Design and construction method of a relation-based identity-based encryption scheme

Abstract

This invention discloses the design and construction of a novel relationship-based identity-based encryption scheme. In identity-based encryption mechanisms, a user's identity information can be used as a public key, and a key generation center generates the user's decryption key. In scenarios where only users with specific relationships can decrypt, traditional identity encryption requires adding the relationship to the user's identity and regenerating the user's key. Furthermore, hierarchical identity encryption leads to upper-level users knowing the keys of lower-level users, resulting in the leakage of lower-level user information. To address this scenario where only users with specific relationships can decrypt, this invention provides a relationship-based identity encryption scheme that decomposes a user's decryption capability into two parts: one related to the user's identity information and the other related to the user's relationship information. Only users possessing both parts of the key can successfully decrypt, thus solving the problems of users regenerating keys and the issue of lower-level user keys being known to upper-level users in hierarchical identity-based encryption.

Description

Technical Field

[0001] This invention relates to the fields of applied cryptography and information security, specifically to a novel design and construction method for a relation-based identity-based encryption scheme. Background Technology

[0002] Cryptography, as the foundation of modern network communication security, enables the secure transmission of confidential information between data senders and receivers. Public-key cryptography, because it eliminates the need for key distribution and management, is more widely used in public network transmissions than symmetric cryptography. In traditional public-key cryptography, users only need to keep their private keys secret; the public key is public. To ensure that the public key of the receiving user is correct and not tampered with, the user's public key needs to be guaranteed by a certificate issued by a Public Key Infrastructure (PKI). Therefore, in scenarios with a large number of users, the management of public key certificates is a heavy burden for PKI. In 1984, the renowned cryptographer Shamir first proposed the concept of Identity-based Cryptology (IBC), which can overcome the problem of PKI certificate management in public-key cryptography mechanisms. Under this cryptographic mechanism, any publicly available information of a user, such as their name, phone number, or email address, can be used as the user's public key, thus eliminating the need for issuing certificates. Meanwhile, a trusted party called the Private Key Generation (PKG) exists, responsible for generating decryption keys corresponding to the user's identity information in the system. When a new user joins the system for the first time, the PKG is responsible for verifying the user's identity information. After confirming the user's identity information, it generates a corresponding private key for the user and securely sends the private key to the user. This scheme quickly attracted great interest from researchers after it was proposed.

[0003] Identity-Based Encryption (IBE) comprises four polynomial-time algorithms: an initialization algorithm, where a key generation center generates public parameters and a master key; a key extraction algorithm, where the key generation center generates a decryption key for each user based on their ID; an encryption algorithm, where the data sender generates ciphertext based on the receiver's ID; and a decryption algorithm, where the data receiver decrypts the ciphertext using their own decryption key to obtain the plaintext. The first concrete and provably secure IBE construction was proposed by Boneh and Franklin in 2001. Subsequently, in 2002, Horwitz and Lynn extended the concept of IBE to hierarchical identity-based encryption, further expanding the functionality of hierarchical key delegation. The first fully functional, collusion-resistant Hierarchical Identity-Based Encryption (HIBE) scheme was proposed by Gentry and Silverberg in 2002. Under this cryptographic mechanism, a key delegation function is added, and user identities are organized hierarchically (such as organization → department → employee), which is adapted to real-world hierarchical management scenarios. Upper-level identities can generate private keys for lower-level identities, and the PKG only needs to manage the keys of the top-level users, thereby solving the single-point bottleneck of IBE and reducing the pressure on the PKG to distribute keys.

[0004] In real-world scenarios, a problem might arise where sender Alice needs to send encrypted information to data recipient Bob, requiring Bob to meet specific relationships, such as being a member of a company. One solution is to bind Bob's identity information to the company or name and regenerate the decryption key, which inevitably increases the burden on both the user and the PKG (Privacy Key). Another solution is to use Hierarchical Identity Base Encryption (HIBE), having upper-level users within the company generate Bob's decryption key on their behalf. However, this approach would allow upper-level users to obtain Bob's decryption key, potentially leading to data leakage.

[0005] To address the aforementioned issues, this invention proposes a Relationship-Based Identity-Based Encryption (R-IBE) scheme. This scheme eliminates the need for the receiver to regenerate the decryption key, ensures that only users satisfying a specific relationship can decrypt the data, and prevents upper-level users from arbitrarily stealing lower-level users' keys and private data. Such a cryptographic scheme has numerous practical applications.

