A post-quantum secure anti-decryption key-leakage revocable identity-based encryption method

Abstract

This invention discloses a post-quantum-secure, revocable identity-based encryption method resistant to decryption key leakage, comprising: inputting security parameters and the maximum number of system users to generate system public parameters and a master private key; generating a private key corresponding to the identity ID based on the system public parameters, the master private key, and the identity ID; for each time sub-period within a time period, generating a key update for the time sub-period based on the system public parameters, the master private key, a revocation list, and a binary tree; generating ciphertext based on the system public parameters, the message, the identity ID, and the time sub-period; generating a decryption key for the time sub-period based on the system public parameters, the private key corresponding to the identity ID, and the key update for the time sub-period; and during the decryption process, inputting the system public parameters and the ciphertext decryption key, and outputting the message. This invention, while ensuring resistance to decryption key leakage, changes the way the KGC generates the private key to achieve indirect revocation, thereby reducing the computational burden on the sender.

Description

Technical Field

[0001] This invention relates to the field of post-quantum secure cryptography, and in particular to a post-quantum secure revocable identity-based encryption method resistant to decryption key leakage. Background Technology

[0002] In Identity-Based Encryption (IBE), a user's public key is directly represented by their identity information. This identity-as-public-key functionality eliminates the complex certificate management required in traditional Public Key Infrastructure (PKI). However, due to the lack of a certificate management mechanism, effectively revoking user privileges in cases of key leakage or expiration becomes a significant challenge for IBE.

[0003] In IBE, the Key Generation Center (KGC) is responsible for system initialization and generating the system's master public and private keys. The KGC generates and distributes a corresponding private key to each user based on their identity information and the system's master private key. The sender uses the receiver's identity information as the public key to generate the corresponding ciphertext; the receiver with a matching identity uses the private key to decrypt and recover the plaintext. Boneh first proposed a method for revoking users in IBE. In standard IBE, the public key is the user's identity. In Revocable Identity-Based Encryption (RIBE), the public key not only contains the user's identity but also incorporates time. In each time period, the KGC generates and distributes private keys associated with the identity and the current time for unrevoked users. When a user is revoked, the KGC stops generating and distributing new private keys for the revoked user. In subsequent time periods, the revoked user cannot continue to decrypt ciphertext. While Boneh's revocation method is intuitive and effective, it suffers from efficiency bottlenecks. KGC regenerates private keys for all unrevoked users in each time period, and its computational cost is proportional to the number of unrevoked users. In real-world scenarios, the number of revoked users is usually much smaller than the number of unrevoked users. Therefore, the revocation method of periodically generating private keys for all unrevoked users is significantly inefficient and impractical.

[0004] Boldyreva introduces a binary tree structure based on the Boneh scheme, significantly reducing the periodic computational overhead of KGC. During the initialization phase, KGC constructs a binary tree, storing user identities in the leaf nodes. KGC generates an initial private key based on the master private key, information about each node along the path from the root to a leaf node, and the user's identity. Each user receives a set of private keys. Each private key is associated with the user's identity and a node. At each time period, KGC, based on the binary tree structure and the identity of the revoked user, uses a complete subtree method to determine the minimum set of nodes that need updating. This set definitely does not contain nodes of revoked users, and at most contains one node of an unrevoked user (multiple unrevoked users may share an ancestor node). Subsequently, KGC generates and broadcasts a key update for each node in the set based on the master private key and the time. Unrevoked users can combine their initial private key with the key update to generate a decryption key for the current time. Revoked users cannot obtain a decryption key using the key update, thus losing their decryption ability. By introducing the binary tree structure and the complete subtree method, the periodic computational overhead of KGC is significantly reduced. Reduce to ,in N Total number of users r This represents the number of users whose accounts have been revoked. Because Boldyreva's scheme achieves revocation by stripping the recipient of their decryption capabilities, this revocation concept is called indirect revocation.

[0005] As research deepened, scholars discovered new security vulnerabilities in the RIBE scheme. Seo et al. found that when the decryption key in RIBE is leaked, the user's private key is also leaked. For example, in the [Chen12] scheme, the decryption key is simply a concatenation of the private key and the key update for the current time period. This means that if the decryption key for a certain time period is leaked, the user's long-term private key will also be exposed. Once the private key is leaked, the confidentiality of the ciphertext for all time periods will be compromised. To eliminate such security risks, Seo et al. proposed the concept of Decryption Key Exposure Resistance (DKER). DKER means that even if the decryption key for some time periods is leaked, the confidentiality of the ciphertext for other time periods will not be compromised.

