Sm2-based proxy re-encryption method, device and equipment and storage medium

Abstract

The application discloses an SM2-based proxy re-encryption method and device, equipment and a storage medium, relates to the field of network security, and is applied to a data sending end and comprises the following steps: determining a first key negotiation point based on a temporary private key and a sending end private key, and generating a second key negotiation point based on the temporary private key and a receiving end public key; determining a target condition hash and a derived symmetric key based on a condition label corresponding to a target message, so as to determine a first ciphertext component, a second ciphertext component and an integrity verification component corresponding to the target message and generate original ciphertext corresponding to the target message; generating a re-encryption key and sending the re-encryption key and the original ciphertext to a proxy server, sending target authorization parameters to a data receiving end, encrypting the original ciphertext through the proxy server, sending target ciphertext to the data receiving end, and decrypting the target ciphertext through the data receiving end based on the target authorization parameters to obtain the target message. The application realizes SM2-based conditional proxy re-encryption.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a proxy re-encryption method, apparatus, device, and storage medium based on SM2. Background Technology

[0002] Proxy Re-Encryption (PRE) is a cryptographic technique that allows a semi-trusted proxy to convert ciphertext encrypted with the data owner's public key into ciphertext decryptable with the data user's private key. During the conversion process, the proxy cannot access the plaintext information, making it widely applicable in scenarios such as cloud storage data sharing, encrypted email forwarding, and blockchain privacy protection. However, in traditional PRE schemes, once the proxy obtains the re-encryption key, it can convert all of the data owner's ciphertext, failing to achieve fine-grained access control. For example, a data owner might want to delegate only emails marked "urgent" to an assistant, while keeping other emails private; traditional PRE cannot meet this requirement. To address this, Conditional Proxy Re-Encryption (CPRE) introduces the concept of "conditions," binding the re-encryption key to specific conditions. This ensures that the proxy can only convert ciphertext that meets those conditions, thereby achieving fine-grained authorization control based on ciphertext conversion. Currently, researchers have constructed conditional proxy re-encryption schemes based on the SM9 identifier cryptographic algorithm and proven that they satisfy IND-CPRE-CPA security under a random oracle model. However, due to the large number of bilinear pairing operations involved in the SM9 algorithm, such schemes have significant computational overhead. On the other hand, most existing information systems use PKI mechanisms based on SM2 for security authentication. However, existing proxy re-encryption schemes based on SM2 do not include condition fields, thus failing to achieve fine-grained access control.

[0003] In summary, how to achieve conditional proxy re-encryption that supports fine-grained access control while maintaining the high efficiency of SM2 elliptic curve cryptography is a problem that urgently needs to be solved. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a proxy re-encryption method, apparatus, device, and storage medium based on SM2, which can achieve conditional proxy re-encryption supporting fine-grained access control while maintaining the high efficiency of SM2 elliptic curve cryptography computation. The specific solution is as follows: In a first aspect, this application discloses a proxy re-encryption method based on SM2, applied to a data sending end, comprising: The target public parameters corresponding to the data sender are obtained, the temporary private key corresponding to the data sender is determined, the first key negotiation point corresponding to the data sender is determined based on the temporary private key and the sender private key corresponding to the data sender, and the second key negotiation point corresponding to the data receiver is generated based on the temporary private key and the receiver public key corresponding to the data receiver; the target public parameters include the target elliptic curve base point, the conditional hash function, the key derivation function, and the integrity verification function; The target condition hash corresponding to the target message is determined by the condition hash function based on the condition tag corresponding to the target message to be sent, and the derived symmetric key corresponding to the target message is determined by the key derivation function based on the target condition hash and the first key negotiation point. Based on the temporary private key and the target elliptic curve base point, the first ciphertext component corresponding to the target message is determined. The target message is then encrypted based on the derived symmetric key to generate a second ciphertext component. The integrity verification function is then used to generate an integrity verification component corresponding to the target message based on the first key negotiation point and the target condition hash. Finally, the original ciphertext corresponding to the target message is generated based on the first ciphertext component, the second ciphertext component, the integrity verification component, the condition tag, and the target condition hash. The key derivation function is used to generate a re-encryption key based on the first key negotiation point, the second key negotiation point, the target condition hash, and the target authorization parameter. The target authorization parameter is then sent to the data receiving end. The re-encryption key and the original ciphertext are sent to a proxy server. The proxy server encrypts the original ciphertext based on the re-encryption key to send the resulting target ciphertext to the data receiving end. Finally, the data receiving end decrypts the target ciphertext based on the target authorization parameter to obtain the target message.

[0005] Optionally, before determining the first key negotiation point corresponding to the data sender based on the temporary private key and the sender private key corresponding to the data sender, the method further includes: Determine the private key of the data sender, and determine the public key of the data sender based on the private key and the target elliptic curve base point.

[0006] Optionally, generating the integrity verification component corresponding to the target message using the integrity verification function based on the first key negotiation point and the target condition hash includes: The third ciphertext component corresponding to the target message is determined using a first integrity verification function based on the negotiation point coordinates corresponding to the first key negotiation point, the target message, and the target condition hash. The fourth ciphertext component corresponding to the target message is determined using a second integrity verification function based on the target message, the first ciphertext component, the third ciphertext component, and the target condition hash. The integrity verification function includes a first integrity verification function and a second integrity verification function, and the integrity verification component includes a third ciphertext component and a fourth ciphertext component. The data sending end performs integrity verification on the target message based on the third ciphertext component, and the data receiving end performs integrity verification on the target message obtained after decrypting the original ciphertext using the fourth ciphertext component.

[0007] Optionally, the process by which the data sending end performs integrity verification on the target message obtained after decrypting the original ciphertext using the third ciphertext component includes: A first verification negotiation point is determined based on the private key of the sending end corresponding to the data sending end and the first ciphertext component in the original ciphertext. Then, using the key derivation function, a verification key is generated based on the negotiation point coordinates corresponding to the first verification negotiation point and the target condition hash in the original ciphertext. The first verification message is then obtained based on the second ciphertext component in the original ciphertext and the verification key. Using the first integrity verification function, a first verification component is generated based on the negotiation point coordinates, the target condition hash in the original ciphertext, and the first verification message, and it is determined whether the first verification component is consistent with the third ciphertext component in the original ciphertext. If the first verification component is consistent with the third ciphertext component in the original ciphertext, then the first verification message is determined to have passed the integrity verification.