[0006] For example: (1) Government agencies have strict requirements for data confidentiality and access control. For internal confidential notices, policy drafts and graded public documents, the encryption system can use the relational encryption technology proposed in this invention to bind decryption permissions to specific organizational affiliations. The ciphertext can only be decrypted by staff holding valid identity private keys and official organizational affiliation certificates. Superior organizational managers cannot see the confidential information of subordinates, solving the privacy defects of traditional graded encryption schemes. (2) Large enterprises have multi-department and multi-branch organizational structures and a large number of sensitive business interactions, such as core project data, salary information and confidential strategic documents. Enterprises can use conditional identity-based encryption to set organizational affiliation constraints for messages. For example, core business data is encrypted for specific employee identities and bound to valid department member identities. Only current employees belonging to the designated department can use their original private keys to decrypt the data. External personnel, resigned employees and cross-department employees without valid affiliations cannot access the content. At the same time, senior department managers do not have independent decryption permissions, avoiding internal privacy leaks caused by excessive administrator privileges. (3) Universities and other educational institutions often need to transmit sensitive data, such as student scholarship information, confidential admission data, details of faculty research funding, and internal evaluation results. In traditional HIBE, university administrators have key export permissions, which may lead to unauthorized access to users' private data. Through a relationship-based encryption mechanism, the management encrypts sensitive files targeting individual students or faculty members and binds decryption permissions to specific colleges or departments. Users can only decrypt messages if they belong to a designated organization and hold their original identity private key. No administrator can obtain decryption permissions, thus fully protecting the privacy of faculty and students while implementing organizational permission restrictions. (4) Academic and research teams frequently transmit unpublished research data, experimental results, and patent application materials, all of which have extremely high privacy requirements. Through the relationship-based encryption mechanism proposed in this invention, researchers can encrypt the confidential results of specific team members and set team organizational affiliation constraints. Only members who belong to a legitimate research team and hold a valid identity private key can decrypt and obtain the data. External personnel, retired team members, and institutional managers without research participation qualifications do not have decryption rights. This mechanism effectively prevents the leakage of research results and solves the privacy risks of HIBE schemes where institutional managers can monitor encrypted text at all levels. Summary of the Invention

[0007] The problem this invention aims to solve is to design and construct a specific relation-based identity-based encryption (R-IBE) scheme based on known mathematical difficulties, in order to address the problems existing in the current IBE and HIBE schemes, and to achieve the effect that only users who satisfy a specific relationship and have a specific identity can decrypt the data, and that upper-level users cannot obtain the private data of lower-level users.

[0008] The technical approach of this invention is to decompose a user's decryption capability into two parts: one part comes from a key generated by the PKG and associated with the user's identity, and the other part comes from a relationship key associated with the user's relationship. Based on this, the design of the traditional IBE scheme adds steps for generating and extracting relationship authorization keys, as well as user verification of the authorization keys, to ensure the trustworthiness of the authorization keys. Detailed Implementation

[0009] 1. The design and construction of the relation-based identity-based encryption mechanism proposed in this invention includes the following polynomial-time algorithm: (1) System initialization algorithm: Generate corresponding public parameters and master key based on security parameters; (2) User identity key extraction algorithm: Generate the user's identity key based on the user's identity ID and the system master key; (3) Relationship Authorization Key Generation Algorithm: Generate the authorization key for relation R based on relation R and the system master key; (4) User relationship key extraction algorithm: Generate the user's relationship key based on the user's identity ID and relationship authorization key; (5) Encryption algorithm: The user encrypts the plaintext m to obtain the ciphertext CT based on the recipient's identity ID and the relationship R of the recipient; (6) Decryption algorithm: The user decrypts the ciphertext CT to obtain the plaintext based on their identity key and relationship key; (7) Verification algorithm: Verify that the relationship authorization key is correct, and verify that the user's relationship key is correct.

[0010] 2. The implementation of the relation-based identity basis encryption (R-IBE) mechanism proposed in this invention can be constructed based on the group-hard problems of discrete logarithms—the computational Diffie-Hellman problem (CDH) and the decisional bilinear Diffie-Hellman problem (DBDH).

[0011] The CDH problem is described as: group Let p be an elliptic curve group of order p, where p is a large prime number. Given the group... elements in , , , where integer It is unknown, calculation .

[0012] The DBDH problem is described as follows: group Let be an elliptic curve group of order p, where p is a large prime number. For a cyclic multiplicative group of order p, there exists a bilinear mapping e: If a given group elements in , , , , where integer It is unknown, and contains random elements. ,distinguish and or judgment Whether it is valid or not.

[0013] The specific algorithm implementation is as follows: (1) System initialization: Given the safety parameter λ, first generate the required bilinear pairing parameters, including two large prime order groups. , All of them are of order p, where p is a large prime number, and a bilinear mapping. Select group A generator Then, choose a hash function: Choose a random integer and calculate The common parameters are The master key is ; (2) User identity key extraction: The user applies for an identity key from the PKG based on their identity ID. After verifying the user's identity, the PKG issues the key to the user. ; (3) Generation of relation authorization key: The manager of relation R (abbreviated as R) m ) and PKG jointly generate the relationship authorization key. First, R m Choose a secret random integer ,calculate PKG is verifying R m After his identity was revealed, Authentication and calculation Then make it public Meanwhile, R m public ; (4) Relationship key extraction: Users extract the relationship key from R based on their identity ID. m Request relationship key, R m After verifying the user's identity ID, the relationship key is sent to the user. ; (5) Encryption Algorithm: The message sender encrypts a message m in the message space based on the receiver's ID and relationship R. First, a random integer is selected. Then calculate as follows: , The ciphertext is ,“ " indicates the XOR operation; (6) Decryption algorithm: The user decrypts the password using their own identity key. and relation key Decryption: Calculation ; (7) Verification Algorithm: After receiving the relationship key, the user can verify the validity of the key as follows: Calculate and and judge Whether it is valid or not, if it is valid, it means that the relationship key is correct. The correctness of the relationship authorization key can be verified publicly: The establishment statement indicates that the relationship authorization key is correct; Note: (1) Explanation of correctness: First, for the correct ciphertext And a valid decryption user ID that satisfies relation R, according to the decryption algorithm:

