Revocable attribute-based encryption method based on block chain and policy hiding

Abstract

The embodiment of the invention provides a revocable attribute-based encryption method based on a block chain and policy hiding, and belongs to the technical field of data security. Comprising the following steps: constructing an access strategy, generating a symmetric key, encrypting a data file and the symmetric key, and outputting an intermediate ciphertext; replacing an access strategy in the intermediate ciphertext through a Bloom filter, outputting a final ciphertext and a ciphertext header component, and storing a hash value of the final ciphertext to a block chain BC; verifying a decryption token for applying for accessing the data file by the data user DU; if the verification is passed, judging whether the attribute set of the data user DU is in a revocation list; under the condition that the attribute set is not in the revocation list, verifying whether the attribute meets an access strategy or not; if yes, executing an outsourcing decryption operation, and returning a part of decryption result to the data user DU; verifying the correctness of the partial decryption result according to a hash value stored on the block chain BC; and if the verification is passed, final decryption is carried out to obtain a plaintext data file.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and more specifically to a revocable attribute-based encryption method based on blockchain and policy hiding. Background Technology

[0002] With the rapid development of cloud computing, big data, and artificial intelligence technologies, massive amounts of data are being outsourced to the cloud for efficient resource sharing and convenient data access. However, data outsourcing also brings serious security and privacy challenges. Traditional encryption methods typically employ an "all or nothing" access model, which is insufficient to support fine-grained access control in complex business scenarios. To address this, Attribute-Based Encryption (ABE) technology has emerged, allowing data owners to define flexible access policies based on user attributes, enabling secure one-to-many data sharing. While ABE has significant theoretical advantages, it still faces numerous challenges in practical deployment: access policies are often embedded in ciphertext in plaintext, leading to the leakage of sensitive attribute information and threatening user privacy; furthermore, user attributes in the system may need to be dynamically revoked due to changes in permissions or identity invalidation, but traditional ABE solutions lack efficient and secure revocation mechanisms, often introducing huge computational and communication overhead, or relying on a single trusted center, posing a single point of failure risk. Therefore, how to build an ABE system that supports efficient attribute revocation while achieving policy hiding has become a critical issue that urgently needs to be addressed in the field of data security.

[0003] On the other hand, existing technologies employ fuzzy mapping or pseudo-attributes to achieve policy hiding, but these methods still struggle to strike a good balance between security and efficiency. Furthermore, most solutions only support partial policy hiding, failing to completely conceal attribute information within the access structure, thus posing a privacy risk. Regarding attribute revocation, common approaches include time-segment-based periodic updates, proxy re-encryption, or revocation via a third party. However, these methods often suffer from high computational complexity, heavy communication loads, and reliance on trusted third parties, making them unsuitable for large-scale, dynamically changing cloud environments. While cloud computing offers powerful computing and storage capabilities, its centralized architecture presents risks such as single points of failure, service provider defaults, and external attacks, making it difficult to fully meet the privacy and trustworthiness requirements of medical data. Therefore, a comprehensive encryption solution is urgently needed that integrates complete policy hiding, supports lightweight attribute revocation, and possesses auditing and verification capabilities. Summary of the Invention

[0004] The purpose of this invention is to provide a revocable attribute-based encryption method based on blockchain and policy hiding. This encryption method can effectively protect the privacy of data owners and users, avoid the exposure of sensitive attributes, and achieve a good balance between security and efficiency. It supports more secure fine-grained access control, introduces a key encryption key (KEK) tree structure, realizes an efficient attribute-level revocation mechanism, overcomes the shortcomings of traditional ABE schemes such as complex revocation process and high communication load, can dynamically handle user attribute changes, reduce system overhead, is suitable for large-scale cloud environments, improves system scalability and practicality, and combines blockchain technology to store key hashes and access logs on the blockchain to ensure data immutability and operation traceability. Through automated execution of smart contracts, it enhances system transparency and fairness, avoids the risk of relying on a single trusted center, and improves overall security and trustworthiness.

