A puncturable ciphertext policy attribute-based encryption method and system supporting user revocation

Abstract

The application discloses a puncturable ciphertext policy attribute-based encryption method and system supporting efficient user revocation, and belongs to the technical field of cloud data security. In view of the high user revocation overhead and the difficulty in adapting to large-scale cloud storage scenes of the existing ciphertext policy attribute-based encryption scheme, the present scheme fuses puncturable encryption and attribute-based encryption, a data owner encrypts plaintext based on an access control policy and embeds an initial puncturable key in ciphertext, a key generation center generates corresponding keys according to user attributes and a label set, when revoking authority, a cloud server updates a puncturable key component according to a puncturing strategy, so that a user matched with a label loses decryption authority, and a digital signature of a puncturing result is generated, a proxy server performs partial decryption after double verification of attributes and labels, a user locally completes final decryption, and a data owner confirms the legality of the revocation operation through signature verification. The present application can realize efficient revocation without re-encrypting ciphertext and updating keys of non-revoked users, has forward security, effectively reduces the terminal computing burden, and adapts to the authority management needs of large-scale users in a cloud environment.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and cloud data security technology, specifically to a puncturable ciphertext policy attribute-based encryption method and system that supports user revocation. Background Technology

[0002] With the rapid development of cloud computing technology, institutions such as school libraries and enterprise document management systems are outsourcing their data to cloud servers to achieve flexible resource sharing and efficient management. However, data outsourcing brings a series of security challenges. How to achieve fine-grained access control and user permission revocation for encrypted data in an untrusted cloud environment has become a research hotspot in the field of cloud data security.

[0003] Ciphertext policy attribute-based encryption, as an emerging cryptographic technique, achieves a "one-to-many" encryption mode by embedding access policies into ciphertext, providing an effective solution for secure data sharing in cloud storage environments. In ciphertext policy attribute-based encryption, data owners can define access policies, and only users whose attributes meet the policy can decrypt the ciphertext, thus achieving fine-grained access control.

[0004] However, in practical applications, dynamic management of user permissions is an unavoidable issue. Taking a university library system as an example, every year a large number of students graduate and leave, while others drop out or transfer. These students should have their access permissions revoked promptly. Existing ciphertext-based encryption schemes that support user revocation are mainly divided into two categories: direct revocation and indirect revocation. Direct revocation schemes embed the list of revoked users into the ciphertext, resulting in poor flexibility and a linear increase in communication overhead as the length of the revocation list grows, making them unsuitable for large-scale user revocation scenarios. Indirect revocation schemes rely on authorized institutions to periodically update the keys of unrevoked users and re-encrypt the ciphertext in the cloud. While offering better flexibility, each revocation requires updating the keys of all unrevoked users and re-encrypting the ciphertext, resulting in significant computational and communication overhead.

[0005] Therefore, how to achieve efficient and flexible user cancellation while ensuring fine-grained access control and reducing the computational and communication overhead of the system has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0006] To address the problems existing in the prior art, this invention provides a puncturable ciphertext policy attribute-based encryption method and system that supports user revocation. By combining puncturable encryption technology with ciphertext policy attribute-based encryption, the puncturable policy enables precise revocation of user rights without redistributing keys or re-encrypting ciphertext, significantly reducing the computational and communication overhead of the system.

[0007] This invention is achieved through the following technical solution: In a first aspect, this application provides a piercing ciphertext policy attribute-based encryption method that supports efficient user revocation, comprising the following steps: Step 1: The data owner performs ciphertext policy attribute-based encryption on the plaintext based on the access control policy, and embeds an initial puncturable key in the ciphertext. The complete ciphertext is then uploaded to the cloud server for storage. Step 2: The key generation center generates a user key containing decryption components of attribute and tag dimensions based on the user's attribute set and tag set. Step 3: When revoking user access rights, the data owner sends a puncture policy to the cloud server; the cloud server updates the puncture key in the ciphertext according to the puncture policy, obtains the punctured ciphertext, causes users whose tags match the puncture policy to lose decryption rights, and generates a digital signature of the puncture result and feeds it back to the data owner. Step 4: The user submits a decryption request and user key to the proxy server; after verifying that the user attributes meet the access control policy and that the user tag is not restricted by the piercing policy, the proxy server performs partial decryption of the ciphertext and returns it to the user. Step 5: The user uses their own key to perform the final decryption of part of the ciphertext to obtain the plaintext data.

[0008] Preferably, the access control policy in step 1 is constructed based on an access control tree, including: Using user attributes as leaf nodes, access logic rules are formed by combining AND gates, OR gates, and threshold gates; the initial puncturable key corresponds to the encrypted component of the tag dimension and is embedded in the ciphertext structure.

[0009] Preferably, in step 2, the generated user key is split into a conversion key and a user private key; The conversion key includes an attribute key component and a tag key component, which are submitted to the proxy server to perform partial decryption. The user's private key includes a core private decryption component, which is stored privately by the user locally.

[0010] Preferably, the process of updating the puncturable key on the cloud server in step 3 includes: According to De Morgan's Law, the puncture strategy is converted into a tag access strategy, and the puncturable key in the ciphertext is reconstructed based on the converted tag access strategy; the puncture operation only updates the puncturable key portion in the ciphertext.

[0011] Preferably, the process of the proxy server performing verification in step 4 includes: First, check if the user's attribute set meets the access control policy. If not, return decryption failure. After the attribute verification passes, check if the user's tag set matches the piercing policy. If they match, return decryption failure. After both verifications pass, perform partial decryption operations.

[0012] Preferably, the partial decryption operation in step 4 includes: The proxy server uses the transformation key to perform bottom-up secret recovery operations on the access control tree and the punctured tag access structure, respectively, and obtains intermediate operation results through Lagrange interpolation aggregation.

[0013] Preferably, the final decryption process in step 5 includes: The user uses their private key to remove the masking component from the decrypted ciphertext, restores the complete decryption factor, and then completes the decryption.

[0014] Preferably, the puncture strategy described in step 3 is constructed by combining one or more tags through Boolean logic, enabling single user revocation and batch user revocation to be synchronized.