[0014] Therefore, the decryption algorithm is correct.

[0015] Secondly, regarding relation keys The correctness of this can be verified by the following formula: ,as well as If these two equations hold true, it means that... It is the correct relation key; (2) Safety Description: First, the user identity key is secure; any adversary without the master key α cannot forge the user's identity key. Otherwise, the adversary's forgery could be reduced to solving the CDH problem. Similarly, there is no relational authorization key. An adversary cannot forge a user's relation key; otherwise, the adversary's forgery would be reduced to solving the CDH problem. In encrypted ciphertext indistinguishable games, set Based on the random oracle machine model, the hash function H is regarded as a random oracle machine, and the identity ID of the challenger is assumed. * Then set , Therefore, regarding the identity questioned by the opponent... The identity key can be calculated based on an example of the DBDH problem. Set relationship authorization key Then identity The relation key can also be calculated. The part that was made public at the same time , It can be calculated; challenging identity , The construction of challenge ciphertext can be embedded with DBDH problem instances, and settings can be configured. , Therefore, if If it is established, then It is a correct ciphertext, otherwise Since the value is random, the solution to the DBDH problem can be determined by the opponent's ability to distinguish the challenge ciphertext, thus achieving a security reduction. Because the DBDH problem is difficult, the security of the solution can be proven.

[0016] This invention implements the design and construction of a relation-based identity-based encryption scheme, achieving the goal that only users satisfying specific relationships can correctly decrypt the data, thereby avoiding the problems of regenerating user keys and upper-level users obtaining lower-level user data. It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A method for designing and constructing a relation-based identity-based encryption scheme, characterized in that, Its algorithm definition includes the following seven polynomial-time algorithms: (1) System initialization algorithm: Generate corresponding public parameters and master key based on security parameters; (2) User identity key extraction algorithm: Generate the user's identity key based on the user's identity ID and the system master key; (3) Relationship Authorization Key Generation Algorithm: Generate the authorization key for relation R based on relation R and the system master key; (4) User relationship key extraction algorithm: Generate the user's relationship key based on the user's identity ID and relationship authorization key; (5) Encryption algorithm: The user encrypts the plaintext m to obtain the ciphertext CT based on the recipient's identity ID and the relationship R of the recipient; (6) Decryption algorithm: The user decrypts the ciphertext CT to obtain the plaintext based on their identity key and relationship key; (7) Verification algorithm: Verify that the relationship authorization key is correct, and verify that the user's relationship key is correct.

2. The design and construction method of the relationship-based identity-based encryption scheme according to claim 1, the specific construction algorithm is implemented as follows: (1) System initialization: Given the safety parameter λ, first generate the required bilinear pairing parameters, including two large prime order groups. , All of them are of order p, where p is a large prime number, and a bilinear mapping. Select group A generator Then, choose a hash function: Choose a random integer and calculate The common parameters are The master key is ; (2) User identity key extraction: The user applies for an identity key from the PKG based on their identity ID. After verifying the user's identity, the PKG issues the key to the user. ; (3) Generation of relation authorization key: The manager of relation R (abbreviated as R) m ) and PKG jointly generate the relationship authorization key. First, R m Choose a secret random integer ,calculate PKG is verifying R m After his identity was revealed, Authentication and calculation Then make it public Meanwhile, R m public ; (4) Relationship key extraction: Users extract the relationship key from R based on their identity ID. m Request relationship key, R m After verifying the user's identity ID, the relationship key is sent to the user. ; (5) Encryption Algorithm: The message sender encrypts a message m in the message space based on the receiver's ID and relationship R. First, a random integer is selected. Then calculate as follows: , The ciphertext is " " indicates the XOR operation; (6) Decryption algorithm: The user decrypts the password using their own identity key. and relation key Decryption: Calculation ; (7) Verification Algorithm: After receiving the relationship key, the user can verify the validity of the key as follows: Calculate and and judge Whether it is valid or not, if it is valid, it means that the relationship key is correct. The correctness of the relationship authorization key can be verified publicly: The establishment statement indicates that the relationship authorization key is correct; Note: Correctness of the solution: Decryption algorithm correctness: ; Verify the correctness of the algorithm: ,as well as .

Images