An attribute-based encryption method on lattice supporting policy hiding

Abstract

The application provides an attribute-based encryption method on a lattice supporting policy hiding, and steps include: a trusted authority center calling a trapdoor generation algorithm in lattice cryptography, selecting a random matrix and a vector to construct public parameters and a master private key, and distributing the public parameters to other participating entities; after receiving an attribute set of a data user, the trusted authority center generates a data user private key by using a left sampling algorithm in lattice cryptography and a pseudo-random function; a data owner constructs an access policy, selects a random encryption vector and multiple perturbation parameters, hides the access policy set by using a pseudo-random function, and then generates data ciphertext, and uploads the data ciphertext to a cloud server; after receiving the data ciphertext sent by the cloud server, the data user generates auxiliary attribute hash values by using a hash function, and compares the attribute hash values in the data ciphertext one by one, if the number of equalities reaches a threshold value, the original message can be recovered, and access control is realized while effectively hiding access policy information.

Description

Technical Field

[0001] This invention relates to the field of attribute-based encrypted access control, and more particularly to a lattice-based attribute-based encryption method that supports policy hiding. Background Technology

[0002] With the development of IoT technology, the ever-increasing demand for data sharing has brought severe challenges to the privacy protection of IoT data. To ensure data privacy, researchers typically encrypt data before storing it in the IoT. However, a single encryption algorithm cannot achieve data access control and is difficult to adapt to the large-scale, dynamic IoT environment. Therefore, attribute-based encryption has become a research hotspot due to its ability to achieve fine-grained access control. In attribute-based encryption schemes, data owners can define flexible access policies to ensure that only data users whose attributes meet the access policy can decrypt the data, aiming to achieve privacy and access control for IoT data. However, existing attribute-based encryption schemes still have shortcomings in terms of security, mainly reflected in the following two issues.

[0003] First, access policies are often embedded in ciphertext in plaintext form. Attackers can analyze these policies to infer sensitive information, leading to the exposure of user identities. For example, in the medical field, an access policy like "Department A AND Attending Physician B" might reveal the patient's department and attending physician's identity, posing a privacy risk. Furthermore, attackers can combine multiple policies to infer user roles or data relationships, thereby deducing deeper information such as the current network's organizational structure and business relationships, further threatening the privacy of data owners and users.

[0004] Secondly, most existing attribute-based encryption schemes are constructed based on bilinear pairing or discrete logarithm difficulties, making them vulnerable to quantum computing attacks. This risk is significantly amplified in the Internet of Things (IoT) context. Since the massive amounts of sensitive data generated by smart grids, connected vehicles, and industrial sensors typically use attribute-based encryption for access control, if quantum computers become practical, attackers could backtrack and decrypt the encrypted data, exposing the operational logic of critical infrastructure or allowing reverse engineering of commercial data chains, seriously threatening the privacy of IoT data. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a lattice-based attribute-based encryption method that supports policy hiding, in order to eliminate or improve one or more defects present in the prior art.

[0006] One aspect of the present invention provides a lattice-based attribute-based encryption strategy hiding method, the method comprising the steps of:

[0007] Step (1): The Trusted Authority Center receives the system initialization request and uses the TrapGen algorithm in lattice cipher to generate a first common matrix and a first lattice basis matrix. It then randomly selects a common offset matrix, a second common matrix, and a first common vector, and simultaneously generates a pseudo-random function key for subsequent consistency calculations of attribute parameters. The Trusted Authority Center sets the first common matrix, common offset matrix, second common matrix, and first common vector as common parameters and publishes them to other entities. It retains the first lattice basis matrix and the pseudo-random function key as the master private key.

[0008] Step (2): The data user submits a private key application request to the Trusted Authority Center, including a set of user attributes. Upon receiving the user's attribute set, the Trusted Authority Center generates a first private key vector using the SampleLeft algorithm in lattice ciphers. It then performs a pseudo-random function operation on each attribute name parameter using a pseudo-random function key, obtaining attribute pseudo-random numbers that correspond one-to-one with the attribute name parameters. The Trusted Authority Center then publishes the first private key vector and the attribute pseudo-random numbers as the data user's private key to the data user for subsequent decryption of encrypted data.