[0015] Secondly, this application provides a pierceable ciphertext policy attribute-based encryption system that supports efficient user revocation, characterized by comprising: The encryption module is used to perform ciphertext policy attribute-based encryption on plaintext based on access control policies, while embedding an initial puncturable key in the ciphertext and uploading the complete ciphertext to the cloud server for storage. The key generation module is used to generate a user key containing decryption components of the attribute dimension and the tag dimension based on the user's attribute set and tag set; The puncture revocation module is used to receive the puncture policy and update the puncturable key in the ciphertext to obtain the ciphertext after puncture and generate a digital signature of the puncture result. An outsourced decryption module is used to verify user attributes and tag permissions. After successful verification, it performs partial decryption of the ciphertext and returns the result to the user. The decryption module is used to perform final decryption on a portion of the decrypted ciphertext to obtain plaintext data.

[0016] Thirdly, this application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the described puncturable ciphertext policy attribute-based encryption method that supports efficient user revocation.

[0017] Compared with the prior art, the present invention has the following beneficial technical effects: This application proposes a puncturable ciphertext policy attribute-based encryption method that supports user revocation. It deeply integrates attribute-based encryption with puncturable encryption to construct a dual-dimensional access control system based on attributes and tags. During the encryption phase, the data owner embeds an initial puncturable key component into the attribute-based encrypted ciphertext, ensuring that decryption permissions are simultaneously constrained by both the attribute access policy and tag status. The user key synchronously contains decryption components for both the attribute and tag dimensions; decryption is only possible when both permission conditions are met. When user revocation is executed, only the puncturable key component in the ciphertext needs to be updated according to the puncture policy. There is no need to re-encrypt the entire attribute encryption layer ciphertext or redistribute keys to users whose revocation has not been completed. This permanently deprives users whose tags match the puncture policy of decryption capabilities. The decryption process adopts a hierarchical model: the proxy server completes attribute verification, tag verification, and some highly complex decryption operations, while the user terminal only needs to perform a lightweight final decryption. Simultaneously, the puncture operation is accompanied by a digital signature mechanism, allowing the data owner to verify the integrity and legality of the cloud-side revocation operation through signature verification. This solution significantly reduces the computational and communication overhead of user revocation, supports precise single-user revocation and batch group revocation, has good forward security, reduces terminal computing power dependence through outsourced decryption, and solves the operational trust issue in a semi-trusted cloud environment through the signature verification mechanism, thus taking into account both the needs of fine-grained access control and efficient user revocation.

[0018] This application also proposes a puncturable ciphertext policy attribute-based encryption system that supports user revocation, an electronic device, and a computer storage medium, which possess all the advantages of the aforementioned puncturable ciphertext policy attribute-based encryption method that supports user revocation. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of a school library electronic data sharing scenario in a cloud environment according to the present invention; Figure 2 This is a model diagram of the puncturable ciphertext policy attribute-based encryption system that supports user revocation according to the present invention; Figure 3 This is a flowchart of the puncturable ciphertext policy attribute-based encryption method that supports user revocation according to the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0022] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0023] To facilitate the explanation of the technical solution of this invention, the basic objects involved and their data relationships are first defined in this embodiment. This invention uses ciphertext policy attribute-based encryption in a cloud environment as its basic technical framework. By introducing puncture encryption technology, it achieves efficient and flexible user revocation functionality, solving the problem of high computational and communication overhead caused by the need to redistribute keys and re-encrypt ciphertext in existing solutions.

[0024] System model and entity definition: such as Figure 2 As shown, the system model of this invention consists of the following four entities: a key generation center, a data owner, a user, and a cloud server. The cloud server further includes three sub-components: a data storage center, a data storage administrator, and a proxy server.

[0025] The key generation center is responsible for generating public and private keys for the system. Based on each user's access permissions, it generates different keys for each user using a set of attributes and a set of tags.

[0026] The data owner owns the system entity that controls the data, is responsible for defining access control policies and puncture policies related to the data, and uses the access policies to encrypt the data; when the data owner needs to revoke any user, the puncture policy is sent to the data storage administrator.

[0027] A user is a system entity that accesses the data storage center. If a user's attributes meet the access policy and the tag does not match the puncture policy, the user can decrypt the ciphertext.

[0028] The cloud server is responsible for outsourcing and managing encrypted data. The data storage center is responsible for storing the encrypted data outsourced to the cloud by the data owner. The data storage administrator is responsible for managing access permissions to the data and using the puncture strategy sent by the data owner to puncture the encrypted data to achieve user revocation. The proxy server is responsible for partially decrypting the encrypted data and returning the partially decrypted data to the user.

[0029] Trust assumptions: In this invention, it is assumed that the key generation center and attribute authorization agency are completely trustworthy and will honestly perform the relevant tasks; the cloud server (including the data storage center, data storage administrator and proxy server) is semi-honest, honestly performing the valid tasks assigned by other entities, but trying to obtain as much information as possible about the ciphertext; the user is also semi-trustworthy and may try to obtain unauthorized data through collusion attacks.

[0030] This invention combines Ciphertext Policy Attribute-Based Encryption (CP-ABE) with puncturable encryption to construct a two-dimensional access control system that decouples the attribute and tag dimensions. The user's decryption key is generated from two independent sets: one is an attribute set, used to match the ciphertext's access control policy to enable normal data access; the other is a tag set, initially inactive, used in conjunction with puncture operations to restrict data access permissions. The attribute and tag sets do not need to be of equal length.

[0031] This encryption method embeds the initial key of the puncture-enabled encryption as a public parameter into the ciphertext structure, and binds the attribute-based encryption key and the puncture-enabled encryption key together to the user's decryption key. Based on this architecture, even if the relevant parameters of the puncture-enabled encryption are publicly disclosed, as long as the core key of the attribute-based encryption is kept secret, unauthorized users cannot decrypt the ciphertext, thus ensuring the security of data access.

