A two-sided anonymous attribute-based encryption method and system for cloud data sharing

Abstract

This invention discloses a two-sided anonymous attribute-based encryption method and system for cloud-based data sharing. The method includes: an authorization center initializing the system to generate a conversion key and a local recovery key mixed with virtual attributes for data users; the data owner obtaining an anonymous token of the policy attribute through blinded interaction, and generating attribute-based ciphertext with an authentication tag using an ABF anonymous index, which is then uploaded to the cloud; the cloud server performing outsourced conversion on the ciphertext based on the conversion key and ABF index to obtain partial decryption results; and the data user filtering virtual attributes to complete ciphertext authentication and final decryption. This invention achieves two-way semantic hiding of access policies and user's real attributes, effectively ensuring the integrity and tamper resistance of the ciphertext during the outsourced computation process while reducing terminal decryption overhead.

Description

Technical Field

[0001] This invention relates to the fields of information security, cloud data sharing, attribute-based encryption, outsourced decryption, and access control, and particularly to a two-sided anonymous attribute-based encryption method and system for cloud data sharing. Background Technology

[0002] In cloud-based data sharing scenarios, data owners typically encrypt files, business records, or model data before storing them with cloud service providers, hoping that only data users who meet specific attribute policies can decrypt and access them. Attribute-based encryption can embed access policies into ciphertext and user attributes into keys, making it suitable for fine-grained access control for multiple users, departments, and roles.

[0003] However, traditional attribute-based encryption schemes still suffer from privacy leaks and computational burdens when deployed in the cloud. On the one hand, attribute tags in access policies often appear in plaintext or directly related forms, allowing cloud service providers to infer the department, business level, or personnel role of the data. On the other hand, the actual set of attributes in the user key may be observed in the cloud during outsourced conversion, thus revealing the identity profile of the data user. For semi-trusted authorization centers, if the data owner directly submits policy attributes during the encryption phase, the authorization center will also obtain the plaintext semantics of the access policy.

[0004] Furthermore, while cloud-outsourced decryption can reduce terminal computation, the lack of context binding and row-level authentication mechanisms means that cloud service providers may truncate, splice, or replace candidate row components, leading to risks such as erroneous decryption, unauthorized attempts, or denial-of-service. Therefore, an attribute-based encryption scheme is needed that can hide the semantics of access policy attributes, obfuscate the true attribute set of data users, and perform most of the decryption computation in the cloud. Summary of the Invention

[0005] To address the problems of exposed access policy attribute semantics, easy cloud-based observation of data user attribute sets, and heavy terminal decryption burden in existing technologies, this invention provides a two-sided anonymity attribute-based encryption method and system for cloud data sharing. The two-sided anonymity refers to: firstly, anonymizing and tokenizing attribute tags in the data owner's access policy, preventing the KGC from directly obtaining the plaintext of the policy attributes during OPRF interaction, and preventing the CSP from reconstructing the attribute tag semantics from the ciphertext and ABF index; secondly, mixing virtual attributes with the data user's real attribute set, so that the CSP can only observe the anonymous token set and the transformation key component, and cannot directly distinguish between real and virtual attributes.

[0006] The technical solution of this invention is implemented as follows:

[0007] A two-sided anonymous attribute-based encryption method for cloud data sharing includes the following steps:

[0008] Step 1: The authorization center KGC performs system initialization, generating public parameters, master key, and OPRF master key for attribute anonymization;

[0009] Step 2: KGC generates a local recovery key for the data user DU and a conversion key for use by the cloud service provider CSP. The attribute set corresponding to the conversion key includes the real attributes of the DU and virtual attributes used for obfuscation.

[0010] Step 3: The data owner DO performs an OPRF blinding interaction with KGC based on the attribute tags in the access structure to obtain the corresponding anonymous token. This prevents KGC from directly knowing the plaintext of the attributes in the access policy during the interaction process and prevents CSP from directly restoring the semantics of the attribute tags in subsequent processing.