[0009] Step (3): The data owner constructs an access policy, including an access policy set and a threshold value. A random encryption vector and multiple perturbation parameters are selected to generate a first ciphertext, a second ciphertext, and a third ciphertext. A pseudo-random function key is used to generate an attribute pseudo-random number for each attribute value in the access policy set. The attribute value is then concatenated with its attribute pseudo-random number and input into a hash function to obtain an attribute hash value, thereby achieving the hiding of policy information. The data owner uploads the first ciphertext, the second ciphertext, the third ciphertext, the attribute hash value, and the threshold value as data ciphertext to the cloud server.

[0010] Step (4): The data user submits a data access request to the cloud server. Upon receiving the request, the cloud server sends the encrypted data to the user. The data user uses a hash function to map the attribute values ​​in the user attribute set to auxiliary attribute hash values. The auxiliary attribute hash values ​​are compared one by one with the attribute hash values ​​in the encrypted data. If the number of equal values ​​reaches a threshold, the first encrypted data, the second encrypted data, the third encrypted data, and the first private key vector are calculated to recover the original message.

[0011] In some embodiments of the present invention, the common parameters in step (1) include a first common matrix, a common offset matrix, a second common matrix, and a first common vector, and the master private key includes a first lattice basis matrix and a pseudo-random function key. The specific generation process is as follows:

[0012] The first common matrix A0 and the first lattice basis matrix are generated using the trapdoor generation algorithm TrapGen(n,m,q) from lattice ciphers. And randomly select the common offset matrix B and the second common matrix A. i And the first common vector u, where i∈ATT, ATT represents the set of system attributes. Select the pseudo-random function key.

[0013] The public parameters and master private key are constructed according to the following formula, and the public parameters are sent to other entities. The master private key is retained by a trusted authority center:

[0014] pp=(A0,B,{A i} i∈ATT ,u);

[0015]

[0016] In some embodiments of the present invention, the data user private key in step (2) includes a first private key vector and an attribute pseudo-random number, and the specific generation process is as follows:

[0017] Randomly select n auxiliary polynomials p1(x), p2(x), ..., p n (x) makes p j (0)=u j For j∈[n], where u j Let represent the j-th component of the first common vector. For each user attribute value i∈R in the user attribute set, construct an auxiliary sampling vector. Employing the left sampling algorithm in lattice cipher Generate the first private key vector e i Satisfying the equation Where R represents the set of user attributes.

[0018] Generate attribute pseudo-random numbers according to the following formula:

[0019]

[0020] Where, r attr,i This indicates a pseudo-random number attribute. Let represent the pseudo-random function key, i∈R represent the user attribute value, and PRF(·,·) represent the pseudo-random function, which is used to map the pseudo-random function key and the user attribute value as parameters to pseudo-random numbers.

[0021] The private key is constructed according to the following formula and sent to the data user:

[0022] sk={e i ,r attr,i} i∈R .

[0023] In some embodiments of the present invention, the data ciphertext in step (3) includes a first ciphertext, a second ciphertext, a third ciphertext, an attribute hash value, and a threshold value. The specific generation process is as follows:

[0024] An access policy (W,t) is set according to a threshold-based secret sharing method, where W represents the set of access policies and t represents the threshold value. The first ciphertext is generated according to the following formula:

[0025]

[0026] Where c1 represents the first ciphertext, u represents the first common vector, s represents the encrypted random vector, D represents the perturbation coefficient, x1 represents the first perturbation vector, M represents the plaintext message bits, q represents the modulus, and (·) T This indicates the transpose operation. This indicates the floor function.

[0027] The second ciphertext is generated according to the following formula:

[0028]

[0029] Where c2 represents the second ciphertext, A0 represents the first common matrix, s represents the encrypted random vector, D represents the perturbation coefficient, and x2 represents the second perturbation vector.

[0030] The third ciphertext is generated according to the following formula:

[0031]

[0032] Among them, c i Indicates the third ciphertext, A i Let B represent the second common matrix, B represent the common offset matrix, s represent the encrypted random vector, D represent the perturbation coefficient, and R represent the perturbation coefficient. i Let x1 represent the attribute perturbation matrix, and x2 represent the third perturbation vector. Let i ∈ W represent the attribute values ​​in the access policy set, and W represent the access policy set.