[0032] When revoking user access permissions, the data owner first selects the corresponding tag based on the revocation requirement, constructs a puncture policy through Boolean logic combinations, and then sends the puncture policy to the data storage administrator. Upon receiving the puncture policy, the data storage administrator converts it into a corresponding tag-based access policy according to De Morgan's Law. Based on the converted tag-based access policy, the administrator performs a puncture operation on the ciphertext, activating the restriction effect of the corresponding tag in the user key. This prevents the user holding the corresponding tag from passing the tag-level permission verification, thus losing the decryption permission for the ciphertext.

[0033] A puncturable ciphertext policy attribute-based encryption method that supports efficient user revocation includes the following steps: Step 1: The data owner performs ciphertext policy attribute-based encryption on the plaintext based on the access control policy, and embeds an initial puncturable key in the ciphertext. The complete ciphertext is then uploaded to the cloud server for storage. Step 2: The key generation center generates a user key containing decryption components of attribute and tag dimensions based on the user's attribute set and tag set. Step 3: When revoking user access rights, the data owner sends a puncture policy to the cloud server; the cloud server updates the puncture key in the ciphertext according to the puncture policy, obtains the punctured ciphertext, causes users whose tags match the puncture policy to lose decryption rights, and generates a digital signature of the puncture result and feeds it back to the data owner. Step 4: The user submits a decryption request and user key to the proxy server; after verifying that the user attributes meet the access control policy and that the user tag is not restricted by the piercing policy, the proxy server performs partial decryption of the ciphertext and returns it to the user. Step 5: The user uses their own key to perform the final decryption on a portion of the ciphertext to obtain the plaintext data; Step 6: The data owner uses the data storage administrator's signing public key to verify the received digital signature, confirming the correctness and integrity of the puncture operation.

[0034] This method is based on attribute-based encryption with a ciphertext policy. During the encryption phase, the data owner double-binds the plaintext with access control policies and tags, generating ciphertext that simultaneously contains attribute encryption components and a puncture-proof key component. This allows decryption permissions to be jointly controlled by the attribute set and the tag set. In the key generation phase, the key generation center generates a user key containing attribute and tag-level decryption components based on the user attribute set and tag set. It then separates a transformation key for outsourced computation and a locally stored user private key; these two keys work together to complete the entire decryption process. During the decryption phase, the proxy server performs two levels of permission verification: first, it verifies whether the user attributes meet the ciphertext's access control policy; then, it verifies whether the user tags are restricted by the puncture policy. Only when both verifications pass does partial decryption occur and the result is returned. During the revocation phase, the data owner issues a puncture policy and the cloud server updates the puncture-enabled key in the ciphertext, permanently depriving users whose tags match the puncture policy of their decryption capabilities. This process does not require reencrypting the original ciphertext or updating the keys of unrevoked users, achieving low-overhead autonomous permission revocation. Furthermore, the revoked user cannot decrypt the ciphertext again, ensuring the forward security of the solution. Simultaneously, the cloud server generates a digital signature for the puncture result, which the data owner can verify to confirm the legality of the revocation operation, making the operation auditable.

[0035] Reference Figure 3 The present invention provides a puncturable ciphertext policy attribute-based encryption scheme that supports user revocation, comprising the following steps: Step 1: Based on the security parameter λ, the system attribute set U, and the total number of system tags d, the key generation center, the proxy server, and the data storage administrator respectively perform bilinear group parameter construction and key pair generation; thus obtaining the system public key, the system master key, the proxy server public and private key pair, and the data storage administrator signature public and private key pair. The system public key is publicly available and used for subsequent encryption and key generation processes, while the system master key is kept secret by the key generation center and used to generate user keys. The key pairs of the two types of entities are used for subsequent partial decryption operations and puncture result signing operations, respectively.

[0036] The specific implementation method of step 1 will be described in detail below.

[0037] S1.1: Constructing the basic environment for a bilinear group: The key generation center is selected as a prime number of order. bilinear group and Define a bilinear mapping Select cyclic group The generator g; defines a cryptographically secure hash function. This is used to map attribute identifiers and tag identifiers to group elements.

[0038] S1.2: For each attribute in the system attribute set U, the key generation center randomly selects an integer. Calculate the corresponding group element components; randomly select the system master secret value. The basic components of the public key of the computing system and The key generation center defines the Lagrange interpolation polynomial function. Select a reserved tag that will not be used for user tag allocation. As the zeros of the polynomial, they form the basic parameters for constructing tag encryption. and The tag-related parameters are incorporated into the system public key.

[0039] S1.3: The key generation center uses a polynomial function. Generate system public key and system master key ,as follows:

[0040]

[0041]

[0042] System public key The system master key is disclosed to all entities within the system. It is privately stored by the key generation center and is not disclosed to any other entity.

[0043] S1.4: The proxy server selects a random number. Use your private key to generate the corresponding public key; ,

[0044] in, It is the identity identifier of the proxy server.

[0045] Generate a public and private key pair for the proxy server. The private key is kept confidential by the proxy server, while the public key is made public within the system.

[0046] S 1.5: The data storage administrator selects a random number. Using your private key for signing, generate the corresponding public key for signing as follows: ,

[0047] The generated signature key pair consists of a private signature key kept confidential by the data storage administrator and a public signature key made public within the system.

[0048] In some embodiments, the bilinear group can be a symmetric bilinear group or an asymmetric bilinear group; when an asymmetric bilinear group is used, the security strength of the scheme can be further improved, while adapting to hardware operating environments with different performance.

[0049] In some embodiments, the hash function can be implemented using SHA-256 combined with elliptic curve point mapping.

[0050] In some embodiments, the polynomial may also be constructed using other forms of puncturable polynomials.

[0051] By selecting and configuring bilinear groups and cryptographic hash functions, a unified mathematical foundation is built for the entire attribute-based encryption and puncture-resistant encryption scheme. The tag set is encoded into an algebraic structure based on the secret sharing polynomial, enabling permission verification and secret recovery at the tag dimension through polynomial interpolation during the decryption phase, providing an algebraic implementation path for subsequent puncture operations. At the same time, the tag encryption parameters and attribute encryption parameters are designed to be independently decoupled, allowing the puncture encryption key to be embedded in the ciphertext as an independent public parameter. When a user revokes their license, only the tag-related components in the ciphertext need to be updated, without re-encrypting the entire ciphertext or updating the keys of users who have not yet revoked their licenses, significantly reducing the computational and communication overhead of large-scale user revocation.