[0005] To achieve the above objectives, embodiments of the present invention provide a revocable attribute-based encryption method based on blockchain and policy hiding, comprising: Initialize the attribute authority center (AA), cloud service provider (CSP), data user (DU), blockchain (BC), data manager (DM), and data owner (DO) respectively; Construct an access policy, generate a symmetric key, encrypt the data file and the symmetric key, and output the intermediate ciphertext; The access policy in the intermediate ciphertext is replaced by a Bloom filter, the final ciphertext and ciphertext header components are output, and the data is uploaded to the cloud service provider CSP for storage. The hash value of the final ciphertext is then stored on the blockchain BC. Verify the decryption token used by data user DU to request access to data files; If the verification passes, determine whether the attribute set of the data user DU is in the cancellation list; If the attribute set is not in the cancellation list, verify whether the attribute satisfies the access policy; If the conditions are met, an outsourced decryption operation is performed, and part of the decryption result is returned to the data user DU; Verify the correctness of some decryption results based on the hash value stored on the blockchain BC; If the verification passes, proceed with the final decryption to obtain the plaintext data file.

[0006] Optionally, the attribute authority center (AA), cloud service provider (CSP), data user (DU), data manager (DM), and data owner (DO) are initialized separately, including: Attribute Authority Center AA Selects Safety Parameters and attribute set ,set up and For the same prime order Multiplication cyclic group, for The generators are defined as bilinear mappings. Random selection For each attribute Random selection ,calculate and Generate master key and common parameters ; Data management provider (DM) constructs a key encryption key (KEK) tree structure, assuming a set of data users. For each attribute Define attribute groups As an attribute The data user set, with leaf nodes associated with each data user. Correspondingly, each non-leaf node Randomly generate a key And stored in the non-leaf nodes, for each data user Define the set of path nodes This represents the distance from the root node to the leaf node. All nodes on the path, for each attribute group Define the minimum covering set , indicating coverage The minimum set of nodes for all data users in the system; For each attribute (in ), Data Management Provider DM Random Selection Index Obtain the attribute public key Public key of data management provider DM Data management provider DM's private key Data management provider (DM) publishes the public key and stores the private key securely. Cloud service provider CSP generates signing key , public, Stored by the cloud service provider (CSP) itself; Random selection index ,calculate , The attribute set of data users is For each attribute ,calculate , Random selection index ,calculate , , , Generate conversion key Data user private key Initialize the attribute group key The Attribute Authority Center AA will Send to cloud service provider CSP, Send to data user DU, Send to the data management provider's DM; Data management provider DM uses a KEK tree for each attribute Generate attribute group key, calculate ,like Not empty, for each non-leaf node ,calculate Generate updated attribute group keys The attribute authority center AA and data management provider DM will generate public parameters. and public key Published to blockchain BC.

[0007] Optionally, an access policy is constructed, a symmetric key is generated, the data file and the symmetric key are encrypted, and the intermediate ciphertext is output, including: Define a fine-grained access strategy as follows ,in for The matrix, The number of attributes in the access strategy. For the mapping function, Each row is mapped to an attribute ; The access policy is transformed into a matrix using a Linear Secret Sharing Scheme (LSSS). Define secret shared vector ,in For the secret value of the shared vector, The calculated shared value is: ,in It is a matrix The OK; Data owner DO randomly generates a symmetric key. Data files are encrypted using the AES algorithm. : Use CP-ABE to encrypt the symmetric key Randomly select encryption index ciphertext computation component , , Output intermediate ciphertext .

[0008] Optionally, the access policy in the intermediate ciphertext is replaced using a Bloom filter, outputting the final ciphertext and ciphertext header components, which are then uploaded to a cloud service provider (CSP) for storage. The hash value of the final ciphertext is then stored on the blockchain (BC), including: Construct an attribute Bloom filter (ABF) and set an access policy. The set of attributes involved is ,in For each attribute Line number, constructor element ,in and Expanded to a fixed length string And perform an XOR operation and store the result in the ABF array at index 1. Location; Will Insert ABF to replace the access policy in the intermediate ciphertext. , obtain the final ciphertext ; Data management provider DM based on attribute groups And a KEK tree, generating a ciphertext header component for each attribute, for each attribute Random selection And select the covering attribute group in the KEK tree. Minimal Covering Set Corresponding non-leaf nodes ,calculate Generate ciphertext header component .

[0009] Data management provider DM will Send it to the cloud service provider CSP, and the cloud service provider CSP will... With the final cipher Associated storage; Data owner DO will ultimately encrypt the data. Uploaded to a cloud service provider (CSP) for storage, the data owner (DO) obtains the final encrypted data. hash value The hash value is then uploaded to the blockchain BC as evidence of data storage.