[0033] Generate an attribute hash value for each attribute value included in the access strategy according to the following formula:

[0034] H attr,i =H(i||r attr,i );

[0035] Among them, H attr,i H(·) represents the attribute hash value, H(·) represents the attribute hash function, i∈W represents the attribute value in the access policy set, W represents the access policy set, and r attr,i This indicates a pseudo-random number attribute.

[0036] The encrypted data is constructed according to the following formula and uploaded to the cloud server:

[0037] CT = (c1, c2, {c i} i∈W ,{H attr,i} i∈W ,t).

[0038] In some embodiments of the present invention, the process of recovering the original message using the data ciphertext and the data user's private key in step (4) is as follows:

[0039] For each user attribute value i∈R, calculate the auxiliary attribute hash value H′. attr,i =H(i||r attr,i ), and compare them one by one with the attribute hash value. If H′ attr,i =H attr,i If the attribute value i is added to the available set R′, then the attribute value i is added to the available set R′; otherwise, the attribute value i is not added to the available set R′.

[0040] For the available set R′, if the number of elements is less than the threshold value t, then output ⊥, indicating that the user attributes do not meet the access policy; otherwise, select a subset J′ with the number of elements t to perform Lagrange interpolation calculation to restore the original message.

[0041] Data can be recovered using the following formula:

[0042]

[0043] Where c1 represents the first ciphertext, L j The Lagrange coefficient is defined as follows: e j c1 represents the first private key vector, c2 represents the second ciphertext, and c3 represents the second private key vector. j This represents the third ciphertext, and j∈J′ represents the attribute value in subset J′.

[0044] like If the original message M is restored, then M = 1; otherwise, M = 0. Here, |·| represents the absolute value operation.

[0045] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the text, or may be learned by practice of the invention. The objects and other advantages of the invention will become apparent from the description and the accompanying drawings.

[0046] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0047] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to limit the scope of the invention.

[0048] Figure 1 This is a schematic diagram of one embodiment of the lattice-based attribute base encryption method supporting policy hiding according to the present invention;

[0049] Figure 2 This is a schematic diagram of the architecture of one embodiment of the lattice-based attribute base encryption method supporting policy hiding according to the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0051] like Figure 1 As shown, this invention proposes a lattice-based attribute-based encryption method that supports policy hiding. The steps of the method include:

[0052] Step (1): The Trusted Authority Center receives the system initialization request and uses the TrapGen algorithm in lattice cipher to generate a first common matrix and a first lattice basis matrix. It then randomly selects a common offset matrix, a second common matrix, and a first common vector, and simultaneously generates a pseudo-random function key for subsequent consistency calculations of attribute parameters. The Trusted Authority Center sets the first common matrix, common offset matrix, second common matrix, and first common vector as common parameters and publishes them to other entities. It retains the first lattice basis matrix and the pseudo-random function key as the master private key.

[0053] Step (2): The data user submits a private key application request to the Trusted Authority Center, including a set of user attributes. Upon receiving the user's attribute set, the Trusted Authority Center generates a first private key vector using the SampleLeft algorithm in lattice ciphers. It then performs a pseudo-random function operation on each attribute name parameter using a pseudo-random function key, obtaining attribute pseudo-random numbers that correspond one-to-one with the attribute name parameters. The Trusted Authority Center then publishes the first private key vector and the attribute pseudo-random numbers as the data user's private key to the data user for subsequent decryption of encrypted data.

[0054] Step (3): The data owner constructs an access policy, including an access policy set and a threshold value. A random encryption vector and multiple perturbation parameters are selected to generate a first ciphertext, a second ciphertext, and a third ciphertext. A pseudo-random function key is used to generate an attribute pseudo-random number for each attribute value in the access policy set. The attribute value is then concatenated with its attribute pseudo-random number and input into a hash function to obtain an attribute hash value, thereby achieving the hiding of policy information. The data owner uploads the first ciphertext, the second ciphertext, the third ciphertext, the attribute hash value, and the threshold value as data ciphertext to the cloud server.

[0055] Step (4): The data user submits a data access request to the cloud server. Upon receiving the request, the cloud server sends the encrypted data to the user. The data user uses a hash function to map the attribute values ​​in the user attribute set to auxiliary attribute hash values. The auxiliary attribute hash values ​​are compared one by one with the attribute hash values ​​in the encrypted data. If the number of equal values ​​reaches a threshold, the first encrypted data, the second encrypted data, the third encrypted data, and the first private key vector are calculated to recover the original message.