[0008] Optionally, the step of encrypting the original ciphertext using the re-encryption key via the proxy server to send the resulting target ciphertext to the data receiving end includes: Through the proxy server, the conditional hash function is used to perform an integrity check on the target conditional hash based on the conditional label in the original ciphertext. After the target conditional hash passes the integrity check, it is verified whether the conditional label is consistent with the request condition in the data usage request sent by the data receiving end. If the conditional label is consistent with the request condition in the data usage request sent by the data receiving end, the second ciphertext component is re-encrypted based on the re-encryption key to obtain the target ciphertext corresponding to the original ciphertext based on the re-encrypted second ciphertext component, and the target ciphertext is sent to the data receiving end.

[0009] Optionally, the step of decrypting the target ciphertext based on the target authorization parameters by the data receiving end to obtain the target message includes: Through the data receiving end, based on the receiving end private key corresponding to the data receiving end and the first ciphertext component in the target ciphertext, the second key negotiation point corresponding to the data receiving end is determined. Based on the second key negotiation point, the target authorization parameter and the target condition hash in the target ciphertext, the target decryption key is determined. Based on the target decryption key and the re-encrypted second ciphertext component in the target ciphertext, the second verification message corresponding to the target ciphertext is obtained. Using the second integrity verification function, a second verification component is generated based on the first ciphertext component, the third ciphertext component, the target condition hash and the second verification message in the target ciphertext. It is determined whether the second verification component is consistent with the fourth ciphertext component in the target ciphertext. If the second verification component is consistent with the fourth ciphertext component in the target ciphertext, the second verification message is determined as the target message corresponding to the target ciphertext.

[0010] Optionally, the SM2-based proxy re-encryption method further includes: If a permission revocation request is received, the target authorization parameters corresponding to the data receiving end are regenerated, and the re-encryption key stored in the proxy server is updated using the regenerated target authorization parameters.

[0011] Secondly, this application discloses an SM2-based proxy re-encryption device, applied at a data sending end, comprising: The negotiation point determination module is used to obtain the target public parameters corresponding to the data sender, determine the temporary private key corresponding to the data sender, determine the first key negotiation point corresponding to the data sender based on the temporary private key and the sender private key corresponding to the data sender, and generate the second key negotiation point corresponding to the data receiver based on the temporary private key and the receiver public key corresponding to the data receiver; the target public parameters include the target elliptic curve base point, conditional hash function, key derivation function, and integrity verification function; The key derivation module is used to determine the target condition hash corresponding to the target message based on the condition tag corresponding to the target message to be sent using the condition hash function, and to determine the derived symmetric key corresponding to the target message based on the target condition hash and the first key negotiation point using the key derivation function. The original ciphertext generation module is used to determine the first ciphertext component corresponding to the target message based on the temporary private key and the target elliptic curve base point, encrypt the target message based on the derived symmetric key to generate a second ciphertext component, and use the integrity verification function to generate the integrity verification component corresponding to the target message based on the first key negotiation point and the target condition hash, so as to generate the original ciphertext corresponding to the target message based on the first ciphertext component, the second ciphertext component, the integrity verification component, the condition label and the target condition hash; The ciphertext re-encryption module is used to generate a re-encryption key based on the first key negotiation point, the second key negotiation point, the target condition hash, and the target authorization parameter using the key derivation function, and send the target authorization parameter to the data receiving end. The re-encryption key and the original ciphertext are then sent to a proxy server, whereby the proxy server encrypts the original ciphertext based on the re-encryption key to send the resulting target ciphertext to the data receiving end. Finally, the data receiving end decrypts the target ciphertext based on the target authorization parameter to obtain the target message.

[0012] Thirdly, this application discloses an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the aforementioned SM2-based proxy re-encryption method.

[0013] Fourthly, this application discloses a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned SM2-based proxy re-encryption method.

[0014] In this application, when the data sending end implements proxy re-encryption based on SM2, it obtains the target public parameters corresponding to the data sending end, determines the temporary private key corresponding to the data sending end, determines the first key negotiation point corresponding to the data sending end based on the temporary private key and the sending end private key corresponding to the data sending end, and generates the second key negotiation point corresponding to the data receiving end based on the temporary private key and the receiving end public key corresponding to the data receiving end. The target public parameters include the target elliptic curve base point, the conditional hash function, the key derivation function, and the integrity verification function. The conditional hash function is used to determine the target conditional hash corresponding to the target message based on the conditional label corresponding to the target message to be sent, and the key derivation function is used to determine the derived symmetric key corresponding to the target message based on the target conditional hash and the first key negotiation point. The first ciphertext component corresponding to the target message is determined based on the temporary private key and the target elliptic curve base point, and the derived symmetric key is determined based on the derived symmetric key. The target message is encrypted using a key to generate a second ciphertext component. An integrity verification component corresponding to the target message is generated based on the first key negotiation point and the target condition hash using the integrity verification function. The original ciphertext corresponding to the target message is then generated based on the first ciphertext component, the second ciphertext component, the integrity verification component, the condition tag, and the target condition hash. A re-encryption key is generated based on the first key negotiation point, the second key negotiation point, the target condition hash, and the target authorization parameter using the key derivation function. The target authorization parameter is sent to the data receiving end. The re-encryption key and the original ciphertext are sent to a proxy server. The proxy server encrypts the original ciphertext based on the re-encryption key to send the resulting target ciphertext to the data receiving end. The data receiving end decrypts the target ciphertext based on the target authorization parameter to obtain the target message. As can be seen, this application maps the conditional label to the target conditional hash using a conditional hash function, and involves it in the entire process of deriving the symmetric key, generating the re-encryption key, and verifying integrity. This achieves a cryptographic binding between the condition and the ciphertext, ensuring that the proxy server can only convert ciphertext that meets the specified conditions. Thus, fine-grained access control is achieved in SM2-based proxy re-encryption, filling the gap in existing SM2-based proxy re-encryption schemes that do not support conditional control. During the encryption process, this application only uses elliptic curve multiplication, excluding bilinear pairing operations, and the proxy server's re-encryption operation requires only one XOR operation, significantly reducing computational overhead compared to SM9-based conditional proxy re-encryption schemes. Furthermore, by introducing a target authorization parameter secretly selected by the data sender, this application ensures that the data receiver must use this parameter to decrypt the re-encrypted ciphertext, thereby achieving exclusive authorization and supporting fine-grained access control in conditional proxy re-encryption. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0016] Figure 1 This is a flowchart of a proxy re-encryption method based on SM2 disclosed in this application; Figure 2 This is a schematic diagram of a specific SM2-based proxy re-encryption method disclosed in this application; Figure 3 This is a schematic diagram of a proxy re-encryption device based on SM2 disclosed in this application; Figure 4 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Proxy Re-Encryption (PRE) is a cryptographic technique that allows a semi-trusted proxy to convert ciphertext encrypted with the data owner's public key into ciphertext decryptable with the data user's private key. During the conversion process, the proxy cannot access the plaintext information, making it widely applicable in scenarios such as cloud storage data sharing, encrypted email forwarding, and blockchain privacy protection. However, in traditional PRE schemes, once the proxy obtains the re-encryption key, it can convert all of the data owner's ciphertext, failing to achieve fine-grained access control. For example, a data owner might want to delegate only emails marked "urgent" to an assistant, while keeping other emails private; traditional PRE cannot meet this requirement. To address this, Conditional Proxy Re-Encryption (CPRE) introduces the concept of "conditions," binding the re-encryption key to specific conditions. This ensures that the proxy can only convert ciphertext that meets those conditions, thereby achieving fine-grained authorization control based on ciphertext conversion. Currently, researchers have constructed conditional proxy re-encryption schemes based on the SM9 identifier cryptography algorithm and proven their IND-CPRE-CPA security under a random oracle model. However, due to the large number of bilinear pairing operations involved in the SM9 algorithm, these schemes have significant computational overhead. On the other hand, most existing information systems employ SM2-based PKI mechanisms for security authentication; however, existing SM2-based proxy re-encryption schemes do not include condition fields, thus failing to achieve fine-grained access control. To address these technical issues, this application discloses an SM2-based proxy re-encryption method that can achieve conditional proxy re-encryption with fine-grained access control while maintaining the computational efficiency of SM2 elliptic curve cryptography.