[0006] With the introduction of the concept of anti-decryption key leakage, RIBE based on bilinear or multilinear pairings has developed rapidly. However, with the rapid advancement of quantum computing technology, traditional cryptographic schemes relying on mathematical problems face the risk of being cracked by quantum computers. Therefore, researching cryptographic schemes with quantum attack resistance has become particularly important. In the field of post-quantum cryptography, lattice cryptography has become one of the most promising research directions due to its solid theoretical foundation and high computational efficiency. Summary of the Invention

[0007] This invention provides a post-quantum secure revocable identity base encryption method resistant to decryption key leakage. It considers changing the way KGC generates private keys to achieve indirect revocation while ensuring resistance to decryption key leakage, thereby reducing the computational burden on the sender.

[0008] A post-quantum-secure, revocable identity-based encryption method resistant to decryption key leakage includes the following steps: (1) Input security parameters Maximum number of system users N Generate the system public parameter PP and the master private key MSK; (2) Based on system common parameters Master private key Generate a private key corresponding to the identity ID. ; (3) Regarding the time period Each time sub-cycle in Based on system common parameters Master private key Cancel list Using a binary tree (BT) to generate key updates for time sub-periods t. ; (4) Based on system common parameters PP and messages Identity ID and Time Sub-period Generate ciphertext ; (5) Based on the system public parameter PP and the private key corresponding to the identity ID Key update for time sub-period t Generate the decryption key for time sub-period t. ; (6) During the decryption process, input the system common parameters PP and the ciphertext. Decryption key Output message .

[0009] Step (1) specifically includes: (1-1) Calling the trapdoor generation algorithm Generate matrix and the corresponding trapdoor ;in, For large prime numbers, , , Let be the time complexity function. for On the domain matrix, For integers Z matrix; (1-2) Two matrices are selected uniformly and randomly. B , W Uniformly and randomly selected n dimensional vector u ; for an n-dimensional vector over a field; (1-3) Construct a tree containing at least N A binary tree BT with leaf nodes is used to mark all leaf nodes as unassigned. For each node in the binary tree... Randomly select matrix ; (1-4) Output system common parameters and the master private key .

[0010] Step (2) specifically includes: (2-1) Randomly select an unassigned leaf node in the binary tree BT. Store the identity ID in the leaf node; The leaf node representing the stored identity ID. Including from leaf nodes All nodes on the path to the root node; (2-2) Let H is mapped to a hash function, and the hash function is... , is used to map natural numbers to vector form; G The tool matrix is ​​used to generate the decryption key; (2-3) Based on identity ID and For each node, generate a value that satisfies the equation. of ; (2-4) Output the private key .

[0011] Steps (2-3) specifically include: Randomly select matrix ,make ; Indicates satisfaction Distribution matrix; sampling ; Represents distribution The variance; Will Divide into blocks by line, first m The line is considered the first part, denoted as ; after m The line is considered the second part, denoted as ;Will Divide into blocks by line, first m The line is considered the first part, denoted as ; after m The line is considered the second part, denoted as The block matrix is ​​concatenated in the following manner to obtain the final key matrix. : ; in, express On the domain matrix.

[0012] Step (3) specifically includes: (3.1) Call the KUNode algorithm, input the binary tree BT and the cancellation list of the time sub-period t. Output the node update set for time sub-period t. ; (3.2) Let H is mapped to a hash function. G It is a tool matrix; (3.3) Update the set for nodes Each node generates a value that satisfies the equation Key update ; (3.4) Broadcast key update .

[0013] Step (4) specifically includes: (4-1) Uniformly random selection of matrix R and V Uniformly and randomly selected vectors ; (4-2) Select noise Select m dimensional noise vector ; (4-3) Calculation , ,in It is an identity matrix; (4-4) Output ciphertext .

[0014] Step (5) specifically includes: (5-1) The user corresponding to the identity ID updates the set of keys by matching the binary tree nodes of their private key with the key of the time sub-period t. The nodes in the table are compared. If there are duplicate nodes, the node is recorded as... If yes, continue with step (5-2); otherwise, abort the entire decryption process. (5-2) The user retrieves the private key from the time sub-period t. Selecting nodes corresponding key matrix Select a node from the key update Corresponding key update ;according to and Generate equations that satisfy the equations decryption key ; (5-3) Output the decryption key .