[0010] Optionally, the encryption method further includes: When it is necessary to revoke a specific attribute of a data user, the Data Management Provider (DM) receives an attribute revocation request and determines the specific attribute and data user to be revoked: Let's assume the data user to be revoked... Attributes Identify attributes All data user sets ,from Remove users whose data has been revoked The updated attribute group was obtained. Data management provider DM updates attributes Minimal Covering Set ; Randomly select a new index Calculate the new attribute index Generate new attribute keys Generate updated public and private keys for the data management provider (DM). , ; Data management provider DM will revoke attribute information (including) , , , Send to the Attribute Authority Center (AA) for each Attribute Authority Center (AA) uses data from users Private key index Calculate the new attribute key component The Attribute Authority Center AA will Send to the data management provider's DM; Data management provider DM based on updated attribute groups Using a KEK tree structure, new attribute group keys are generated for data users whose data has not been revoked: ; Data management provider DM based on updated attribute groups Generate a new ciphertext header using the KEK tree structure. For each attribute ,calculate Leave everything else unchanged and generate the updated ciphertext header: The data management provider (DM) sends the updated encrypted header to the cloud service provider (CSP), which then updates it. Data management provider DM records information related to attribute revocation on the blockchain BC.

[0011] Optionally, the decryption token requested by data user DU to access the data file is verified, including: Data user DU checks their own attribute set To verify validity, confirm that all attributes have not been revoked and that the latest attribute group key is available. ; Data user DU uses conversion key and attribute group key And randomly select a temporary session key. Calculate the decryption token component , For each attribute Computational attribute token At the same time, the token is signed. ,in, For the decryption operation timestamp; After receiving the decryption request, the cloud service provider (CSP) verifies the DU signature. The effectiveness.

[0012] Optionally, determining whether the attribute set of the data user DU is in the cancellation list includes: Inspect the attribute set of data user DUs in the cloud service provider CSP. If the data is on the revocation list, the decryption request from user DU is denied.

[0013] Optionally, if the attribute set is not in the revocation list, verify whether the attribute satisfies the access policy, including: For each attribute of data user DU The cloud service provider (CSP) executes an ABF query and calculates... Get the ABF array indexes ( (The number of preset hash functions). Retrieve the string at the corresponding position from ABF. Reconstructing elements ; If the reconstruction is successful, The format is line number || attribute name and If the attribute matches successfully, the mapping relationship is recorded. Hehanghao Otherwise, the attribute is not in the access strategy; In the attribute set of data user DU If no attribute in ABF matches successfully, collect the set of all matching line numbers. Verify that the attributes satisfy the access policy, using the row number set. and access matrix Calculate whether a constant exists. , making If the function does not exist, the cloud service provider (CSP) will refuse the decryption request.

[0014] Optionally, under certain conditions, an outsourced decryption operation is performed, returning a portion of the decryption result to the data user DU, including: Cloud service provider CSP uses line number sets and reconstruction constant Perform outsourced decryption calculations for each line number. Cloud service providers (CSPs) use decryption tokens and intermediate ciphertext components to calculate a portion of the value. , , Partial decryption results are ; Cloud service provider CSP records the hash value of the outsourced decryption operation on blockchain BC and calculates part of the decryption result. The hash value is Create decryption record ,in, For data user identification, This is a partial hash value of the decryption result returned by the cloud service provider (CSP). The hash digest of the decryption token request message sent by the data user DU to the cloud service provider CSP, and the record is signed. Signature record Uploaded to the blockchain BC.

[0015] Optionally, if the verification passes, the final decryption is performed to obtain the plaintext data file, including: Data user DU uses a local private key and temporary session key Complete the final decryption and calculate the symmetric key. After simplification, we get Decrypt data files using symmetric keys ; Create decryption audit log: , To decrypt the file identifier, For operation type, To obtain the hash value of the plaintext file obtained through decryption, In operation mode; Digitally sign audit records. Data user DU uploads the signed audit record to the blockchain BC.