[0019] See Figure 1 As shown, this embodiment of the invention discloses a proxy re-encryption method based on SM2, applied to a data sending end, including: Step S11: Obtain the target public parameters corresponding to the data sender, determine the temporary private key corresponding to the data sender, determine the first key negotiation point corresponding to the data sender based on the temporary private key and the sender private key corresponding to the data sender, and generate the second key negotiation point corresponding to the data receiver based on the temporary private key and the receiver public key corresponding to the data receiver; the target public parameters include the target elliptic curve base point, conditional hash function, key derivation function, and integrity verification function.

[0020] In this embodiment, the SM2-based proxy re-encryption method involves three types of entities: the data sender (also known as data owner A), the data receiver (also known as data user B), and the proxy server. The data sender uses its own public key to conditionally encrypt the message and generate the original ciphertext, while simultaneously generating a re-encryption key bound to the data receiver and specific conditions. The proxy server is a semi-honest party; it can only re-encrypt the original ciphertext that meets the specified conditions to obtain the target ciphertext, but it cannot obtain the plaintext or generate the re-encryption key independently. The data receiver decrypts the target ciphertext using its own private key and the target authorization parameters. Under the random oracle model, based on the difficulty assumptions of the Elliptic Curve Discrete Logarithm Problem (ECDLP) and the Computational Diffie-Hellman Problem (CDH), it can be proven that the SM2-based proxy re-encryption method proposed in this embodiment satisfies IND-CPRE-CPA security.

[0021] For ease of description, the main notation used in this embodiment is as follows, where, when used as input to the hash function, points in the elliptic curve group... By splicing its horizontal and vertical coordinates express: , Large prime numbers are parameters of elliptic curves. The base point of the elliptic curve, whose order is . ; From the base point generated Cyclic group of order 1; This is the sender's private key for the data sender (User A). The sender's public key; This is the private key of the data receiver (User B). The receiver's public key; Plaintext message, i.e., the target message, with a length of [length missing]. Bit; : Conditional tags for the target message; Authorization parameters, i.e., target authorization parameters; Conditional hash function The output length of the SM3 algorithm is set to 256 bits. Key derivation function, The length of the symmetric key, and the target message. They have the same length; : This is the first integrity verification function. The second integrity verification function is mapped to the elliptic curve group after being output by the SM3 algorithm. The elements in.

[0022] In this embodiment, as Figure 2 As shown, the SM2-based proxy re-encryption method includes processes such as system establishment, key generation, conditional encryption, re-encryption key generation, proxy re-encryption, original ciphertext decryption, and re-encrypted ciphertext decryption, which will be described in detail below.

[0023] In this embodiment, during the system setup phase, the 256-bit prime-domain elliptic curve parameters recommended by the SM2 standard are selected. Define the above conditional hash function. Key derivation function and integrity verification function Output target public parameters The publicly disclosed parameters of the target include the base points of the target elliptic curve. Conditional hash function Key derivation function and by the first integrity verification function Second integrity verification function The integrity verification function is constructed. The system establishment process follows the elliptic curve parameters recommended by the SM2 standard to facilitate compatibility with existing SM2-based cryptographic infrastructures.

[0024] In this embodiment, before determining the first key negotiation point corresponding to the data sender based on the temporary private key and the sender's private key, the method further includes: determining the sender's private key corresponding to the data sender, and determining the sender's public key corresponding to the data sender based on the sender's private key and the target elliptic curve base point. Specifically, the user randomly selects... Calculate public-private key pairs Among them, the private key Public key Thus, the data sender obtains the sender's private key. Public key of the sender The data receiver obtains the receiver's private key. Public key of the receiving end The key generation process is consistent with the key generation method of the SM2 standard, and the public key can be incorporated into the existing PKI system for management and distribution.

[0025] In this embodiment, the data sender randomly selects a temporary private key. Based on temporary private key Public key of the sender Calculate the first key negotiation point Simultaneously, it can be based on a temporary private key. Public key of the receiving end Calculate the second key negotiation point It is understandable that in practical applications, the data sender can store the temporary private key in a preset private key table. When it is necessary to authorize the data receiver, the temporary private key is retrieved from the preset private key table and the receiver's second key negotiation point is calculated.

[0026] Step S12: Use the conditional hash function to determine the target conditional hash corresponding to the target message based on the conditional tag corresponding to the target message to be sent, and use the key derivation function to determine the derived symmetric key corresponding to the target message based on the target conditional hash and the first key negotiation point.

[0027] In this embodiment, a conditional hash function is used based on the conditional tag corresponding to the target message. Calculate the target hash Using the key derivation function based on the negotiation point coordinates of the first key negotiation point With target condition hash Derived symmetric key corresponding to the derived target message .

[0028] Step S13: Determine the first ciphertext component corresponding to the target message based on the temporary private key and the target elliptic curve base point; encrypt the target message based on the derived symmetric key to generate a second ciphertext component; and use the integrity verification function to generate the integrity verification component corresponding to the target message based on the first key negotiation point and the target condition hash; and generate the original ciphertext corresponding to the target message based on the first ciphertext component, the second ciphertext component, the integrity verification component, the condition tag, and the target condition hash.