[0056] like Figure 2 As shown, the lattice-based attribute-based encryption method supporting policy hiding proposed in this invention involves four participating entities: a trusted authority center, a data owner, a data user, and a cloud server.

[0057] Trusted Authority Center: The Trusted Authority Center is responsible for generating public parameters and a master private key for the method, and for generating the private key required by the data user to decrypt the data. To achieve policy concealment, the Trusted Authority Center generates a pseudo-random function key, which is used as part of the master private key.

[0058] Data Owner: The data owner is the entity that publishes the data and is responsible for setting access policies. To achieve policy hiding, the data owner converts all attribute values ​​in the access policy set into attribute hash values, ensuring that the access policies do not leak any user attribute information. Furthermore, the data owner can use the access policies to encrypt the data, generating encrypted data, and upload it to the cloud server.

[0059] Data users: Data users can submit data access requests to the cloud server. They possess a private key distributed by a trusted authority center and, when access conditions are met, decrypt the encrypted data to obtain the original data. The encrypted data contains a hidden access policy represented by attribute hash values ​​and threshold values. Users process the attribute values ​​in their attribute set using a hash function to obtain auxiliary attribute hash values, which are then compared one by one with the attribute hash values ​​in the encrypted data. If the number of equal hash values ​​reaches the threshold value, it means the user's attribute set meets the access policy, and the user can access the data. The user can then use their private key to decrypt and obtain the original data. Otherwise, the user cannot obtain the original data content, thus achieving data access control.

[0060] Cloud server: The cloud server is responsible for the storage and transmission of encrypted data, saving the encrypted data uploaded by the data owner and providing it to the data users who request access as needed.

[0061] The specific procedures for steps (1), (2), (3), and (4) are as follows:

[0062] Step (1): The trusted authority uses the trapdoor generation algorithm TrapGen(n,m,q) in lattice cipher to generate the first common matrix A0 and the first lattice basis matrix. And randomly select the common offset matrix B and the second common matrix A. i And the first common vector u, where i∈ATT, ATT represents the set of system attributes. Then, the trusted authority selects the pseudo-random function key. And form the common parameter pp=(A0,B,{A i} i∈ATT (u) and master private key The public parameters are sent to other entities, and the master private key is kept by a trusted authority center.

[0063] Step (2): After receiving the attribute set submitted by the data user, the trusted authority center randomly selects n auxiliary polynomials p1(x), p2(x), ..., p n (x) makes p j (0)=u j For j∈[n], where u j It is the j-th component of the first common vector. For each user attribute value i∈R in the user attribute set, the trusted authority center constructs an auxiliary sampling vector. Employing the left sampling algorithm in lattice cipher Generate the first private key vector e i Satisfying the equation Where R represents the set of user attributes. Then, the trusted authority center generates pseudo-random numbers based on these attributes. Construct the data user private key sk = {ei ,r attr,i} i∈R Send it to the data user.

[0064] Step (3): The data owner sets the access policy (W,t) according to the threshold secret sharing method, where W represents the set of access policies and t represents the threshold value. The first ciphertext, second ciphertext, and third ciphertext are generated according to the following formula:

[0065]

[0066]

[0067]

[0068] Where c1 represents the first ciphertext, u represents the first common vector, s represents the encrypted random vector, D represents the perturbation coefficient, x1 represents the first perturbation vector, M represents the plaintext message bits, q represents the modulus, and (·) T This indicates the transpose operation. This represents the floor operation, c2 represents the second ciphertext, A0 represents the first common matrix, x2 represents the second perturbation vector, and c i Indicates the third ciphertext, A i Let B represent the second common matrix, and let R represent the common offset matrix. i Let x1 represent the attribute perturbation matrix, x2 represent the third perturbation vector, and i ∈ W represent the attribute values ​​in the access policy set, where W represents the access policy set. Then, the data owner generates an attribute hash value H for each attribute value included in the access policy. attr,i =H(i||r attr,i ), where H attr,i H(·) represents the attribute hash value, H(·) represents the attribute hash function, i∈W represents the attribute value in the access policy set, W represents the access policy set, and r attr,i This represents a pseudo-random number attribute. Finally, the data owner constructs the encrypted data CT = (c1, c2, {c i} i∈W ,{H attr,i} i∈W ,t), uploaded to the cloud server.