[0016] Through the above technical solution, this invention provides a revocable attribute-based encryption method based on blockchain and policy hiding. It initializes the attribute authority center (AA), cloud service provider (CSP), data user (DU), blockchain (BC), data manager (DM), and data owner (DO) respectively, constructs access policies, generates symmetric keys, encrypts the data file and the symmetric key, outputs intermediate ciphertext, replaces the access policy in the intermediate ciphertext with a Bloom filter, outputs the final ciphertext and ciphertext header components, and uploads them to the cloud service provider (CSP) for storage. The hash value of the final ciphertext is stored on the blockchain (BC). The decryption token requested by data user (DU) to access the data file is verified. If the verification is successful, it is determined whether the attribute set of data user (DU) is in the revocation list. If the attribute set is not in the revocation list, it is verified whether the attributes satisfy the access policy. If satisfied, an outsourced decryption operation is performed, and a partial decryption result is returned to the data user (DU). The correctness of the partial decryption result is verified based on the hash value stored on the blockchain (BC). If the verification is successful, final decryption is performed to obtain the plaintext data file. This invention employs Attribute Bloom Filter (ABF) technology to completely hide access policies. Compared to the attribute information leakage problem caused by plaintext embedding of policies in existing technologies, it can effectively protect the privacy of data owners and users, avoid the exposure of sensitive attributes, and achieve a good balance between security and efficiency. It supports more secure fine-grained access control. By introducing a Key Encryption Key (KEK) tree structure, it realizes an efficient attribute-level revocation mechanism, overcoming the shortcomings of complex revocation process and high communication load in traditional ABE schemes. It can dynamically handle user attribute changes, reduce system overhead, is suitable for large-scale cloud environments, and improves the scalability and practicality of the system. Combined with blockchain technology, this invention stores key hashes and access logs on the blockchain to ensure the immutability of data and the traceability of operations. Through automated execution of smart contracts, it enhances the transparency and fairness of the system, avoids the risk of relying on a single trusted center, and improves the overall security and trustworthiness.

[0017] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0018] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of a revocable attribute-based encryption method based on blockchain and policy hiding, according to one embodiment of the present invention. Figure 2This is a flowchart of a revocable attribute-based encryption method based on blockchain and policy hiding, according to one embodiment of the present invention. Figure 3 This is a timing diagram of a revocable attribute-based encryption method based on blockchain and policy hiding, according to one embodiment of the present invention. Detailed Implementation

[0019] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0020] In the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used the solution.

[0021] like Figure 1 The diagram shown is a schematic representation of a revocable attribute-based encryption method based on blockchain and policy hiding, according to one embodiment of the present invention. Figure 2 The diagram shows a flowchart of a revocable attribute-based encryption method based on blockchain and policy hiding, according to one embodiment of the present invention. Figure 3 The diagram shown is a timing diagram of a revocable attribute-based encryption method based on blockchain and policy hiding, according to one embodiment of the present invention. Figure 2 In this context, the encryption method may include: In step S1, the attribute authority center AA, cloud service provider CSP, data user DU, blockchain BC, data manager DM, and data owner DO are initialized respectively; In step S2, an access policy is constructed, a symmetric key is generated, the data file and the symmetric key are encrypted, and the intermediate ciphertext is output. In step S3, the access policy in the intermediate ciphertext is replaced by a Bloom filter, the final ciphertext and ciphertext header components are output, and they are uploaded to the cloud service provider CSP for storage. The hash value of the final ciphertext is stored in the blockchain BC. In step S4, the decryption token requested by data user DU to access the data file is verified; In step S5, if the verification passes, it is determined whether the attribute set of the data user DU is in the cancellation list; In step S6, if the attribute set is not in the cancellation list, verify whether the attribute satisfies the access policy; In step S7, if the conditions are met, an outsourced decryption operation is performed, and a portion of the decryption result is returned to the data user DU. In step S8, the correctness of some decryption results is verified based on the hash value stored on blockchain BC. In step S9, if the verification is successful, the final decryption is performed to obtain the plaintext data file.

[0022] In Figure 2 In the method shown, step S1 can be used to initialize the attribute authority center (AA), cloud service provider (CSP), data user (DU), data manager (DM), and data owner (DO) respectively. Specifically: Attribute Authority Center AA Selects Safety Parameters and attribute set ,set up and For the same prime order Multiplication cyclic group, for The generators are defined as bilinear mappings. Random selection For each attribute Random selection ,calculate and Generate master key and common parameters ; Data management provider (DM) constructs a key encryption key (KEK) tree structure, assuming a set of data users. For each attribute Define attribute groups As an attribute The data user set, with leaf nodes associated with each data user. Correspondingly, each non-leaf node Randomly generate a key And stored in the non-leaf nodes, for each data user Define the set of path nodes This represents the distance from the root node to the leaf node. All nodes on the path, for each attribute group Define the minimum covering set , indicating coverage The minimum set of nodes for all data users in the system; For each attribute (in ), Data Management Provider DM Random Selection Index Obtain the attribute public key Public key of data management provider DM Data management provider DM's private key Data management provider (DM) publishes the public key and stores the private key securely. Cloud service provider CSP generates signing key , public, Stored by the cloud service provider (CSP) itself; Random selection index ,calculate , The attribute set of data users is For each attribute ,calculate , Random selection index ,calculate , , , Generate conversion key Data user private key Initialize the attribute group key The Attribute Authority Center AA will Send to cloud service provider CSP, Send to data user DU, Send to the data management provider's DM; Data management provider DM uses a KEK tree for each attribute Generate attribute group key, calculate ,like Not empty, for each non-leaf node ,calculate Generate updated attribute group keys The attribute authority center AA and data management provider DM will generate public parameters. and public key These parameters are published to the blockchain BC, which stores them as the initial state of the system and provides tamper-proof auditing to ensure transparency and verifiability.