[0015] Step (6) specifically includes: (6-1) According to the ciphertext The time sub-period t contained therein is used to select the decryption key for the corresponding time sub-period. ; (6-2) Calculation ;if , =1; otherwise =0; (6-3) Output message .

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. Innovative Key Generation Mechanism: KGC generates user private keys based on the Non-homogeneous Short Integer Solution Problem (ISIS); users who obtain the private key must combine it with the key update broadcast by KGC to obtain the short basis of the matrix; based on the short basis corresponding to the identity and time matrix, the receiver generates a randomized short vector as the decryption key for the current time period. This invention, while ensuring resistance to decryption key leakage, changes the way KGC generates private keys to achieve indirect revocation, thereby reducing the computational burden on the sender.

[0017] 2. This invention solves the problem of key autonomous derivation in existing methods by decomposing the decryption key generation process into two independent but interrelated stages: identity and time.

[0018] 3. This invention constructs a revocable identity-based encryption scheme resistant to decryption key leakage based on a hierarchical key derivation and decryption mechanism. This scheme achieves indirect revocation while ensuring security against decryption key leakage, thereby reducing the user's computational burden and the system's communication overhead. Based on the standard model, the method's selected identity security is proven using the fault-tolerant learning problem and the short integer solution problem. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of a post-quantum secure revocable identity-based encryption method to resist decryption key leakage, according to an embodiment of the present invention.

[0021] Figure 2 This is a schematic diagram of a post-quantum secure anti-decryption key leakage revocable identity-based encryption method according to an embodiment of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] It should be noted that, unless otherwise specified, the features in the following embodiments and implementation methods can be combined with each other.

[0024] In the event of a user's private key leakage, revocable identity-based encryption methods can dynamically revoke the associated user's account, thereby ensuring backward security of the system. Revocable identity-based encryption methods resistant to decryption key leakage ensure that even if a user's decryption key is leaked at a certain time period, the ciphertext of that user at other time periods remains secure. Existing revocable identity-based encryption methods resistant to decryption key leakage typically achieve direct user revocation by generating ciphertext only for users who have not been revoked. However, this revocation method requires generating ciphertext for every plaintext message. The amount of ciphertext is on the order of magnitude. The computation of redundant ciphertext places a huge computational burden on users and a huge communication overhead on the system.

[0025] like Figure 1 and Figure 2 As shown, this embodiment of the invention provides a post-quantum-secure revocable identity-based encryption method resistant to decryption key leakage, comprising the following steps: (1) Parameter description.

[0026] (1.1) Message Scope identity range .

[0027] (1.2) Time period range The time period is usually treated as a natural number, but the scheme construction requires the time period to be in vector form, so a hash function is used. This maps natural numbers to vector form.

[0028] (1.3) For any , express A uniform random distribution on.

[0029] (1.4) , , , , , .

[0030] (2) Initialization.

[0031] Input security parameters Maximum number of system users N Output the system's public parameters PP and master private key MSK.

[0032] (2.1) Call the trapdoor generation algorithm Generate matrix and the corresponding trapdoor .

[0033] (2.2) Two matrices are selected uniformly and randomly. B , W Uniformly and randomly selected n dimensional vector u .

[0034] (2.3) Construct a tree with minimum number of elements N In a binary tree BT with leaf nodes, mark all leaf nodes as unassigned. For each node in the binary tree... Randomly select matrix .

[0035] (2.4) Output system common parameters Master private key .

[0036] (3) Private key generation.

[0037] Input system common parameters Master private key and identity Output the private key corresponding to the identity ID. .

[0038] (3.1) Randomly select an unassigned leaf node in the binary tree BT. The identity ID is stored in the leaf node. The leaf node representing the stored identity ID. Including from leaf nodes All nodes on the path to the root node (including leaf nodes and the root node).

[0039] (3.2) Let H is mapped to a hash function. G It is a tool matrix.

[0040] (3.3) Based on identity ID and For each node, generate a value that satisfies the equation. of Specifically, this includes: Randomly select matrix ,make ; sampling ; Will Divide into blocks by line, first m The line is considered the first part, denoted as ; after m The line is considered the second part, denoted as ;Will Divide into blocks by line, first m The line is considered the first part, denoted as ; after m The line is considered the second part, denoted as The block matrices are concatenated in the following manner to obtain the final key matrix: .

[0041] (3.4) Output the private key .

[0042] (4) Key update generation.

[0043] Input system common parameters Master private key Cancel list And binary tree BT, output t Time-period key update .