[0029] In this embodiment, the data sender uses a temporary private key. base point of the target elliptic curve Calculate the first ciphertext component corresponding to the target message. Then based on derived symmetric keys The target message M is encrypted to obtain the second ciphertext component. Then, the integrity verification function is used to generate the integrity verification component corresponding to the target message based on the first key negotiation point and the target condition hash. Then, the original ciphertext corresponding to the target message is generated based on the first ciphertext component, the second ciphertext component, the integrity verification component, the condition tag and the target condition hash obtained in the above process.

[0030] In one specific implementation, generating an integrity verification component corresponding to the target message using an integrity verification function based on a first key negotiation point and a target condition hash includes: using the first integrity verification function... Based on the first key negotiation point Corresponding negotiation point coordinates Target message and target condition hash Determine the third ciphertext component corresponding to the target message. and utilize the second integrity verification function Based on target message First ciphertext component Third ciphertext component and target condition hash Determine the fourth ciphertext component corresponding to the target message. Finally, based on the first ciphertext component Second ciphertext component Third ciphertext component Fourth ciphertext component Conditional tags With target condition hash Generate target message The corresponding original ciphertext The integrity verification function includes a first integrity verification function and a second integrity verification function. The integrity verification component includes a third ciphertext component and a fourth ciphertext component. The data sender performs integrity verification on the target message based on the third ciphertext component, and the data receiver performs integrity verification on the target message obtained after decrypting the original ciphertext using the fourth ciphertext component.

[0031] It should be noted that in the above encryption process, the first ciphertext component Used during the decryption phase to allow the data sender or receiver to recover the same key negotiation point as during encryption using their respective private keys; First key negotiation point It is a scalar product of the temporary private key and the sender's public key, and its x and y axes are used to derive the symmetric key. With the third ciphertext component The calculation constitutes the core shared secret of encryption; target condition hash. Conditional labels Compressed into a fixed-length bit string and simultaneously incorporated into a derived symmetric key. Third ciphertext component With the fourth ciphertext component The calculation, thus setting the conditions It is bound to the confidentiality and integrity of the ciphertext. Second ciphertext component The result of symmetric encryption of the target message; the third ciphertext component. With the fourth ciphertext component These are two independent integrity verification fields, used for integrity verification at the data sending end and the data receiving end respectively, to ensure that the ciphertext and the conditions it is bound to are not tampered with during transmission and re-encryption.

[0032] In one specific implementation, the process of the data sender performing integrity verification on the target message obtained after decrypting the original ciphertext using the third ciphertext component includes: determining a first verification negotiation point based on the sender's private key and the first ciphertext component in the original ciphertext; generating a verification key using a key derivation function based on the negotiation point coordinates corresponding to the first verification negotiation point and the target condition hash in the original ciphertext; obtaining a first verification message based on the second ciphertext component in the original ciphertext and the verification key; generating a first verification component using a first integrity verification function based on the negotiation point coordinates, the target condition hash in the original ciphertext, and the first verification message; and determining whether the first verification component is consistent with the third ciphertext component in the original ciphertext. If the first verification component is consistent with the third ciphertext component in the original ciphertext, the first verification message is determined to have passed integrity verification. In other words, the decryption of the original ciphertext specifically includes the following steps: 1) Input the original ciphertext With the sender's private key ; 2) Calculate the first verification negotiation point based on the sender's private key and the first ciphertext component in the original ciphertext. ; 3) Utilize the key derivation function to determine the negotiation point coordinates based on the first verification negotiation point. The target condition hash in the original ciphertext Generate verification key ; 4) Obtain the first verification message based on the second ciphertext component and the verification key. ; 5) Utilize the first integrity verification function based on the negotiated point coordinates Target condition hashing With the first verification message Calculate the first verification component And determine whether it is equal to the third ciphertext component. If they are equal, the integrity verification is considered successful and the target message is output. Otherwise, an error will be reported.

[0033] Step S14: Generate a re-encryption key using the key derivation function based on the first key negotiation point, the second key negotiation point, the target condition hash, and the target authorization parameter. Send the target authorization parameter to the data receiving end. Send the re-encryption key and the original ciphertext to the proxy server. The proxy server encrypts the original ciphertext based on the re-encryption key to send the resulting target ciphertext to the data receiving end. The data receiving end decrypts the target ciphertext based on the target authorization parameter to obtain the target message.

[0034] In this embodiment, the data sender authorizes the data receiver and generates a binding condition tag for the data receiver. The proxy server obtains the re-encryption key for the target authorization parameters, and after obtaining the re-encryption key and the original ciphertext, it can re-encrypt the original ciphertext based on the re-encryption key and send the resulting target ciphertext to the data receiving end. The data receiving end, provided that it has obtained the target authorization parameters sent by the data sending end through the secure channel, decrypts the target ciphertext based on the target authorization parameters, and thus obtains the target message corresponding to the target ciphertext if the target authorization parameters are correct.

[0035] In one specific implementation, the data sender authorizes the data receiver and generates a binding condition tag for the data receiver. The re-encryption key specifically includes the following steps: 1) Randomly generate target authorization parameters And it is sent to the data receiving end through a secure channel; 2) Obtain the temporary private key used for encryption. Based on temporary private key Each with the sender's public key Receiver public key Calculate the first key negotiation point With the second key negotiation point ; 3) Utilizing conditional hash functions based on conditional labels Calculate the target condition hash ; 4) Utilize the key derivation function based on the first key negotiation point Second key negotiation point Target condition hashing With target authorization parameters Generate a re-encryption key The re-encryption key is then sent to the proxy server for storage.

[0036] It is understandable that in the above process of generating the re-encryption key, the re-encryption key... Derivation of the key for the data sender Key derivation items oriented towards the data receiver and incorporating authorization parameters Perform an XOR operation to make it both equal to the target condition hash. Binding (different condition tags correspond to different re-encryption keys), and also with the target authorization parameters Binding (the data receiver must possess the correct target authorization parameters to complete decryption). Because the generation of the re-encryption key requires the temporary private key used during encryption. To calculate the first key negotiation point With the second key negotiation point However, the proxy server cannot obtain the first ciphertext component due to the difficulty of the elliptic curve discrete logarithm problem. Reverse the temporary private key Therefore, the proxy server cannot generate or forge re-encryption keys on its own.

[0037] In this embodiment, the process of encrypting the original ciphertext using a proxy server based on a re-encryption key to send the resulting target ciphertext to the data receiving end includes: using the proxy server, performing an integrity check on the target condition hash based on the condition label in the original ciphertext using a condition hash function; and after the target condition hash passes the integrity check, verifying whether the condition label is consistent with the request condition in the data usage request sent by the data receiving end; if the condition label is consistent with the request condition in the data usage request sent by the data receiving end, then re-encrypting the second ciphertext component based on the re-encryption key to obtain the target ciphertext corresponding to the original ciphertext based on the re-encrypted second ciphertext component, and sending the target ciphertext to the data receiving end.