[0052] Step 2: Based on the system public key The public key of the proxy server Plain text message and access control tree The data owner randomly selects a random number, calculates the session key, generates the initial key for puncture encryption, and generates the ciphertext component of each node according to the structure of the access control tree. The ciphertext component of each node is then merged with the initial key for puncture encryption to generate ciphertext.

[0053] Preferably, based on the system public key Proxy server public key Plaintext data In addition to the preset access control policies, the data owner first constructs an access control tree based on the data's permission management requirements, using attributes as leaf nodes and AND gates, OR gates, and threshold gates as non-leaf nodes to form an attribute access control policy bound to the ciphertext. Then, a master secret value is randomly selected for encryption, and a session key between the data owner and the proxy server is calculated based on this master secret value. At the same time, the master secret value is used as the root node secret value of the access control tree to perform secret sharing, generating a corresponding secret fragment for each leaf node. Subsequently, a puncture encryption initial secret value is randomly selected to generate an initial punctureable key component and embed it into the ciphertext structure as the access control entry point at the tag level. Finally, by combining the secret fragments of each node in the access control tree, the session key, and the initial punctureable key, all ciphertext components are calculated and combined into a complete ciphertext.

[0054] The specific implementation method of step 2 will be described in detail below.

[0055] S2.1: The data owner constructs an access control tree based on the data's access permission requirements, with attributes as leaf nodes and logic gates (AND gate, OR gate, threshold gate) as non-leaf nodes. This serves as an access control policy for encrypted binding.

[0056] S2.2: The data owner selects a random number. This master secret value is used to calculate the session key between the data owner and the proxy server. Simultaneously, the master secret value s is used as the root node secret value of the access control tree, and secret sharing is performed according to the structure of the access control tree to generate a shard value for each leaf node.

[0057] S2.3: The data owner selects a random number. The initial key for generating puncture encryption is The initial puncturable key is embedded in the ciphertext as a built-in restriction policy. Initial key as follows:

[0058] S2.4: Based on the fragmentation values ​​of each leaf node in the access control tree, the session key, and the initial puncturable key, calculate all ciphertext components and combine them to form the complete ciphertext. :

[0059]

[0060] S2.5: The data owner will generate the complete ciphertext. Uploaded to the cloud server's data storage center for persistent storage.

[0061] In some embodiments, the control tree may also adopt a linear secret sharing structure and express access control policies in matrix form to adapt to more complex multi-attribute permission management scenarios.

[0062] In some embodiments, the session key can be generated through a key negotiation algorithm, replacing the fixed-value calculation method, to further enhance the security of data transmission and some decryption processes.

[0063] By encapsulating the access control tree and the initial puncturable key component within the ciphertext structure, a dual-access verification mechanism for attribute access and tag revocation is constructed: user decryption requires two conditions to be met simultaneously: first, the user's attribute set must satisfy the access policy corresponding to the access control tree; second, the user's tag set must not match the puncturing policy corresponding to the ciphertext. The access control tree implements fine-grained access control based on attributes; the initial puncturable key component provides an independent tag-level access permission entry point to the ciphertext, decoupled from the attribute access structure. This allows the data owner to directly reconstruct the tag-level access permission structure and revoke the access permissions of specific users through subsequent puncturing operations, without needing to re-encrypt the entire ciphertext. This dual-verification ciphertext structure retains the advantages of fine-grained access in attribute-based encryption while providing a cryptographic foundation for low-overhead fine-grained user revocation.

[0064] Step 3: Based on the system public key System Master Key Target user attribute set With tag set The key generation center performs operations such as secret value selection, attribute key component calculation, and tag key component calculation to obtain the corresponding user's private key. With conversion key ; Among them, the conversion key Send to the user, who then submits the private key to the proxy server for partial decryption. It is kept privately by the user and used for the final local decryption operation.

[0065] Preferably, based on the system public key, system master key, target user's attribute set, and tag set, the key generation center first selects two independent user-specific secret values ​​for the current user, corresponding to the attribute key generation link and the tag key generation link, respectively; then, based on the system master key and the corresponding exclusive secret value, it calculates the attribute key component corresponding to each attribute in the user's attribute set and the tag key component corresponding to each tag in the tag set; subsequently, it splits all key components according to functional permissions and combines them to form a conversion key for outsourced decryption and a user private key for local decryption.

[0066] The specific implementation method of step 3 will be described in detail below.

[0067] S3.1: The key generation center randomly selects two independent random numbers for the current user. These serve as user-specific secret values, used for generating the attribute key component and the tag key component, respectively.

[0068] S3.2: Based on the system master key User-exclusive secret value For each attribute in the user attribute set S, calculate the corresponding attribute key component to form an attribute key set.

[0069] S3.3: Based on the system master key Another user secret value is used to calculate the corresponding tag key component for each tag in the user tag set, forming a tag key set.

[0070] The S4 key generation center splits the attribute key set and the tag key set, and combines them to generate the conversion key. With user private key ,as follows:

[0071]

[0072] Among them, the conversion key A portion of the key, which can be publicly computed, is sent to the user; the user's private key. It contains core private components, which are securely stored locally by the user.

[0073] In some embodiments, the aforementioned user tag set may include multi-dimensional tags such as user identity identifier, user department, user grade, and user role. Custom tag dimensions may also be added according to business needs to adapt to the revocation granularity requirements of different scenarios.

[0074] In some embodiments, the key generation process can adopt a distributed key generation method, in which multiple authorized nodes jointly generate the system master key and user key, avoiding single point of failure and security risks of a single key generation center.