[0044] (4.1) Call the KUNode algorithm, inputting the binary tree BT and t Cancellation list for time period Output t Time period node update set .

[0045] (4.2) Let Mapping H in Definition 1 It has been defined in the middle. G yes Lemma 3 The tool matrix in the text.

[0046] (4.3) Update the set for nodes. Each node generates a value that satisfies the equation Key update The details are as follows: Randomly select matrix ,make ; sampling ; Will Divide into blocks by line, first m The line is considered the first part, denoted as ; after m The line is considered the second part, denoted as ;Will Divide into blocks by line, first m The line is considered the first part, denoted as ; after m The line is considered the second part, denoted as The block matrices are concatenated in the following manner to obtain the final key matrix: ; (4.4) Broadcast key update .

[0047] (5) Encryption.

[0048] Input system common parameters PP, messages Identity ID and time cycle t Output ciphertext .

[0049] (5.1) Uniformly random selection of matrix R and V Uniformly and randomly selected vectors .

[0050] (5.2) Select noise Select m dimensional noise vector .

[0051] (5.3) Calculation , ,in It is an identity matrix.

[0052] (5.4) Output ciphertext .

[0053] (6) Decryption key generation.

[0054] Input the system's public parameter PP and the private key corresponding to the identity ID. and t Time-period key update Output t Decryption key for time period .

[0055] (6.1) The user with the ID sets the binary tree node of their private key to... t Key update set for time periods The nodes in the table are compared. If there are duplicate nodes, the node is recorded as... Continue with the following steps. Otherwise, the algorithm terminates.

[0056] (6.2) Users in t Time period, from the private key Selected from Select from key update .according to and Generate equations that satisfy the equations decryption key .

[0057] Randomly select vector ,make .

[0058] sampling .

[0059] Based on the private key and key update ,calculate .

[0060] calculate .

[0061] Will Divide into columns, each column from left to right. m The columns are denoted as follows: , .Will Divide into columns, each column from left to right. m The columns are denoted as follows: and By concatenating the segmented matrices, the decryption key is obtained: ; (6.3) Output the decryption key .

[0062] (7) Decryption.

[0063] Input system common parameters PP, ciphertext Decryption key Output message .

[0064] (7.1) According to the ciphertext The time period t included is used to select the decryption key corresponding to the time period. .

[0065] (7.2) Calculation .if , =1; Otherwise =0.

[0066] (7.3) Output message .

[0067] The effects of the present invention will be analyzed below.

[0068] (1) Correctness analysis.

[0069] ; The error term in the decryption process is .

[0070] ; According to the principle of residual hashing, .

[0071] According to the principle of trapdoor generation .

[0072] According to the principle of trapdoor generation The same applies to the other items in this matrix.

[0073] According to the principle of trapdoor generation .

[0074] .

[0075] When the parameters in the scheme satisfy When the relationship is established, the solution can successfully decrypt and recover the plaintext.

[0076] (2) Security analysis.

[0077] Theorem 1: Under the assumptions of the LWE decision problem and the ISIS problem, the method of the present invention has selective identity security.

[0078] Proof: The indistinguishability selective identity Chosen Plaintext Attacks (IND-sID-CPA) of this scheme is proven step-by-step through a series of games. In the series of games, the first game is indistinguishable from the game defined by the IND-sID-CPA security model. In the last game, the opponent's advantage is zero. Since an adversary in arbitrary probability multinomial time (PPT) cannot distinguish any two adjacent games in the series, the adversary's advantage in winning the original IND-sID-CPA game is negligible. In conclusion, under the assumptions of the LWE decision problem and the ISIS problem, the method of this invention possesses selective identity security.

[0079] Game 0: Opponent Based on the definition of the security model and the challengers Perform the original IND-sID-CPA game.

[0080] Game 1: In Game 1, the challenger Change matrix B , W The generation method. These represent the identity and time of the challenger's turn to challenge the opponent. In Game 0, the challenger... Randomly select matrix B , W In Game 1, the Challenger Random sampling matrix during initialization phase .matrix Representing the challengers The matrix selected when generating the challenge ciphertext.

[0081] make: , .

[0082] Game 2: In Game 2, the Challenger Change the way you respond to private key queries.

[0083] For Category I adversaries: Challengers Requires responding to the challenge identity corresponding to the private key The question was asked. During the initialization phase, settings were configured. .

[0084] [1] .

[0085] for Randomly select matrix ,make .

[0086] [2] .

[0087] (1) For , .

