and the output is the incremental key.
[0066] (3) Add the original key to the incremental key to obtain the new key.
[0067] It should be noted that the preferred embodiments of this application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of this application. For those skilled in the art, various modifications and improvements can be made without departing from the concept of the invention, and these all fall within the protection scope of the invention. Therefore, the protection scope of this patent should be determined by the appended claims.
Claims
1. An attribute-based encryption method for trusted data spaces, characterized in that, include: To obtain the change state of each attribute element in each user attribute set, the user attribute set at the current update time will be used as the target set, and the user attribute set at the previous update time will be used as the reference set. The attribute elements are categorized according to their change states to obtain different subsets of change states. The union of all subsets of change states is taken to obtain the set of change attributes. Any attribute element in the set of change attributes is taken as the target element. The associated leaf nodes of the target element in the preset access strategy tree are obtained to construct a set of associated leaf nodes. The influence degree of the target element is calculated based on the set of associated leaf nodes. The total number of associated non-leaf nodes of the target element in the preset access strategy tree is obtained. The adjustment magnitude caused by the target element is calculated based on the influence degree and the total number of associated non-leaf nodes. The adjustment magnitude caused by each attribute element in the set of change attributes is obtained by traversing the tree. For each attribute element in the set of changing attributes, the threshold and associated leaf node in the preset access policy tree are adjusted in combination with the change state and adjustment magnitude. The key is updated based on the adjusted access policy tree to complete the encryption. The degree of influence of the target element is calculated based on the associated leaf node set, including: Take any associated leaf node in the associated leaf node set as the target node, and use the ratio of the node level of the target node to the depth of the preset access strategy tree as the first perturbation degree of the target node. Construct a historical user attribute set, and use the ratio of the frequency of occurrence of the target element in the historical user attribute set to the total number of attribute elements in the historical user attribute set as the second perturbation degree of the target node. The product of the first perturbation level and the second perturbation level is taken as the comprehensive perturbation level of the target element on the target node; Iterate through the target element to obtain the overall perturbation degree of each associated leaf node in the associated leaf node set, and take the average of all overall perturbation degrees as the influence degree of the target element. The adjustment range caused by the target element is calculated based on the degree of impact and the total number of associated non-leaf nodes, including: The total number of associated nodes is the sum of the total number of elements in the set of associated leaf nodes and the total number of associated non-leaf nodes. The ratio of the total number of associated nodes to the total number of nodes in the preset access strategy tree, the degree of influence, and the preset hyperparameters are multiplied, and the rounded value of the multiplication result is used as the adjustment range of the target element caused by the change.
2. The attribute-based encryption method for trusted data spaces according to claim 1, characterized in that, The attribute element consists of an attribute type and an attribute value.
3. The attribute-based encryption method for trusted data spaces according to claim 2, characterized in that, The process of obtaining the change state of each attribute element in each user attribute set includes: Take any attribute element in the target set as the first reference element. In response to the fact that the attribute type of the first reference element does not exist in the reference set, add the new one as the first reference element and change the state of each attribute element in the target set. Take any attribute element in the reference set as the second reference element. In response to the fact that the attribute type of the second reference element does not exist in the target set, delete the changed state of the second reference element. Iterate to obtain the changed state of each attribute element in the reference set. Obtain the intersection of the attribute types of the target set and the attribute types of the reference set. Take any attribute type in the intersection as the target type. In response to the difference between the attribute value of the target type in the target set and the attribute value of the target type in the reference set, modify it as the change state of the corresponding attribute element of the target type in the target set. Iterate through the intersection to obtain the change state of the corresponding attribute element of each attribute type in the target set.
4. The attribute-based encryption method for trusted data spaces according to claim 1, characterized in that, The associated leaf nodes of the target element in the preset access strategy tree include: The leaf node in the preset access strategy tree that is the same as the target element is used as the associated leaf node of the target element.
5. The attribute-based encryption method for trusted data spaces according to claim 1, characterized in that, Building a historical user attribute set includes: Get the user attribute set for each time between the current update time and the preset initial time, and use the user attribute set for each time as a set element to construct the historical user attribute set.
6. The attribute-based encryption method for trusted data spaces according to claim 1, characterized in that, The threshold values and associated leaf nodes in the preset access strategy tree are adjusted based on the change status and adjustment magnitude, including: In response to the change in the state of the target element to be added, the associated leaf node corresponding to the target element is added to the preset access strategy tree. The parent node of the added associated leaf node is taken as the node to be amplified. In response to the node to be amplified being an OR gate, the sum of the original threshold and the adjustment range of the node to be amplified is calculated to obtain the new threshold of the node to be amplified. In response to the node to be amplified being an AND gate, the number of child nodes of the node to be amplified is taken as the new threshold of the node to be amplified. In response to the change of the target element's state to deletion, the associated leaf node corresponding to the target element is deleted in the preset access strategy tree. The parent node of the deleted associated leaf node is taken as the node to be reduced. In response to the node to be reduced being an OR gate, the difference between the original threshold and the adjustment range of the node to be reduced is calculated to obtain the new threshold of the node to be reduced. In response to the node to be reduced being an AND gate, the number of child nodes of the node to be reduced is taken as the new threshold of the node to be reduced. In response to the change in the target element's state to "modified", the associated leaf node corresponding to the target element is modified in the preset access strategy tree. The parent node of the modified associated leaf node is taken as the node to be adjusted. In response to the node to be adjusted being an OR gate, the sign function value of the difference between the preset influence threshold and the influence degree is calculated. The product of the sign function value and the adjustment magnitude is calculated. The sum of the original threshold of the node to be adjusted and the product is taken as the new threshold of the node to be adjusted. In response to the node to be adjusted being an AND gate, the number of child nodes of the node to be adjusted is taken as the new threshold of the node to be adjusted.
7. The attribute-based encryption method for trusted data spaces according to claim 1, characterized in that, Also includes: In response to the adjusted threshold being less than 1, assign 1 to the adjusted threshold. If the adjusted threshold value is greater than the corresponding number of child nodes, the number of child nodes is assigned to the adjusted threshold value.