[0075] By generating a unique key for each user, bound to their attributes and tags, the attribute component is used to match the access control policy of the ciphertext, and the tag component is used to match the ciphertext's decryption policy. By splitting the key into a transformation key and a user's private key, public-private separation is achieved in decryption computation: the proxy server can only use the transformation key to perform partial decryption and cannot obtain the final plaintext, ensuring data confidentiality. The tag set and attribute set are independent of each other and do not need to be of the same length, allowing for flexible configuration of different dimensions of user identity, providing support for fine-grained revocation. This step generates a key for each user bound to the attribute set and tag set. The attribute set is used to satisfy the access control policy, and the tag set is used to implement user revocation. When the data owner needs to revoke a user's account, by piercing the portion of the ciphertext corresponding to the user's tag, the revoked user's tag key cannot decrypt the ciphertext, without the need to redistribute the key.

[0076] Step 4: Based on the system public key, the target ciphertext, and the puncture policy issued by the data owner, the data storage administrator performs puncture policy conversion, puncture secret sharding, puncture key component calculation, and ciphertext update operations to obtain the punctured ciphertext and generate a signature evidence of the puncture operation to send to the data owner. The ciphertext after the puncture will cause users who use the tag-matching puncture strategy to lose their decryption privileges, thereby revoking the user's access rights.

[0077] Preferably, based on the system public key, the data storage administrator's signing private key, and the puncture strategy, the data storage administrator first converts the puncture strategy into a corresponding tag access strategy according to De Morgan's Law; then, using the converted tag access strategy as the structure, the initial puncturable key component embedded in the ciphertext is reconstructed to generate the punctured key component; subsequently, the punctured key component replaces the initial puncturable key component in the original ciphertext, resulting in the punctured ciphertext, which is then stored in the data storage center to overwrite the original ciphertext; finally, the punctured key component is digitally signed using the administrator's own signing private key to generate signature evidence, which is then sent to the data owner.

[0078] The specific implementation method of step 4 will be described in detail below.

[0079] S4.1: The data storage administrator receives the puncture strategy P issued by the data owner and transforms the puncture strategy according to De Morgan's Law: For each non-leaf node of the puncture strategy, it is ANDed with the gate... Convert to OR gate 、or door Convert to AND gate The threshold gate (k,n) is transformed into a threshold gate (n-k+1,n); for each leaf node of the puncture strategy, the label of the leaf node is transformed into a negative form, finally obtaining the transformed puncture access strategy. .

[0080] S4.2: The data storage administrator randomly selects two random numbers. As the puncture secret value, the basic puncture component is calculated:

[0081]

[0082]

[0083] S4.3: Use the puncture secret value as the root node secret value, and follow the transformed puncture access strategy. Perform secret sharing to generate shard values ​​for each leaf node in the strategy.

[0084] S4.4: Targeting the post-transformation puncture access strategy For each leaf node, the corresponding puncture key component is calculated by combining the shard value and the random number, as follows:

[0085] Combine all puncture key components to generate the complete post-puncture key. ;

[0086] S4.5: Use the post-puncture key Replace the initial puncturable key embedded in the original ciphertext to obtain the complete punctured ciphertext. ;

[0087]

[0088] S4.6: Data storage administrators use their own signing private keys. For the newly generated puncture key Perform digital signature The signature and the puncture key are combined to form puncture evidence, which is then sent to the data owner for preservation.

[0089] In some embodiments, the above puncture strategy can support multi-level nested logic gate structures, and can also be extended to support a hybrid strategy of attributes and labels to achieve more complex combined undo logic.

[0090] In some embodiments, multiple puncture operations can be performed on the same ciphertext, with each puncture corresponding to a different undo requirement. The effects of multiple punctures are superimposed to adapt to scenarios of dynamic and continuous changes in user permissions.

[0091] By leveraging De Morgan's Law to transform the puncture strategy, the revocation request for decryption by users who are prohibited from matching tags is converted into a cryptographically executable access structure. Revocation is achieved by modifying the puncturable key in the ciphertext. The entire puncture process only modifies the puncturable key portion of the ciphertext, eliminating the need to re-encrypt the attribute access components of the ciphertext or update keys for users whose permissions have not been revoked, significantly reducing the computational and communication overhead of user revocation. The flexible configuration of the puncture strategy enables revocation operations at various granularities, such as single-user revocation, batch user revocation, and revocation by user group, adapting to different business scenarios. The puncture operation is accompanied by a digital signature, allowing for traceability and verification of the revocation operation, preventing malicious operations on cloud servers.

[0092] Step 5: Based on the system public key, the target ciphertext, and the conversion key submitted by the user, the proxy server performs attribute policy matching, puncture policy matching, access control tree secret recovery, and puncturable key recovery operations. If the user attributes meet the access control policy and the label does not match the puncture policy, the partially decrypted ciphertext is output and sent to the user. If the conditions are not met, a decryption failure message is returned.

[0093] Preferably, based on the system public key, the pierced target ciphertext, and the conversion key submitted by the user, the proxy server first receives the user's data access request and retrieves the corresponding ciphertext from the data storage center. It first verifies whether the attribute set in the conversion key satisfies the access control tree policy bound to the ciphertext. If the attributes do not match, it directly returns decryption failure. If the attributes match, it further verifies whether the tag set in the conversion key matches the piercing policy corresponding to the ciphertext. If the tag set matches the piercing policy, it indicates that the corresponding user's access rights have been revoked, and decryption failure is also returned. After the double verification passes, the proxy server uses the attribute key component in the conversion key to perform bottom-up Lagrange interpolation on the access control tree, recovering the secret value corresponding to the root node of the access control tree and calculating the intermediate component of the session key. Then, it uses the tag key component in the conversion key to perform bottom-up interpolation on the pierced tag access structure, recovering the secret component corresponding to the tag dimension. Finally, it combines the two types of secret components to calculate the partially decrypted ciphertext and returns it to the corresponding user. The specific implementation method of step 5 will be described in detail below.

[0094] S5.1: The proxy server receives the conversion key and data access request submitted by the user and retrieves the corresponding target ciphertext from the data storage center.

[0095] S5.2: The proxy server extracts the attribute set from the conversion key and the access control tree from the ciphertext, and determines whether the user's attribute set S meets the access requirements of the access control tree; if not, it directly returns a decryption failure.