[0038] In one specific implementation, the proxy server performs a re-encryption operation after receiving the original ciphertext and the re-encryption key, specifically including the following steps: 1) Input the original ciphertext With re-encryption key ; 2) Integrity check: Utilize a conditional hash function based on the conditional tags in the original ciphertext. Target condition hash Conduct inspections and verifications. Check if the condition is true; if not, reject and return an error. 3) Condition matching: Validate condition labels Whether the data usage request is consistent with the request conditions in the data usage request sent by the data receiver; 4) If all the above checks pass, then the second ciphertext component is re-encrypted based on the re-encryption key, and the calculation is performed. ; 5) Based on the second ciphertext component after re-encryption Obtain the target ciphertext The target ciphertext is then sent to the data receiving end.

[0039] Understandably, in the aforementioned proxy re-encryption process, the proxy server only holds the original ciphertext and the re-encryption key, and performs an XOR operation. The ciphertext conversion can be completed instantly with extremely low computational overhead. The proxy server cannot re-encrypt the second ciphertext component. The recovery of the target message: On the one hand, it does not possess the private key of the data receiver. With target authorization parameters The target decryption key on the data receiving end cannot be calculated; on the other hand, the first ciphertext component... Reverse the temporary private key The first key negotiation point can be calculated from publicly available information. Second key negotiation point All of these can be reduced to elliptic curve discrete logarithm problems or computational Diffie-Hellman problems, which are infeasible under the corresponding difficulty assumptions. Furthermore, integrity checks and condition matching steps ensure that the proxy server only performs transformations on ciphertexts where the target condition hash matches the condition label, and the condition label matches the data usage request, thereby achieving fine-grained access control.

[0040] In this embodiment, the target message is obtained by decrypting the target ciphertext based on the target authorization parameters by the data receiving end. This includes: determining the second key negotiation point corresponding to the data receiving end based on the receiving end private key and the first ciphertext component in the target ciphertext by the data receiving end; determining the target decryption key based on the second key negotiation point, the target authorization parameters, and the target condition hash in the target ciphertext; obtaining the second verification message corresponding to the target ciphertext based on the target decryption key and the re-encrypted second ciphertext component in the target ciphertext; generating the second verification component based on the first ciphertext component, the third ciphertext component, the target condition hash, and the second verification message using the second integrity verification function; determining whether the second verification component is consistent with the fourth ciphertext component in the target ciphertext; and determining the second verification message as the target message corresponding to the target ciphertext when the second verification component is consistent with the fourth ciphertext component in the target ciphertext.

[0041] In one specific implementation, the data receiver uses its private key and target authorization parameters to decrypt and verify the integrity of the target ciphertext, specifically including the following steps: 1) Input the target ciphertext Receiver's private key With target authorization parameters ; 2) Calculate the second key negotiation point based on the receiver's private key and the first ciphertext component. ; 3) Determine the target decryption key based on the second key negotiation point, the target authorization parameters, and the target condition hash. ; 4) Obtain the second verification message based on the target decryption key and the re-encrypted second ciphertext component. ; 5) Utilize the second integrity verification function based on the first ciphertext component in the target ciphertext. Third ciphertext component Target condition hashing With the second verification message Calculate the second verification component And determine whether it is equal to the fourth ciphertext component. If they are equal, then the second verification message will be sent. The target message is identified as the target ciphertext. Otherwise, an error will be reported.

[0042] It should be noted that the third ciphertext component The calculation includes the negotiation point coordinates of the first key negotiation point. The data sender, possessing only the sender's private key, can recover the negotiation point coordinates from the first ciphertext component, thus enabling the data sender to perform integrity verification using the third ciphertext component; while the fourth ciphertext component... The calculation involves a target message, a first ciphertext component, a third ciphertext component, and a target conditional hash, all of which are information obtainable by the data receiver after decryption. Therefore, the data receiver uses the fourth ciphertext component for integrity verification. This setup ensures that both the data sender and receiver have independently executable integrity verification methods.

[0043] Furthermore, this embodiment achieves exclusive authorization and cryptographic revocation of permissions by introducing target authorization parameters. If a permission revocation request is received, the target authorization parameters corresponding to the data receiving end are regenerated, and the re-encryption key stored on the proxy server is updated using the regenerated target authorization parameters. Specifically, as shown... Figure 2As shown, the operation of this embodiment in the actual system includes three stages: data upload, data access, and permission revocation. In the data upload stage, the data sender performs conditional encryption on the target message and uploads the original ciphertext to the proxy server. In the data access stage, the data sender generates target authorization parameters during the initial authorization and sends them to the data receiver via a secure channel. It also generates a re-encryption key bound to a conditional tag and sends it to the proxy server. The proxy server re-encrypts the original ciphertext that meets the conditions and returns the target ciphertext to the data receiver. The data receiver uses its private key and the target authorization parameters to decrypt the message. In the permission revocation stage, when a permission revocation request is received, the data sender regenerates the target authorization parameters. The re-encryption key is then updated using the regenerated target authorization parameters, thus obtaining the updated re-encryption key. But not The authorization parameter is sent to the data receiving end whose permissions have been revoked. On one hand, since the target authorization parameter is secretly selected by the data sending end, and the data receiving end must use this target authorization parameter to decrypt the re-encrypted ciphertext, the data sending end enjoys exclusive authorization and can directly authorize the data receiving end without relying on any third party. On the other hand, the data sending end changes the target authorization parameter and updates the re-encryption key in the proxy server, but does not send the new target authorization parameter to the revoked data receiving end. This prevents the revoked data receiving end from decrypting the updated ciphertext due to the lack of the correct target authorization parameter, thus achieving cryptographic forced revocation without relying on the honesty of the proxy server. When it is necessary to reauthorize the previously revoked data receiving end, the data sending end generates the target authorization parameter again. Synchronously update the re-encryption key stored on the proxy server, and... Access can be restored by redistributing the data to the appropriate data receiver.