[0088] i) Randomly select a matrix ,make .

[0089] ii) Sampling .

[0090] (2) For , .

[0091] i) Randomly select a matrix ,make .

[0092] ii) Sampling .

[0093] for Rivals, Challengers A response is needed in addition to challenging one's identity. Private key corresponding to other identity IDs The inquiry. Uniformly and randomly selected during the initialization phase. .

[0094] [1] .

[0095] i) Challenger C randomly selects a matrix ,make .

[0096] ii) Sampling .

[0097] Game 3: In Game 3, change the way you respond to key update queries.

[0098] For Type I adversaries, the adversary is allowed to query the private key corresponding to the challenge identity. According to the definition of the security model, adversaries are not allowed to continue querying the key update corresponding to the challenge time.

[0099] [1] .

[0100] i) Randomly select a matrix ,make .

[0101] ii) Sampling .

[0102] for Similar to an opponent, you need to respond to the opponent's challenge time. Corresponding key update Let the matrix .

[0103] [2] .

[0104] (1) Randomly select a matrix ,Will Return to the enemy .

[0105] (2) .

[0106] i) Randomly select a matrix ,make .

[0107] ii) Sampling .

[0108] [3] .

[0109] i) Randomly select a matrix ,make .

[0110] ii) Sampling .

[0111] Game 4: In Game 4, the Challenger Change the way the decryption key is generated.

[0112] For a Type I adversary, when At that time, the challenger could not simulate the key update. Challenger Respond to questions according to the following steps The decryption key is requested.

[0113] (1) Randomly select a matrix ,make .

[0114] (2) Solve for the equation that satisfies private key i) Randomly select a matrix .

[0115] ii) Sampling .

[0116] (3) According to and Calculate the decryption key .

[0117] i) Randomly select vectors ,make .

[0118] ii) Sampling .

[0119] iii) Based on the private key and key update ,calculate .

[0120] iv) Calculation .Will Divide into blocks by line, from left to right, each block m The rows are respectively denoted as , .Will Divide into blocks by line, from left to right, each block m The rows are respectively denoted as ,and By concatenating the segmented matrices, the decryption key can be obtained. (4) Output the decryption key .

[0121] For Category II adversaries, when At that time, the challenger could not simulate the private key. Challenger Respond to the questions below using the following steps Decryption key query.

[0122] (1) Randomly select a matrix ,make .

[0123] (2) Next, we need to solve for the equation. Key update .

[0124] i) Randomly select a matrix .

[0125] ii) Sampling .

[0126] (3) According to and Calculate the decryption key. The remaining steps are the same as in the scheme.

[0127] Game 5: In Game 5, the Challenger Change matrix A sum matrix BGeneration method. In Game 4, the challenger Generate matrices using the TrapGen algorithm. A and the corresponding trapdoor Randomly select matrix B In Game 5, the Challenger Randomly select matrix A The matrix is ​​generated using the TrapGen algorithm. B and the corresponding trapdoor .

[0128] Game 6: In Game 6, the Challenger Change the way challenge ciphertext is generated. In Game 6, the challenger... Random selection As a challenge ciphertext.

[0129] Example: Given a simulator LWE Example Simulator The task is to distinguish It is by The generated data is selected from a uniform random distribution.

[0130] Beginning: Opponent Will challenge identity Challenge Time Send to emulator .

[0131] Initialization: Simulator Constructing a matrix during the initialization phase A ,make .

[0132] Questioning phase: adversary The simulator performs private key queries, key update queries, decryption key queries, and revocation queries. The method of responding to questions in Game 5.

[0133] Challenge Phase: Opponent Plain text message Send to the emulator .

[0134] simulator Generate challenge ciphertext: ; calculate The challenge will be the ciphertext. Send to the enemy .

[0135] Guessing Phase: When the Opponent Receive the challenge ciphertext, make a guess and return. Simulator The enemy's guess This serves as an answer to the LWE (Low-Weightedness) determination problem.

[0136] Analysis: When At that time, challenge the ciphertext ; ; Therefore, when At that time, the distribution of the challenge ciphertext is the same as in Game 5. When the elements are uniformly random, the distribution of the challenge ciphertext is the same as in Game 6. Therefore, the simulator The advantage of solving the LWE judgment problem is the same as the opponent's advantage in distinguishing between game 4 and game 5. The opponent's advantage in distinguishing between game 4 and game 5 is negligible.