[0096] S5.3: If the attribute verification passes, the proxy server further extracts the tag set L from the conversion key and determines whether the user's tag set L matches the puncture strategy in the ciphertext; if the tags match the puncture strategy, it means that the user has been revoked and decryption failure is returned.

[0097] S5.4: For users who meet the access conditions, the proxy server uses the attribute key component in the conversion key to perform a bottom-up secret recovery of the access control tree.

[0098] For the leaf nodes of the access control tree, if the attribute Then calculate the secret recovery value of the node;

[0099]

[0100]

[0101] If attribute This node cannot be secretly recovered. ; For non-leaf nodes in the access control tree, the proxy server recursively calls the above leaf node operations to obtain the recovery values ​​of all recoverable child nodes; from these, it selects a set of valid child nodes that meet the current node's logic gate threshold requirements, aggregates them using Lagrange interpolation to obtain the secret recovery value of the current non-leaf node, and performs the operation level by level upwards until the root node of the access control tree is reached.

[0102]

[0103]

[0104]

[0105] in, .

[0106] S5.5: For the root node of the access control tree, recover the intermediate value based on the root node of the access control tree. Then calculate the session key by the tag dimension. The session key is then used to strip the label encryption layer of the ciphertext, yielding an intermediate ciphertext component that retains only the attribute encryption structure. Finally, by canceling out factors in the numerator and denominator, the core intermediate component of the attribute dimension is obtained through purification. ; The expression for restoring the root node value:

[0107] The expression for the session key:

[0108] Core intermediate components The expression:

[0109] This intermediate component retains the core decryption item corresponding to the system master key and is superimposed with a mask of the user's exclusive secret value. The proxy server cannot independently restore the complete decryption factor based on this value.

[0110] S5.6: The proxy server uses the tag key component in the transformation key to perform a bottom-up secret recovery operation on the punctured tag access structure in the ciphertext.

[0111] For the leaf nodes of the label access structure, the Lagrange coefficients are used. After calculating the secret fragment, the secret recovery value of the corresponding node is obtained:

[0112]

[0113]

[0114]

[0115]

[0116]

[0117] By performing Lagrange interpolation operations step by step upwards, the secret value corresponding to the root node of the label access structure is finally recovered:

[0118]

[0119]

[0120]

[0121]

[0122] S5.7: The proxy server combines the core intermediate component of the attribute, the secret value of the root node of the tag dimension, and the common component of the ciphertext to generate the complete partially decrypted ciphertext. The message is returned to the user who initiated the request. This decrypted portion of the ciphertext only contains the intermediate results of the overlay mask; the proxy server cannot independently reconstruct the original plaintext.

[0123] In some embodiments, the aforementioned partial decryption operations can be performed collaboratively by multiple proxy servers in a distributed manner. By sharing secrets to split the computational tasks, the decryption efficiency and system fault tolerance can be further improved.

[0124] In some embodiments, before performing decryption, the proxy server may first verify the legitimacy of the conversion key submitted by the user, and confirm the issuing entity and validity period of the key through zero-knowledge proof or signature verification, so as to prevent unauthorized users from submitting forged keys to initiate decryption requests.

[0125] By offloading all highly complex operations such as access control tree traversal, Lagrange interpolation, and bilinear pairing to a cloud-based proxy server with sufficient computing power, the user terminal only needs to perform the subsequent lightweight final decryption operation. This significantly reduces the computational overhead on the user end and is suitable for devices with limited computing power, such as mobile terminals. Through a dual mechanism of attribute policy verification and puncture policy verification, the fine-grained access control capabilities of attribute-based encryption are preserved, while ensuring that even if the attributes of a revoked user meet the requirements, they cannot continue decryption, thus guaranteeing the effectiveness of the revocation operation. At the same time, the proxy server can only obtain masked intermediate results and cannot access the core decryption factors held by the user's private key. This ensures data confidentiality while achieving computational offloading and is suitable for the semi-trusted threat model of cloud servers.

[0126] Step 6: Using the user's private key and the partially decrypted ciphertext returned by the proxy server as input, the user performs mask removal and final decryption operations locally to obtain the original plaintext data; Specifically, first, the user receives a portion of the decrypted ciphertext returned by the proxy server, extracts the intermediate component of the attributes, the secret value of the tag dimension, and the common component of the ciphertext, and combines it with the user's private key stored securely on their local machine to obtain all the parameters required for decryption.

[0127] Then, the user uses their private key's secret value to remove the mask from the intermediate components, completes the core decryption factor, and finishes the final decryption to obtain the original plaintext data. ;

[0128] This decryption method requires only simple exponentiation and multiplication / division operations, resulting in extremely low computational complexity. Even terminal devices with limited computing power can quickly complete the decryption. Since final decryption relies on the user's locally held private key, proxy servers and other third parties cannot independently recover the plaintext, ensuring end-to-end data security. Furthermore, each user's unique secret value is independent, and keys from different users cannot be mixed, effectively resisting multi-user collusion attacks and preventing unauthorized users from obtaining plaintext through key concatenation.

[0129] In some embodiments, the final decryption process described above can be implemented in conjunction with a symmetric encryption algorithm. The symmetric key is decrypted using the core decryption factor, and then the original data is decrypted using the symmetric key, thereby improving the decryption efficiency of large files and batches of data.

[0130] In some embodiments, the user's private key may be stored in a hardware security module or a trusted execution environment, and the decryption operation is completed entirely within the trusted environment, further enhancing the security of key storage and operation.

[0131] Step 7: Using the data storage administrator's signature public key, the original puncture policy issued by the data owner, and the puncture evidence returned by the data storage administrator as input, the data owner performs signature verification and policy consistency verification, and outputs the verification result of the puncture operation to confirm the correctness and compliance of the user's revocation operation.

[0132] Preferably, the data owner receives the puncture evidence returned by the data storage administrator, extracts the puncture-post key component and digital signature, and retrieves the original puncture strategy issued this time as a verification benchmark.