[0011] Step 4: The DO generates attribute-based encrypted ciphertext, row-level authentication label, and authentication encrypted ciphertext based on the access structure, anonymous token, and ABF anonymous index, wherein the ABF anonymous index is used to hide the plaintext mapping relationship between the attribute label and the access policy row;

[0012] Step 5: The CSP performs an outsourced conversion on the ciphertext based on the conversion key and the ABF anonymous index to obtain a partial decryption result;

[0013] Step 6: The DU performs virtual attribute filtering, authentication verification, access structure reconstruction, and final decryption on the partial decryption result based on the local recovery key and the real attribute anonymous token mapping. The plaintext is restored when the verification is successful.

[0014] The two-sided anonymity includes attribute tag semantic hiding oriented towards access policies, and anonymous token obfuscation hiding oriented towards the set of attributes of data users.

[0015] As a further optimization of the above scheme, in step 1, KGC inputs security parameters. Generate Type-III asymmetric bilinear pairing groups ,in For a large prime number, , , They are respectively , Generator; KGC selects master key index and OPRF master key System-defined global attribute encoding functions In basic mode Epoch Enhanced Mode KGC selects a family of hash functions. ,in , , , , , , KGC selected , , and ABF parameters ,in Number of ABF slots The number of ABF hash functions; KGC outputs common parameters. ,in KGC stores the CA public key or system administrator public key used to verify DO certificates. .

[0016] As a further optimization of the above solution, in step 2, for the user... Real attribute set KGC from an independent namespace Generate virtual attribute set To form a set of mixed attributes KGC randomly selected ,in For DU local recovery key, For the randomization index, define , , For each blended attribute KGC calculates anonymous tokens ,definition and generate property components. KGC defines the conversion key used by CSP as follows: and transmit the local recovery key via a secure channel Mapping to real attributes Send to DU and retain locally.

[0017] As a further optimization of the above scheme, step 2 includes a joint epoch hashing anti-linking mechanism for periodic virtual attribute refresh, specifically:

[0018] Step 41: The system adopts the global attribute encoding function described in claim 2. Furthermore, the encryption, conversion, and final decryption processes of the same ciphertext employ a consistent approach. Logo;

[0019] Step 42, KGC Press Regenerate a random number of virtual attribute sets And generate the corresponding conversion key. When Epoch enhancement mode is enabled, KGC synchronously generates and updates the real attribute anonymous token mapping to DU. This makes the old virtual attribute anonymous token and the old The anonymous token for the true attributes under the current account has expired;

[0020] Step 43: When Epoch Enhanced Mode is enabled, the true attribute anonymous token is... The change allows the same real attribute to correspond to different anonymous tokens in different periods, thereby reducing or avoiding direct cross-period link analysis based on token equality.

[0021] As a further optimization of the above scheme, step 3, the process of obtaining the anonymous token through the OPRF blinded interaction between DO and KGC, includes the following steps:

[0022] Step 51, DO targets the access structure Each row of attributes Select blinding factor ,calculate and send a batch request to KGC. ;

[0023] Step 52, KGC check and And perform a subgroup check using the OPRF master key. calculate Then return to DO;

[0024] Step 53, DO check and Obtaining anonymous tokens through deblinding and calculate This prevents KGC from directly obtaining information during OPRF interactions. The attributes are plaintext.

[0025] As a further optimization of the above scheme, step 4, the construction of the ABF anonymous index includes the following steps:

[0026] Step 61: For each different anonymous token in the access policy Define row set bitmap Calculate the check string and combine the two into a load. The bit length of each slot in the ABF slot array is related to the load. The bit lengths are consistent;

[0027] Step 62: Randomly select ABF seeds ,pass derived Each independent hash function For each Calculate slot and require the same anonymous token to correspond to If two anonymous tokens are different, and there are duplicate slots corresponding to the same anonymous token, then a new one will be derived. Alternatively, the slots can be regenerated using a rejection sampling method;

[0028] Step 63, if If there are no empty slots, select another one. Rebuild; if an empty slot exists, select the slot to retain. Fill the remaining empty slots with random strings, and let After the XOR write is completed and all anonymous tokens have been written, the slots that have not yet been assigned values ​​are filled with random strings to obtain the ABF anonymous index. This allows CSP to query candidate policy rows based on anonymous tokens, but it cannot directly restore the semantics of attribute tags.