[0044] It should be noted that, through the above process, this embodiment will use conditional labels. Through conditional hash function Mapped to target condition hash This allows the key to participate in all key derivation processes, including deriving the symmetric key, generating the re-encryption key, and integrity verification, thereby achieving a cryptographic binding between the condition and the ciphertext. Re-encryption key Incorporating target condition hashing into the calculation This binds the re-encryption key to conditions, with different condition tags corresponding to different re-encryption keys. The proxy server can only convert ciphertext that matches the conditions bound to the re-encryption key. Third ciphertext component With the fourth ciphertext component All calculations are incorporated into the target conditional hash. This approach binds integrity verification to conditions, effectively preventing tampering attacks that decouple conditions from ciphertext content. Simultaneously, both the original ciphertext and the target ciphertext obtained after re-encryption possess a complete SM2-CPRE ciphertext structure, ensuring compatibility with SM2 standard ciphertext. In particular, the scheme provided in this embodiment exhibits good degradation properties and compatibility. This works when only a single fixed condition exists in the system, meaning all ciphertexts use the same condition label. At that time, target condition hash Since the conditional binding is constant, it no longer has a distinguishing effect. In this case, the scheme provided in this embodiment degenerates into the original SM2-based proxy re-encryption scheme in terms of ciphertext structure and operation process. This degenerate property indicates that this embodiment is obtained by introducing a conditional binding mechanism without compromising the compatibility of the original scheme. It retains the efficiency of the original scheme and adds fine-grained access control capabilities.

[0045] Based on this, the security of this embodiment is analyzed. Under the random oracle model, this embodiment assumes the proxy server is semi-honest and, based on the difficulty assumptions of the elliptic curve discrete logarithm problem and the computational Diffie-Hellman problem, proves that it satisfies the conditional proxy re-encryption indistinguishability (IND-CPRE-CPA) security under chosen-plaintext attacks. Specifically: First, the proxy server cannot obtain the plaintext because of the re-encrypted second ciphertext component. Key Derivatives Contained Second key negotiation point dependent on the data receiver With target authorization parameters The proxy server does not possess the recipient's private key. With target authorization parameters It is also impossible to obtain the first ciphertext component. A temporary private key is computed despite the difficulty of the elliptic curve discrete logarithm problem. Therefore, the target decryption key cannot be calculated; secondly, the proxy server cannot independently generate or forge the re-encryption key, because the generation of the re-encryption key depends on the first key negotiation point. With the second key negotiation point First, the calculation of the above negotiation points based on publicly available information can be reduced to a computational Diffie-Hellman problem, which is infeasible under the corresponding difficulty assumptions. Second, the conditions are tamper-proof because the target condition hash is simultaneously incorporated into the calculation of the derived symmetric key, the re-encryption key, and the third and fourth ciphertext components. Once an attacker tampers with the condition label or the target condition hash, the integrity check of the proxy server or the integrity verification of the data sender and receiver will fail, thus making it impossible to decouple the conditions from the ciphertext content. Third, the authorization is exclusive because the target authorization parameter is secretly selected by the data sender. Even if there are other parties who do not hold this parameter, they cannot decrypt the re-encrypted ciphertext. In summary, this embodiment achieves security attributes such as condition binding, condition tamper-proofing, exclusive authorization, and cryptographic revocation of permissions while ensuring the confidentiality of the ciphertext.

[0046] To facilitate understanding, this embodiment will be further explained below with reference to a specific application scenario. Taking the encrypted email forwarding scenario as an example, the data sender is the mailbox owner, the data receiver is its assistant, and the proxy server is the mail server. When encrypting the email, the mailbox owner uses attributes such as the urgency of the email as condition tags. For example, take For emails marked "urgent," the original ciphertext is generated according to the aforementioned encryption process and uploaded to the mail server. When the mailbox owner wishes to delegate only emails marked "urgent" to an assistant, a binding condition label is generated according to the aforementioned re-encryption key generation process. The re-encryption key for emails with the condition tag "urgent" is sent to the mail server, along with the target authorization parameters, which are then sent to the assistant via a secure channel. The mail server only re-encrypts the original ciphertext with the condition tag "urgent" and sends the resulting target ciphertext to the assistant. The assistant then decrypts the target ciphertext using their private key and the target authorization parameters, thus processing the urgent emails. For other non-urgent emails, the mail server cannot re-encrypt them because their condition tags do not match the conditions bound to the re-encryption key. Therefore, these emails remain private to the assistant, achieving fine-grained access control. When the mailbox owner needs to revoke the assistant's processing privileges, the target authorization parameters are regenerated, and the re-encryption key stored on the mail server is updated. However, the new target authorization parameters are not sent to the assistant, preventing the assistant from decrypting subsequently processed emails due to the lack of the correct target authorization parameters. Similarly, in cloud storage data sharing scenarios, the data sender uploads encrypted data to the cloud storage server, using attributes such as data category, security level, or validity period as conditional tags, thereby authorizing only designated data users with data that meets specific conditions. In blockchain privacy protection scenarios, data is stored on the blockchain in encrypted form. The data sender generates a re-encryption key bound to the conditions, enabling the proxy server to only convert on-chain ciphertext that meets the conditions to the authorizing party, thus achieving controlled sharing while protecting data privacy. The above scenarios can all utilize the SM2-based proxy re-encryption method provided in this embodiment to achieve efficient ciphertext conversion and authorization that supports fine-grained access control.

[0047] As can be seen, this application maps the conditional label to the target conditional hash using a conditional hash function, and involves it in the entire process of deriving the symmetric key, generating the re-encryption key, and verifying integrity. This achieves a cryptographic binding between the condition and the ciphertext, ensuring that the proxy server can only convert ciphertext that meets the specified conditions. Thus, fine-grained access control is achieved in SM2-based proxy re-encryption, filling the gap in existing SM2-based proxy re-encryption schemes that do not support conditional control. During the encryption process, this application only uses elliptic curve multiplication, excluding bilinear pairing operations, and the proxy server's re-encryption operation requires only one XOR operation, significantly reducing computational overhead compared to SM9-based conditional proxy re-encryption schemes. Furthermore, by introducing a target authorization parameter secretly selected by the data sender, this application ensures that the data receiver must use this parameter to decrypt the re-encrypted ciphertext, thereby achieving exclusive authorization and supporting fine-grained access control in conditional proxy re-encryption.