[0133] The data owner uses the data storage administrator's signing public key to perform a signature verification operation on the punctured key component and the corresponding digital signature, as follows:

[0134] If the equation holds true, it means that the puncture key component was indeed issued by the data storage administrator and was not tampered with during transmission.

[0135] Puncture strategy consistency verification: Combined with the original puncture strategy, verify the structure of the key component after puncture and the matching relationship with the strategy, confirm that the logical scope of the puncture operation is completely consistent with the original strategy, and there are no deviations such as over-range revocation or omission of revocation.

[0136] Verification result output: If the signature verification passes and the puncture strategy matches, the puncture operation is deemed legal and valid, and the user can revoke the formal effect; if any verification fails, the puncture operation is deemed abnormal, an alarm can be triggered, and the data storage administrator is required to re-execute the puncture.

[0137] The auditability of cloud-side puncture operations is achieved through a digital signature mechanism, solving the trust issue of semi-trusted cloud servers: data owners do not need to perform the puncture operation themselves; they can confirm whether the cloud server has correctly executed the reversal instruction simply by verifying the signature and comparing the structure, preventing the cloud server from missing, incorrectly executing, or maliciously tampering with the puncture strategy. This verification process has minimal computational load, does not increase the computational burden on the data owner, and simultaneously achieves full traceability of the reversal operation.

[0138] In some embodiments, the digital signature may employ a national cryptographic digital signature algorithm or other signature algorithms that comply with local cryptographic regulatory standards to adapt to the compliance requirements of different regions.

[0139] In some embodiments, puncture evidence can be synchronously stored on a blockchain node, utilizing the immutability of the blockchain to achieve permanent evidence of the reversal operation, thus meeting the auditing and traceability requirements of high-security scenarios.

[0140] Example 2 Taking the access control scenario of cloud-stored electronic resources in university libraries as an example, this paper explains the fine-grained user revocation capability of this method: The data owner encrypts library electronic data using the access policy {“University A” AND {“Teacher” OR “Student”} AND {“Mathematics” OR “Computer Science” OR “Physics”}}. A student's attribute set is {“University A”, “Student”, “Mathematics”}, and the corresponding tag set is {“University A”, “Student”, “Mathematics”, “ID=147258”, “Grade=2020”}. This student can access the encrypted data normally by matching the access policy through the attribute set.

[0141] When user undoing needs to be performed at different granularities, different puncture strategies can be constructed accordingly: When it is necessary to revoke the access rights of all members of the school, select the public label "University A" to construct a piercing strategy. After the piercing, all users carrying this label will lose the ability to decrypt. When it is necessary to revoke the privileges of 2020 graduates, a puncture strategy is constructed: {“University A” AND “Grade = 2020”}. After the puncture, all graduates whose tags contain “Grade = 2020” will be unable to decrypt the corresponding ciphertext. When it is necessary to revoke the permissions of a single student who has withdrawn from school, a piercing strategy {“University A” AND “ID=147258”} can be constructed to accurately revoke the access permissions of the student with student ID 147258; When it is necessary to revoke the permissions of all students in a specified college, construct a puncture strategy {"College A" AND "Students" AND {"Mathematics" OR "Computer Science"}}. After the puncture, students in both the Mathematics College and the Computer Science College will be unable to access the corresponding data.

[0142] By flexibly configuring the tag combination of the puncture strategy, it can adapt to user revocation needs at different granularities and meet the dynamic permission management requirements of scenarios with frequent personnel changes, such as universities.

[0143] Example 3 This application provides a puncturable ciphertext policy attribute-based encryption system that supports efficient user revocation, including: The encryption module is used to perform ciphertext policy attribute-based encryption on plaintext based on access control policies, while embedding an initial puncturable key in the ciphertext and uploading the complete ciphertext to the cloud server for storage. The key generation module is used to generate a user key containing decryption components of the attribute dimension and the tag dimension based on the user's attribute set and tag set; The puncture revocation module is used to receive the puncture policy and update the puncturable key in the ciphertext to obtain the ciphertext after puncture and generate a digital signature of the puncture result. An outsourced decryption module is used to verify user attributes and tag permissions. After successful verification, it performs partial decryption of the ciphertext and returns the result to the user. The decryption module is used to perform final decryption on a portion of the decrypted ciphertext to obtain plaintext data.

[0144] To achieve efficient and flexible user permission revocation in a cloud storage environment, this invention designs a puncturable ciphertext policy attribute-based encryption method, enabling data owners to implement fine-grained user revocation in a policy-based manner. The entire revocation process does not require redistribution of user keys or re-encryption of the ciphertext, significantly reducing the computational and communication overhead of user revocation, and this advantage is even more pronounced in large-scale user revocation scenarios. This method specifically achieves the following technical objectives: Data confidentiality guarantee: Even if an unauthorized user launches a collusive attack, they will not be able to obtain plaintext data; users whose access permissions are revoked will lose the ability to decrypt the corresponding ciphertext.

[0145] Fine-grained revocation control: Supports the construction of puncture strategies through expressive Boolean formulas. The strategies can include logical operations such as AND, OR, and thresholds to achieve flexible and precise revocation of user permissions.

[0146] System efficiency improvement: User revocation is completed by relying on the puncture mechanism, which eliminates the high overhead of updating the key of the unrevoked user and re-encrypting the entire ciphertext in the traditional revocation scheme, effectively reducing the system's computing and communication costs.

[0147] Forward security guarantee: Even if the attribute set of a revoked user meets the access control policy of the ciphertext, the ciphertext after the puncture cannot be decrypted; at the same time, the revocation operation of some users does not affect the normal data access of other users who have not been revoked.

[0148] It should be noted that, in the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another device, or some features may be ignored or not executed. The modules described as separate components may or may not be physically separated. The components shown as modules may be one or more physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs.

[0149] Furthermore, in the various embodiments of the present invention, the modules can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The integrated unit described above can be implemented in hardware or as a software functional unit.

[0150] An electronic device provided in this application includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the puncturable ciphertext policy attribute-based encryption method that supports efficient user revocation as described in any of the above embodiments.