[0029] As a further optimization of the above solution, in step 4, DO generates the ABE row component and context. The process of digital signature and AEAD ciphertext includes: DO generates a signature key pair before encryption, and a certificate is issued by the system administrator or certificate authority. ;DO uses the LSSS access structure Select shared vectors And calculate And randomly select for each row ;DO calculates the encapsulation factor Session key Public Head And generate for each row , ;DO definition ,in, In Used to indicate the attribute encoding period used in this ciphertext generation, and for use when interacting with DO to perform OPRF blinding. Consistent identification; DO calculation , , and generate ,in, To remove plaintext mapping of row attributes The subsequent public description of the access matrix includes at least the access matrix. The DO contains the structural information required for its reconstruction, used to preserve the dimensions of the access structure matrix and the reconstruction relationships, but does not directly expose the semantics of row attribute labels; calculate ,by As AEAD associated data, generate Finally, the ciphertext is output. .

[0030] As a further optimization of the above scheme, steps 5 and 6, where CSP performs outsourced conversion and DU performs final decryption, include the following steps:

[0031] Step 81, CSP based derived For each anonymous token in the conversion key XOR recovery load ,when Extract candidate row set at time ;

[0032] Step 82, CSP Calculation and to calculate ;when At that time, CSP will pair and convert the results. and Together with the original ciphertext as described in claim 7 Together, they form part of the decryption result. Output to DU;

[0033] Step 83, DU is first based on verify Validity; if validation fails, output the following: ;DU based on , , , and Recalculate and If the reconstruction yields and In If inconsistent, output For each candidate tuple, if Then it is discarded as a virtual attribute, if Then calculate And verify If the verification fails, the candidate tuple is discarded.

[0034] Step 84: DU searches for a set that satisfies the true attribute row of the verified signature. ,make If there is no set that satisfies Or the corresponding reconstruction coefficient cannot be obtained. If the output is ⊥, then the output is ⊥; let ⊥ be the output. The conversion result corresponding to the verified anonymous token with genuine attributes. ,calculate Using the local recovery key get Then by and implement Restoring plaintext If AEAD decryption fails, output: .

[0035] A two-sided anonymous attribute-based encryption system for cloud data sharing, used to execute the above scheme, the system comprising the following modules:

[0036] The KGC module, DO module, CSP module, and DU module are used for system initialization, user key generation, virtual attribute mixing, Epoch refresh, and OPRF evaluation. The DO module is used for performing OPRF blinding requests, ABF anonymous index construction, ABE row component generation, and context based on the access structure. The system generates, digitally signs, and performs AEAD encryption; the CSP module stores the ciphertext, queries candidate policy rows based on ABF, and performs outsourced transformations; the DU module stores the local recovery key and the real attribute anonymous token mapping, performs virtual attribute filtering, DO authentication and context consistency verification, row-level authentication tag verification, LSSS reconstruction, and final decryption.

[0037] Compared with the prior art, the present invention achieves the following beneficial effects:

[0038] (1) This invention proposes a two-sided anonymous attribute-based encrypted access control method for cloud data sharing. By combining OPRF blind interaction with ABF anonymous index, the attribute tags in the access policy are converted into anonymous tokens during the data owner DO encryption stage. The ABF anonymous index is used to hide the plaintext mapping relationship between the attribute tags and the access policy lines, so that the authorization center KGC cannot directly know the plaintext of the attributes in the access policy during the OPRF interaction process, and the cloud service provider CSP cannot directly restore the semantics of the attribute tags from the ciphertext index. Compared with the scheme of directly disclosing the access policy or only partially hiding the policy structure, it can more effectively improve the privacy protection capability of the access policy side.