[0023] Step S2 can be used to construct an access policy, generate a symmetric key, encrypt the data file and the symmetric key, and output intermediate ciphertext. Specifically: Define a fine-grained access strategy as follows ,in for The matrix, The number of attributes in the access strategy. For the mapping function, Each row is mapped to an attribute ; The access policy is transformed into a matrix using a Linear Secret Sharing Scheme (LSSS). Define secret shared vector ,in For the secret value of the shared vector, The calculated shared value is: ,in It is a matrix The OK; Data owner DO randomly generates a symmetric key. Data files are encrypted using the AES algorithm. : Use CP-ABE to encrypt the symmetric key Randomly select encryption index ciphertext computation component , , Output intermediate ciphertext .

[0024] Step S3 can be used to replace the access policy in the intermediate ciphertext using a Bloom filter, output the final ciphertext and ciphertext header components, and upload them to the cloud service provider CSP for storage. The hash value of the final ciphertext is then stored on the blockchain BC. Specifically: To hide attribute information in the access policy, an attribute Bloom filter (ABF) is constructed. Let the access policy... The set of attributes involved is ,in For each attribute Line number, constructor element ,in and Expanded to a fixed length string And perform an XOR operation and store the result in the ABF array at index 1. Location; Will Insert ABF to replace the access policy in the intermediate ciphertext. , obtain the final ciphertext ; Data management provider DM based on attribute groups And a KEK tree, generating a ciphertext header component for each attribute, for each attribute Random selection And select the covering attribute group in the KEK tree. Minimal Covering Set Corresponding non-leaf nodes ,calculate Generate ciphertext header component .

[0025] Data management provider DM will Send it to the cloud service provider CSP, and the cloud service provider CSP will... With the final cipher Associated storage; Data owner DO will ultimately encrypt the data. Uploaded to a cloud service provider (CSP) for storage, the data owner (DO) obtains the final encrypted data. hash value The hash value is then uploaded to the blockchain BC as evidence of data storage.

[0026] In one embodiment of the present invention, the encryption method further includes: when it is necessary to revoke a specific attribute of a data user, the data manager (DM) receives an attribute revocation request and determines the specific attribute and data user to be revoked: assuming the data user to be revoked... Attributes Identify attributes All data user sets ,from Remove users whose data has been revoked The updated attribute group was obtained. Data management provider DM updates attributes Minimal Covering Set ; Randomly select a new index Calculate the new attribute index Generate new attribute keys Generate updated public and private keys for the data management provider (DM). , ; Data management provider DM will revoke attribute information (including) , , , Send to the Attribute Authority Center (AA) for each Attribute Authority Center (AA) uses data from users Private key index Calculate the new attribute key component The Attribute Authority Center AA will Send to the data management provider's DM; Data management provider DM based on updated attribute groups Using a KEK tree structure, new attribute group keys are generated for data users whose data has not been revoked: ; Data management provider DM based on updated attribute groups Generate a new ciphertext header using the KEK tree structure. For each attribute ,calculate Leave everything else unchanged and generate the updated ciphertext header: The data management provider (DM) sends the updated encrypted header to the cloud service provider (CSP), which then updates it. Data management provider DM records information related to attribute revocation on the blockchain BC to ensure the transparency and auditability of the operation.

[0027] Step S4 can be used to verify the decryption token requested by data user DU to access the data file, specifically: Data user DU checks their own attribute set To verify validity, confirm that all attributes have not been revoked and that the latest attribute group key is available. ; Data user DU uses conversion key and attribute group key And randomly select a temporary session key. Calculate the decryption token component , For each attribute Computational attribute token At the same time, the token is signed. ,in, For the decryption operation timestamp; After receiving the decryption request, the cloud service provider (CSP) verifies the DU signature. The effectiveness.

[0028] Step S5 can be used to determine whether the attribute set of data user DU is in the cancellation list, and the cloud service provider CSP checks the attribute set of data user DU. If the data is on the revocation list, the decryption request from user DU is denied.