[0069] Step (4): For each user attribute value i∈R, the data user calculates the auxiliary attribute hash value H′. attr,i =H(i||r attr,i ), and compare them one by one with the attribute hash value. If H′ attr,i =H attr,iIf the attribute value i is found to be true, it is added to the available set R′; otherwise, it is not added to the available set R′. For the available set R′, if the number of elements is less than the threshold value t, the decryption output is ⊥, indicating that the user attribute does not meet the access policy; otherwise, the data user selects a subset J′ with the number of elements t for Lagrange interpolation and calculates... Where c1 represents the first ciphertext, L j The Lagrange coefficient is defined as follows: e j c1 represents the first private key vector, c2 represents the second ciphertext, and c3 represents the second private key vector. j Let represent the third ciphertext, and j∈J′ represent the attribute values ​​in subset J′. If If the data user restores the original message M=1, then the data user restores the original message M=0. Here, |·| represents the absolute value operation.

[0070] also,

[0071]

[0072] in This represents the error term, e≈0. It can be verified whether the conditions are met. The original data is then restored. Therefore, the lattice-based attribute-based encryption method supporting policy hiding provided by this invention is correct.

[0073] The beneficial effects of the present invention include at least the following:

[0074] 1. This invention uses a threshold secret sharing method to construct an attribute-based encryption access policy, which provides high policy flexibility while achieving data access control and is suitable for complex data sharing scenarios;

[0075] 2. This invention proposes a policy hiding mechanism, which calculates the attribute hash value in the access policy set to replace the attribute value, preventing the leakage of sensitive attributes in the access policy and realizing the privacy protection of user attribute information.

[0076] 3. This invention uses lattice cryptography to construct attribute base encryption, which can resist quantum computing attacks and ensure the security of data ciphertext in the post-quantum era.

[0077] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A lattice-based attribute-based encryption method supporting policy hiding, characterized in that, The steps of the method include: Step (1): The Trusted Authority Center receives the system initialization request and uses the TrapGen algorithm in lattice cipher to generate a first common matrix and a first lattice basis matrix. It then randomly selects a common offset matrix, a second common matrix, and a first common vector, and simultaneously generates a pseudo-random function key for subsequent consistency calculations of attribute parameters. The Trusted Authority Center sets the first common matrix, common offset matrix, second common matrix, and first common vector as common parameters and publishes them to other entities. It retains the first lattice basis matrix and the pseudo-random function key as the master private key. Step (2): The data user submits a private key application request to the Trusted Authority Center, including a set of user attributes. Upon receiving the user's attribute set, the Trusted Authority Center generates a first private key vector using the SampleLeft algorithm in lattice ciphers. It then performs a pseudo-random function operation on each attribute name parameter using a pseudo-random function key, obtaining attribute pseudo-random numbers that correspond one-to-one with the attribute name parameters. The Trusted Authority Center then publishes the first private key vector and the attribute pseudo-random numbers as the data user's private key to the data user for subsequent decryption of encrypted data. Step (3): The data owner constructs an access policy, including an access policy set and a threshold value. A random encryption vector and multiple perturbation parameters are selected to generate a first ciphertext, a second ciphertext, and a third ciphertext. A pseudo-random function key is used to generate an attribute pseudo-random number for each attribute value in the access policy set. The attribute value is then concatenated with its attribute pseudo-random number and input into a hash function to obtain an attribute hash value, thereby achieving the hiding of policy information. The data owner uploads the first ciphertext, the second ciphertext, the third ciphertext, the attribute hash value, and the threshold value as data ciphertext to the cloud server. Step (4): The data user submits a data access request to the cloud server. Upon receiving the request, the cloud server sends the encrypted data to the user. The data user uses a hash function to map the attribute values ​​in the user attribute set to auxiliary attribute hash values. The auxiliary attribute hash values ​​are compared one by one with the attribute hash values ​​in the encrypted data. If the number of equal values ​​reaches a threshold, the first encrypted data, the second encrypted data, the third encrypted data, and the first private key vector are calculated to recover the original message.