[0137] The embodiments described above provide a detailed explanation of the technical solutions and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A post-quantum secure revocable identity-based encryption method resistant to decryption key leakage, characterized in that, Includes the following steps: (1) Input security parameters and the maximum number of system users N Generate the system public parameter PP and the master private key MSK; (2) Based on system common parameters Master private key Generate a private key corresponding to the identity ID. ; (3) Regarding the time period Each time sub-cycle in Based on system common parameters Master private key Cancel list Using a binary tree (BT) to generate key updates for time sub-periods t. ; (4) Based on system common parameters PP and messages Identity ID and Time Sub-period Generate ciphertext ; (5) Based on the system public parameter PP and the private key corresponding to the identity ID Key update for time sub-period t Generate the decryption key for time sub-period t. ; (6) During the decryption process, input the system common parameters PP and the ciphertext. Decryption key Output message .

2. The post-quantum secure revocable identity-based encryption method against decryption key leakage according to claim 1, characterized in that, Step (1) specifically includes: (1-1) Calling the trapdoor generation algorithm Generate matrix and the corresponding trapdoor ;in, For large prime numbers, , , Let be the time complexity function. for On the domain matrix, Integer On matrix; (1-2) Two matrices are selected uniformly and randomly. B , W Uniformly and randomly selected n dimensional vector u ; for an n-dimensional vector over a field; (1-3) Construct a tree containing at least N A binary tree BT with leaf nodes is used to mark all leaf nodes as unassigned. For each node in the binary tree... Randomly select matrix ; (1-4) Output system common parameters and the master private key .

3. The post-quantum secure revocable identity-based encryption method against decryption key leakage according to claim 2, characterized in that, Step (2) specifically includes: (2-1) Randomly select an unassigned leaf node in the binary tree BT. Store the identity ID in the leaf node; The leaf node representing the stored identity ID. Including from leaf nodes All nodes on the path to the root node; (2-2) Let H is a hash function used to map natural numbers to vector form. G The tool matrix is ​​used to generate the decryption key; (2-3) Based on identity ID and For each node, generate a value that satisfies the equation. of ; (2-4) Output the private key .

4. The post-quantum secure revocable identity-based encryption method against decryption key leakage according to claim 3, characterized in that, Steps (2-3) specifically include: Randomly select matrix ,make ; Indicates satisfaction Distribution matrix; sampling ; Represents distribution The variance; Will Divide into blocks by line, first m The line is considered the first part, denoted as ; after m The line is considered the second part, denoted as ;Will Divide into blocks by line, first m The line is considered the first part, denoted as ; after m The line is considered the second part, denoted as The block matrix is ​​concatenated in the following manner to obtain the final key matrix. : ； in, express On the domain matrix.

5. The post-quantum secure revocable identity-based encryption method against decryption key leakage according to claim 4, characterized in that, Step (3) specifically includes: (3.1) Call the KUNode algorithm, input the binary tree BT and the cancellation list of the time sub-period t. Output the node update set for time sub-period t. ; (3.2) Let H is mapped to a hash function. G It is a tool matrix; (3.3) Update the set for nodes Each node generates a value that satisfies the equation Key update ; (3.4) Broadcast key update .

6. The post-quantum secure revocable identity-based encryption method against decryption key leakage according to claim 5, characterized in that, Step (4) specifically includes: (4-1) Uniformly random selection of matrix R and V Uniformly and randomly selected vectors ; (4-2) Select noise Select m dimensional noise vector ; (4-3) Calculation , ,in It is an identity matrix; (4-4) Output ciphertext .

7. The post-quantum secure revocable identity-based encryption method against decryption key leakage according to claim 6, characterized in that, Step (5) specifically includes: (5-1) The user corresponding to the identity ID updates the set of keys in the binary tree of their private key and the key update set of the time sub-period t. The nodes in the table are compared. If there are duplicate nodes, the node is recorded as... If yes, continue with step (5-2); otherwise, abort the entire decryption process. (5-2) The user retrieves the private key from the time sub-period t. Selecting nodes corresponding key matrix Select a node from the key update Corresponding key update ;according to and Generate equations that satisfy the equations decryption key ; (5-3) Output the decryption key .

8. The post-quantum secure revocable identity-based encryption method against decryption key leakage according to claim 7, characterized in that, Step (6) specifically includes: (6-1) According to the ciphertext The time sub-period t contained therein is used to select the decryption key for the corresponding time sub-period. ; (6-2) Calculation ;if , =1; otherwise =0; (6-3) Output message .

Images