[0039] (2) The present invention designs an anonymous token obfuscation mechanism for the set of attributes of data users. By mixing real attributes and virtual attributes of DU to generate a conversion key, and combining periodic virtual attribute refresh and Epoch joint hashing mechanism, CSP obtains an anonymous token set and the mixed conversion key component, which makes it difficult to directly distinguish between real attribute tokens and virtual attribute tokens, thereby reducing the risk of the real attribute set of DU being identified and alleviating the privacy leakage problem caused by cross-period link analysis based on token equality.

[0040] (3) The present invention constructs an attribute-based encryption access control process that supports outsourcing conversion. Under the premise of ensuring the correctness of access control, the CSP undertakes the main pairing operation and outputs part of the decryption result. The DU only needs to perform lightweight operations such as virtual attribute filtering, DO authentication, row-level authentication label verification, LSSS reconstruction and local deblinding to complete the final decryption, which reduces the computational burden on the data user side and is suitable for application scenarios where terminal equipment resources are limited or large-scale cloud data sharing is required.

[0041] (4) This invention introduces context identifiers, row digest roots, row-level digital signatures, and AEAD-related data binding mechanisms during the ciphertext generation and outsourcing conversion process to ensure consistent binding of the ciphertext header, ABF anonymous index, row ciphertext components, authenticated encrypted ciphertext, and data owner identity information. When abnormal situations such as truncation, splicing, replacement, or forgery of candidates occur during storage, transmission, or outsourcing conversion of the ciphertext or partial decryption results, DU can promptly detect the abnormalities through certificate verification, context reconstruction, row-level signature verification, or AEAD authentication decryption, thereby improving the integrity verification capability and anti-tampering capability in the cloud outsourcing access control process. Attached Figure Description

[0042] Figure 1 This is a diagram of a two-sided anonymous attribute-based encryption system architecture for cloud data sharing provided by an embodiment of the present invention;

[0043] Figure 2 This is a flowchart illustrating the encryption, conversion, and final decryption process of a two-sided anonymous attribute-based encryption method for cloud data sharing provided in this embodiment of the invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below in conjunction with the embodiments of this invention. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are all within the scope of protection of this invention.

[0045] This embodiment uses a medical data cloud sharing system as an example to illustrate the privacy protection execution process of the present invention. Assume the data owner DO is a top-tier hospital, the data user DU is a medical researcher, the cloud service provider CSP is a third-party cloud platform, and the authorization center KGC is a medical data authorization center. The system adopts the Epoch enhancement mode, with the current period identified as epoch="2026-05". This embodiment provides a two-sided anonymity attribute-based encrypted access control method for cloud data sharing, including the following steps:

[0046] Step 1, System Initialization: KGC selects an elliptic curve that supports Type-III asymmetric bilinear pairing, such as the BLS12-381 curve, and generates a pairing group. Among them, the order For large prime numbers, , They are respectively , The generator. KGC randomly selects the master key index. and OPRF master key Set ABF anonymous index parameters, such as the number of slots. Number of independent hash functions , check string length KGC publishes its related family of hash functions. and the public key of the system administrator or CA authority As a common parameter Publish and properly store the system master key. .

[0047] Step 2, User Key Generation and Virtual Attribute Confusion: For medical researcher DU, the real attribute set is as follows: KGC generates collections of virtual properties from independent namespaces. and form a set of mixed attributes. KGC randomly selects ,in As a local recovery key for DU and generate the key body. , .right Each attribute in KGC encodes based on the current cycle. Calculate anonymous tokens ,definition and generate corresponding attribute components. KGC will contain the conversion keys for real and virtual attributes. Send to CSP and transmit local recovery key via secure channel Mapping table with real attributes Send to DU.

[0048] Step 3: Data Owner Registration and Access Policy Settings: The hospital's DO completes the signing key registration in the system and obtains a certificate issued by the certificate authority or system administrator. DO is preparing to share an electronic medical record file. The access policy is set to "Internal Medicine Physician" and "Municipal Hospital", with the corresponding access structure. Includes two rows of attributes: , This access policy states that only DUs that simultaneously meet both of the above attribute conditions can recover plaintext files.