[0151] Another electronic device provided in this application embodiment may further include: an input port connected to a processor for transmitting multimodal data collected by an external acquisition device to the processor; a display unit connected to the processor for displaying the processor's processing results to the outside world; and a communication module connected to the processor for enabling communication between the electronic device and the outside world. The display unit may be a display panel, a laser scanning display, etc.; the communication method adopted by the communication module includes, but is not limited to, Mobile High Definition Link (HML), Universal Serial Bus (USB), High Definition Multimedia Interface (HDMI), and wireless connection (including Wi-Fi, Bluetooth, Bluetooth Low Energy, and IEEE 802.11s-based communication technology).

[0152] This application provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the steps of the puncturable ciphertext policy attribute-based encryption method that supports efficient user revocation as described in any of the above embodiments.

[0153] For descriptions of relevant parts of the pierceable ciphertext policy attribute-based encryption system, electronic device, and computer-readable storage medium supporting efficient user revocation provided in this application's embodiments, please refer to the detailed descriptions of the corresponding parts in the pierceable ciphertext policy attribute-based encryption method supporting efficient user revocation provided in this application's embodiments; they will not be repeated here. Furthermore, parts of the technical solutions provided in this application that are consistent with the implementation principles of corresponding technical solutions in the prior art have not been described in detail to avoid excessive elaboration.

[0154] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A puncturable ciphertext policy attribute-based encryption method supporting efficient user revocation, characterized in that, Includes the following steps: Step 1: The data owner performs ciphertext policy attribute-based encryption on the plaintext based on the access control policy, and embeds an initial puncturable key in the ciphertext. The complete ciphertext is then uploaded to the cloud server for storage. Step 2: The key generation center generates a user key containing decryption components of attribute and tag dimensions based on the user's attribute set and tag set. Step 3: When revoking user access permissions, the data owner issues a puncture policy to the cloud server; The cloud server updates the puncturable key in the ciphertext according to the puncture policy, obtains the punctured ciphertext, causes users whose tags match the puncture policy to lose decryption privileges, and generates a digital signature of the puncture result to be fed back to the data owner. Step 4: The user submits a decryption request and user key to the proxy server; After verifying that the user attributes meet the access control policy and that the user tag is not restricted by the piercing policy, the proxy server performs partial decryption of the ciphertext and returns it to the user. Step 5: The user uses their own key to perform the final decryption of part of the ciphertext to obtain the plaintext data.

2. The puncturable ciphertext policy attribute-based encryption method supporting efficient user revocation as described in claim 1, characterized in that, The access control policy described in step 1 is built based on an access control tree and includes: Using user attributes as leaf nodes, access logic rules are formed by combining AND gates, OR gates, and threshold gates; the initial puncturable key corresponds to the encrypted component of the tag dimension and is embedded in the ciphertext structure.

3. The puncturable ciphertext policy attribute-based encryption method supporting efficient user revocation as described in claim 1, characterized in that, In step 2, the generated user key is split into a conversion key and a user private key; The conversion key includes an attribute key component and a tag key component, which are submitted to the proxy server to perform partial decryption. The user's private key includes a core private decryption component, which is stored privately by the user locally.

4. The puncturable ciphertext policy attribute-based encryption method supporting efficient user revocation as described in claim 1, characterized in that, The process of updating the puncturable key on the cloud server in step 3 includes: According to De Morgan's Law, the puncture strategy is converted into a tag access strategy, and the puncturable key in the ciphertext is reconstructed based on the converted tag access strategy; the puncture operation only updates the puncturable key portion in the ciphertext.

5. The puncturable ciphertext policy attribute-based encryption method supporting efficient user revocation according to claim 1, characterized in that, Step 4, the process of the proxy server performing verification, includes: First, check if the user's attribute set meets the access control policy. If not, return decryption failure. After the attribute verification passes, check if the user's tag set matches the piercing policy. If they match, return decryption failure. After both verifications pass, perform partial decryption operations.

6. The puncturable ciphertext policy attribute-based encryption method supporting efficient user revocation according to claim 1, characterized in that, The partial decryption operation process described in step 4 includes: The proxy server uses the transformation key to perform bottom-up secret recovery operations on the access control tree and the punctured tag access structure, respectively, and obtains intermediate operation results through Lagrange interpolation aggregation.

7. The puncturable ciphertext policy attribute-based encryption method supporting efficient user revocation according to claim 6, characterized in that, The bottom-up secret recovery operation includes: The secret recovery value of the node is obtained by performing bilinear pairing between the ciphertext component and the transformation key component on the leaf node; For non-leaf nodes, select child node recovery values ​​that meet the current node access threshold, and aggregate them using Lagrange interpolation to obtain the current node recovery value; The calculation is recursively performed layer by layer until the root node is reached, and the intermediate calculation results of the root node in both the attribute dimension and the label dimension are output respectively.

8. The puncturable ciphertext policy attribute-based encryption method supporting efficient user revocation according to claim 1, characterized in that, The final decryption process described in step 5 includes: The user uses their private key to remove the masking component from the decrypted ciphertext, restores the complete decryption factor, and then completes the decryption.

9. A piercing ciphertext policy attribute-based encryption system supporting efficient user revocation, characterized in that, include: The encryption module is used to perform ciphertext policy attribute-based encryption on plaintext based on access control policies, while embedding an initial puncturable key in the ciphertext and uploading the complete ciphertext to the cloud server for storage. The key generation module is used to generate a user key containing decryption components of the attribute dimension and the tag dimension based on the user's attribute set and tag set; The puncture revocation module is used to receive the puncture policy and update the puncturable key in the ciphertext to obtain the ciphertext after puncture and generate a digital signature of the puncture result. An outsourced decryption module is used to verify user attributes and tag permissions. After successful verification, it performs partial decryption of the ciphertext and returns the result to the user. The decryption module is used to perform final decryption on a portion of the decrypted ciphertext to obtain plaintext data.

10. An electronic device, characterized in that, The method includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the puncturable ciphertext policy attribute-based encryption method supporting efficient user revocation as described in any one of claims 1-8.

Images