[0029] Step S6 can be used to verify whether an attribute satisfies the access policy when the attribute set is not in the revocation list. Specifically: For each attribute of data user DU The cloud service provider (CSP) executes an ABF query and calculates... Get the ABF array indexes ( (The number of preset hash functions). Retrieve the string at the corresponding position from ABF. Reconstructing elements ; If the reconstruction is successful, The format is line number || attribute name and If the attribute matches successfully, the mapping relationship is recorded. Hehanghao Otherwise, the attribute is not in the access strategy; In the attribute set of data user DU If no attribute in ABF matches successfully, collect the set of all matching line numbers. Verify that the attributes satisfy the access policy, using the row number set. and access matrix Calculate whether a constant exists. , making If the function does not exist, the cloud service provider (CSP) will refuse the decryption request.

[0030] Step S7 can be used to perform an outsourced decryption operation under certain conditions, returning a portion of the decryption result to the data user DU, specifically: Cloud service provider CSP uses line number sets and reconstruction constant Perform outsourced decryption calculations for each line number. Cloud service providers (CSPs) use decryption tokens and intermediate ciphertext components to calculate a portion of the value. , , Partial decryption results are ; Cloud service provider CSP records the hash value of the outsourced decryption operation on blockchain BC and calculates part of the decryption result. The hash value is Create decryption record ,in, For data user identification, This is a partial hash value of the decryption result returned by the cloud service provider (CSP). The hash digest of the decryption token request message sent by the data user DU to the cloud service provider CSP, and the record is signed. Signature record Uploaded to the blockchain BC.

[0031] Step S8 can be used to verify the correctness of a partial decryption result based on the hash value stored on the blockchain BC. Data user DU receives the partial decryption result returned by the cloud service provider CSP. Then, integrity verification is performed, and the received data is calculated. hash value To verify the correctness of some decryption results, we need to check whether the decryption records obtained from the blockchain BC are consistent with those of the cloud service provider CSP. Step S9 can be used to verify the data and then perform the final decryption to obtain the plaintext data file. Specifically: Data user DU uses a local private key and temporary session key Complete the final decryption and calculate the symmetric key. After simplification, we get Decrypt data files using symmetric keys ; Data user DU creates decryption audit log: , To decrypt the file identifier, Set the operation type (to "DECRYPTION"). To obtain the hash value of the plaintext file obtained through decryption, Set to "SUCCESS" as the operating status. Data user DU digitally signs the audit records. Data user DU uploads the signed audit record to blockchain BC. Blockchain BC nodes verify the validity of the signature and add the valid audit record to blockchain BC, forming tamper-proof audit evidence.

[0032] Through the above technical solution, this invention provides a revocable attribute-based encryption method based on blockchain and policy hiding. It initializes the attribute authority center (AA), cloud service provider (CSP), data user (DU), blockchain (BC), data manager (DM), and data owner (DO) respectively, constructs access policies, generates symmetric keys, encrypts the data file and the symmetric key, outputs intermediate ciphertext, replaces the access policy in the intermediate ciphertext with a Bloom filter, outputs the final ciphertext and ciphertext header components, and uploads them to the cloud service provider (CSP) for storage. The hash value of the final ciphertext is stored on the blockchain (BC). The decryption token requested by data user (DU) to access the data file is verified. If the verification is successful, it is determined whether the attribute set of data user (DU) is in the revocation list. If the attribute set is not in the revocation list, it is verified whether the attributes satisfy the access policy. If satisfied, an outsourced decryption operation is performed, and a partial decryption result is returned to the data user (DU). The correctness of the partial decryption result is verified based on the hash value stored on the blockchain (BC). If the verification is successful, final decryption is performed to obtain the plaintext data file. This invention employs Attribute Bloom Filter (ABF) technology to completely hide access policies. Compared to the attribute information leakage problem caused by plaintext embedding of policies in existing technologies, it can effectively protect the privacy of data owners and users, avoid the exposure of sensitive attributes, and achieve a good balance between security and efficiency. It supports more secure fine-grained access control. By introducing a Key Encryption Key (KEK) tree structure, it realizes an efficient attribute-level revocation mechanism, overcoming the shortcomings of complex revocation process and high communication load in traditional ABE schemes. It can dynamically handle user attribute changes, reduce system overhead, is suitable for large-scale cloud environments, and improves the scalability and practicality of the system. Combined with blockchain technology, this invention stores key hashes and access logs on the blockchain to ensure the immutability of data and the traceability of operations. Through automated execution of smart contracts, it enhances the transparency and fairness of the system, avoids the risk of relying on a single trusted center, and improves the overall security and trustworthiness.