[0049] Step 4, Access Policy Anonymization and Ciphertext Generation: To prevent the KGC from directly knowing the access policy attributes, DO (Documentation Object) addresses this. and Blinding factors were selected respectively. Calculate the blinding request value and And send it to KGC. KGC uses the OPRF master key. Calculate return value , After deblinding, the true anonymous token corresponding to the access policy is obtained. and and calculate , During this process, KGC receives blinded group elements and cannot directly obtain the plaintext of the access policy attributes set by DO.

[0050] Subsequently, DO targeted and Construct an ABF anonymous index. Let... Corresponding to the first line, Corresponding to line 2, DO generates row set bitmaps respectively. and check string and combine the two into a load. Then write to the ABF slot. DO randomly selects a seed. Derived hash function, assuming After being mapped to slots 12, 45, and 99 by three hash functions, DO will write the corresponding load to the above slots using an XOR method; Write to other slots in the same way, and fill unused slots with random strings to obtain a complete string. Structure. Therefore, CSP can subsequently query candidate policy rows based on anonymous tokens, but cannot directly reconstruct the plaintext mapping relationship between attribute tags and policy rows.

[0051] DO further selects shared vectors based on the LSSS access structure matrix. Calculate the shared value for each row. And randomly select for each row This then generates the ABE ciphertext public header. and row components and DO defines metadata. Calculate ABF summary , line summary root and the context identifier that is strictly bound to the above components DO uses its own signing private key to generate row-level signatures for component messages. Finally, DO... To link data, use the session key generated by the master encapsulation factor to pair electronic medical record files. Perform AEAD authentication encryption to obtain the authenticated encrypted ciphertext. and will contain the complete ciphertext of all components. Upload to CSP.

[0052] Step 5: CSP performs outsourced conversion: CSP receives the ciphertext. Then, using the conversion key they hold Anonymous token queries in the ABF anonymous index. When CSP uses or When querying virtual attribute tokens, the payload recovered by XOR cannot be matched by the checksum (i.e.) ), discard directly; when using and During the query, the system checks for matches and retrieves the corresponding candidate rows. Subsequently, CSP performs Type-III bilinear pairing transformations on the matched candidate rows, generating intermediate transformation results. and and the original ciphertext The above conversion results are packaged together to form a partial decryption result. Send to DU. Since CSP does not hold DU's local recovery key, it cannot independently recover the session key or plaintext file.

[0053] Step 6, DU final decryption: DU receives partial decryption results. Then, firstly based on the public key Verify DO certificate The legitimacy of the identifier and the reconstruction of the context identifier. This checks whether the encrypted text has been replaced, spliced, or tampered with in the cloud. Then, DU uses a locally stored real attribute mapping table. Filtering candidates: If candidate anonymous tokens If it is a virtual attribute or invalid item, it will be discarded; if Then continue verifying the corresponding row-level signature. After successful verification, DU calculates the satisfaction set and reconstruction coefficients based on the access matrix. Calculate the main encapsulation factor components and using the local recovery key Perform lightweight deblinding Recover the session key and perform AEAD authentication and decryption. If the DU possesses both the "Internal Medicine Physician" and "Municipal Hospital" attributes, the plaintext electronic medical record is successfully recovered. If any of the attributes is missing, or if any step of certificate verification, context verification, row-level signature verification, or AEAD authentication decryption fails, the system will output: .

[0054] Step 7, Periodic Refresh: When enhanced anti-linking capabilities are needed, KGC refreshes the virtual attribute set and anonymous tokens according to a preset period. For example, in the next epoch="2026-06", KGC regenerates the virtual attribute set, and when Epoch Enhancement mode is enabled, due to the change in the global encoding function, the same real attribute corresponds to a completely new anonymous token. Therefore, CSP cannot perform long-term cross-period association analysis on the same DU or the same real attribute solely based on the equality of anonymous tokens.

[0055] Based on the disclosure and teachings of the foregoing specification, those skilled in the art can make changes and modifications to the above embodiments. Therefore, the present invention is not limited to the specific embodiments disclosed and described above. Some modifications and changes to the present invention should also fall within the protection scope of the claims of the present invention. Furthermore, although some specific terms are used in this specification, these terms are only for convenience of explanation and do not constitute any limitation on the present invention.