[0048] See Figure 3 As shown, this application discloses an SM2-based proxy re-encryption device applied at a data sending end, comprising: The negotiation point determination module 11 is used to obtain the target public parameters corresponding to the data sender, determine the temporary private key corresponding to the data sender, determine the first key negotiation point corresponding to the data sender based on the temporary private key and the sender private key corresponding to the data sender, and generate the second key negotiation point corresponding to the data receiver based on the temporary private key and the receiver public key corresponding to the data receiver; the target public parameters include the target elliptic curve base point, the conditional hash function, the key derivation function, and the integrity verification function; The key derivation module 12 is used to determine the target condition hash corresponding to the target message based on the condition tag corresponding to the target message to be sent using the condition hash function, and to determine the derived symmetric key corresponding to the target message based on the target condition hash and the first key negotiation point using the key derivation function. The original ciphertext generation module 13 is used to determine the first ciphertext component corresponding to the target message based on the temporary private key and the target elliptic curve base point, encrypt the target message based on the derived symmetric key to generate a second ciphertext component, and use the integrity verification function to generate the integrity verification component corresponding to the target message based on the first key negotiation point and the target condition hash, so as to generate the original ciphertext corresponding to the target message based on the first ciphertext component, the second ciphertext component, the integrity verification component, the condition label and the target condition hash; The ciphertext re-encryption module 14 is used to generate a re-encryption key based on the first key negotiation point, the second key negotiation point, the target condition hash, and the target authorization parameter using the key derivation function, and send the target authorization parameter to the data receiving end. The re-encryption key and the original ciphertext are sent to the proxy server, so that the proxy server encrypts the original ciphertext based on the re-encryption key to send the obtained target ciphertext to the data receiving end, and the data receiving end decrypts the target ciphertext based on the target authorization parameter to obtain the target message.

[0049] As can be seen, this application maps the conditional label to the target conditional hash using a conditional hash function, and involves it in the entire process of deriving the symmetric key, generating the re-encryption key, and verifying integrity. This achieves a cryptographic binding between the condition and the ciphertext, ensuring that the proxy server can only convert ciphertext that meets the specified conditions. Thus, fine-grained access control is achieved in SM2-based proxy re-encryption, filling the gap in existing SM2-based proxy re-encryption schemes that do not support conditional control. During the encryption process, this application only uses elliptic curve multiplication, excluding bilinear pairing operations, and the proxy server's re-encryption operation requires only one XOR operation, significantly reducing computational overhead compared to SM9-based conditional proxy re-encryption schemes. Furthermore, by introducing a target authorization parameter secretly selected by the data sender, this application ensures that the data receiver must use this parameter to decrypt the re-encrypted ciphertext, thereby achieving exclusive authorization and supporting fine-grained access control in conditional proxy re-encryption.

[0050] In one specific embodiment, the device may further include: The key determination module is used to determine the private key of the data sender and the public key of the data sender based on the private key and the target elliptic curve base point.

[0051] In one specific implementation, the original ciphertext generation module 13 may include: The integrity verification component generation unit is used to determine the third ciphertext component corresponding to the target message based on the negotiation point coordinates corresponding to the first key negotiation point, the target message, and the target condition hash using a first integrity verification function, and to determine the fourth ciphertext component corresponding to the target message based on the target message, the first ciphertext component, the third ciphertext component, and the target condition hash using a second integrity verification function. The integrity verification function includes a first integrity verification function and a second integrity verification function, and the integrity verification component includes a third ciphertext component and a fourth ciphertext component. The data sending end performs integrity verification on the target message based on the third ciphertext component, and the data receiving end performs integrity verification on the target message obtained after decrypting the original ciphertext using the fourth ciphertext component.

[0052] In one specific embodiment, the device may further include: The first verification message acquisition module is used to determine a first verification negotiation point based on the private key of the sending end corresponding to the data sending end and the first ciphertext component in the original ciphertext, and to generate a verification key based on the negotiation point coordinates corresponding to the first verification negotiation point and the target condition hash in the original ciphertext using the key derivation function, so as to obtain the first verification message based on the second ciphertext component in the original ciphertext and the verification key. The first message verification module is used to generate a first verification component based on the negotiation point coordinates, the target condition hash in the original ciphertext, and the first verification message using the first integrity verification function, and to determine whether the first verification component is consistent with the third ciphertext component in the original ciphertext. If the first verification component is consistent with the third ciphertext component in the original ciphertext, then the first verification message is determined to have passed integrity verification.

[0053] In one specific implementation, the proxy server may include: The condition verification module is used to perform an integrity check on the target condition hash based on the condition label in the original ciphertext using the condition hash function, and after the target condition hash passes the integrity check, to verify whether the condition label is consistent with the request conditions in the data usage request sent by the data receiving end. The ciphertext sending module is configured to, if the condition tag is consistent with the request condition in the data usage request sent by the data receiving end, re-encrypt the second ciphertext component based on the re-encryption key, so as to obtain the target ciphertext corresponding to the original ciphertext based on the re-encrypted second ciphertext component, and send the target ciphertext to the data receiving end.

[0054] In one specific implementation, the data receiving end may include: The target message acquisition module is configured to determine the second key negotiation point corresponding to the data receiving end based on the receiving end private key corresponding to the data receiving end and the first ciphertext component in the target ciphertext; determine the target decryption key based on the second key negotiation point, the target authorization parameter, and the target condition hash in the target ciphertext; obtain the second verification message corresponding to the target ciphertext based on the target decryption key and the re-encrypted second ciphertext component in the target ciphertext; generate a second verification component based on the first ciphertext component, the third ciphertext component, the target condition hash, and the second verification message using the second integrity verification function; determine whether the second verification component is consistent with the fourth ciphertext component in the target ciphertext; and determine the second verification message as the target message corresponding to the target ciphertext when the second verification component is consistent with the fourth ciphertext component in the target ciphertext.

[0055] In one specific implementation, the SM2-based proxy re-encryption method may further include: If a permission revocation request is received, the target authorization parameters corresponding to the data receiving end are regenerated, and the re-encryption key stored in the proxy server is updated using the regenerated target authorization parameters.

[0056] Furthermore, embodiments of this application also disclose an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0057] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the SM2-based proxy re-encryption method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0058] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0059] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored thereon can include an operating system 221, computer programs 222, etc., and the storage method can be temporary storage or permanent storage.

[0060] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the SM2-based proxy re-encryption method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0061] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned SM2-based proxy re-encryption method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0062] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0063] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0064] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0065] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0066] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A proxy re-encryption method based on SM2, characterized in that, Applied to the data sending end, including: The target public parameters corresponding to the data sender are obtained, the temporary private key corresponding to the data sender is determined, the first key negotiation point corresponding to the data sender is determined based on the temporary private key and the sender private key corresponding to the data sender, and the second key negotiation point corresponding to the data receiver is generated based on the temporary private key and the receiver public key corresponding to the data receiver; the target public parameters include the target elliptic curve base point, the conditional hash function, the key derivation function, and the integrity verification function; The target condition hash corresponding to the target message is determined by the condition hash function based on the condition tag corresponding to the target message to be sent, and the derived symmetric key corresponding to the target message is determined by the key derivation function based on the target condition hash and the first key negotiation point. Based on the temporary private key and the target elliptic curve base point, the first ciphertext component corresponding to the target message is determined. The target message is then encrypted based on the derived symmetric key to generate a second ciphertext component. The integrity verification function is then used to generate an integrity verification component corresponding to the target message based on the first key negotiation point and the target condition hash. Finally, the original ciphertext corresponding to the target message is generated based on the first ciphertext component, the second ciphertext component, the integrity verification component, the condition tag, and the target condition hash. The key derivation function is used to generate a re-encryption key based on the first key negotiation point, the second key negotiation point, the target condition hash, and the target authorization parameter. The target authorization parameter is then sent to the data receiving end. The re-encryption key and the original ciphertext are sent to a proxy server. The proxy server encrypts the original ciphertext based on the re-encryption key to send the resulting target ciphertext to the data receiving end. Finally, the data receiving end decrypts the target ciphertext based on the target authorization parameter to obtain the target message.