[0033] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0034] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0035] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0036] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0037] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0038] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0039] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0040] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0041] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A revocable attribute-based encryption method based on blockchain and policy hiding, characterized in that, The encryption method includes: Initialize the attribute authority center (AA), cloud service provider (CSP), data user (DU), blockchain (BC), data manager (DM), and data owner (DO) respectively. Construct an access policy, generate a symmetric key, encrypt the data file and the symmetric key, and output the intermediate ciphertext; The access policy in the intermediate ciphertext is replaced by a Bloom filter, the final ciphertext and ciphertext header components are output, and the data is uploaded to the cloud service provider CSP for storage. The hash value of the final ciphertext is then stored on the blockchain BC. Verify the decryption token used by data user DU to request access to data files; If the verification passes, determine whether the attribute set of the data user DU is in the cancellation list; If the attribute set is not in the cancellation list, verify whether the attribute satisfies the access policy; If the conditions are met, an outsourced decryption operation is performed, and part of the decryption result is returned to the data user DU; Verify the correctness of some decryption results based on the hash value stored on the blockchain BC; If the verification passes, proceed with the final decryption to obtain the plaintext data file.

2. The encryption method according to claim 1, characterized in that, Initialize the Attribute Authority Center (AA), Cloud Service Provider (CSP), Data User (DU), Data Manager (DM), and Data Owner (DO) respectively, including: Attribute Authority Center AA selects safety parameters and attribute set ,set up and For the same prime order Multiplication cyclic group, for The generators are defined as bilinear mappings. Random selection For each attribute Random selection ,calculate and Generate master key and common parameters ; Data management provider (DM) constructs a key encryption key (KEK) tree structure, assuming a set of data users. For each attribute Define attribute groups As an attribute The data user set, with leaf nodes associated with each data user. Correspondingly, each non-leaf node Randomly generate a key And stored in the non-leaf nodes, for each data user Define the set of path nodes This represents the distance from the root node to the leaf node. All nodes on the path, for each attribute group Define the minimum covering set , indicating coverage The minimum set of nodes for all data users in the system; For each attribute (in ), Data Management Provider DM Random Selection Index Obtain the attribute public key Public key of data management provider DM Data management provider DM's private key Data management provider (DM) publishes the public key and stores the private key securely. Cloud service provider CSP generates signing key , public, Stored by the cloud service provider (CSP) itself; Random selection index ,calculate , The attribute set of data users is For each attribute ,calculate , Random selection index ,calculate , , , Generate conversion key Data user private key Initialize the attribute group key The Attribute Authority Center AA will Send to cloud service provider CSP, Send to data user DU, Send to the data management provider's DM; Data management provider DM uses a KEK tree for each attribute Generate attribute group key, calculate ,like Not empty, for each non-leaf node ,calculate Generate updated attribute group keys The attribute authority center AA and data management provider DM will generate public parameters. and public key Published to blockchain BC.

3. The encryption method according to claim 2, characterized in that, Construct an access policy, generate a symmetric key, encrypt the data file and the symmetric key, and output the intermediate ciphertext, including: Define a fine-grained access strategy as follows ,in for The matrix, The number of attributes in the access strategy. For the mapping function, Each row is mapped to an attribute ; The access policy is transformed into a matrix using a Linear Secret Sharing Scheme (LSSS). Define secret shared vector ,in For the secret value of the shared vector, The calculated shared value is: ,in It is a matrix The OK; Data owner DO randomly generates a symmetric key. Data files are encrypted using the AES algorithm. : Use CP-ABE to encrypt the symmetric key Randomly select encryption index ciphertext computation component , , Output intermediate ciphertext .

4. The encryption method according to claim 3, characterized in that, The access policy in the intermediate ciphertext is replaced using a Bloom filter, outputting the final ciphertext and ciphertext header components. This is then uploaded to a cloud service provider (CSP) for storage. Finally, the hash value of the final ciphertext is stored on the blockchain (BC), including: Construct an attribute Bloom filter (ABF) and set an access policy. The set of attributes involved is ,in For each attribute Line number, constructor element ,in and Expanded to a fixed length string And perform an XOR operation and store the results in the ABF array at index 1. Location; Will Insert ABF to replace the access policy in the intermediate ciphertext. , obtain the final ciphertext ; Data management provider DM based on attribute groups And a KEK tree, generating a ciphertext header component for each attribute, for each attribute Random selection And select the covering attribute group in the KEK tree. Minimal Covering Set Corresponding non-leaf nodes ,calculate Generate ciphertext header component ; Data management provider DM will Send it to the cloud service provider CSP, and the cloud service provider CSP will... With the final cipher Associated storage; Data owner DO will ultimately encrypt the data. Uploaded to a cloud service provider (CSP) for storage, the data owner (DO) obtains the final encrypted data. hash value The hash value is then uploaded to the blockchain BC as evidence of data storage.