Claims

1. A two-sided anonymous attribute-based encrypted access control method for cloud data sharing, characterized in that, Includes the following steps: Step 1: The authorization center KGC performs system initialization, generating public parameters, master key, and OPRF master key for attribute anonymization; Step 2: KGC generates a local recovery key for the data user DU and a conversion key for use by the cloud service provider CSP. The attribute set corresponding to the conversion key includes the real attributes of the DU and virtual attributes used for obfuscation. Step 3: The data owner DO performs an OPRF blinding interaction with KGC based on the attribute tags in the access structure to obtain the corresponding anonymous token. This prevents KGC from directly knowing the plaintext of the attributes in the access policy during the interaction process and prevents CSP from directly restoring the semantics of the attribute tags in subsequent processing. Step 4: The DO generates attribute-based encrypted ciphertext, row-level authentication label, and authentication encrypted ciphertext based on the access structure, anonymous token, and ABF anonymous index, wherein the ABF anonymous index is used to hide the plaintext mapping relationship between the attribute label and the access policy row; Step 5: The CSP performs an outsourced conversion on the ciphertext based on the conversion key and the ABF anonymous index to obtain a partial decryption result; Step 6: The DU performs virtual attribute filtering, authentication verification, access structure reconstruction, and final decryption on the partial decryption result based on the local recovery key and the real attribute anonymous token mapping. The plaintext is restored when the verification is successful. The two-sided anonymity includes attribute tag semantic hiding oriented towards access policies, and anonymous token obfuscation hiding oriented towards the set of attributes of data users.

2. The method according to claim 1, characterized in that, In step 1, KGC inputs security parameters. Generate Type-III asymmetric bilinear pairing groups ,in For a large prime number, , , They are respectively , Generator; KGC selects master key index and OPRF master key System-defined global attribute encoding functions In basic mode Epoch Enhanced Mode KGC selects a family of hash functions. ,in , , , , , , KGC selected , , and ABF parameters ,in Number of ABF slots The number of ABF hash functions; KGC outputs common parameters. ,in KGC stores the CA public key or system administrator public key used to verify DO certificates. .

3. The method according to claim 2, characterized in that, In step 2, for the user Real attribute set KGC from an independent namespace Generate virtual attribute set To form a set of mixed attributes KGC randomly selected ,in For DU local recovery key, For the randomization index, define , , For each blended attribute KGC calculates anonymous tokens ,definition and generate property components. KGC defines the conversion key used by CSP as follows: and transmit the local recovery key via a secure channel Mapping to real attributes Send to DU and retain locally.

4. The method according to claim 3, characterized in that, Step 2 also includes a joint epoch hashing anti-linking mechanism for periodic virtual attribute refresh and epoch, specifically: Step 41: The system adopts the global attribute encoding function described in claim 2. Furthermore, the encryption, conversion, and final decryption processes for the same ciphertext employ a consistent approach. Logo; Step 42, KGC Press Regenerate a random number of virtual attribute sets And generate the corresponding conversion key. When Epoch enhancement mode is enabled, KGC synchronously generates and updates the real attribute anonymous token mapping to DU. This makes the old virtual attribute anonymous token and the old The anonymous token for the true attributes under the current account has expired; Step 43: When Epoch Enhanced Mode is enabled, the true attribute anonymous token is... The change allows the same real attribute to correspond to different anonymous tokens in different periods, thereby reducing or avoiding direct cross-period link analysis based on token equality.

5. The method according to claim 3, characterized in that, In step 3, the process of obtaining the anonymous token through the OPRF blinded interaction between DO and KGC includes the following steps: Step 51, DO targets the access structure Each row of attributes Select blinding factor ,calculate and send a batch request to KGC. ; Step 52, KGC check and And perform a subgroup check using the OPRF master key. calculate Then return to DO; Step 53, DO check and Obtaining anonymous tokens through deblinding and calculate This prevents KGC from directly obtaining information during OPRF interactions. The attributes are plaintext.