2. The proxy re-encryption method based on SM2 according to claim 1, characterized in that, Before determining the first key negotiation point corresponding to the data sender based on the temporary private key and the sender's private key corresponding to the data sender, the method further includes: Determine the private key of the data sender, and determine the public key of the data sender based on the private key and the target elliptic curve base point.

3. The proxy re-encryption method based on SM2 according to claim 1, characterized in that, The step of generating the integrity verification component corresponding to the target message based on the first key negotiation point and the target condition hash using the integrity verification function includes: The third ciphertext component corresponding to the target message is determined using a first integrity verification function based on the negotiation point coordinates corresponding to the first key negotiation point, the target message, and the target condition hash. The fourth ciphertext component corresponding to the target message is determined using a second integrity verification function based on the target message, the first ciphertext component, the third ciphertext component, and the target condition hash. The integrity verification function includes a first integrity verification function and a second integrity verification function, and the integrity verification component includes a third ciphertext component and a fourth ciphertext component. The data sending end performs integrity verification on the target message based on the third ciphertext component, and the data receiving end performs integrity verification on the target message obtained after decrypting the original ciphertext using the fourth ciphertext component.

4. The proxy re-encryption method based on SM2 according to claim 3, characterized in that, The process by which the data sending end performs integrity verification on the target message obtained after decrypting the original ciphertext using the third ciphertext component includes: A first verification negotiation point is determined based on the private key of the sending end corresponding to the data sending end and the first ciphertext component in the original ciphertext. Then, using the key derivation function, a verification key is generated based on the negotiation point coordinates corresponding to the first verification negotiation point and the target condition hash in the original ciphertext. The first verification message is then obtained based on the second ciphertext component in the original ciphertext and the verification key. Using the first integrity verification function, a first verification component is generated based on the negotiation point coordinates, the target condition hash in the original ciphertext, and the first verification message. It is then determined whether the first verification component is consistent with the third ciphertext component in the original ciphertext. If the first verification component is consistent with the third ciphertext component in the original ciphertext, the first verification message is determined to have passed integrity verification.

5. The proxy re-encryption method based on SM2 according to claim 1, characterized in that, The step of encrypting the original ciphertext using the re-encryption key via the proxy server to send the resulting target ciphertext to the data receiving end includes: Through the proxy server, the conditional hash function is used to perform an integrity check on the target conditional hash based on the conditional label in the original ciphertext. After the target conditional hash passes the integrity check, it is verified whether the conditional label is consistent with the request conditions in the data usage request sent by the data receiving end. If the condition tag is consistent with the request condition in the data usage request sent by the data receiving end, then the second ciphertext component is re-encrypted based on the re-encryption key, so as to obtain the target ciphertext corresponding to the original ciphertext based on the re-encrypted second ciphertext component, and the target ciphertext is sent to the data receiving end.

6. The proxy re-encryption method based on SM2 according to claim 3, characterized in that, The step of decrypting the target ciphertext based on the target authorization parameters through the data receiving end to obtain the target message includes: Through the data receiving end, based on the receiving end private key corresponding to the data receiving end and the first ciphertext component in the target ciphertext, the second key negotiation point corresponding to the data receiving end is determined. Based on the second key negotiation point, the target authorization parameter and the target condition hash in the target ciphertext, the target decryption key is determined. Based on the target decryption key and the re-encrypted second ciphertext component in the target ciphertext, the second verification message corresponding to the target ciphertext is obtained. Using the second integrity verification function, a second verification component is generated based on the first ciphertext component, the third ciphertext component, the target condition hash and the second verification message in the target ciphertext. It is determined whether the second verification component is consistent with the fourth ciphertext component in the target ciphertext. If the second verification component is consistent with the fourth ciphertext component in the target ciphertext, the second verification message is determined as the target message corresponding to the target ciphertext.

7. The SM2-based proxy re-encryption method according to any one of claims 1 to 6, characterized in that, Also includes: If a permission revocation request is received, the target authorization parameters corresponding to the data receiving end are regenerated, and the re-encryption key stored in the proxy server is updated using the regenerated target authorization parameters.

8. A proxy re-encryption device based on SM2, characterized in that, Applied to the data sending end, including: The negotiation point determination module is used to obtain the target public parameters corresponding to the data sender, determine the temporary private key corresponding to the data sender, determine the first key negotiation point corresponding to the data sender based on the temporary private key and the sender private key corresponding to the data sender, and generate the second key negotiation point corresponding to the data receiver based on the temporary private key and the receiver public key corresponding to the data receiver; the target public parameters include the target elliptic curve base point, conditional hash function, key derivation function, and integrity verification function; The key derivation module is used to determine the target condition hash corresponding to the target message based on the condition tag corresponding to the target message to be sent using the condition hash function, and to determine the derived symmetric key corresponding to the target message based on the target condition hash and the first key negotiation point using the key derivation function. The original ciphertext generation module is used to determine the first ciphertext component corresponding to the target message based on the temporary private key and the target elliptic curve base point, encrypt the target message based on the derived symmetric key to generate a second ciphertext component, and use the integrity verification function to generate the integrity verification component corresponding to the target message based on the first key negotiation point and the target condition hash, so as to generate the original ciphertext corresponding to the target message based on the first ciphertext component, the second ciphertext component, the integrity verification component, the condition label and the target condition hash; The ciphertext re-encryption module is used to generate a re-encryption key based on the first key negotiation point, the second key negotiation point, the target condition hash, and the target authorization parameter using the key derivation function, and send the target authorization parameter to the data receiving end. The re-encryption key and the original ciphertext are then sent to a proxy server, whereby the proxy server encrypts the original ciphertext based on the re-encryption key to send the resulting target ciphertext to the data receiving end. Finally, the data receiving end decrypts the target ciphertext based on the target authorization parameter to obtain the target message.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the SM2-based proxy re-encryption method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, wherein the computer programs, when executed by a processor, implement the SM2-based proxy re-encryption method as described in any one of claims 1 to 7.

Images