5. The encryption method according to claim 4, characterized in that, The encryption method further includes: When it is necessary to revoke a specific attribute of a data user, the Data Management Provider (DM) receives an attribute revocation request and determines the specific attribute and data user to be revoked: Let's assume the data user to be revoked... Attributes Identify attributes All data user sets ,from Remove users whose data has been revoked The updated attribute group was obtained. Data management provider DM updates attributes Minimal Covering Set ; Randomly select a new index Calculate the new attribute index Generate new attribute keys Generate updated public and private keys for the data management provider (DM). , ; Data management provider DM will revoke attribute information (including) , , , Send to the Attribute Authority Center (AA) for each Attribute Authority Center (AA) uses data users Private key index Calculate the new attribute key component The Attribute Authority Center AA will Send to the data management provider's DM; Data management provider DM based on updated attribute groups Using a KEK tree structure, new attribute group keys are generated for data users whose data has not been revoked: ； Data management provider DM based on updated attribute groups Generate a new ciphertext header using the KEK tree structure. For each attribute ,calculate Leave everything else unchanged and generate the updated ciphertext header: The data management provider (DM) sends the updated encrypted header to the cloud service provider (CSP), which then updates it. Data management provider DM records information related to attribute revocation on the blockchain BC.

6. The encryption method according to claim 5, characterized in that, Verify the decryption token used by data user DU to request access to data files, including: Data user DU checks their own attribute set To verify validity, confirm that all attributes have not been revoked and that the latest attribute group key is available. ; Data user DU uses conversion key and attribute group key And randomly select a temporary session key. Calculate the decryption token component , For each attribute Computational attribute token At the same time, the token is signed. ,in, For the decryption operation timestamp; After receiving the decryption request, the cloud service provider (CSP) verifies the DU signature. The effectiveness.

7. The encryption method according to claim 6, characterized in that, Determining whether the attribute set of the data user DU is in the cancellation list includes: Inspect the attribute set of data user DUs in the cloud service provider CSP. If the data is on the revocation list, the decryption request from user DU is denied.

8. The encryption method according to claim 7, characterized in that, If the attribute set is not in the cancellation list, verify whether the attribute satisfies the access policy, including: For each attribute of data user DU The cloud service provider (CSP) executes an ABF query and calculates... Get the ABF array indexes ( (The number of preset hash functions). Retrieve the string at the corresponding position from ABF. Reconstructing elements ; If the reconstruction is successful, The format is line number || attribute name and If the attribute matches successfully, the mapping relationship is recorded. Hehanghao Otherwise, the attribute is not in the access strategy; In the attribute set of data user DU If no attribute in ABF matches successfully, collect the set of all matching line numbers. Verify that the attributes satisfy the access policy, using the row number set. and access matrix Calculate whether a constant exists. , making If the function does not exist, the cloud service provider (CSP) will refuse the decryption request.

9. The encryption method according to claim 8, characterized in that, Under certain conditions, an outsourced decryption operation is performed, and a portion of the decryption result is returned to the data user DU, including: Cloud service provider CSP uses line number sets and reconstruction constant Perform outsourced decryption calculations for each line number. Cloud service providers (CSPs) use decryption tokens and intermediate ciphertext components to calculate a portion of the value. , , Partial decryption results are ; Cloud service provider CSP records the hash value of the outsourced decryption operation on blockchain BC and calculates part of the decryption result. The hash value is Create decryption record ,in, For data user identification, This is a partial hash value of the decryption result returned by the cloud service provider (CSP). The hash digest of the decryption token request message sent by the data user DU to the cloud service provider CSP, and the record is signed. Signature record Uploaded to the blockchain BC.

10. The encryption method according to claim 9, characterized in that, Verification passed; final decryption proceeds to obtain the plaintext data file, including: Data user DU uses a local private key and temporary session key Complete the final decryption and calculate the symmetric key. After simplification, we get Decrypt data files using symmetric keys ; Create decryption audit log: , To decrypt the file identifier, For operation type, To obtain the hash value of the plaintext file obtained through decryption, In operation mode; Digitally sign audit records. Data user DU uploads the signed audit record to the blockchain BC.

Images