6. The method according to claim 5, characterized in that, In step 4, the construction of the ABF anonymous index includes the following steps: Step 61: For each different anonymous token in the access policy Define row set bitmap Calculate the check string And combine the two into a load. The bit length of each slot in the ABF slot array is related to the load. The bit lengths are consistent; Step 62: Randomly select ABF seeds ,pass derived Each independent hash function For each Calculate slot and require the same anonymous token to correspond to If two anonymous tokens are different, and there are duplicate slots corresponding to the same anonymous token, then a new one will be derived. Alternatively, the slots can be regenerated using a rejection sampling method; Step 63, if If there are no empty slots, select another one. Rebuild; if an empty slot exists, select the slot to retain. Fill the remaining empty slots with random strings, and let After the XOR write is completed and all anonymous tokens have been written, the slots that have not yet been assigned values ​​are filled with random strings to obtain the ABF anonymous index. This allows CSP to query candidate policy rows based on anonymous tokens, but it cannot directly restore the semantics of attribute tags.

7. The method according to claim 6, characterized in that, In step 4, DO generates the ABE line component and context. The process of digital signature and AEAD ciphertext includes: DO generates a signature key pair before encryption, and a certificate is issued by the system administrator or certificate authority. ;DO uses the LSSS access structure Select shared vectors And calculate And randomly select for each row ;DO calculates the encapsulation factor Session key Public Head And generate for each row , ;DO definition ,in, In Used to indicate the attribute encoding period used in this ciphertext generation, and for use when interacting with DO to perform OPRF blinding. Consistent identification; DO calculation , , and generate ,in, To remove plaintext mapping of row attributes The subsequent public description of the access matrix includes at least the access matrix. The DO contains the structural information required for its reconstruction, used to preserve the dimensions of the access structure matrix and the reconstruction relationships, but does not directly expose the semantics of row attribute labels; calculate ,by As AEAD associated data, generate Finally, the ciphertext is output. .

8. The method according to claim 7, characterized in that, In steps 5 and 6, the CSP performs outsourced conversion and the DU performs final decryption, which includes the following steps: Step 81, CSP based derived For each anonymous token in the conversion key XOR recovery load ,when Extract candidate row set at time ; Step 82, CSP Calculation and to calculate ;when At that time, CSP will pair and convert the results. and Together with the original ciphertext as described in claim 7 Together, they form part of the decryption result. Output to DU; Step 83, DU is first based on verify Validity; if validation fails, output [validity]. ;DU based on , , , and Recalculate and If the reconstruction yields and In If inconsistent, output For each candidate tuple, if Then it is discarded as a virtual attribute, if Then calculate And verify If the verification fails, the candidate tuple is discarded. Step 84: DU searches for a set that satisfies the true attribute row that has passed the signature verification. ,make If there is no set that satisfies Or the corresponding reconstruction coefficient cannot be obtained. If the output is ⊥, then the output is ⊥; let ⊥ be the output. The conversion result corresponding to the verified anonymous token with genuine attributes. ,calculate Using the local recovery key get Then by and implement Restoring plaintext If AEAD decryption fails, output: .

9. A two-sided anonymous attribute-based encryption system for cloud data sharing, characterized in that, The system is used to perform the method according to any one of claims 1 to 8, the system comprising a KGC module, a DO module, a CSP module, and a DU module; the KGC module is used to perform system initialization, user key generation, virtual attribute mixing, Epoch refresh, and OPRF evaluation; the DO module is used to perform OPRF blinding requests, ABF anonymous index construction, ABE row component generation, and context based on the access structure. The system generates, digitally signs, and performs AEAD encryption; the CSP module stores the ciphertext, queries candidate policy rows based on ABF, and performs outsourced transformations; the DU module stores the local recovery key and the real attribute anonymous token mapping, performs virtual attribute filtering, DO authentication and context consistency verification, row-level authentication tag verification, LSSS reconstruction, and final decryption.

Images