2. The lattice-based attribute-based encryption method supporting policy hiding according to claim 1, characterized in that, The generation of public parameters and master private key in step (1). The first common matrix A0 and the first lattice basis matrix are generated using the trapdoor generation algorithm TrapGen(n,m,q) from lattice ciphers. And randomly select the common offset matrix B and the second common matrix A. i And the first common vector u, where i∈ATT, ATT represents the set of system attributes. Select the pseudo-random function key. The public parameters and master private key are constructed according to the following formula, and the public parameters are sent to other entities. The master private key is retained by a trusted authority center: pp=(A0,B,{A i } i∈ATT ,u); 3. The lattice-based attribute-based encryption method supporting policy hiding according to claim 1, characterized in that, The generation of the data user's private key in step (2) includes a first private key vector and attribute pseudo-random numbers. Randomly select n auxiliary polynomials p1(x), p2(x), ..., p n (x) makes p j (0)=u j For j∈[n], where u j Let represent the j-th component of the first common vector. For each user attribute value i∈R in the user attribute set, construct an auxiliary sampling vector. Employing the left sampling algorithm in lattice cipher Generate the first private key vector e i Satisfying the equation Where R represents the set of user attributes. Generate attribute pseudo-random numbers according to the following formula: Where, r attr,i This indicates a pseudo-random number attribute. Let R represent the pseudo-random function key, i∈R represent the user attribute value, and PRF(·,·) represent the pseudo-random function, which is used to map the pseudo-random function key and the user attribute value as parameters to pseudo-random numbers. The private key is constructed according to the following formula and sent to the data user: en={e i ,r attr,i } i∈R 。 4. The lattice-based attribute-based encryption method supporting policy hiding according to claim 1, characterized in that, The generation of data ciphertext in step (3) includes a first ciphertext, a second ciphertext, a third ciphertext, an attribute hash value, and a threshold value. The access policy (W,t) is set according to the threshold secret sharing method, where W represents the set of access policies and t represents the threshold value. The first ciphertext is generated according to the following formula: Where c1 represents the first ciphertext, u represents the first common vector, s represents the encrypted random vector, D represents the perturbation coefficient, x1 represents the first perturbation vector, M represents the plaintext message bits, q represents the modulus, and (·) T This indicates the transpose operation. This indicates the floor function. The second ciphertext is generated according to the following formula: Where c2 represents the second ciphertext, A0 represents the first common matrix, s represents the encrypted random vector, D represents the perturbation coefficient, and x2 represents the second perturbation vector. The third ciphertext is generated according to the following formula: Among them, c i Indicates the third ciphertext, A i Let B represent the second common matrix, B represent the common offset matrix, s represent the encrypted random vector, D represent the perturbation coefficient, and R represent the perturbation coefficient. i Let x1 represent the attribute perturbation matrix, and x2 represent the third perturbation vector. Let i ∈ W represent the attribute values ​​in the access policy set, and W represent the access policy set. Generate an attribute hash value for each attribute value included in the access strategy according to the following formula: H attr,i =H(i||r attr,i ); Among them, H attr,i H(·) represents the attribute hash value, H(·) represents the attribute hash function, i∈W represents the attribute value in the access policy set, W represents the access policy set, and r attr,i This indicates a pseudo-random number attribute. The encrypted data is constructed according to the following formula and uploaded to the cloud server: CT=(c1,c2,{c i } i∈W ,{H attr,i } i∈W ,t)。 5. The lattice-based attribute-based encryption method supporting policy hiding according to claim 1, characterized in that, In step (4), the original message is recovered based on the encrypted data and the data user's private key. For each user attribute value i∈R, calculate the auxiliary attribute hash value H′. attr,i =H(i||r attr,i ), and compare them one by one with the attribute hash value. If H′ attr,i =H attr,i If the attribute value i is added to the available set R′, then the attribute value i is added to the available set R′; otherwise, the attribute value i is not added to the available set R′. For the available set R′, if the number of elements is less than the threshold value t, then output ⊥, indicating that the user attributes do not meet the access policy; otherwise, select a subset J′ with the number of elements t to perform Lagrange interpolation calculation to restore the original message. Data can be recovered using the following formula: Where c1 represents the first ciphertext, L j The Lagrange coefficient is defined as follows: e j c1 represents the first private key vector, c2 represents the second ciphertext, and c3 represents the second private key vector. j This represents the third ciphertext, and j∈J′ represents the attribute value in subset J′. like If the original message M is restored, then M = 1; otherwise, M = 0. Here, |·| represents the absolute value operation.

Images